General
-
Target
http://icanhazip.cm/__cf_bm=VoZRijlk3TkNtn7XsRRMROLFOuUI5cm_GabsXKKImm0-1663267736-0-AWlusF6mg8eh+nkta4wlvbf+ojD0C1b+8oBf10vIgSPu61GRWXKmsZzVJ4bj/DTP1hxgGW6ORW1RE+CJ5jGhV6w=; path=/; expires=Thu, 15-Sep-22 19:18:56 GMT; domain=.icanhazip.com; HttpOnly
-
Sample
220915-xmglfshegr
Static task
static1
URLScan task
urlscan1
Behavioral task
behavioral1
Sample
http://icanhazip.cm/__cf_bm=VoZRijlk3TkNtn7XsRRMROLFOuUI5cm_GabsXKKImm0-1663267736-0-AWlusF6mg8eh+nkta4wlvbf+ojD0C1b+8oBf10vIgSPu61GRWXKmsZzVJ4bj/DTP1hxgGW6ORW1RE+CJ5jGhV6w=; path=/; expires=Thu, 15-Sep-22 19:18:56 GMT; domain=.icanhazip.com; HttpOnly
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
http://icanhazip.cm/__cf_bm=VoZRijlk3TkNtn7XsRRMROLFOuUI5cm_GabsXKKImm0-1663267736-0-AWlusF6mg8eh+nkta4wlvbf+ojD0C1b+8oBf10vIgSPu61GRWXKmsZzVJ4bj/DTP1hxgGW6ORW1RE+CJ5jGhV6w=; path=/; expires=Thu, 15-Sep-22 19:18:56 GMT; domain=.icanhazip.com; HttpOnly
Resource
win10v2004-20220812-en
Malware Config
Targets
-
-
Target
http://icanhazip.cm/__cf_bm=VoZRijlk3TkNtn7XsRRMROLFOuUI5cm_GabsXKKImm0-1663267736-0-AWlusF6mg8eh+nkta4wlvbf+ojD0C1b+8oBf10vIgSPu61GRWXKmsZzVJ4bj/DTP1hxgGW6ORW1RE+CJ5jGhV6w=; path=/; expires=Thu, 15-Sep-22 19:18:56 GMT; domain=.icanhazip.com; HttpOnly
Score6/10-
Looks up external IP address via web service
Uses a legitimate IP lookup service to find the infected system's external IP.
-