Search/hxxps://fern-song[.]pages[.]dev/win/index[.]php?vq=7ZNbQwNzBJ2yll0ZkiqiA2QyREYyaVMwT1BCOTFPb1JEeHRNL2dLNVNDc2UvMDVlNmFpWkJPeHFyazl1VGpHUzA4MXRRamttLzVKOTI4R2ptaHcxeGtsUHhPTXlneFFCTWJjZGNUNkZteDRDRm43K2ovVXBZMjlVU3lISDdLdlREZlBrMG9UL1RYUkFiYWhBQmxTS09vMVJuMUcyM2w2U1JGT29VUm5ITmJRSmZFOFdCbUIrSVIxbVdTdWxPVGdjWXQxNXIrZ1kyUlZvcmQ1ZQ==

● IOC

hxxps://fern-song[.]pages[.]dev/win/index[.]php?vq=7ZNbQwNzBJ2yll0ZkiqiA2QyREYyaVMwT1BCOTFPb1JEeHRNL2dLNVNDc2UvMDVlNmFpWkJPeHFyazl1VGpHUzA4MXRRamttLzVKOTI4R2ptaHcxeGtsUHhPTXlneFFCTWJjZGNUNkZteDRDRm43K2ovVXBZMjlVU3lISDdLdlREZlBrMG9UL1RYUkFiYWhBQmxTS09vMVJuMUcyM2w2U1JGT29VUm5ITmJRSmZFOFdCbUIrSVIxbVdTdWxPVGdjWXQxNXIrZ1kyUlZvcmQ1ZQ==

View graph Watch Export

Type

URL

Source

ThreatFox

First seen

Oct 6, 2026

Last seen

—

payload deliveryreported by LocalReporter

Look up on VirusTotal

Linked malware

Related Indicators

6

domainfern-song[.]pages[.]devsame malware family domainpolar-willow-comet[.]pages[.]devsame malware family domainlemon-hill7[.]pages[.]devsame malware family urlhxxps://polar-willow-comet[.]pages[.]dev/win/index[.]php?vq=dIjPdmJg8VKQ7DAHcDcz/ktPUXRhNU0vV3phVGNlb0IrbGE1TGdYYlZkMXJrUXJlaWdDYUE1aHF0Si9McmYzdmlNdUVVc2RUZXBDQ3AvSzU0b1FXQ2ZTTklxYjRuU25pQlo2NDZXOHFsdFdRejZNWGpPMG5STUVLZ0V4b0VRUHRIU1NxeFRKOXVrWDFBV3AwdHdBZ2F0emJuUUlVVVc1Y2F2d2lTMjZUVWdpOWoyZDJwSzNBZ2poVUdvYnk1Q0xtQ0tWOG1CZmNRblMyNUpGLw==same malware family urlhxxps://lemon-hill7[.]pages[.]dev/win/index[.]php?vq=mIkU125tvDTrm29Wcxr3HjBWbDVXaUMxKzNKdEcvR1U2MEtqbXY1VkVLdkgxSWE1U1dnbVRzRmFkeU9ZYWVMWWU2R3ZDMGZ1Y1NjcGZ4bXF6ekJrSkJsNjEzNEwza3lBVnlJcXNOVis3TUtRQlRaaUlBV1hIMGIvUmRkdTMrVzhYeERkUGk1RCtmUmw5OC9GcUhMM0tGL3lqazhpZDFMUStsLzJVRlltYW1jWEZiOUpVK0tkL21IR2FpTml3eVZPMzlVTm1mbDFVV3F3akRSTg==same malware family domainaraestudio[.]essame malware family

Connections

1 relationships