7-Zip #FakeApp observed serving #NetSupportRat

https[:]//7zlp2024[.]shop

>>

0511file24.msix (b3a95ec7b1e7e73ba59d3e7005950784d2651fcd2b0e8f24fa665f89a7404a56)

MGJFFRT466
NSM301071

62.76.234[.]49:443

Observed a few possible upcoming #KeitaroTDS domains via Silent Push. Found in research, not observed in any compromised sites yet. #SocGholish #TA569.

designinteractiveplatform[.]club
ajaxapiendpoint[.]cloud
codingmastermindhub[.]club
apivuecomponent[.]com

Observed a new beginning part of the delivery chain for #LandUpdate808

hxxps[:]//mercro[.]com/web-metrics.js

Found in Silent Push. Can't get the next part yet.

https://urlscan.io/search/#mercro.com

Edge-themed Fake Update:

edgeupgrade[.]com

Clicking the update button serves hxxps[:]//elrifeno[.]com/temp/Install_x64.exe (44faed020d5d8b29918a3f02d757b2cfada67574cf9e02748ea7f75ba5878907)

This is related to the other fake update sites below that ET is already tracking:

updatechrllom[.]com
mozilaupgrade[.]com
javadevssdk[.]com

Another possible upcoming #SmartApeSG domain found in research, not from anything injected into a compromised site.

carnivalsale[.]com/cdn-vs/original.js

As seen here: https://urlscan.io/result/274908d4-e989-49a3-ba9f-982eed384d56/

Another possible upcoming #SmartApeSG domain found in research, not from anything injected into a compromised site.

boylegmfg[.]com/cdn-vs/original.js

As seen here: https://urlscan.io/result/24389cf6-1dbc-4c42-a1bf-eacf6cb97947/

Another possible upcoming #SmartApeSG domain found in research, not from anything injected into a compromised site.

gxsicmj3l[.]top/cdn-vs/original.js

As seen here:
https://urlscan.io/result/d1e01c92-13b9-47d7-8931-4912b43e0956/

I'm starting to wonder how frequently they cycle through their domains.

Another possible upcoming #SmartApeSG domain found in research, not from anything compromised.

giorja[.]com/cdn-vs/original.js

As seen here:
https://urlscan.io/result/d269516c-475f-4cdf-b9d6-d11d51ba3efb/

Also, the one for the bankbates from yesterday... https://urlscan.io/result/df265447-ecef-4337-be43-b1ac7436e6e7/