General
- Target https://e.email.workingadvantage.com/click?Eam9lLmtvdHVsYUBnY3BzazEyLm9yZw/CeyJtaWQiOiIxNzgyMzExMjA4MTU3ZWFjOWJiODY2NThiIiwiY3QiOiJlYmctd2FnMy03YmNhYmNlMmEyMzEyM2I1N2EwODUxNWYyNWFkNTFlOC0xIiwicmQiOiJnY3BzazEyLm9yZyJ9/VaHR0cHM6Ly9wcmVmZXJlbmNlcy56bWFpbC5iZW5lcGxhY2UuY29tL3Vuc3VicGFnZQ/SWkhfZWJnd2FfTkRCQU0wNjI0MjAyNmMyMTY0NjM2/LZWIy/qP2VuY2J1PU5uUnFZWEV3YW1ScmIzZHplV001YkhBeVpuVndPVFpzTUE9PSZlbmNlPWFtOWxMbXR2ZEhWc1lVQm5ZM0J6YXpFeUxtOXladz09Jm1lc3NhZ2VfdWlkPTE3ODIzMTEyMDgxNTdlYWM5YmI4NjY1OGI/gajvo2w/JMDYyNDIwMjZDMjE2NDYzNg/ses95a9b859
- Sample260625-qbdbbsct6q
Score
7/10
Malware Config
Targets
-
- Target https://e.email.workingadvantage.com/click?Eam9lLmtvdHVsYUBnY3BzazEyLm9yZw/CeyJtaWQiOiIxNzgyMzExMjA4MTU3ZWFjOWJiODY2NThiIiwiY3QiOiJlYmctd2FnMy03YmNhYmNlMmEyMzEyM2I1N2EwODUxNWYyNWFkNTFlOC0xIiwicmQiOiJnY3BzazEyLm9yZyJ9/VaHR0cHM6Ly9wcmVmZXJlbmNlcy56bWFpbC5iZW5lcGxhY2UuY29tL3Vuc3VicGFnZQ/SWkhfZWJnd2FfTkRCQU0wNjI0MjAyNmMyMTY0NjM2/LZWIy/qP2VuY2J1PU5uUnFZWEV3YW1ScmIzZHplV001YkhBeVpuVndPVFpzTUE9PSZlbmNlPWFtOWxMbXR2ZEhWc1lVQm5ZM0J6YXpFeUxtOXladz09Jm1lc3NhZ2VfdWlkPTE3ODIzMTEyMDgxNTdlYWM5YmI4NjY1OGI/gajvo2w/JMDYyNDIwMjZDMjE2NDYzNg/ses95a9b859
Score7/10-
A potential corporate email address has been identified in the URL: [email protected]
-
Looks up external IP address via web service
Uses a legitimate IP lookup service to find the infected system's external IP.