James_inthe_boxMar 19

First time seeing #expiro drop #originlogger:

https://app.any.run/tasks/3d2d1d8b-b635-40b3-8a45-5edcaf3872b0/

Show thread𝙽𝙴𝚃𝚁𝙴𝚂𝙴𝙲
@james_inthe_box Thanks for sharing! Looks like it (OriginLogger?) is exfiltrating to:
🔥 cvgrf[.]biz
🔥 knjghuig[.]biz
🔥 npukfztj[.]biz
🔥 przvgke[.]biz
🔥 pywolwnvd[.]biz
🔥 ssbzmoy[.]biz
Mar 19 at 1:05pmWeb
Show threadJames_inthe_boxMar 19
@netresec That's the expiro at work :) ftp.aventour\.com\.mx is the originlogger exfil.
Show thread𝙽𝙴𝚃𝚁𝙴𝚂𝙴𝙲Mar 19
@james_inthe_box Ah, yes of course! Thanks for pointing that out 🙏