General
- Target https://e.email.ticketsatwork.com/click?ZdJNbb5tAEIX5LUi8hWR38MISyUrt2E6TNK6Uq5MXa3cZMOFqWOI0Vf97xcWWH9rX2W84Z2YOc73Bqmjy01JojVVd5N8iVdYJhVbPuPxtZnFgnpvU49znDjBORmyEVBHfEZwSZp6YSpvnJsrI1mJnMwg9juA73HeZgJALAKZU6EpGKEWwiXliVu0nj3TMP8bzfg_t6DpWCepa6F1RJe0CzlSRZUW-rrAfpT5LRR7EeXRabkrj4e37GmWkxW69nE0nd8QnPhBwFfUdjzFm_EBJje3F0LNuqnS8lysrDLHCXGH9D9kmrxtZqyqWeIG5ks04uNqkKvOpjNnudXVP3lY3XxLY5A2WOwX1513MPlSmxhaZWMDAzbCuRYTrJg4sYM7sv4vs6PZASmSliKO8w48M2GmcJ3ZYFBqrA9yvo0MxE3F6eOjP3D28YKqKDO15C9iOvXgFt-PCqshkk6ao416NdmWV6o2oN13FA-lTfxR4jMpQMhjx0COuo4jgPBABAuc-KMr7xqwcpvRGrJfYj80cwhgDp-eK_OPY-RdqcTDeprar7gbbto2DcdsOf4HbJhdxvHr5nD9tr1dzCxbX1XsxhY_Z7PaZ3LzSz8efs_uktGB6zZOn1IKFs2zyxIJFM79t-UfWbCeT9OHqffmwnQ6_wvFlPCMS2yvHjYybfZguhzD9HQAei43c93704
- Sample260910-zssl1swdmc
Score
7/10
Malware Config
Targets
-
- Target https://e.email.ticketsatwork.com/click?ZdJNbb5tAEIX5LUi8hWR38MISyUrt2E6TNK6Uq5MXa3cZMOFqWOI0Vf97xcWWH9rX2W84Z2YOc73Bqmjy01JojVVd5N8iVdYJhVbPuPxtZnFgnpvU49znDjBORmyEVBHfEZwSZp6YSpvnJsrI1mJnMwg9juA73HeZgJALAKZU6EpGKEWwiXliVu0nj3TMP8bzfg_t6DpWCepa6F1RJe0CzlSRZUW-rrAfpT5LRR7EeXRabkrj4e37GmWkxW69nE0nd8QnPhBwFfUdjzFm_EBJje3F0LNuqnS8lysrDLHCXGH9D9kmrxtZqyqWeIG5ks04uNqkKvOpjNnudXVP3lY3XxLY5A2WOwX1513MPlSmxhaZWMDAzbCuRYTrJg4sYM7sv4vs6PZASmSliKO8w48M2GmcJ3ZYFBqrA9yvo0MxE3F6eOjP3D28YKqKDO15C9iOvXgFt-PCqshkk6ao416NdmWV6o2oN13FA-lTfxR4jMpQMhjx0COuo4jgPBABAuc-KMr7xqwcpvRGrJfYj80cwhgDp-eK_OPY-RdqcTDeprar7gbbto2DcdsOf4HbJhdxvHr5nD9tr1dzCxbX1XsxhY_Z7PaZ3LzSz8efs_uktGB6zZOn1IKFs2zyxIJFM79t-UfWbCeT9OHqffmwnQ6_wvFlPCMS2yvHjYybfZguhzD9HQAei43c93704
Score7/10-
A potential corporate email address has been identified in the URL
-
Contacts third-party web service commonly abused for C2
Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.
-
Looks up external IP address via web service
Uses a legitimate IP lookup service to find the infected system's external IP.