SideCopy HTA/PHP payload retrieval from docsportal.in second-stage path

Ankit Mehta@Secvyn

•updated 28 days ago•1•0•4

Detects outbound HTTP GET requests to the known malicious domain 'docsportal.in' attempting to retrieve second-stage payloads such as '161.php' or 'com.hta'. This pattern is associated with the SideCopy threat actor's malware delivery infrastructure.