General
- Target http://url1137.crypto.com/ls/click?upn=u001.a3rDJB2v9y9hAhzyhYB5oEJeKgH27Eeuxg9uYPT74x73Q5ZEDUFFBrHyVCpWTOWC7UvjXE0gFCTA1a9iFLiqDg-3D-3DWUWJ_5py27-2FImFuvRJ3K2KiJbLzZynXucLytJTxamR0RCAPm83c547vCs5BrwhpH0I59SdZCIIXhUet5F7W3F6uIo6JxiLQRnwCx2cDXGsgu59gPkyyoUKL5GmMt1V6jbSiBVZEFY-2BEJzPJSlI1pj3tzztDG2dkLNLoBQt8waif-2FfrwKZAyfkLk-2ByYbUYXnoyszvi-2BsRCcLU5I8mORUbdQWAsbA-3D-3D
- Sample260730-l3fhjsvhmh
Score
6/10
Malware Config
Targets
-
- Target http://url1137.crypto.com/ls/click?upn=u001.a3rDJB2v9y9hAhzyhYB5oEJeKgH27Eeuxg9uYPT74x73Q5ZEDUFFBrHyVCpWTOWC7UvjXE0gFCTA1a9iFLiqDg-3D-3DWUWJ_5py27-2FImFuvRJ3K2KiJbLzZynXucLytJTxamR0RCAPm83c547vCs5BrwhpH0I59SdZCIIXhUet5F7W3F6uIo6JxiLQRnwCx2cDXGsgu59gPkyyoUKL5GmMt1V6jbSiBVZEFY-2BEJzPJSlI1pj3tzztDG2dkLNLoBQt8waif-2FfrwKZAyfkLk-2ByYbUYXnoyszvi-2BsRCcLU5I8mORUbdQWAsbA-3D-3D
Score6/10-
Contacts third-party web service commonly abused for C2
Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.
-
Looks up external IP address via web service
Uses a legitimate IP lookup service to find the infected system's external IP.