hxxp://104.254.99[.]77/out.ps1%E2%80%9DURL
Reported by 1 independent source · first reported by Group-IB · last reported
Last reported 8 years ago
What the reports say
1 report, newest first · the exact sentence from each-
When Hackers are Quicker than Antiviruses: Cobalt Group Bypasses Antivirus Protection“As a result of the code being executed, a PS script is uploaded from a remote hosting “hxxp://104.254.99[.]77/out.ps1” and is subsequently run.”
Indicators reported together
named in the same reports- f360d41a0b42b129f7f0c29f98381416in 1 report
- 8993f927beaf8daa02bb792c86c2b5e0in 1 report
- 139.59.89[.]20in 1 report
- 104.254.99[.]67in 1 report
- 138.68.234[.]128in 1 report
- 104.254.99[.]77in 1 report
- 17f9db18327a2977…54a5c191195cin 1 report
- 60656140e2047bd5…9048b27b72c7in 1 report
- d46df9eacfe7ff75e098942e541d0f18in 1 report
- bc4d2d914f7f0044…1ddbc2fd3326in 1 report
- c8bce60c90ce26b0e2b96770071c72d2in 1 report
- 5f434901d4f186bd…4d5a10b0dc20in 1 report
- db0d8569bc52e259bd327b10d0317174in 1 report
- 5f0d7423d889eb9d…bff8890bbc90in 1 report
- b6f640a14cc416e366e9bf899481fd6ain 1 report
- fb97a028760cf5ce…2fc7dbfce5f4in 1 report
- 104.200.67[.]112in 1 report
- 67.205.190[.]195in 1 report
- 93.113.131[.]162in 1 report
Copy these 19 indicators · defanged
Also named with it: CVE-2017-11882
Thanks — we review every report.