General
- Target http://url1137.crypto.com/ls/click?upn=u001.a3rDJB2v9y9hAhzyhYB5oEJeKgH27Eeuxg9uYPT74x6ykMMQUFGQ1w1M95rcb4sA5x2ykt305xrqc4MIxhs8nw-3D-3D7LxZ_yW-2ByGIqumFOHRPQyUE5BScYQ06SepSkdjfHzKyDbbXu25KkI-2FNgGKzO5X5n-2FqBW3Fp3vf-2FpD2hGWEv4UzK3jg9SSo0AtcSLOat7-2BlSN8tAcij6ogzt2I4c3LuZde9fE-2BxvnOyoXb2ggpKUjSnflAw9HTGGFCPicbMywlFN-2BM9p5yr1I-2Fm7hrLcP4AlVoFR8WexuaEI0OEKZ5JkK-2Fjbo-2FxzJiB1QJ6FoT0qXBvIvXM5U-3D
- Sample260730-jge9jser2s
Score
6/10
Static task
static1
URLScan task
urlscan1
Behavioral task
behavioral1
Sample
http://url1137.crypto.com/ls/click?upn=u001.a3rDJB2v9y9hAhzyhYB5oEJeKgH27Eeuxg9uYPT74x6ykMMQUFGQ1w1M95rcb4sA5x2ykt305xrqc4MIxhs8nw-3D-3D7LxZ_yW-2ByGIqumFOHRPQyUE5BScYQ06SepSkdjfHzKyDbbXu25KkI-2FNgGKzO5X5n-2FqBW3Fp3vf-2FpD2hGWEv4UzK3jg9SSo0AtcSLOat7-2BlSN8tAcij6ogzt2I4c3LuZde9fE-2BxvnOyoXb2ggpKUjSnflAw9HTGGFCPicbMywlFN-2BM9p5yr1I-2Fm7hrLcP4AlVoFR8WexuaEI0OEKZ5JkK-2Fjbo-2FxzJiB1QJ6FoT0qXBvIvXM5U-3D
Resource
win10v2004-20260513-en
16 signatures
150 seconds
Malware Config
Targets
-
- Target http://url1137.crypto.com/ls/click?upn=u001.a3rDJB2v9y9hAhzyhYB5oEJeKgH27Eeuxg9uYPT74x6ykMMQUFGQ1w1M95rcb4sA5x2ykt305xrqc4MIxhs8nw-3D-3D7LxZ_yW-2ByGIqumFOHRPQyUE5BScYQ06SepSkdjfHzKyDbbXu25KkI-2FNgGKzO5X5n-2FqBW3Fp3vf-2FpD2hGWEv4UzK3jg9SSo0AtcSLOat7-2BlSN8tAcij6ogzt2I4c3LuZde9fE-2BxvnOyoXb2ggpKUjSnflAw9HTGGFCPicbMywlFN-2BM9p5yr1I-2Fm7hrLcP4AlVoFR8WexuaEI0OEKZ5JkK-2Fjbo-2FxzJiB1QJ6FoT0qXBvIvXM5U-3D
Score6/10-
Contacts third-party web service commonly abused for C2
Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.
-
Looks up external IP address via web service
Uses a legitimate IP lookup service to find the infected system's external IP.