indicatorurl

hxxps://frehf[.]oss-cn-hongkong[.]aliyuncs[.]com/%E4%BA%BA%E4%BA%8B%E5%8A%9B%E8%B3%87%E6%BA%90%E9%83%A8[.]zip

Posts referencing this indicator

An Analysis of ValleyRAT Infection Campaigns from Fake Installers, Japanese Malicious Emails
Spiderlabs
Full phishing URL from the malicious email; downloads the ZIP archive containing the DLL sideloading payload
2026-07-06