hxxps://discord[.]com/api/webhooks/1089956337733087274/uYNA_D8Ns1z9NZ3B1mGp0XXyGq-785KLGIfEAZsrz3TJd5fvOjXA927F7bUTTzbNT6ZkURL

Reported by 1 independent source · first reported 10 Apr 2023 by Elastic Security Labs · last reported 10 Apr 2023

Last reported 3 years ago

What the reports say

1 report, newest first · the exact sentence from each

“…tolen information to the attacker’s Discord channel via the following webhook: hxxps://discord[.]com/api/webhooks/1089956337733087274/uYNA_D8Ns1z9NZ3B1mGp0XXyGq-785KLGIfEAZsrz3TJd5fvOjXA927F7bUTTzbNT6Zk.”

Elastic Security LabsVendor10 Apr 2023
Attack chain leads to XWORM and AGENTTESLA

Indicators reported together

named in the same reports

hxxps://www.mediafire[.]com/file/xnqxmqlcj51501d/7000m.txt/filein 1 report
hxxps://billielishhui.blogspot[.]com/atom.xmlin 1 report
billielishhui.blogspot[.]comin 1 report
afbef8e590105e16…a3af761ad2f0in 1 report
bf5ea8d5fd573abb…f9c5c3baeaa2in 1 report
cbbb56fe6cd7277a…e3a883b6f8bcin 1 report
65463161760af7ab…3bdd203f85f4in 1 report

Copy these 7 indicators · defanged

7 indicators, defanged, one per line

hxxps://www.mediafire[.]com/file/xnqxmqlcj51501d/7000m.txt/file
hxxps://billielishhui.blogspot[.]com/atom.xml
billielishhui.blogspot[.]com
afbef8e590105e16bbd87bd726f4a3391cd6a4489f7a4255ba78a3af761ad2f0
bf5ea8d5fd573abb86de0f27e64df194e7f9efbaadd5063dee8ff9c5c3baeaa2
cbbb56fe6cd7277ae9595a10e05e2ce535a4e6bf205810be0bbce3a883b6f8bc
65463161760af7ab85f5c475a0f7b1581234a1e714a2c5a555783bdd203f85f4

Thanks — we review every report.

Report a wrong value