Essential information

Value / Name

https://riverlino.com/U.GRE';$j=$env:TEMP+'\1.ps1';

Confidence

100/100

Revoked

Yes

Valid from

24/10/2025 06:30

Valid until

10/12/2025 05:30

Pattern type

stix

Published

21/12/2025 18:58

Modified

21/12/2025 18:58

Author / Source

AlienVault

Description

No description.

Pattern

[url:value = 'https://riverlino.com/U.GRE\';$j=$env:TEMP+\'\\1.ps1\';']

Labels / Tags

Labels: clickfix netsupport rat remote administration tools

Marking (TLP)

TLP:CLEAR

Related entities

No linked attack reports or intrusion sets yet.