hxxp://ip-api[.]com/csv/?fields=query,countryCodeURL
Reported by 1 independent source · first reported by Group-IB · last reported
Last reported 5 years ago
What the reports say
1 report, newest first · the exact sentence from each-
The Brothers Grim“The first domain to contact is “api.myip.com” in order to obtain the country code and client IP (hxxp://ip-api[.]com/csv/?fields=query,countryCode) and then make the request to the C2 to obtain the AES key.”
Indicators reported together
named in the same reports- 03ec9000b493c716…88c6a1c65ce5in 1 report
- 015e5a1fa9d8151ee51d6e53e187fbb2in 1 report
- 163917ced2d1b330…ec3ea871d517in 1 report
- 63bd614434a70599…a3c4b4db5cafin 1 report
- hxxps://github[.]com/apriegob/GrimAgent/blob/main/IDAPro/IDAPro_string_decryptor.pyin 1 report
- d6ee553f52f20127…73144ef2354din 1 report
- microsoftupdate[.]topin 1 report
- microsoftsystemcloud[.]comin 1 report
- chaseltd[.]topin 1 report
Copy these 9 indicators · defanged
Thanks — we review every report.