hxxps://telegra[.]ph/Functions-04-03URL
Reported by 1 independent source · first reported by Cisco Talos · last reported
Last reported 1 month ago
What the reports say
1 report, newest first · the exact sentence from each-
ClearFake WebDAV infection chain delivers Amatera stealer, ZigCryptoStealer, and NetSupport Manager“Before starting its Amatera C2 session, the Amatera sample used in "pf.ch" branch constructs the dead drop C2 URL "hxxps://telegra[.]ph/Functions-04-03".”
Indicators reported together
named in the same reports- verification[.]googlein 1 report
- pf[.]chin 1 report
- leaguejazire[.]comin 1 report
- riyazinikokar[.]xyzin 1 report
- 145.249.109[.]147in 1 report
- 45.150.34[.]2in 1 report
- 279d04c0cfd700c8…772739aecb92in 1 report
- lb.propertyfind[.]ccin 1 report
- fd.gstats-api-contact[.]ccin 1 report
- pkg.vogueatelier[.]ccin 1 report
- kffd3.vogueatelier[.]ccin 1 report
- kffd3.vexlatech[.]ccin 1 report
- static.quorashift[.]ccin 1 report
- 643ef35536ff9273…44b02131b205in 1 report
- 1819827e17f31e72…da9f24179b25in 1 report
- update.dubbedmuch[.]ccin 1 report
- hxxps://kr.cedar2glanz[.]ru/jewel.jsin 1 report
- kr.cedar2glanz[.]ruin 1 report
- hxxps://phys.stunned-amniotic[.]com/hub.login 1 report
- phys.stunned-amniotic[.]comin 1 report
Copy these 20 indicators · defanged
Thanks — we review every report.