General
- Target https://prepareqcdcnvsystempre-inspection.s3.dualstack.us-east-2.amazonaws.com/5h2gcm3c-sns?Type=Notification&MessageId=8abea8d9-5754-40df-b1d0-0df93145d167&TopicArn=arn:aws:sns:us-east-2:234427423701:4qmcpf0g7quj&Timestamp=2026-11-04T10:12:05.000Z&SignatureVersion=1&Sig=onwolUhZeeOi9zVW3xY%2BEzZFKtcFPSqgnoHSueGUYlEJsYmIc5UpSh1hDPpOFfzMbioM950O9kICc8fTE7KnHud9&SigningCertURL=https%3A//sns.us-east-2.amazonaws.com/SimpleNotificationService-99a078a10da0cd70fb08ab5121a905df.pem&UnsubscribeURL=https%3A//sns.us-east-2.amazonaws.com/%3FAction%3DUnsubscribe%26SubscriptionArn%3Darn%3Aaws%3Asns%3Aus-east-2%3A595187834701%3Aksk2vcru%3Armincdmw&SubscribeURL=https%3A//sns.us-east-2.amazonaws.com/%3FAction%3DConfirmSubscription%26TopicArn%3Darn%3Aaws%3Asns%3Aus-east-2%3A698708506401%3Ach7rdaj3%26Token%3DctgwyHnIdMJYE4K2kEXo2nKEOTElEizM93%2BYTCrJu0A/o02cSxaU7AUtRCFN%2BYnpKPH3Pydc4B8E7VWsvtjW2nZw#676169656c6c6f40616c7465616e65742e6974
- Sample261104-t22cmax13m
Static task
static1
URLScan task
urlscan1
Behavioral task
behavioral1
Sample
https://prepareqcdcnvsystempre-inspection.s3.dualstack.us-east-2.amazonaws.com/5h2gcm3c-sns?Type=Notification&MessageId=8abea8d9-5754-40df-b1d0-0df93145d167&TopicArn=arn:aws:sns:us-east-2:234427423701:4qmcpf0g7quj&Timestamp=2026-11-04T10:12:05.000Z&SignatureVersion=1&Sig=onwolUhZeeOi9zVW3xY%2BEzZFKtcFPSqgnoHSueGUYlEJsYmIc5UpSh1hDPpOFfzMbioM950O9kICc8fTE7KnHud9&SigningCertURL=https%3A//sns.us-east-2.amazonaws.com/SimpleNotificationService-99a078a10da0cd70fb08ab5121a905df.pem&UnsubscribeURL=https%3A//sns.us-east-2.amazonaws.com/%3FAction%3DUnsubscribe%26SubscriptionArn%3Darn%3Aaws%3Asns%3Aus-east-2%3A595187834701%3Aksk2vcru%3Armincdmw&SubscribeURL=https%3A//sns.us-east-2.amazonaws.com/%3FAction%3DConfirmSubscription%26TopicArn%3Darn%3Aaws%3Asns%3Aus-east-2%3A698708506401%3Ach7rdaj3%26Token%3DctgwyHnIdMJYE4K2kEXo2nKEOTElEizM93%2BYTCrJu0A/o02cSxaU7AUtRCFN%2BYnpKPH3Pydc4B8E7VWsvtjW2nZw#676169656c6c6f40616c7465616e65742e6974
Resource
win10v2004-20260911-en
Malware Config
Targets
-
- Target https://prepareqcdcnvsystempre-inspection.s3.dualstack.us-east-2.amazonaws.com/5h2gcm3c-sns?Type=Notification&MessageId=8abea8d9-5754-40df-b1d0-0df93145d167&TopicArn=arn:aws:sns:us-east-2:234427423701:4qmcpf0g7quj&Timestamp=2026-11-04T10:12:05.000Z&SignatureVersion=1&Sig=onwolUhZeeOi9zVW3xY%2BEzZFKtcFPSqgnoHSueGUYlEJsYmIc5UpSh1hDPpOFfzMbioM950O9kICc8fTE7KnHud9&SigningCertURL=https%3A//sns.us-east-2.amazonaws.com/SimpleNotificationService-99a078a10da0cd70fb08ab5121a905df.pem&UnsubscribeURL=https%3A//sns.us-east-2.amazonaws.com/%3FAction%3DUnsubscribe%26SubscriptionArn%3Darn%3Aaws%3Asns%3Aus-east-2%3A595187834701%3Aksk2vcru%3Armincdmw&SubscribeURL=https%3A//sns.us-east-2.amazonaws.com/%3FAction%3DConfirmSubscription%26TopicArn%3Darn%3Aaws%3Asns%3Aus-east-2%3A698708506401%3Ach7rdaj3%26Token%3DctgwyHnIdMJYE4K2kEXo2nKEOTElEizM93%2BYTCrJu0A/o02cSxaU7AUtRCFN%2BYnpKPH3Pydc4B8E7VWsvtjW2nZw#676169656c6c6f40616c7465616e65742e6974
Score6/10-
Looks up external IP address via web service
Uses a legitimate IP lookup service to find the infected system's external IP.