General

  • Target

    https://aws.predictiveresponse.net/fwdhst.htm?redirect=//ad.adverticum.net/C/1759478/5574136/430894600?ct0=//performancegx.com/oluuu/7wk3l/Mobily/mobily.com.sa/ay5hYmFuYW1pQG1vYmlseS5jb20uc2E=

  • Sample

    240907-js5nkstdja

Malware Config

Targets

    • Target

      https://aws.predictiveresponse.net/fwdhst.htm?redirect=//ad.adverticum.net/C/1759478/5574136/430894600?ct0=//performancegx.com/oluuu/7wk3l/Mobily/mobily.com.sa/ay5hYmFuYW1pQG1vYmlseS5jb20uc2E=

    • Looks up external IP address via web service

      Uses a legitimate IP lookup service to find the infected system's external IP.

    • Detected potential entity reuse from brand microsoft.

MITRE ATT&CK Enterprise v15

Tasks