neuro.msi / MSI file downloaded from hxxp://85.208.108[.]30/nuero.msi contained within JS file


vpn.msi / MSI file downloaded from hxxp://193.32.177[.]192/vpn.msi contained within JS file


aclui.dll / DLL contained within MSI file BST.msi and vpn.msi


capisp.dll / DLL contained within MSI file neuro.msi


BruteRatel payload / BruteRatel decrypted payload contained within capisp.dll


containing fake IRS website, luring users into trying to download W2 form


Domain hosting BST.msi


Domain hosting vpn.msi


Domain hosting neuro.msi


BruteRatel C2 - Payload contained within aclui.dll BruteRatel C2 Payload contained within aclui.dll


Latrodectus C2


Infected WordPress


Socgholish


JScript Fake update page


PDF


PDF Payload


Payload SHA1 Download


MSI


upfilles.dll


in-memory DLL (decrypted DLL embedded in upfilles.dll)


Atlantida – HTA


Atlantida – MHTML


Atlantida – Powershell


Atlantida – .NET Injector Atlantida – NET Injector


Atlantida – C&C


Rhadamanthys – GO downloader


Rhadamanthys – GO Loader


Lumma Stealer


Lumma – C&Cs


RedLine Stealer


sha256: 313f2078fa0abb4452daa061ed98eccbfb956dfc76fdb6870cf9ec2a4b534f5a


md5: f7d09dd6a214d5c5be9c17a833665d1f


sha256: 478c650401b6ea7d68f649fab17a8eb9581b81607b49e1cff0f61d65df29d1da filename: runbll32.dll


md5: 3e25bf86d491cb4b7cd454c5aaaf8587 filename: runbll32.dll


md5: 3e25bf86d491cb4b7cd454c5aaaf8587 sha256: 478c650401b6ea7d68f649fab17a8eb9581b81607b49e1cff0f61d65df29d1da


mens-freeze.html, sha256: 72721f96599ab1191d2588e1a8001cc76f9bd8968fa4708dff153b1383b37aeb


mens-freeze.html, md5: 95fe77c5028c5713dac53efa97b50be1


sha256: 9479ff59794cbf5f26996eb702f027e700bdbb13858463b7d2537a3fdff4af64 filename: attachment.xls


md5: 2440bb07a338603b0b1f5fa4682c5ed4 filename: attachment.xls


md5: 2440bb07a338603b0b1f5fa4682c5ed4 sha256: 9479ff59794cbf5f26996eb702f027e700bdbb13858463b7d2537a3fdff4af64


sha256: 720df41451f9de8d863fce8c90310cd9f14dabe2519f98580c963784628eea55 filename: spreadsheet.xls


md5: 363b9c08efb795a088694706fdc771c2 filename: spreadsheet.xls


md5: 363b9c08efb795a088694706fdc771c2 sha256: 720df41451f9de8d863fce8c90310cd9f14dabe2519f98580c963784628eea55


sha256: d0dccd3a46392875b480c3666e2da62d12fdb0b4e5557185d4116344ed73110d filename: Loader.dll


md5: 1cc4bdaa3ef0f00a71bf74fb9c320694 filename: Loader.dll


md5: 1cc4bdaa3ef0f00a71bf74fb9c320694 sha256: d0dccd3a46392875b480c3666e2da62d12fdb0b4e5557185d4116344ed73110d


sha256: 912e8f6d71d556c6def42cb01e8c17e7bd6e46bd3f90eba0c8e8f83937d362f0 filename: ResetEngine.dll


md5: 07feb6b34198e1a8aec598e8dca8f42e filename: ResetEngine.dll


md5: 07feb6b34198e1a8aec598e8dca8f42e sha256: 912e8f6d71d556c6def42cb01e8c17e7bd6e46bd3f90eba0c8e8f83937d362f0


CobaltStrikeBeacon.shellcode, sha256: e32f016fe347dd29e263c026c680b9044dcf75340b6fa72b43f1a73a4d7605cf


CobaltStrikeBeacon.shellcode, md5: 235ddb7a47a2733b36ac7e312590548b


sha256: 042de780112ef6d50b37a3f57e5a8f1e9910ad986fbba984be8fea3a18f39d59 filename: virus_12.07.2024.rar


md5: db6030e4845eb8aa76f5a1803f95ca56 filename: virus_12.07.2024.rar


md5: db6030e4845eb8aa76f5a1803f95ca56 sha256: 042de780112ef6d50b37a3f57e5a8f1e9910ad986fbba984be8fea3a18f39d59


sha256: 2feb0bc8dec293ac19246cc0ecc05a1bc606ddac9aa57e677ade4cfac4e94d20 filename: equipment_survey_regions_.xls


md5: 8fbc386b46ab18f35564536e7e6b3b68 filename: equipment_survey_regions_.xls


md5: 8fbc386b46ab18f35564536e7e6b3b68 sha256: 2feb0bc8dec293ac19246cc0ecc05a1bc606ddac9aa57e677ade4cfac4e94d20


sha256: 7f29c3ea5b8fbd8b8ab6f7b508b6f8b6fa68fdebfec928f57f203bdef63b1c08 filename: accounts.xls


md5: 7ab58eb9b1c6b6e43a8606b9785d7352 filename: accounts.xls


md5: 7ab58eb9b1c6b6e43a8606b9785d7352 sha256: 7f29c3ea5b8fbd8b8ab6f7b508b6f8b6fa68fdebfec928f57f203bdef63b1c08


sha256: eca4273d922a66eb943a4bd1fd73ee4bd196289e32fe629cfe4ecf99e4cfadd3


md5: 618c22c74c0bfa60b7232751f90ddc2d


sha256: 02d15669996853594424e5e7f957e12b2042b7775535bd2160953b4e84bb61cd filename: 66_oborona_PURGED.xls


md5: c98afaa61bc1a9a985e679b273509912 filename: 66_oborona_PURGED.xls


md5: c98afaa61bc1a9a985e679b273509912 sha256: 02d15669996853594424e5e7f957e12b2042b7775535bd2160953b4e84bb61cd


sha256: 8932a95c10b088874bfb3471c352d2a7d64757ce77b226f19133301c481d9d03 filename: accounts.xls


md5: 1ff1d1f4a91704cf011019c772801e8a filename: accounts.xls


md5: 1ff1d1f4a91704cf011019c772801e8a sha256: 8932a95c10b088874bfb3471c352d2a7d64757ce77b226f19133301c481d9d03


sha256: b7ef3c08cea0c50a43a7e3904f386189bd92f5da2920f026febc9f42c4de109d


md5: 5799bccc0140492483ac53354f29577d


sha256: 22ba7234715ec7d99656fc6e16c2d75cbb5465c0fb2e5063c6d02baa4837a602


md5: 59a5ac6c2dc0ec90966e2064962e4fd6


sha256: eaf3fd4dd5f6ea621ddc1bbccd5626cfa47bd3f8370c254866d9540dfda24374


md5: 0990df4c6805f1ababcc17eb4640395c


sha256: bea3df5f788e60d324f1623a4328dafd9eaa6bb01d0a93343176def708bc002f


md5: e32c23f357514d18c398ba393b74b603


sha256: e89612f017334f1bea536095abda92ded478a56ea4dce5e293222ce99a3e0c91


md5: 9c498e1a3f5cb89f236c8b8fe9274d2c


sha256: d8aba4e6904e03daac2c154a1b6b6a9ebe351e4af9b59b44a8ed442f4e67abcf filename: spreadsheet.xls


md5: e5b36154cd6c6c013633af2b64aecaa8 filename: spreadsheet.xls


md5: e5b36154cd6c6c013633af2b64aecaa8 sha256: d8aba4e6904e03daac2c154a1b6b6a9ebe351e4af9b59b44a8ed442f4e67abcf


sha256: 027e50b96e1683f22c448f9c7157f518d7d8f887c22862df3837fcfee558a6f2 filename: trix.xls


md5: ef5b01f2c5800b29d67560a84c41a832 filename: trix.xls


md5: ef5b01f2c5800b29d67560a84c41a832 sha256: 027e50b96e1683f22c448f9c7157f518d7d8f887c22862df3837fcfee558a6f2


sha256: f4a434dd2ac33ffe67575a61c1048d8c9c7f75363727dae9af578a943e9e512a filename: trix.xls


md5: 2f61b89c56bdc5fa3818bcb2ebf23d34 filename: trix.xls


md5: 2f61b89c56bdc5fa3818bcb2ebf23d34 sha256: f4a434dd2ac33ffe67575a61c1048d8c9c7f75363727dae9af578a943e9e512a


sha256: a032348d09c21894b14e9accee0bfd4a14b9dfda6f113cfc1476f45bec500135 filename: attachment.xls


md5: 1fd4b7f97551c1df0403b2c7280b8bd9 filename: attachment.xls


md5: 1fd4b7f97551c1df0403b2c7280b8bd9 sha256: a032348d09c21894b14e9accee0bfd4a14b9dfda6f113cfc1476f45bec500135


sha256: 2b3617ae3fb743eaf604d0d3d36b68cf249dbeb180f06c8d0f3d60ccc3cc4b43 filename: ruhbll32.dll


md5: 6908e1c1616271efba5b7c811b998c76 filename: ruhbll32.dll


md5: 6908e1c1616271efba5b7c811b998c76 sha256: 2b3617ae3fb743eaf604d0d3d36b68cf249dbeb180f06c8d0f3d60ccc3cc4b43


sha256: 5f590fbd8307c7568737b62379a1fc0559308c7f29cb31920aa64097ffc0ca56 filename: spreadsheet.xls


md5: 36b293e93b9b3fd4aaa98de8ab31d244 filename: spreadsheet.xls


md5: 36b293e93b9b3fd4aaa98de8ab31d244 sha256: 5f590fbd8307c7568737b62379a1fc0559308c7f29cb31920aa64097ffc0ca56


sha256: 9a5a37b16350da20f86553df67eb7edf2142e1d36da1fcf99cacc6a74cc03730


md5: 1724a8b1abb30612eceeb983809a3945


sha256: 411f088c3f997fdddec7a3b153d9526bd2d2d7c55ea25bae32d7b41f36514e04


md5: 7fb55ab462fbcbd218682f1386ed94d4


sha256: b1997a5bb5da44e05e05935ebe79d44f11358b8d8da7d4a99ad3e0367b5c567e filename: trix2.xls


md5: 86ab1d8dff4c828f232ff848ff497610 filename: trix2.xls


md5: 86ab1d8dff4c828f232ff848ff497610 sha256: b1997a5bb5da44e05e05935ebe79d44f11358b8d8da7d4a99ad3e0367b5c567e


sha256: ce5481496b58ef0bdf43d650bc8b70db5a2e03b1f8f42e30002bc95d9be8fe03 filename: trix.xls


md5: 7bbc1d438ddb10a6b0893dc9a53aa868 filename: trix.xls


md5: 7bbc1d438ddb10a6b0893dc9a53aa868 sha256: ce5481496b58ef0bdf43d650bc8b70db5a2e03b1f8f42e30002bc95d9be8fe03


Податок_2024.xls, sha256: 2cde8de330a874020340f2110bd1fd013fab7e93ef884c9006a646b49b567a75


Податок_2024.xls, md5: 4218f95313a57ea6173bd8590f9a5c50


sha256: d7edb2ef6e95cbd77368ba5f5644d67c4de23feea9336bd324146b8abd63eab1 filename: ruhbll32.dll


md5: 47de94cd457149fac309abdd1c48d1bd filename: ruhbll32.dll


md5: 47de94cd457149fac309abdd1c48d1bd sha256: d7edb2ef6e95cbd77368ba5f5644d67c4de23feea9336bd324146b8abd63eab1


sha256: b2434817428c6e38e435343db0d758498ba73952703c9d835f8ba62cbd36763d


md5: 06faea7df39635f60feab8eaf663589c


sha256: 67e282aeadd040e14519a3755e526228a0e91472520728d258568cf61e68097f filename: accounts.xls


md5: fef3d4c960f97c113762e1b9f253c3ca filename: accounts.xls


md5: fef3d4c960f97c113762e1b9f253c3ca sha256: 67e282aeadd040e14519a3755e526228a0e91472520728d258568cf61e68097f


sha256: 51f6b8dfcbe757f5df935203369da894c45727028d972b1207e449d0a592f7e2


md5: 9d83e1af2727e271261fd5f31a966f9f


sha256: a7694687ac179a48f07d306ed1b08cd60e9aa7063ee91ab64b0a50ddd7371378


md5: a6d1d556cd53d1ccd01a7ad3fd496a39


sha256: 477c198d257a738c945a866b176d9ecf922e3145f86f26154065818be5623fd5


md5: edb6cfca036c1a183d532fe78f1e23e0


sha256: 4a00b428a6513ea69a7185903f773bf8008e862ac295be86ef26536001ba17ef filename: accounts2.xls


md5: 8d6948d9e974d8f513e398713dfd6398 filename: accounts2.xls


md5: 8d6948d9e974d8f513e398713dfd6398 sha256: 4a00b428a6513ea69a7185903f773bf8008e862ac295be86ef26536001ba17ef


sha256: 651e551854a4d949c4168efd6ae374f20e7951ad09fbea0e7d03456072644a99 filename: trix2.xls


md5: d350a490f31df7a6efb86b2403a5d8e9 filename: trix2.xls


md5: d350a490f31df7a6efb86b2403a5d8e9 sha256: 651e551854a4d949c4168efd6ae374f20e7951ad09fbea0e7d03456072644a99


sha256: 22af576e3c9ff82d2ddf45701e9f0db5ec6320ab9837d39d5d9d76d15a084f16 filename: trix.xls


md5: 52cab62df14c0ea5f5532283ea2376a4 filename: trix.xls


md5: 52cab62df14c0ea5f5532283ea2376a4 sha256: 22af576e3c9ff82d2ddf45701e9f0db5ec6320ab9837d39d5d9d76d15a084f16


Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36


Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36 Edg/98.0.1108.62


Indicators of Compromise (IoCs) for FrostyGoop AKA BUSTLEBERM


itmvroidovs.exe


Monthly Report MAP.xlam


Infrastructure / [TFTP SERVER on demand]


Malware / microsocks socks5 xlogin


Election Lure / Trojan ( 0001140e1 ) Election Lure / Trojan ( 001140e1 )


Syllabus Lure / Trojan ( 0001140e1 ) Syllabus Lure / Trojan ( 001140e1 )


Crimson RAT / Trojan ( 005b635b1 ) Crimson RAT / Trojan ( 05b635b1 )


Crimson RAT / Trojan ( 005b67de1 ) Crimson RAT / Trojan ( 05b67de1 )


File


File (SHA256)


SocGholish associated


Obfuscated PowerShell script that contains two embedded resources. (1.php?s=boicn)


Zip file containing BOINC client and configuration


BOINC installer script


Main for Hosted BOINC Server


Observed DNS query; SocGholish associated


First stage payload


Observed DNS query


SMTP exfiltration-sender accounts


SMTP exfiltration-recipient accounts


SMTP exfiltration hosts


filename: Crowdstrike-hotfix.zip


sha256: c44506fe6e1ede5a104008755abf5b6ace51f1a84ad656a2dccc7f2c39c0eca2


filename: Setup.exe


sha256: 5ae3838d77c2102766538f783d0a4b4205e7d2cdba4e0ad2ab332dc8ab32fea9


filename: instrucciones.txt


sha256: 4f450abaa4daf72d974a830b16f91deed77ba62412804dca41a6d42a7d8b6fd0


filename: maddisAsm_.bpl


sha256: 52019f47f96ca868fa4e747c3b99cba1b7aa57317bf8ebf9fcbf09aa576fe006


filename: madexcept_.bpl


sha256: 835f1141ece59c36b18e76927572d229136aeb12eff44cb4ba98d7808257c299


filename: rtl120.bpl


sha256: b1fcb0339b9ef4860bb1ed1e5ba0e148321be64696af64f3b1643d1311028cb3


filename: vcl120.bpl


sha256: b6f321a48812dc922b26953020c9a60949ec429a921033cfaf1e9f7d088ee628


filename: datastate.dll


sha256: 6010e2147a0f51a7bfa2f942a5a9eaad9a294f463f717963b486ed3f53d305c2


filename: maidenhair.cfg


sha256: 931308cfe733376e19d6cd2401e27f8b2945cec0b9c696aebe7029ea76d45bf6


filename: battuta.flv


sha256: be074196291ccf74b3c4c8bd292f92da99ec37a25dc8af651bd0ba3f0d020349


filename: Remcos


sha256: 48a3398bbbf24ecd64c27cb2a31e69a6b60e9a69f33fe191bcf5fddbabd9e184


BL Networks / Rapid7 Blog


OVH SAS / Jarm fingerprint + HTML response


Android/Spy.Ratel.A / Android malware impersonating Hamster Kombat, filename: Hamster.apk


Android/Spy.Ratel.A / Android malware impersonating Hamster Kombat, sha1: acd260356e3337f775e1aa6259b55e2d3bb11f80


Win32/Kryptik.HWZI / Windows malware targeting Hamster Kombat players, filename: Setup.exe


Win32/Kryptik.HWZI / Windows malware targeting Hamster Kombat players, sha1: c51266a3f6098489764579c4a62b8509249f00e5


Win32/Kryptik.HXDB / Windows malware targeting Hamster Kombat players, filename: Hamster-Kombat.exe


Win32/Kryptik.HXDB / Windows malware targeting Hamster Kombat players, sha1: 7be8d85301c9cce3945561878c924908a8e1f714


WinGo/TrojanDropper. Agent.CW / Windows malware targeting Hamster Kombat players, filename: update.exe


WinGo/TrojanDropper. Agent.CW / Windows malware targeting Hamster Kombat players, sha1: 91351285cb1448d22c883bc9dc1273ca46e3c90a


WinGo/TrojanDropper. Agent.CW / Windows malware targeting Hamster Kombat players, filename: Setup_v1.1.2.exe


WinGo/TrojanDropper. Agent.CW / Windows malware targeting Hamster Kombat players, sha1: 46a83fbcf1aa068c8f6c46ae239abe968094e0ed


Win32/Kryptik.HXIB / Windows malware targeting Hamster Kombat players, filename: update.exe


Win32/Kryptik.HXIB / Windows malware targeting Hamster Kombat players, sha1: 2b17e3a93a59e4f9350fef831456c9f02acf9a75


Win32/Kryptik.HXIB / Windows malware targeting Hamster Kombat players, sha1: 9deb6d5e9209a9ec2b8d12972225b6a2166387ea


Win32/Kryptik.HXIB / Windows malware targeting Hamster Kombat players, sha1: 16b815c14941ecfe164bdf074f47817dcb90ccbf


WinGo/Agent.VY / Windows malware targeting Hamster Kombat players, filename: Open.exe


WinGo/Agent.VY / Windows malware targeting Hamster Kombat players, sha1: 2e257d5abb0e76ab57a0d6ae470340f71738480f


Win32/Kryptik.HXIB / Windows malware targeting Hamster Kombat players, sha1: 78f1b8c6087348ec83b7f85eefdeec5db506d851


Win32/GenKryptik.GXGC / Windows malware targeting Hamster Kombat players, filename: AUTOCLICKER.exe


Win32/GenKryptik.GXGC / Windows malware targeting Hamster Kombat players, sha1: 6f14278bc5dea7803c9d3780bca2bdb63a854f16


Win32/Kryptik.HXDV / Windows malware targeting Hamster Kombat players, filename: HAMSTER KOMBAT BALANCE HACK.exe


Win32/Kryptik.HXDV / Windows malware targeting Hamster Kombat players, sha1: 812799738c18acb88d5c9987cbfbb678c35142d8


Win32/Kryptik.HXCA / Windows malware targeting Hamster Kombat players, filename: Hamster-Kombat-NEW.exe


Win32/Kryptik.HXCA / Windows malware targeting Hamster Kombat players, sha1: b11b1cd89ea5f0d562d18278278ee247b18190e9


Win32/Kryptik.HXIB / Windows malware targeting Hamster Kombat players, sha1: fe51c824245ffe8cb509b73c25cdf02871a38f1a


Win32/Kryptik.HXDB / Windows malware targeting Hamster Kombat players, filename: update.exe


Win32/Kryptik.HXDB / Windows malware targeting Hamster Kombat players, sha1: 592215355fb25521fd7664b9ec017b1ca2fea73b


Win32/Kryptik.HXDB / Windows malware targeting Hamster Kombat players, sha1: 92b028a302faa31bdb788da3c511983ad5b08084


Python/TrojanDownloader. Agent.AFC / Windows malware targeting Hamster Kombat players, filename: Run.exe


Python/TrojanDownloader. Agent.AFC / Windows malware targeting Hamster Kombat players, sha1: 12b0bd4b2f1eb173b782b98c89ba6880c6f88056


Python/TrojanDownloader. Agent.AFB / Windows malware targeting Hamster Kombat players, filename: Install.exe


Python/TrojanDownloader. Agent.AFB / Windows malware targeting Hamster Kombat players, sha1: 3021e974d78544e62f43e5e0059ebc879594e55c


Python/TrojanDownloader. Agent.AFC / Windows malware targeting Hamster Kombat players, sha1: f79c575d0d887427b7b38ecbfb42046270fb89e8


Thumbprint


Macma


UserAgent" Macma component


kAgent" Macma component


arch" Macma component


at" Macma component


com.USAgent.mv.plist" Macma component


USAgent" Macma component


Trojan.Suzafk dropper


Trojan.Suzafk DLL


Trojan.Suzafk unpacked


Linux malware with Daggerfly library


Macma and MgBot C&C server


Trojan.Suzafk C&C server


MgBot C&C server


crowdstrike-hotfix.zip


Setup.exe


battuta.flv


maidenhair.cfg


datastate.dll


instrucciones.txt


filename: update2.pdf


sha256: 1bbb795ce19f4dcc4ac9f8e8c12f3452f1f07c68a53ef631c76e392e1d06ea43


filename: update.zip


sha256: 96dec6e07229201a02f538310815c695cf6147c548ff1c6a0def2fe38f3dcbc8


filename: CrowdStrike.exe


sha256: 4491901eff338ab52c85a77a3fbd3ce80fda738046ee3b7da7be468da5b331a3


Name


sum


Compromised


Phishing landing page


C2 (likely)


Legit PDF file (just for placeholder) after successful login


Telegram Bot


Trojan ( 0001140e1 ), filename: health-records-x-ray-n.bat


Trojan ( 0001140e1 ), md5: 4ba8bdd684441ef9f6f9ac7de7edb28b


Word document


Macro download


Second-stage file


Daolpu


Daolpu C2 server


EvilVideo payload, filename: Teating.apk


EvilVideo payload, sha1: f159886dcf9021f41eaa2b0641a758c4f0c4033d


C&C server of EvilVideo payload


punkt-1-07-10-24-na-zasid.doc, sha256: 6c439e62fb404e9095392878ef32ffce18ce6155a1510f4005409243401e8caf


punkt-1-07-10-24-na-zasid.doc, md5: 197e86b76a41f154b64e092f7cc3b306


RecordsService (HATVIBE), sha256: f9baa77117f5a058461e859efc67c8ce1ac205d1536326e01a030ab22295af5b


RecordsService (HATVIBE), md5: 81cdcda59c86f8aa636810e4a085d673


79[1].zip 9[1].zip, sha256: 593ca6d639f7c3e99db768b318b765e7585496debfde553dc1df03f5894012e3


79[1].zip 9[1].zip, md5: 7a2a8c002a5e22c6231885e1ccf82bd1


pip_update.cp37-win32.pyd (CHERRYSPY), sha256: 259619899c60aa46df4f83558606813c79927c141bbf4b21bbf07b21b40e7ac1


pip_update.cp37-win32.pyd (CHERRYSPY), md5: 7f865b65a82dcb18385644e0fd894727


sha256: e6daa00e095948acfc176d71c5bf667a0403e5259653ea5ac8950aee13180ae0 filename: 33c3e4599ad678133905e6c1589c12d2.doc


md5: 33c3e4599ad678133905e6c1589c12d2 filename: 33c3e4599ad678133905e6c1589c12d2.doc


md5: 33c3e4599ad678133905e6c1589c12d2 sha256: e6daa00e095948acfc176d71c5bf667a0403e5259653ea5ac8950aee13180ae0


sha256: bcdbe035001af9d2cc173e975fa0b13b133e613b7d9b6e90df86672f9057e19b filename: document.docm.doc.doc


md5: d618720afd0ee49601f7933c414ffbb5 filename: document.docm.doc.doc


md5: d618720afd0ee49601f7933c414ffbb5 sha256: bcdbe035001af9d2cc173e975fa0b13b133e613b7d9b6e90df86672f9057e19b


sha256: f4ada2b858c84da8b53c08ce4579f8b5b5df25e0d0f17ee0b48e10c87c338d23 filename: document.docm.doc


md5: 8e1b29046c7f5bd1ddd4f549e2555592 filename: document.docm.doc


md5: 8e1b29046c7f5bd1ddd4f549e2555592 sha256: f4ada2b858c84da8b53c08ce4579f8b5b5df25e0d0f17ee0b48e10c87c338d23


~DFDDCA10BC52EE0534.TMP, sha256: 93322be0785556e627d2b09832c18e39c115e6a6fbff64b1e590e1ddcf8f6a43


~DFDDCA10BC52EE0534.TMP, md5: d84043b72bdceb92b2d60c2725bd674f


~WRF{6A9E94D3-76E9-4BFA-ABA9-BAFFB470F23E}.tmp, sha256: a171e9c413518750806ae094e32f15791d4193229cc598642760af536cf6551d


~WRF{6A9E94D3-76E9-4BFA-ABA9-BAFFB470F23E}.tmp, md5: 34ced721349626ce81c11693b9243c19


sha256: 332d9db35daa83c5ad226b9bf50e992713bc6a69c9ecd52a1223b81e992bc725 filename: RemoteAssistanceSvc.hta


md5: d0c3b49e788600ff3967f784eb5de973 filename: RemoteAssistanceSvc.hta


md5: d0c3b49e788600ff3967f784eb5de973 sha256: 332d9db35daa83c5ad226b9bf50e992713bc6a69c9ecd52a1223b81e992bc725


sha256: 48a30083f115ca0d359afc175cf942367207a73fdda28778e2b264534cf21830 filename: AccessProtection.hta


md5: 8159abd281783e0ae601afce3b7d23b1 filename: AccessProtection.hta


md5: 8159abd281783e0ae601afce3b7d23b1 sha256: 48a30083f115ca0d359afc175cf942367207a73fdda28778e2b264534cf21830


@namecheap.com


RO @m247.com


RU @mtw.ru


%PROGRAMDATA%\Python\pythonw.exe / %PROGRAMDATA%\Python\pythonw.exe


%LOCALAPPDATA%\records\RecordsService


\vManage\StandaloneService


Malicious


crowdstrike-hotfix.zip (Remcos RAT), sha1: fef212ec979f2fe2f48641160aadeb86b83f7b35 sha256: c44506fe6e1ede5a104008755abf5b6ace51f1a84ad656a2dccc7f2c39c0eca2


crowdstrike-hotfix.zip (Remcos RAT), md5: 1e84736efce206dc973acbc16540d3e5 sha256: c44506fe6e1ede5a104008755abf5b6ace51f1a84ad656a2dccc7f2c39c0eca2


crowdstrike-hotfix.zip (Remcos RAT), md5: 1e84736efce206dc973acbc16540d3e5 sha1: fef212ec979f2fe2f48641160aadeb86b83f7b35


Crowdstrike-hotfix.zip


instrucciones.txt


Setup.exe


datastate.dll


maidenhair.cfg (HijackLoader configuration)


battuta.flv


madBasic_.bpl (HijackLoader first-stage)


RemCos Payload


Ransom.Linux.PLAYDE.YXEE3T / ELF Binary


Untested / Observed address


Hosting for NetScan


Hosting for WinRAR


Hosting for PsExec


SQLULDR2, filename: sqluldr.exe


SQLULDR2, md5: fcff642268898fcf65702a214aefbf9e


PINEGROVE, filename: OneDriveUploader.exe


PINEGROVE, md5: ac125aea0b703de37980779599438b4a


DUSTPAN, filename: aclui.dll


DUSTPAN, md5: 17d0ada8f5610ff29f2e8eaf0e3bb578


DUSTTRAP, filename: dbgeng.dll


DUSTTRAP, md5: 9991ce9d2746313f505dbf0487337082


DUSTTRAP, md5: c33247bc3e7e8cb72133e47930e6ddad


DUSTTRAP, filename: hostfxr.dll


DUSTTRAP, md5: cfce85548436fb89a83bf34dc17f325d


DUSTTRAP, md5: e98b9e21928252332edf934f3d18ac21


DUSTTRAP, md5: 8222352a61eacca3a1c6517956aa0b55


DUSTTRAP


DUSTTRAP, filename: Sbiedll.dll


DUSTTRAP, md5: d72f202c1d684c9a19f075290a60920f


DUSTTRAP, filename: atstrust.dll


DUSTTRAP, md5: 393065ef9754e3f39b24b2d1051eab61


DUSTPAN, filename: conn.exe


DUSTPAN, md5: 35f650c94faf6a2068e8238dd99edbea


DUSTPAN, filename: PrintWorkflowUserSvc_
a0c15f9d.dll / cbi.dll


PrintWorkflowUserSvc_
a0c15f9d.dll / cbi.dll

DUSTPAN, md5: 3bb44c0dd7f424864d76d4df09538cb6


DUSTTRAP, md5: aca5c6daecf463012a09564764584937


BEACON


DUSTTRAP / First observed at 2024-02-21Last observed at 2024-07-16


Related to DUSTTRAP FQDN www[.]eloples[.]com


Used to deliver DUSTPAN First activity observed at 2023-03-21


EMLs


ZIP File


ZIP / Tax


ZIP / The Remcos RAT


C2 server


iwr -usebasicparsing iex


SocGholish/TA569 affiliate traditional DGA


Weight loss pill scam RDGA


VexTrio Viper RDGA


Regional jail RDGA


Russian diploma scam RDGA


Hancitor C2 RDGA


Revolver Rabbit RDGA


Revolver Rabbit RDGA used as C2 / decoy for XLoader malware


Service DLL, sha1: 43f1c44fa14f9ce2c0ba9451de2f7d3dd1a208de filename: prints1m.dll


Service DLL, md5: 4bb191c6d3a234743ace703d7d518f8f filename: prints1m.dll


Service DLL, md5: 4bb191c6d3a234743ace703d7d518f8f sha1: 43f1c44fa14f9ce2c0ba9451de2f7d3dd1a208de


PowerShell script, sha1: a59cca28205eeb94c331010060f86ad2f3d41882 filename: service.ps1


PowerShell script, md5: 95e3312de43c1da4cc3be8fa47ab9fa4 filename: service.ps1


PowerShell script, md5: 95e3312de43c1da4cc3be8fa47ab9fa4 sha1: a59cca28205eeb94c331010060f86ad2f3d41882


Cheat Engine driver, sha1: bab2ae2788dee2c41065850b2877202e57369f37 filename: dbk64.sys


Cheat Engine driver, md5: d8ebfd26bed0155e7c4ec2ca429c871d filename: dbk64.sys


Cheat Engine driver, md5: d8ebfd26bed0155e7c4ec2ca429c871d sha1: bab2ae2788dee2c41065850b2877202e57369f37


Download Link


filename: reader_update.zip


md5: 0bb063d129162e8c93830fdbcf2ba416


filename: reader_update.exe


md5: a74ae422391a22b5469135ae7f0cbf7d


test.txt


filename: AutoIt3.exe


md5: c56b5f0201a3b3de53e561fe76912bfd


filename: script.a3x


md5: 3a292ef66958f3a6e2684bea0d158aa3


filename: test.txt


md5: c845f145f64264171c729ccaa2b86301


mal.bin (Initial Shellcode Loaded in Memory)


mal.bin_extracted (PE File Carved from Shellcode)


mal_encrypted.bin (XOR Encrypted Portion in A3X File)


mal_dropped.bin (XOR Decrypted version of mal_encrypted.bin with fixed MZ header)


DarkGate C2


Executable, filename: DC.exe


Executable, sha1: cb704d2e8df80fd3500a5b817966dc262d80ddb8


Executable, filename: DC.ini


Executable, sha1: 2c56e9beea9f0801e0110a7dc5549b4fa0661362


Executable, filename: Svchost.exe


Executable, sha1: 5e460a517f0579b831b09ec99ef158ac0dd3d4fa


Executable, filename: LB3.exe


Executable, sha1: 107ec3a7ed7ad908774ad18e3e03d4b999d4690c


Executable


• VeeamHax


UA-2024-07-04-010019.pdf, sha256: 40ee385eb112c8631f2566a2187cee844bf87984c88698106d92d469f580b134


UA-2024-07-04-010019.pdf, md5: fb3cd8734a70842406dbe8ea8bee0fd2


GLUEEGG, sha256: 82ba5c5af08a9b1b88faa0a87033af3af49e6d699dbf0df09fb4805283ff33d9 filename: adobe_acrobat_fonts_pack.exe


GLUEEGG, md5: 37e2751b26feffa619a7ff123842867b filename: adobe_acrobat_fonts_pack.exe


GLUEEGG, md5: 37e2751b26feffa619a7ff123842867b sha256: 82ba5c5af08a9b1b88faa0a87033af3af49e6d699dbf0df09fb4805283ff33d9


DROPCLUE, sha256: fb5bfd1c555b2d508f0e56bf44367203e05355440614c351bd685a9c3c84d3ed filename: code1.lua


DROPCLUE, md5: 778c85b7ed5046afa17c20d4c4a604cb filename: code1.lua


DROPCLUE, md5: 778c85b7ed5046afa17c20d4c4a604cb sha256: fb5bfd1c555b2d508f0e56bf44367203e05355440614c351bd685a9c3c84d3ed


DROPCLUE, sha256: 4d502ff5892c3b60c32e89cf841c5d81c70786a9089c4ccc211029741b1bf387 filename: code2.lua


DROPCLUE, md5: b73333ea586696a0ca41c8a7b2046e8c filename: code2.lua


DROPCLUE, md5: b73333ea586696a0ca41c8a7b2046e8c sha256: 4d502ff5892c3b60c32e89cf841c5d81c70786a9089c4ccc211029741b1bf387


DROPCLUE, sha256: c296a6f55e06729bbf4ec270f12ddc24678a1e622dfeb16bce64d9d20f44e03f filename: code3.lua


DROPCLUE, md5: 1191f83c3ffadac0142814ec9691829e filename: code3.lua


DROPCLUE, md5: 1191f83c3ffadac0142814ec9691829e sha256: c296a6f55e06729bbf4ec270f12ddc24678a1e622dfeb16bce64d9d20f44e03f


UA-2024-07-04-010019-a-open.pdf, sha256: 1937f46f81ee04c797987ca84bd9b338dc6e157b6928b957c0e685312e67ffc3


UA-2024-07-04-010019-a-open.pdf, md5: bdd1b02c7588feb06e70874f3aa90d03


font-pack-pdf-windows-64-bit, sha256: 0a2d4764b70dfb0992608658cbafb641e3c38430364233f74b666a55b92817a5


font-pack-pdf-windows-64-bit, md5: 57a9efe39f30a4284c0d5bfc3c80cc69


%random%.bat, sha256: 5f8ac3b5f4a33cafaf101f2ac63bad21bae88c6df7369fa58f0709ef35266a9e


%random%.bat, md5: d7dbfe6b80590c5038dd8ef430c5277e


ATERA, sha256: ceedf36401ccea32d5465d955cc0a8a72c297182219338cf5521e557ce9ea963 filename: setup.msi


ATERA, md5: 8a1bd632a9b8df88aae5e1d3439411ce filename: setup.msi


ATERA, md5: 8a1bd632a9b8df88aae5e1d3439411ce sha256: ceedf36401ccea32d5465d955cc0a8a72c297182219338cf5521e557ce9ea963


(Додатково) / ACROBAIT, sha256: dc7b8a3b3d03ad01e05b807618d3a5556cf3f699b5cffc3133ef7e1bc9efdd17 filename: AdobeFontPackCx64_03292024.exe


(Додатково) / ACROBAIT, md5: df678ec9c97db5bcfe8e8f5acc7e1cae filename: AdobeFontPackCx64_03292024.exe


(Додатково) / ACROBAIT, md5: df678ec9c97db5bcfe8e8f5acc7e1cae sha256: dc7b8a3b3d03ad01e05b807618d3a5556cf3f699b5cffc3133ef7e1bc9efdd17


(Додатково) / ROSEBLOOM, sha256: 01ebc558aa7028723bebd8301fd110d01cbd66d9a8b04685afd4f04f76e7b80c filename: AdobeFontPackage06192024_x64.exe


(Додатково) / ROSEBLOOM, md5: a41cd0977b7f57f35b958428433cebbd filename: AdobeFontPackage06192024_x64.exe


(Додатково) / ROSEBLOOM, md5: a41cd0977b7f57f35b958428433cebbd sha256: 01ebc558aa7028723bebd8301fd110d01cbd66d9a8b04685afd4f04f76e7b80c


(Додатково) / ROSETHORN, sha256: 846a7255eff6535d0e85c67a60712250df239a91c8b63df2073548d40434058c filename: utility.dll


(Додатково) / ROSETHORN, md5: c670c06ad6b01053ad5ec3f8f4d2ec12 filename: utility.dll


(Додатково) / ROSETHORN, md5: c670c06ad6b01053ad5ec3f8f4d2ec12 sha256: 846a7255eff6535d0e85c67a60712250df239a91c8b63df2073548d40434058c


Додатково


(Додатково) / легітимний ресурс звернути увагу якщо продукти ATERA не використовуються санкціоновано


filename: horizon.jsp


md5: 26a5a7e71a601be991073c78d513dee3


filename: Index_jsp$ProxyEndpoint$Attach.class


md5: 87c88f06a7464db2534bc78ec2b915de


filename: Index_jsp.class


md5: 6a9bc68c9bc5cefaf1880ae6ffb1d0ca


filename: Index_jsp.java


md5: 64454645a9a21510226ab29e01e76d39


filename: Index_jsp$ProxyEndpoint.class


md5: e2175f91ce3da2e8d46b0639e941e13f


filename: Index_jsp$ProxyEndpoint$1.class


md5: 9f89f069466b8b5c9bf25c9374a4daf8


filename: Index_jsp$ProxyEndpoint$2.class


md5: 187d6f2ed2c80f805461d9119a5878ac


filename: Nova_jsp.class


md5: ed7178cec90ed21644e669378b3a97ec


filename: Nova_jsp$TomcatListenerMemShellFromThread.class


md5: 5bf7560d0a638e34035f85cd3788e258


filename: Nova_jsp.java


md5: e02be0dc614523ddd7a28c9e9d500cff


SHA26 / Zip


XmSI.txt


Lnk File


cvnPCrQdkzwdMrWimioArHeGeMPPl.exe


Batch Script


Terminator.sys


adr.exe


main.exe


Malicious


Async RAT (via Pixeldrain)


Async RAT (via Pastebin)


Xworm (via Pastebin)


LockBit 3.0


admin.py


Fadmino.py


cadmino.py


VersionCheck.lua


Ransom note


LockBit builder config JSON


build.bat


keygen.exe


LockBit_NullBulge payload


Malicious BeamNG Mod


NOOPLDR Type1


NOOPLDR Type2


Sleipnir Browser


TradingView


AICoin


Signal


C&C


Other


address used for sending emails


BugSleep


RMM MSI


Archives


Lisa.pdf.zip, sha1: 00e0824e139e21fd6e41e2a34c1d6f598d7e4fbe sha256: 66d24e2081fcfe3ffdcf80e208553f32b088c7e863668ab3813ba980e1efbc2c


Lisa.pdf.zip, md5: ab9c3ef0b8bb1d68d819d569c8276af0 sha256: 66d24e2081fcfe3ffdcf80e208553f32b088c7e863668ab3813ba980e1efbc2c


Lisa.pdf.zip, md5: ab9c3ef0b8bb1d68d819d569c8276af0 sha1: 00e0824e139e21fd6e41e2a34c1d6f598d7e4fbe


Lisa.pdf.lnk, sha1: d4adb79a3809989569fb24aa43c947ef69b8aee1 sha256: 6d47ce1660eb54a31e7870b170605f9641ec97d756fb865f3a5e357649dc2041


Lisa.pdf.lnk, md5: 300b380bf870010f14bfeeeccbdc9729 sha256: 6d47ce1660eb54a31e7870b170605f9641ec97d756fb865f3a5e357649dc2041


Lisa.pdf.lnk, md5: 300b380bf870010f14bfeeeccbdc9729 sha1: d4adb79a3809989569fb24aa43c947ef69b8aee1


Jellyfish Loader, sha1: 9ff473df01487ca59d6426c8fddf77a1c27b2437 sha256: e654e97efb6214bea46874a49e173a3f8b40ef30fd0179b1797d14bcc2c2aa6c


Jellyfish Loader, md5: e577fa8e0491fe027bc4da86a01f64ea sha256: e654e97efb6214bea46874a49e173a3f8b40ef30fd0179b1797d14bcc2c2aa6c


Jellyfish Loader, md5: e577fa8e0491fe027bc4da86a01f64ea sha1: 9ff473df01487ca59d6426c8fddf77a1c27b2437


Gomir


MuddyRot related codes


Infrastructure / down


Windows Executable, sha1: 82c4739158099fe156aa1b23409c9bf5f96eb9d5 sha256: 35c75ba64f1658bd9442afa255b671e3fe9cb93ffb4821270074a85fca966c3f filename: ddos.exe


Windows Executable, md5: 214436a0c7623e84e8078a3b141b7d9c sha256: 35c75ba64f1658bd9442afa255b671e3fe9cb93ffb4821270074a85fca966c3f filename: ddos.exe


Windows Executable, md5: 214436a0c7623e84e8078a3b141b7d9c sha1: 82c4739158099fe156aa1b23409c9bf5f96eb9d5 filename: ddos.exe


Windows Executable, md5: 214436a0c7623e84e8078a3b141b7d9c sha1: 82c4739158099fe156aa1b23409c9bf5f96eb9d5 sha256: 35c75ba64f1658bd9442afa255b671e3fe9cb93ffb4821270074a85fca966c3f


Linux Binary, sha1: dc203816c0bb91614d270a129ac968ee45f1b7d2 sha256: bbbd97e1c525f811fbd16e2a48989cfa3e3164aa3b21824108dd3f8f5394bd7 filename: ddos_free


Linux Binary, md5: 4711b96b395c7ced1e0c2f2d0b1786c6 sha256: bbbd97e1c525f811fbd16e2a48989cfa3e3164aa3b21824108dd3f8f5394bd7 filename: ddos_free


Linux Binary, md5: 4711b96b395c7ced1e0c2f2d0b1786c6 sha1: dc203816c0bb91614d270a129ac968ee45f1b7d2 filename: ddos_free


Linux Binary, md5: 4711b96b395c7ced1e0c2f2d0b1786c6 sha1: dc203816c0bb91614d270a129ac968ee45f1b7d2 sha256: bbbd97e1c525f811fbd16e2a48989cfa3e3164aa3b21824108dd3f8f5394bd7


Technical specifications of the Car (technical specifications, colors, technology…).bat


brbad.bat


breakingbad.bat


breakingbad.msi


dejin.pdf


Documentt.zip


Document.zip


file.hta


Update Browser.bat


UpdateBrowser.msi


via us.txt.zip


ViaUs.txt.zip


Hosts Malware


Cloaking


Decoy site


Download


Atomic Stealer payload


Atomic Stealer C2


PDF


VBScript


AU3 script


DarkGate


filename: f1.bat


md5: d5e5980feb1906d85fbd2a5f2165baf7


filename: f2.bat


md5: 91acdfd491f3618bdb8d2af77452a760


filename: ntuser.dat


md5: d4eedad29418ca69303b00d5b80093fc


Generic


filename: TotalExec.ps1


md5: 26f3a62d205004fbc9c76330c1c71536


filename: AnyDesk.exe


md5: d9f15227fefb98ba69d98542fbe7e568


filename: Email


sha256: c5545d28faee14ed94d650bda28124743e2d7dacdefc8bf4ec5fc76f61756df3


Html


filename: HTA


sha256: 5c204217d48f2565990dfdf2269c26113bd14c204484d8f466fb873312da80cf


filename: PS


sha256: e9ad648589aa3e15ce61c6a3be4fc98429581be738792ed17a713b4980c9a4a2


ZIP


AutoIT script


filename: URL


domain: tuchinehd.com


sha256: 07594ba29d456e140a171cba12d8d9a2db8405755b81da063a425b1a8b50d073


EXE


Loader


Web shell


TellYouThePass


Clop


Suspected Clop


Warp AV Killer


CMiz


HQdI


pmqE


sha256: db029555a58199fa6d02cbc0a7d3f810ab837f1e73eb77ec63d5367fa772298b


domain: backup.sh


filename: db.exe


sha256: f037d0cc0a1dc30e92b292024ba531bd0385081716cb0acd9e140944de8d3089


hostctld


logrotate


sha256: 8cbec5881e770ecea451b248e7393dfcfc52f8fbb91d20c6e34392054490d039


domain: processlib2.so


sha256: 908d7443875f3e043e84504568263ec9c39c207ff398285e849a7b5f20304c21


domain: processlib.so


rbmx


sha256: a544d0ffd75918a4e46108db0ba112b7e95a88054ec628468876c7cf22c203a3


domain: recon.sh


sha256: 04fec439f2f08ec1ad8352859c46f865a6353a445410208a50aa638d93f49451


domain: remove_bg.sh


sha256: 5a35b7708846f96b3fb5876f7510357c602da67417e726c702ddf1ad2e71f813


domain: remove.sh


rfmx


rotate


sha256: 4dc790ef83397af9d9337d10d2e926d263654772a6584354865194a1b06ce305


domain: kp.sh


pk


FakeBat C2 server


Fake web browser updates


GoogleChrome[1]x86.msix Fake web browser updates


boci.ps1 Fake web browser updates


Social engineering schemes on social networks


Social engineering schemes on social networks, filename: http


Social engineering schemes on social networks, domain: utd-corts.com


Getmess.msix Social engineering schemes on social networks


ynwje.ps1 Social engineering schemes on social networks


Gսոa.UI3.Wіnfօrms / 2.0.4.8


AlgoTrading / 3.2.56


AlgoTrading / 3.2.57


AlgoTrading.Net / 5.0.164


Altcoins / 1.45.24


Altcoins / 1.45.25


Altcoins.Library / 2.12.5


AnimatedGifWpf / 2.1.0


AnimatedGifWpf / 2.0.2


AnimatedGifWpf / 2.0.8


AnimatedGifWpf / 2.0.3


AnimatedGifWpf / 2.0.9


AnimatedGifWpf / 2.0.5


AnimatedGifWpf / 2.1.1


AvalonEdit.Net / 8.3.0.91


AvalonEdit.Net / 8.3.0.93


AvalonEdit.Net / 8.4.0.96


AvalonEdit.Net / 8.3.0.92


AvalonEdit.Net / 6.3.0.90


AvalonEdit.Net / 8.3.0.90


AvalonEdit.Net / 8.3.0.94


AvalonEdit.Net / 8.4.0.95


Binance.Libary / 7.0.3


Binance.Libary / 3.8.8


Binance.Libary / 2.7.4


Binance.Libary / 1.6.0


Binance.Libary / 6.5.3


Binance.Libary / 0.8.7


Binance.Libary / 6.1.0


Binance.Libary / 0.2.1


Binance.Libary / 3.3.4


Binance.Libary / 6.0.3


Binance.Library / 0.6.1


BitcoinLib.Net / 1.5.3


BitcoinLib.Net / 2.2.7


BitcoinLib.Net / 3.4.1


BitcoinLib.Net / 4.2.0


BitcoinLib.Net / 4.4.2


BitcoinLib.Net / 4.5.2


BitcoinLib.Net / 4.7.6


BitcoinLib.Net / 7.0.6


BitcoinLib.Net / 7.7.6


BitcoinLib.Net / 8.6.8


Bunifu / 6.3.0


Bunifu / 6.3.1


Bunifu.GUI / 6.3.0


C1.Wіn / 6.0.20232.630


C1.Wіn / 6.0.20232.629


C1.Wіn / 6.0.20232.632


C1.Wіn / 6.0.20232.631


CaptchaCsharp / 7.0.0


CaptchaCsharp / 7.0.1


CefSharp.WinForm.Net.Core / 112.3.20


CefSharp.WinForm.Net.Core / 112.3.22


CefSharp.WinForm.Net.Core / 112.3.30


CefSharp.WinForm.Net.Core / 112.3.28


CefSharp.WinForm.Net.Core / 112.3.23


CefSharp.WinForm.Net.Core / 112.3.31


CefSharp.WinForm.Net.Core / 112.3.21


CefSharp.WinForm.Net.Core / 112.3.29


CitizenFX / 2.54.7


CitizenFX / 2.54.8


CitizenFX / 2.54.9


Clipboard.net / 1.45.69


Clipboard.net / 1.45.67


Clipboard.net / 1.45.70


Crypto.Exchange / 6.3.5


Crypto.Exchange / 6.2.4


Crypto.Exchange / 6.2.1


Crypto.Exchange / 6.2.2


Crypto.Exchange / 6.3.4


CsvHelper.Excel.Core.Net / 8.7.0


CsvHelper.Excel.Core.Net / 0.8.2


CsvHelper.Excel.Core.Net / 7.3.3


CsvHelper.Excel.Core.Net / 1.7.4


CsvHelper.Excel.Core.Net / 1.4.3


CsvHelper.Excel.Core.Net / 5.3.0


CsvHelper.Excel.Core.Net / 7.6.3


CsvHelper.Excel.Core.Net / 0.3.5


CsvHelper.Excel.Core.Net / 0.1.7


CsvHelper.Excel.Core.Net / 8.8.7


DiscordRPC.Net.Core / 3.45.7


DiscordRPC.Net.Core / 3.45.8


DiscordRPC.Net.Core / 5.4.67


DiscordRPC.Net.Core / 3.45.9


DiscordRPC.Net.Core / 5.4.68


dnlib.net / 4.3.7


dnlib.net / 4.3.0


dnlib.net / 4.3.1


dnlib.net / 4.3.2


dnlib.net / 4.3.3


dnlib.net / 4.3.4


dnlib.net / 4.3.5


dnlib.net / 4.3.8


dnlib.net / 4.4.0


dnlib.net / 4.4.2


dnlib.net / 4.4.1


dnlib.net / 4.3.6


Fluentmail.Smtp / 4.5.78


Gunа.GUI / 3.0.4.8


Gunа.GUI / 3.0.4.9


Gunа.GUI / 2.0.4.6


Gunа.GUI / 3.0.4.7


HarmonyX.Net / 1.23.7


HarmonyX.Net / 1.23.6


HarmonyX.Net / 1.23.5


KeyAuthAPI / 1.2.56


Lib.Harmony.net / 1.1.7


Lib.Harmony.net / 1.3.1


Lib.Harmony.net / 1.3.3


Lib.Harmony.net / 1.8.9


Lib.Harmony.net / 4.5.1


Lib.Harmony.net / 4.8.6


Lib.Harmony.net / 5.5.9


Lib.Harmony.net / 7.5.3


Lib.Harmony.net / 7.6.6


Lib.Harmony.net / 8.5.7


Litecoin / 12.56.75


Litecoin / 12.56.74


Mail / 2.5.8


Mail / 2.6.0


Mail / 2.5.9


Merger / 4.2.6


Nemesis.Essentials.Net / 1.3.4


Nemesis.Essentials.Net / 2.1.8


Nemesis.Essentials.Net / 2.2.7


Nemesis.Essentials.Net / 2.4.3


Nemesis.Essentials.Net / 4.6.3


Nemesis.Essentials.Net / 6.7.1


Nemesis.Essentials.Net / 6.8.8


Nemesis.Essentials.Net / 7.5.3


Nemesis.Essentials.Net / 8.3.7


Nemesis.Essentials.Net / 8.7.7


NotifyIcon.Net / 1.1.0


NotifyIcon.Net / 1.1.1


NotifyIcon.Net / 1.1.2


NotifyIcons / 4.6.3


NotifyIcons / 4.6.4


NotifyIcons / 4.6.5


OtpCsharp / 2.1.0


OtpCsharp / 2.1.1


Pathoschild.Stardew.ModBuildConfig.Net / 4.8.8


Pathoschild.Stardew.ModBuildConfig.Net / 4.4.8


Pathoschild.Stardew.ModBuildConfig.Net / 6.4.8


Pathoschild.Stardew.ModBuildConfig.Net / 9.6.9


Pathoschild.Stardew.ModBuildConfig.Net / 6.2.6


Pathoschild.Stardew.ModBuildConfig.Net / 1.4.7


Pathoschild.Stardew.ModBuildConfig.Net / 9.2.9


Pathoschild.Stardew.ModBuildConfig.Net / 1.5.6


Pathoschild.Stardew.ModBuildConfig.Net / 5.1.3


Pathoschild.Stardew.ModBuildConfig.Net / 2.1.9


PayPalMerchant.SDK / 45.51.1


PayPalMerchant.SDK / 45.40.7


PayPalMerchant.SDK / 45.51.0


PayPalMerchant.SDK / 2.16.250


PayPalMerchant.SDK / 3.40.0


PayPalMerchant.SDK / 45.40.6


PayPalMerchant.SDK / 45.40.8


PayPalMerchant.SDK / 45.41.0


PayPalMerchant.SDK / 45.40.9


Portable.Xaml.Net / 1.0.4


Portable.Xaml.Net / 1.0.3


Portable.Xaml.Net / 1.0.1


Portable.Xaml.Net / 1.0.0


Portable.Xaml.Net / 1.0.2


Portable.Xaml.Net / 1.0.5


ppy.osu.Game.Lib / 3.5.1


ppy.osu.Game.Lib / 4.1.4


ppy.osu.Game.Lib / 4.6.6


ppy.osu.Game.Lib / 8.0.2


ppy.osu.Game.Lib / 7.7.4


ppy.osu.Game.Lib / 6.4.2


ppy.osu.Game.Lib / 5.7.8


ppy.osu.Game.Lib / 5.1.7


ppy.osu.Game.Lib / 5.3.5


ppy.osu.Game.Lib / 2.4.4


psbuiId / 1.1.1-beta


PubIishIgnore / 1.0.11-beta


PublishIgnor / 1.0.11-beta


Reddit.api / 2.3.8


Reddit.api / 3.2.4


Reddit.api / 3.2.8


Reddit.api / 4.4.3


Reddit.api / 6.9.3


Reddit.api / 7.6.6


Reddit.api / 7.7.4


Reddit.api / 8.8.4


Reddit.api / 8.8.6


Reddit.api / 9.3.3


Reothor.Lab.EvilPackage / 2.0.1


Reothor.Lab.EvilPackage / 2.0.0


Reothor.Lab.EvilPackage / 4.4.4.4


Reothor.Lab.EvilPackage / 1.3.3.7


Reothor.Lab.EvilPackage / 200.0.0


Reothor.Lab.EvilPackage / 4.4.5.5


Reothor.Lab.EvilPackage / 100.0.0


Rg.Plugins.Popups.Net / 3.4.0


Rimworld.References.Net / 1.8.2


Rimworld.References.Net / 4.3.0


Rimworld.References.Net / 0.1.3


Rimworld.References.Net / 7.5.0


Rimworld.References.Net / 2.5.0


Rimworld.References.Net / 1.0.6


Rimworld.References.Net / 1.6.2


Rimworld.References.Net / 8.5.0


Rimworld.References.Net / 4.1.2


Rimworld.References.Net / 6.4.6


Sanka.UI2.WinForms / 0.1.5


Sanka.UI2.WinForms / 0.1.6


Sanka.UI2.WinForms / 0.1.8


Sanka.UI2.WinForms / 0.1.7


Sanka.UI3.WinForms / 3.7.9.6


Sanka.UI3.WinForms / 3.8.9.6


Shade.UI.WinForms / 1.7.3.6


Shade.UI.WinForms / 1.7.3.5


Shade.UI.WinForms / 1.7.3.4


Shade.WPF.Controls / 1.46.6


Shade.WPF.Controls / 1.46.7


Soenneker.Redis.Util.Net / 1.3.4


Soenneker.Redis.Util.Net / 1.4.5


Soenneker.Redis.Util.Net / 1.6.9


Soenneker.Redis.Util.Net / 1.7.6


Soenneker.Redis.Util.Net / 2.1.3


Soenneker.Redis.Util.Net / 2.2.7


Soenneker.Redis.Util.Net / 2.5.6


Soenneker.Redis.Util.Net / 2.6.7


Soenneker.Redis.Util.Net / 3.2.9


Soenneker.Redis.Util.Net / 3.3.1


Soenneker.Redis.Util.Net / 3.3.5


Soenneker.Redis.Util.Net / 3.4.5


Soenneker.Redis.Util.Net / 3.6.7


Soenneker.Redis.Util.Net / 3.7.2


Soenneker.Redis.Util.Net / 4.2.4


Soenneker.Redis.Util.Net / 4.4.3


Soenneker.Redis.Util.Net / 4.5.8


Soenneker.Redis.Util.Net / 4.8.8


Soenneker.Redis.Util.Net / 5.5.4


Soenneker.Redis.Util.Net / 5.6.2


Soenneker.Redis.Util.Net / 5.6.6


Soenneker.Redis.Util.Net / 5.7.3


Soenneker.Redis.Util.Net / 5.8.6


Soenneker.Redis.Util.Net / 6.2.3


Soenneker.Redis.Util.Net / 6.3.4


Soenneker.Redis.Util.Net / 6.4.5


Soenneker.Redis.Util.Net / 6.5.7


Soenneker.Redis.Util.Net / 7.1.4


Soenneker.Redis.Util.Net / 7.1.6


Soenneker.Redis.Util.Net / 7.3.9


Soenneker.Redis.Util.Net / 7.4.2


Soenneker.Redis.Util.Net / 7.5.1


Soenneker.Redis.Util.Net / 7.7.2


Soenneker.Redis.Util.Net / 8.1.9


Soenneker.Redis.Util.Net / 8.2.5


Soenneker.Redis.Util.Net / 8.7.5


Soenneker.Redis.Util.Net / 8.8.4


Soenneker.Redis.Util.Net / 8.9.5


Soenneker.Redis.Util.Net / 9.1.4


Soenneker.Redis.Util.Net / 9.3.4


Soenneker.Redis.Util.Net / 9.7.6


Soenneker.Redis.Util.Net / 9.8.9


Solana / 34.66.21


Solana / 34.66.22


TheOpenAI.API / 1.0.2


TheOpenAI.API / 1.0.1


TheOpenAI.API / 1.0.0


TheOpenAI.API / 1.1.4


TheOpenAI.API / 1.1.5


TheOpenAI.API / 1.0.3


TheOpenAI.API / 1.1.3


Ultimate.Wpf.Toolkit / 4.6.0


Ultimate.Wpf.Toolkit / 4.6.1


Whatsapp.API / 1.8.6


Whatsapp.API / 3.5.9


Whatsapp.API / 4.2.3


Whatsapp.API / 5.8.7


Whatsapp.API / 6.3.7


Whatsapp.API / 6.5.6


Whatsapp.API / 6.6.5


Whatsapp.API / 8.4.2


Whatsapp.API / 8.6.4


Whatsapp.API / 9.6.7


Winforms / 3.56.6


Winforms / 3.56.7


Zendesk-Api / 12.58.0


Zendesk-Api / 12.57.8


Zendesk-Api / 12.57.9


MoonWalk backdoor (related to DodgeBox loader with d72f202c1d684c9a19f075290a60920f)


Utility plugin


C2 plugin


MoonWalk backdoor (related to DodgeBox loader with 393065ef9754e3f39b24b2d1051eab61)


NetScan


Advanced Scanner


WinRAR


OpenSSH


AnyDesk


WinSCP


File


Domains


HTML Smuggling Malicious Attachment


Link to HTML Smuggling Blog Post


ZIP archive containing DodgeBox samples, filename: Music.zip


ZIP archive containing DodgeBox samples, md5: 0d068b6d0523f069d1ada59c12891c4a


Original Sandboxie signed binary, filename: taskhost.exe


Original Sandboxie signed binary, md5: b3067f382d70705d4c8f6977a7d7bee4


DodgeBox DLL sideloaded by taskhost.exe, filename: Sbiedll.dll


DodgeBox DLL sideloaded by taskhost.exe, md5: d72f202c1d684c9a19f075290a60920f


Encrypted payload DLL that decrypts to the MoonWalk backdoor, filename: Sbiedll.dat


Encrypted payload DLL that decrypts to the MoonWalk backdoor, md5: 294cc02db5a122e3a1bc4f07997956da


DodgeBox DLL which is sideloaded by an undetermined AhnLab executable, filename: Atstrust.dll


DodgeBox DLL which is sideloaded by an undetermined AhnLab executable, md5: 393065ef9754e3f39b24b2d1051eab61


Encrypted payload DLL that decrypts the MoonWalk backdoor, filename: Atstrust.dat


Encrypted payload DLL that decrypts the MoonWalk backdoor, md5: bcac2cbda36019776d7861f12d9b59c4


2024 StealthVector loader, filename: AppRouted.dll


2024 StealthVector loader, md5: f062183da590aba5e911d2392bc29181


Encrypted shellcode and payload DLL that decrypts to CobaltStrike, filename: AppRouteing.dll


Encrypted shellcode and payload DLL that decrypts to CobaltStrike, md5: 4141c4b827ff67c180096ff5f2cc1474


2024 StealthVector loader, filename: N/A


2024 StealthVector loader, md5: bc85062de0f70afd44bb072b0b71a8cc


2024 StealthVector loader, filename: mscms.dll


2024 StealthVector loader, md5: 72070b165d1f11bd4d009a81bf28a3e5


2024 StealthVector loader, filename: roboform-x64.dll


2024 StealthVector loader, md5: f0953ed4a679b987a2da955788737602


Malicious shell script


Redtail packed ELF


Redtail unpacked ELF


observed trying to exploit CVE-2024-4577


Downloader


C2 servers


VideoVLC_subtitles.exe MD5s


RM.TXT MD5s


Business Secrets from the Bible – Rabbi Daniel Lapin.LNK MD5s


worldofprocure.rar MD5s


NTUSER.vbs{428f9636-1254-e23e3-ada2-03427pie22}.TM.vbs MD5s


C&C Server


Download


filename: DC.exe


sha1: cb704d2e8df80fd3500a5b817966dc262d80ddb8


filename: DC.ini


sha1: 2c56e9beea9f0801e0110a7dc5549b4fa0661362


filename: Svchost.exe


sha1: 5e460a517f0579b831b09ec99ef158ac0dd3d4fa


filename: LB3.exe


sha1: 107ec3a7ed7ad908774ad18e3e03d4b999d4690c


C2 Servers


address -Likely malicious SMB Server address Likely malicious SMB Server


Likely malicious SMB Server


Phishing Attachment


The malware then connects to the initial C2 server, which is a GitHub page


Alternatively, instead of connecting to GitHub, CloudSorcerer also tries to get the same data from this


CloudSorcerer C2


Muse


FakeLockBit 3.0


Dark Race


DoNex


ZIP / Malware Delivery


DLL / NIM Loader + Coyote banking Trojan


Recently active malicious Coyote C2’s


RAR Archive


Loader Binary


Batch File (E3D0.bat)


Dropped Powershell script (powershell.ps1)


Builder (main.exe)


Kematian.bin


Intrusion and infection


file /<computed string encoded ID>.jsp


Conclusion


Description Origin of the malicious lnk file's package


Malicious LNK from this campaign


C&C Server


C2 Server likely associated with SystemBC


Probable Exfiltration Server


C2 Server likely associated with Cobalt Strike


Possible C2 Infrastructure


Possible Exfiltration Server Not inherently malicious associated with MEGA file storage


MD5s / Gh0st RAT (2345.exe)


MD5s / Gh0st RAT (systeminfo.exe)


MD5s / PlugX Loader (Roboform.dll)


MD5s / PlugX (Encoded) (WindowsWatcher.key)


MD5s / GoThief (conost.exe)


C&C Servers / Gh0st RAT


C&C Servers


C&C Servers / GoThief


Download / Gh0st RAT


Download / PlugX Loader


Download / PlugX (Encoded)


Download / GoThief


Communication for victims


Data Leak Site


Gh0st RAT (2345.exe)


Gh0st RAT (systeminfo.exe)


PlugX Loader (Roboform.dll)


PlugX (Encoded) (WindowsWatcher.key)


GoThief (conost.exe)


Gh0st RAT


GoThief


PlugX Loader


PlugX (Encoded)


ScreenConnect samples related to the instance that is controlled by threat actors


filename: uy5a7ykit5s7xs7isi9i.exe


md5: 6bdba391a77bb67cb5aaae203d061ea8


filename: Industries.cmd


md5: 3f8ca557d51e210952bdd7180cb33d10


filename: Lay.pif


md5: b06e67f9767e5023892d9698703ad098


Files: / B.au3


filename: Webserver.py


md5: 3dde1507996cf8c3dd53a726501be33b


Eldorado (32-bit windows)


Eldorado (64-bit windows)


Eldorado (32-bit linux)


Eldorado (64-bit linux)


URL's


GoogleChrome-x86.msix URL's


boci.ps1 URL's


2024-05-01T00:00:00Z / 2049-04-25T00:00:00Z


2024-04-01T00:00:00Z / 2049-04-25T00:00:00Z


2024-05-01T00:00:00Z / 2049-05-29T00:00:00Z


2024-05-01T00:00:00Z / 2049-05-28T00:00:00Z


2024-05-01T00:00:00Z / 2049-06-05T00:00:00Z


Open Directory Address


Python Script


run.py


fuzz.py


bp.py


burp.py


Trojan-Downloader ( 005a4e961 ), filename: Loader


Trojan-Downloader ( 005a4e961 ), md5: 02f3b7596cff59b0a04fd2b0676bc395


Trojan-Downloader ( 005a4e921 ), filename: 584A.bat


Trojan-Downloader ( 005a4e921 ), md5: d2ea85153d712cce3ea2abd1a593a028


Trojan ( 0001140e1 ), filename: PowerShell.ps1


Trojan ( 0001140e1 ), md5: a3619b0a3ee7b7138cefb9f7e896f168


Trojan ( 005ae5411 ), filename: Main.exe


Trojan ( 005ae5411 ), md5: e06f672815b89458c03d297db99e9f6b


Trojan ( 00597b5e1 ), filename: Injection.js


Trojan ( 00597b5e1 ), md5: 1cbbfbc69bd8fa712b037ebe37e87709


Modified ERP update program past case (ClientUpdater.exe)


HotCroissant Past Case (***Kor.exe)


Modified ERP update program latest case (ClientUpdater.exe)


XcLoader (XcExecutor.exe)


XcLoader (icsvcext.dll)


XcLoader (settings.lock)


XcLoader (test.exe)


XcLoader (onedrive.dll)


Xctdoor (******.***.Common.RegEx.dll)


C&C Server / HotCroissant


C&C Server / Xctdoor


Download / HotCroissant


Stage 1


Stage 2


Stage 3


Main payload


UserName


Unknown macOS malware payload delivery


Unknown macOS malware payload delivery host


Unknown macOS malware botnet C2


Unknown macOS malware botnet C2 server


agov-zugriff: ab juli 2024 für alle öffentlichen online-dienste obligatorisch

Malspam subject


Malspam sending


Sending address


sender


Unknown macOS malware, sha1: 8800bb6633bb313d6e10058e7f4736336276b2e5 sha256: 474ee78c6636ee478ea7f4521559679fbc468bb326357737bfc465e63ed153fa filename: AGOV-Access.dmg


Unknown macOS malware, md5: bb8911f632a4547802a8dbb40268e1bd sha256: 474ee78c6636ee478ea7f4521559679fbc468bb326357737bfc465e63ed153fa filename: AGOV-Access.dmg


Unknown macOS malware, md5: bb8911f632a4547802a8dbb40268e1bd sha1: 8800bb6633bb313d6e10058e7f4736336276b2e5 filename: AGOV-Access.dmg


Unknown macOS malware, md5: bb8911f632a4547802a8dbb40268e1bd sha1: 8800bb6633bb313d6e10058e7f4736336276b2e5 sha256: 474ee78c6636ee478ea7f4521559679fbc468bb326357737bfc465e63ed153fa


Virtual Hard Disk file


HTA Stager


First-stage Nim downloader


Donut and Sliver


NIM downloader target


VHD distribution site


VHD distribution sit


Staging server


Sliver C2


Related infrastructure


Related infrastructur


strings: / $pdb_path ascii


strings: / $code ascii


PowerShell script (tys.txt)


TRANSLATEXT (GoogleTranslate.crx)


PowerShell script download


Script download


C2 domain to exfiltrate data


Blog for dead drop resolver


Threat actor’s GitHub


CMD file


The official that was serving malicious installers


C2 IPv4 address hosting an SFTP server


Trojanized installer package, filename: NotezillaSetup.exe


Trojanized installer package, sha256: 6f49756749d175058f15d5f3c80c8a7d46e80ec3e5eb9fb31f4346abdb72a0e7


Trojanized installer package, filename: NotezillaSetup32.exe


Trojanized installer package, sha256: bfa99c41aecc814de5b9eb8397a27e516c8b0a4e31edd9ed1304da6c996b4aaa


Trojanized installer package, filename: CopywhizSetup.exe


Trojanized installer package, sha256: 2eae4f06f2c376c6206c632ac93f4e8c4b3e0e63eca3118e883f8ac479b2f852


Trojanized installer package, filename: CopywhizSetup32.exe


Trojanized installer package, sha256: 048cae10558cddfb2cf0ade25f1101909bba58d0a448e0d78590cc5e64e95127


Trojanized installer package, filename: RecentXSetup.exe


Trojanized installer package, sha256: 4df9b7da9590990230ed2ab9b4c3d399cf770ed7f6c36a8a10285375fd5a292f


Trojanized installer package, filename: RecentXSetup32.exe


Trojanized installer package, sha256: ebf2b84ed64629242f8d0abfca73344736205249539474e8f57d1d3dbe8ccc41


Batch script that coordinates execution of other payloads and performs exfiltration of stolen data, filename: dllBus.bat


Batch script that coordinates execution of other payloads and performs exfiltration of stolen data, sha256: 1fa84b696b055f614ccd4640b724d90ccad4afc035358822224a02a9e2c12846


Used to create a scheduled task for persistence, filename: dllCrt.xml


Used to create a scheduled task for persistence, sha256: cdc1f2430681e9278b3f738ed74954c4366b8eff52c937f185d760c1bbba2f1d


Executes dllCrt.bat, filename: dllCrt32.exe


Executes dllCrt.bat, sha256: fdc84cb0845f87a39b29027d6433f4a1bbd8c5b808280235cf867a6b0b7a91eb


Creates a scheduled task using dllCrt.xml, filename: dllCrt.bat


Creates a scheduled task using dllCrt.xml, sha256: a89953915eabe5c4897e414e73f28c300472298a6a8c055fcc956c61c875fd96


Executes dllBus.bat with multiple command line arguments, filename: dllBus32.exe


Executes dllBus.bat with multiple command line arguments, sha256: 70bce9c228aacbdadaaf18596c0eb308c102382d04632b01b826e9db96210093


Encrypted archive that contains the payloads dllTemp32.exe and dllCache32.exe, filename: Apps.zip


Encrypted archive that contains the payloads dllTemp32.exe and dllCache32.exe, sha256: ca6ff18ee006e7ab3cb42fc541b08ce4231dadfab0cce57b1c126db3df9f1297


Steals data from the clipboard during execution, filename: dllTemp32.exe


Steals data from the clipboard during execution, sha256: 33e4d5eed3527c269467eec2ac57ae94ae34fd1d0a145505a29c51cf8e83f1b9


Logs keystrokes during execution, filename: dllCache32.exe


Logs keystrokes during execution, sha256: 03761d9fd24a2530b386c07bf886350ae497e693440a9319903072b93a30c82d


Encrypted archive that contains dllChrome32.exe, filename: Updt.zip


Encrypted archive that contains dllChrome32.exe, sha256: 6487a0dc9dfbbaa6557af096178a1361e49762a41500aa03f17df5d3b159bf4e


Decrypts and dumps credentials from the Google Chrome database if present, filename: dllChrome32.exe


Decrypts and dumps credentials from the Google Chrome database if present, sha256: de4e03288071cdebe5c26913888b135fb2424132856cc892baea9792d6c66249


Google ad


Decoy site


Download


Payload


C2 server


Initial attachment, filename: Application Form & Brochure.zip


Initial attachment, sha256: 8f609f60dd82dc13878b1d82ebc56e5056cb9274234df1510ee737e62ba22aaa


Decoy pdf, filename: Application Form.pdf


Decoy pdf, sha256: 90f7d3f354a1637d7467962fe87449532881d06ed76acaae696cc286cba02de7


Decoy docx, filename: Housing Project Brochure.docx


Decoy docx, sha256: d7cf1c4dfcb10f1ad533413f419e6dd467783f82a87d6c309ba9a213457e035c


UPX-packed ELF binary, filename: Password


UPX-packed ELF binary, sha256: a074d391d575f6628fba3a90adb4673ea189512b55e7980d74fd816e354e10cb


Password (unpacked) / upx -d unpack command


1VXY76hUXaWcXQBdbUZYjVhOHmI6fOUHV, filename: 8e59936cd5b69eed2241866384915427e576158331a3a67fa50ca6fc1b129a99


1VXY76hUXaWcXQBdbUZYjVhOHmI6fOUHV, sha256: ca34d4fdc48bc2f17b45af97d0cf2ce69913532b9b27a7ed97ee2e5b42540e4e


1dlI8jSabaeJT1MnQxiih0Ww-hZrG-GAe, filename: BID2.txt


1dlI8jSabaeJT1MnQxiih0Ww-hZrG-GAe, sha256: bebe490aec13b6d84f56250c0f6f9d9f10bc0ba0ae42316407d49b87217b63fc


1XvW8ir8l0G9axv4lhEvQFOxOyzmMV64t, filename: GID2.txt


1XvW8ir8l0G9axv4lhEvQFOxOyzmMV64t, sha256: d8b8116c5e9a14983c275444dc3a251cdad09f9d56e6c121749269c24bf691a9


1btUsB3nWehTNW8Cho9Wv3Efrt4c6EhI_, filename: GTK-Theme-Parse.txt


1btUsB3nWehTNW8Cho9Wv3Efrt4c6EhI_, sha256: ae59ba12ec6a42ee5b08c3e2ce91ec02071b2f5ad9338e3a19d690bd68acb860


home/hackerex/Desktop/Golang_Dev/Discord/14/New file testing/Password.go


not upx packed, filename: India_Emerging_Global_Economy


not upx packed, sha256: 44504a847b36d8c76dbe9e1bdc63fd7e4cac41fa93f392317abfcabdbb6044de


bash control script


elf


base64 → bzip → bash script / GTK-Theme-Parse.txt


base64 elf


decoy PDF


channel id


bzip’d bash / GTK-Theme-Parse.txt


bot ID


bot token


see blackberry & volexity posts


InnoLoader C2


InnoLoader C2 / and more


BAT


MSI


Script, Lu0bot


DLL, StealC


TXT, StealC


C2 / BAT


C2 / Lu0bot


C2 / StealC


legacyreact-aws-s3-typescript / 1.1.5


legacyreact-aws-s3-typescript / 1.1.6


legacyreact-aws-s3-typescript / 1.1.7


legacyreact-aws-s3-typescript / 1.2.1


legacyreact-aws-s3-typescript / 1.2.2


legacyreact-aws-s3-typescript / 1.2.4


RisePro Binary (Selection), filename: PE/EXE


RisePro Binary (Selection), sha256: 2229327fa653ffd07f11773ee22eb00e580b6824ce122a1e788f19859aa9dca2


RisePro Binary (Selection), sha256: 5e1a1b2e2c20bc50b54e02393fa6f26a2b8c2f4d87f2abdecaca73472b5c5dba


RisePro Binary (Selection), sha256: a36d5e790ca17fb6f70884942d868d29c6854054f2db79ed8f4e2d0d16ef1647


RisePro Binary (Selection), sha256: 4f0e839393df72db99a05ade0848979ff375399b104e59a7cc3847d746c17e5c


RisePro Binary (Selection), sha256: 56108c707fcaf87b2220c081db115171ff35811946b3ad2d76105715e8530fbe


RisePro Binary (Selection), sha256: b4ad80860c773c79c946c3a4df13e534153bd17ceebad6acedac3156dfe0144c


RisePro Binary (Selection), sha256: 77e97faca59d8de34ddc7272791efac41da9ff5b7b175a99e09a255e2701d725


RisePro Binary (Selection), sha256: a78513831b47f4b35ee9063aa167bf5d05c61559b2ac7f8fb93fa966a36e34d2


RisePro Binary (Selection), sha256: 30baf54d50379893b23b24203611da331d436dfc35f2d0a805bac4da0d310489


RisePro Binary (Selection), sha256: c48eb226b641b382fd4155f10c96aacc585c6e65814865cd762e88b8a5cffd14


RisePro Binary (Selection), sha256: 6b82e6f228cbb8143b68e1739f3d083cf6ab0ba9c202ce1ec769bb12c9030619


RisePro Binary (Selection), sha256: 5719a862d5a32ec56328f8e066a83b6b0577a6965074ca671d0cecce681d5f79


RisePro Binary (Selection), sha256: 9d540839e75daf4f31eb36271fef6eb16a913446384d07e4d8dbb2602f18bf0f


RisePro Binary (Selection), sha256: 15dfbd2df433c9725239d6602bdfc56d00db62f88a1769a534d98cad50536c27


RisePro Binary (Selection), sha256: c7a40fb4aa017a0d17b535c1857d51f95b7ed8684a1ea860294bf5d897667839


RisePro Binary (Selection), sha256: 6113bc3f3f972393acff5022f5ba95fb96c3d9038386ada49ccf244fa5f885fa


RisePro Binary (Selection), filename: PE/EXE


RisePro Binary (Selection), sha256: ce930238a02a55d7b6f13fdf9b3306de61c5c25513ed396c7e9a8dbd4c45dbd9


RisePro Binary (Selection), sha256: 19c98cba0d8037a36b00d2c11cc24d25e1f388ba5093a4b6e9017508371fb34b


RisePro Binary (Selection), sha256: d2cbb7a5ef2ecdf7c6f8c965df5886a18ea0e630009cdedb3692ed1b8c77b487


RisePro Binary (Selection), sha256: 078b3f37483cfc697fbd67120311e6109843804f5cae9c46f04fa1b51ba7120a


RisePro Binary (Selection), sha256: d435d7cf9077533a7c23129a8d7462e7596505e3990664dd5888fce40652bb14


RisePro Binary (Selection), sha256: d7c3c01d62fb59e186b2256894fb089c01e1aeda5dbd86a3004f1857a13313ad


RisePro Binary (Selection), sha256: 0d5bb8b8da18abd1f3934103c501abf9b9cd3a6e1656853359a568dca3229765


RisePro Binary (Selection), sha256: cb21be437c800875400a94b2442bbe02ccaf31ee49e1f440aac378fc2b0b756d


RisePro Binary (Selection), sha256: f87dd2b6a63e850b6c2128ec139c6334b572b1c80698fcc30de6f39ffc788f4f


Recently active RisePro C2


Geolocation Services utilized by RisePro


Example of secondary downloads via “Send Loader Config”


Tsunami


PwnRig


Russia Yamalo-Nenetskiy avtonomnyy okrug Pangody AS50916 CityLink Ltd


France Hauts-de-France Roubaix AS16276 OVH SAS


Canada Quebec Montreal AS16276 OVH SAS


NewCopy.xlsx.lnk


Malware download


Pkg.zip


Python DLL


vmtcuv.vbs


XWorm


ZIP


Відомості про кредитора.dvs. lnk


sud.exe


C&C


LNK shortcut


reputation.printer.garmin / Trojan ( 005a5d9c1 )


Tsunami


PwnRig


main


bash


miner


rsagen


Download server for rsagen


Mining pool 1


Mining pool 2


Mining pool 3


- Possible malicious used by attacker during cloud account compromise


Probable malicious used by attacker during cloud account compromise


Credential harvesting endpoint / Endpoint


First Attack Case / WebShell woanware (1.aspx)


First Attack Case / WebShell woanware (2.aspx)


First Attack Case / WebShell Chopper (2a.aspx)


First Attack Case / WebShell Behinder (32.aspx)


First Attack Case / WebShell Behinder (1234a.aspx)


First Attack Case / WebShell Behinder (1235a.aspx)


First Attack Case / WebShell Behinder (12345a.aspx)


First Attack Case / BadPotato (bad1231.exe)


First Attack Case / Cpolar (cpolar.exe)


First Attack Case / Runner (1.bat)


First Attack Case / ScheduleTask (1.xml)


First Attack Case / NSSM (service.exe)


First Attack Case / CoinMiner downloader (svchost.exe)


First Attack Case / CoinMiner downloader (sihost.exe)


First Attack Case / CoinMiner (SecurityHealthServices.exe)


First Attack Case / WebShell ASPXspy (aspx.txt)


First Attack Case / WebShell ASPXspy (good.txt)


First Attack Case / WebShell Caidao (index.txt)


First Attack Case / BadPotato (bad.exe)


First Attack Case / BadPotato (bad520.exe)


First Attack Case / GodPotato (god3.exe)


First Attack Case / GodPotato (god4.exe)


First Attack Case / PrintNotifyPotato (P2.exe)


First Attack Case / PrintNotifyPotato (P4.exe)


First Attack Case / IIS LPE (iislpe.exe)


First Attack Case / IIS LPE (iislpe1.exe)


First Attack Case / Cpolar (cpo.exe)


First Attack Case / Frpc (F.exe)


First Attack Case / Frpc (frpc.exe)


First Attack Case / Frpc Config (frpc.txt)


First Attack Case / Lcx (99.exe)


First Attack Case / Lcx (Lcx.exe)


First Attack Case / UserAdder (UserAdd.exe)


First Attack Case / UserAdder Command (net.txt)


First Attack Case / UserAdder Command (useradd.bat)


Second Attack Case / WebShell Chopper (zbngjv.aspx)


Second Attack Case / WebShell Chopper (bin.aspx)


Second Attack Case / WebShell Godzilla (aaa.ashx)


Second Attack Case / WebShell Godzilla (aaa.asmx)


Second Attack Case / WebShell awen (cmd.aspx)


Second Attack Case / WebShell Behinder (hi1.aspx)


Second Attack Case / WebShell Deleter (sklqbpbl.aspx)


Second Attack Case / Privilege escalation tool CVE-2021-1732 (aa.aspx)


Second Attack Case / Fscan (fscan.exe)


Second Attack Case / NetCat (nc.exe)


Second Attack Case / NetCat (nc64.exe)


Second Attack Case / EarthWorm (ew.exe)


Second Attack Case / Ladon (11.exe)


Second Attack Case / RingQ (ringq.exe)


Second Attack Case / CoinMiner downloader (gzrqo.aspx)


Second Attack Case / CoinMiner (aspx.exe)


C&C Server / NetCat


C&C Server / Frpc


Download / CoinMiner


Download / PrintNotifyPotato


Download / Privilege escalation tool CVE-2021-1732


Download / Fscan


Download / EarthWorm


Download / Ladon


Download / RingQ


$ polyswarm link list -f DISGOMOJI


filename: Щодо_притягення_до_адміністративної_відповідальності.xhtml


Щодо_притягення_до_адміністративної_відповідальності.xhtml

sha256: 5cf828715c004f42eea066b4935511ecb42a4e150235faee482b06904af83cc7


filename: 03.05.2024.rar


sha256: 40f3e18c474e02c71620c611e2e3827793d7f07d26cc49396be500baa37dc872


filename: Матеріали щодо притягення до адміністративної відповідальності осіб за статтею 173-2 КУпАП.lnk

(Materials on bringing persons to administrative responsibility under Article 173-2 of the Code of Administrative Offenses.lnk)


Матеріали щодо притягення до адміністративної відповідальності осіб за статтею 173-2 КУпАП.lnk

(Materials on bringing persons to administrative responsibility under Article 173-2 of the Code of Administrative Offenses.lnk)

sha256: 21623210a29df18c000dbf3fcc5bb4885e8a03915f47b152a93a07f66eb2e90f


Sheridan Wyoming US


San Jose California US


Boydton Virginia US


(Dallas Texas US) the main VPS used in the attack which was taken down on our request


Chicago Illinois US


Ada Ohio US


Washington Virginia US


Simple indicator of observable {c1bba723f79282dceed4b8c40123c72a5dfcf4e3ff7dd48db8cb6c8772b60b88}


Simple indicator of observable {4cb575bc114d39f8f1e66d6e7c453987639289a28cd83a7d802744cd99087fd7}


Simple indicator of observable {14bcb7196143fd2b800385e9b32cfacd837007b0face71a73b546b53310258bb}


Freenom / Form stealing JS C2


30.06.2022 / CNOBIN INFORMATION TECHNOLOGY LIMITED / Form stealing JS C2


30.06.2022 / CNOBIN INFORMATION TECHNOLOGY LIMITED / BeEF-based malware delivery platform C2


14.07.2023 / CNOBIN INFORMATION TECHNOLOGY LIMITED / Landing page / File storage


HeavyLift malware


GravityRAT Android malware


GravityAdmin - Admin panel binaries


Cosmic Leopard owned


Cosmic Leopard malicious


download server


Legitimate EXE


Malicious batch script


malicious HTA


Malicious Launcher


RAR


malicious DLL


malicious LNK


Encrypted SpiceRAT


Decrypted SpiceRAT


SpiceRAT Plugin DLL


Decrypted SugarGh0st RAT


LNK


Embedded JS


HeavyLift malware


GravityRAT Android malware


GravityAdmin - Admin panel binaries


Cosmic Leopard owned


Cosmic Leopard malicious


download server


Legitimate EXE


Malicious batch script


malicious HTA


Malicious Launcher


RAR


malicious DLL


malicious LNK


Encrypted SpiceRAT


Decrypted SpiceRAT


SpiceRAT Plugin DLL


Decrypted SugarGh0st RAT


LNK


Embedded JS


filename: Minutes of meeting Intl Military Technical Forum Army 2024.zip


Minutes of meeting Intl Military Technical Forum Army 2024.zip

sha256: 40f61588c92bc0965719b78d2f0827585308abb5b4cf8a01138b3cf69378df28


filename: Progress report.zip


sha256: 89a6a2a9eac5905393f6be5d7455094061bd9c011aa9538b05e67beabfe60f86


filename: Minutes of meeting Intl Military Technical Forum Army 2024.rar


Minutes of meeting Intl Military Technical Forum Army 2024.rar

sha256: ef24d507df0e08d7521e4d85b5128687e37c15864431e35adad96e9392e6f491


filename: Progress Report .rar


sha256: e3976ba4ca83ed592671bf54ea62b8e2d38972cc052a4c9b4b201e3262dcde99


filename: Notice EC10 Power.rar


sha256: a4e892ac0e83af56a4023c74ec252c3a4e2338f4e6ed6b575e76ee28ad31ed42


filename: Minutes of meeting Intl Military Technical Forum Army 2024 Password.txt


Minutes of meeting Intl Military Technical Forum Army 2024 Password.txt

sha256: 8e30d2e6159602df6992e34de63df1f64245a6104012fc307f38241d860da986


filename: Password.txt


sha256: c62bb70fcf91035ddc13832f137e0d603dcd5293466d2766eef3dc4ee77d0fb9


filename: Minutes of meeting Intl Military Technical Forum Army 2024.pdf.chm


Minutes of meeting Intl Military Technical Forum Army 2024.pdf.chm

sha256: f4863baa692b6e9277cdfc1108273d109e08667d0e273313ec7184acef6ffe4e


filename: Progress Report.pdf.chm


sha256: 3441772843f91218c2471355a72adf6cdd6889fc74de6f842bc3edc1b823ad0f


filename: NRTC Drone Requirements.pdf.chm


sha256: 2609900881eed50feda545be70de045fd9012c7b4895a3506e767d4df695a68c


filename: Notice EC10 Power.pdf.chm


sha256: ae2649ec385e8fc01585cc08040460b9c086e1e70d23cef373fb3ff4556c0e95


filename: RuntimeIndexer.exe


sha256: 8ec0e528de50cdd232294480999a9730944aa218fbc12ad24228e078b845cb5c


Rainyday loader


Quickheal


Coolclient


Indicator – Type – Description / C2 Endpoint


Indicator – Type – Description / File Payload


Payload, Indicator – Type – Description


Indicator – Type – Description / address C2 Endpoint


Indicator – Type – Description


4K Sport, md5: b9ee66c96b110622f4608581e77b0e4d


4K Sport, domain: cincincintopcin.info


5G, md5: 7031c88ea3a306c4e4d786d3b0625a20


5G, domain: cincincintopcin.info


Purolator, md5: 432cd820424c1a9ae0abac63a4f130c7


Purolator, domain: cincincintopcin.info


Purolator, md5: ae53e2d732523c460d31e2805989e480


Purolator, md5: c6153acefb8d3724f7defc177cff9ca9


Purolator, md5: db097d837681d059a63725bc4ad93515


lnat Tv Video Oynaticisi, md5: 1db5ce9cbb3932ce2e11e5b3cd900ee2


lnat Tv Video Oynaticisi, domain: tonymayisayininfilancagunu.info


lnat Tv Video Oynaticisi, md5: 811bcc33027f3784d800e75dea81f277


lnat Tv Video Oynaticisi, md5: 97abc0aa3819e161ca1f7f3e78025e15


lnat Tv Video Oynaticisi, domain: tonyttnnntnn1704.top


lnat Tv Video Oynaticisi, md5: 8468c1cda925021ed911fd9c17915eec


Chrome, md5: fb3d3bdc13f445df3f4dd55f547aa92a


Chrome, domain: pembe1303sock.top


Chrome, md5: b6bbf8ed1cf8ec67b25bbcf26de483b4


Chrome, md5: 1ed0d97491afd5c2d27f74f18e254cc3


İnat TV PRO, md5: 469dfea6446a8bb5fada116bd28483d7


İnat TV PRO, domain: pembe1303sock.top


Chrome, md5: 62faff68d6e3957973e91810a0abf166


Chrome, domain: pemmbebebebebebe.info


Android 14 Guncellemesi, md5: e501752247d32e908e4db70f457ced42


Android 14 Guncellemesi, domain: pemmbebebebebebe.info


lnat Tv Video Oynatici, md5: bbecdd2513981eb9573b163151747e3b


lnat Tv Video Oynatici, domain: pemmbebebebebebe.info


lnat Tv Video Oynatici, md5: 08344a2575efed552f2688b371ebac67


Chrome Güncelleme, md5: 185f8c23fd680cae560aad220e137886


Chrome Güncelleme, domain: baahhhs21.info


Chrome Güncelleme, md5: 3b7df8e68eca9a4bcc559d79a2c5a4c7


Chrome Güncelleme, domain: tony1303sock.top


Chrome Güncelleme, md5: 6b05a1e9faf5b77bad1826bacf322b24


lnat Tv Video Oynaticisi, md5: 4c12987ac5d56a35258b3b7cdc87f038


lnat Tv Video Oynaticisi, domain: tony1303sock.top


lnat Tv Video Oynaticisi, md5: 3fbe1323bdef176a6011a534e15a80f0


lnat Tv Video Oynaticisi, md5: 0e7c37e28871f439539b3d87242def55


lnat Tv Video Oynaticisi, md5: 646077aaf1ced1b32ae6519beced080f


lnat Tv Video Oynaticisi, md5: 8d232fd0bfc9e1e4e77b8d719f24b48f


lnat Tv Video Oynaticisi, md5: d98386401edf18ddbf45a40febf80c40


Chrome, md5: 5a807cb36fdb3eaa50004351cb83a348


Chrome, domain: unkunknunkkkkk.info


Purolator, md5: 3ccb77a10497a32efcaa42ac646ca6cf


Purolator, domain: unkunknunkkkkk.info


Purolator, md5: da92fc812b84137cef1571fb6c0285f0


Purolator, md5: 2fb098a1868c7162aff9aa84fcc45071


Purolator, md5: ac7741bca86793d28659b358f734a65e


Purolator, md5: e8ab402124e19af08d5ddc924d463991


Purolator, md5: e65f01591ae40802748b09f9964bc61e


Google Chrome, md5: 8a4928ac9089adc4a153741d2f1c784a


Google Chrome, domain: unkunknunkkkkk.info


5G, md5: cffad0170fc13756cab142d3989c26a9


5G, domain: unkunknunkkkkk.info


Actualizacion de Chrome, md5: 29dd2f61f1d402ab46d963ed25c591d5


Actualizacion de Chrome, domain: unkunknunkkkkk.info


Actualizacion de Chrome, md5: a6157e3e5e1aef93ae71b3cff3ec9d80


İnat TV Video Oynatici, md5: 2ecce74a26fe3f76252d0fc29cdc3ed3


İnat TV Video Oynatici, domain: a2a2a2a.life


İnat TV Video Oynatici, md5: b9f3782c3d6034cdd12b6854e49b5fcf


İnat TV Video Oynatici, md5: 2a94a9157e7cb3259531cfb1bf9f1f83


İnat TV Video Oynatici, md5: 25139a3dde2d6b9ded29de97452a8774


İnat TV Video Oynatici, md5: 9437ea7aa931bfed9e6cdd76fe27d811


İnat TV PRO, md5: b2ae7eb30163c8b004dc354ebb973e49


İnat TV PRO, domain: a2a2a2a.life


İnat TV PRO Video Oynatici, md5: df29a4a16af5da6e24aa3361b204a664


İnat TV PRO Video Oynatici, domain: a2a2a2a.life


İnat TV PRO Video Oynatici, md5: 5d3958940abab05acee4b9dbab6bc4c3


Dilan Polat Resimleri, md5: 0f83a144483ba17f4e3154d717361381


Dilan Polat Resimleri, domain: a2a2a2a.life


Cimer Aidat İadesi, md5: 59735a4123c664f1795fb7154c95af67


Cimer Aidat İadesi, domain: a2a2a2a.life


Cimer Aidat İadesi, md5: 920bdb47c0c060ecc5a06461c9715e26


Avast Premium, md5: 3dac7bb95b01676d24cb194c3c47029f


Avast Premium, domain: a2a2a2a.life


Youtube Premium, md5: d8e8eb2714c91b9968ffd409f771e7e1


Youtube Premium, domain: a2a2a2a.life


Aidat İadesi, md5: 53970ff7dd8edaec7fc0cdd030c0b038


Aidat İadesi, domain: a2a2a2a.life


Aidat İadesi, md5: e69248a7308436d8c6dde803c22821cb


Purolator, md5: cb1280f6e63e4908d52b5bee6f65ec63


Purolator, domain: a4a4a4a.life


Purolator, md5: a5aeb6ccc48fea88cf6c6bcc69940f8a


Purolator, md5: bd7b9dd5ca8c414ff2c4744df41e7031


Purolator, md5: 9ceef4129ea27388018c0d1bb8554bcc


Purolator, md5: 3e0ee083fa9fce493383d75db1c69eee


Purolator, md5: 776b5b3c18a10b7e04f238478408f057


Purolator, md5: 4bace6e0b61f5169bb0ca7f48c38aea2


Purolator, md5: c9f30775469ef4ba09b1c09fdb13fd2d


Purolator, md5: 2580f696f903b11f4ca06754fa82b5a7


Purolator, md5: dbf7b5f6faeacbed7adb0880d50380b4


Purolator, md5: f7deb4066b016df32e8cd47b7ad44225


Purolator, md5: 02c7e63ffa0c5488dd080b64bc297852


Inat TV, Avast


4K Sports, Purolator, Chrome


Inat TV


Chrome


4K Sports


Phishing


Malicious PDF Hashes)


filename: acapnia.zip


md5: cda2b1a38e7fc1440d92df4a8b957eba


filename: quadrat.wmv


md5: e77ed886d929e368535385afea6a81be


filename: SpyShelter.exe


md5: c637e5ecf625b72f4bef9d28cd81d612


Vidar payload


Retrieved ZIP archive


Vidar C2


hxxps


Delivery


Stealer


Sample


The Netherlands AS202685 Aggros Operations Ltd


The Netherlands None None AS202685 Aggros Operations Ltd


kit


Part of the locker wiper ransomware repository with a read.me in Russian inside


Retrieval of the internal and transport configurations


Processing of an operator's commands


Monitoring of the file system


Protocol for communication between GoRed and its C2


Connecting to a data exfiltration server


Collecting system information


Various auxiliary utilities


Data packing


Proxy mode operation


Reverse shell mode operation


DNS tunneling implementation


ICMP tunneling implementation


List of processes


List of environment variables


Information about the processor, RAM, installed OS, user name, group name


List of network interfaces


List of active network connections


Hardware information


system structure


GoRed / GoRed / GoRed


sha1: c5540ec2ec79a21f07b0d793cc36b024a0db64cc sha256: 67b7a8fad28dcc40c0889e5c4e40aef9348441c64bba74bd6db885d88ce6d246 filename: col


md5: 6ea3feb1888ce02e3d0d2857b5ef71c4 sha256: 67b7a8fad28dcc40c0889e5c4e40aef9348441c64bba74bd6db885d88ce6d246 filename: col


md5: 6ea3feb1888ce02e3d0d2857b5ef71c4 sha1: c5540ec2ec79a21f07b0d793cc36b024a0db64cc filename: col


md5: 6ea3feb1888ce02e3d0d2857b5ef71c4 sha1: c5540ec2ec79a21f07b0d793cc36b024a0db64cc sha256: 67b7a8fad28dcc40c0889e5c4e40aef9348441c64bba74bd6db885d88ce6d246


sha1: a81373d92d798418109552fb91d4c407d4c37a89 sha256: f43c99ef85166774ed47cad96c70b8273aa82c313e55bb08d9c74e2b3f59b000 filename: coll.exe


md5: 64db61efc8acf370b91110b6f93d4dce sha256: f43c99ef85166774ed47cad96c70b8273aa82c313e55bb08d9c74e2b3f59b000 filename: coll.exe


md5: 64db61efc8acf370b91110b6f93d4dce sha1: a81373d92d798418109552fb91d4c407d4c37a89 filename: coll.exe


md5: 64db61efc8acf370b91110b6f93d4dce sha1: a81373d92d798418109552fb91d4c407d4c37a89 sha256: f43c99ef85166774ed47cad96c70b8273aa82c313e55bb08d9c74e2b3f59b000


sha1: 5a504869350a4bdbcda22b09dbe7b05a7551a860 sha256: f91c9fd27bf0e3a7e82998721946ee70735ec46ee672ca80e3062aa2d5195447 filename: 63f6de3c86de55172b147b947f29c808.virus


md5: 63f6de3c86de55172b147b947f29c808 sha256: f91c9fd27bf0e3a7e82998721946ee70735ec46ee672ca80e3062aa2d5195447 filename: 63f6de3c86de55172b147b947f29c808.virus


md5: 63f6de3c86de55172b147b947f29c808 sha1: 5a504869350a4bdbcda22b09dbe7b05a7551a860 filename: 63f6de3c86de55172b147b947f29c808.virus


md5: 63f6de3c86de55172b147b947f29c808 sha1: 5a504869350a4bdbcda22b09dbe7b05a7551a860 sha256: f91c9fd27bf0e3a7e82998721946ee70735ec46ee672ca80e3062aa2d5195447


sha1: a190448a0c01a6e58610de27d022ccba0e755f79 sha256: be246cdf932aa5b1c2ada0d74c8d1eca4028538b28fb61d7a8d930b4266fd55c filename: c.upx


md5: d3cd9d9bad6450e8fd4fd2e972639c69 sha256: be246cdf932aa5b1c2ada0d74c8d1eca4028538b28fb61d7a8d930b4266fd55c filename: c.upx


md5: d3cd9d9bad6450e8fd4fd2e972639c69 sha1: a190448a0c01a6e58610de27d022ccba0e755f79 filename: c.upx


md5: d3cd9d9bad6450e8fd4fd2e972639c69 sha1: a190448a0c01a6e58610de27d022ccba0e755f79 sha256: be246cdf932aa5b1c2ada0d74c8d1eca4028538b28fb61d7a8d930b4266fd55c


sha1: 81861a853216f78219dd8cb0b4717d5d63260e7d sha256: ec36fcd64432843292d16f601a758ba4091ada906c5c4c4e540e326676911141 filename: cad5cb82baccd1f28e381e5c924f204a.virus


md5: cad5cb82baccd1f28e381e5c924f204a sha256: ec36fcd64432843292d16f601a758ba4091ada906c5c4c4e540e326676911141 filename: cad5cb82baccd1f28e381e5c924f204a.virus


md5: cad5cb82baccd1f28e381e5c924f204a sha1: 81861a853216f78219dd8cb0b4717d5d63260e7d filename: cad5cb82baccd1f28e381e5c924f204a.virus


md5: cad5cb82baccd1f28e381e5c924f204a sha1: 81861a853216f78219dd8cb0b4717d5d63260e7d sha256: ec36fcd64432843292d16f601a758ba4091ada906c5c4c4e540e326676911141


sha1: 1d784e6c7d12fb7730895f21e4bfd3cde4b3900f sha256: 41d35016c78f86eee8972808c7de8c200ff24625639adff5b9d0ab8773fff6b4 filename: bb.exe


md5: 6f6e7fe49a8d5696f389e202d3b8c7e2 sha256: 41d35016c78f86eee8972808c7de8c200ff24625639adff5b9d0ab8773fff6b4 filename: bb.exe


md5: 6f6e7fe49a8d5696f389e202d3b8c7e2 sha1: 1d784e6c7d12fb7730895f21e4bfd3cde4b3900f filename: bb.exe


md5: 6f6e7fe49a8d5696f389e202d3b8c7e2 sha1: 1d784e6c7d12fb7730895f21e4bfd3cde4b3900f sha256: 41d35016c78f86eee8972808c7de8c200ff24625639adff5b9d0ab8773fff6b4


sha1: de243b57b087f5d1cde50db1949aa3744f1f6b5e sha256: aca34d7c3832879f6f7ebe8f7c59160896909574c94d1d12d7c71b6f7918bc50 filename: coll.exe


md5: b5dc9a67f76fa18784b51fd3c5b9607c sha256: aca34d7c3832879f6f7ebe8f7c59160896909574c94d1d12d7c71b6f7918bc50 filename: coll.exe


md5: b5dc9a67f76fa18784b51fd3c5b9607c sha1: de243b57b087f5d1cde50db1949aa3744f1f6b5e filename: coll.exe


md5: b5dc9a67f76fa18784b51fd3c5b9607c sha1: de243b57b087f5d1cde50db1949aa3744f1f6b5e sha256: aca34d7c3832879f6f7ebe8f7c59160896909574c94d1d12d7c71b6f7918bc50


sha1: 680cb0a25e4a5148f5a1f7d3b75fad4fd345cdb0 sha256: 8d055f3ad4d01f601df24a7c20ded981005adef7e6d26750415d1f95a471c2e3 filename: revsh.exe


md5: caf68b393d56548074b9434564cb0625 sha256: 8d055f3ad4d01f601df24a7c20ded981005adef7e6d26750415d1f95a471c2e3 filename: revsh.exe


md5: caf68b393d56548074b9434564cb0625 sha1: 680cb0a25e4a5148f5a1f7d3b75fad4fd345cdb0 filename: revsh.exe


md5: caf68b393d56548074b9434564cb0625 sha1: 680cb0a25e4a5148f5a1f7d3b75fad4fd345cdb0 sha256: 8d055f3ad4d01f601df24a7c20ded981005adef7e6d26750415d1f95a471c2e3


sha1: ef50067027e27bea188023fa6a8ce9054c7d4ce9 sha256: 17e57c5e71b99a386b18728eac4a27e83415756071c9e85859940da41e94976b


md5: b747c05888caf380edf6b2baab142272 sha256: 17e57c5e71b99a386b18728eac4a27e83415756071c9e85859940da41e94976b


md5: b747c05888caf380edf6b2baab142272 sha1: ef50067027e27bea188023fa6a8ce9054c7d4ce9


sha1: 4f6164321d10c7a54a54398ccc7b11c1e7390e38 sha256: 32d76f2fe1188a131cb3219356639e83c60d47a703e40b8801a364d98e37128f filename: dttcodexgigas.4f6164321d10c7a54a54398ccc7b11c1e7390e38


md5: 0385b0f83dbfc99c243ff066e3fe3cb2 sha256: 32d76f2fe1188a131cb3219356639e83c60d47a703e40b8801a364d98e37128f filename: dttcodexgigas.4f6164321d10c7a54a54398ccc7b11c1e7390e38


md5: 0385b0f83dbfc99c243ff066e3fe3cb2 sha1: 4f6164321d10c7a54a54398ccc7b11c1e7390e38 filename: dttcodexgigas.4f6164321d10c7a54a54398ccc7b11c1e7390e38


md5: 0385b0f83dbfc99c243ff066e3fe3cb2 sha1: 4f6164321d10c7a54a54398ccc7b11c1e7390e38 sha256: 32d76f2fe1188a131cb3219356639e83c60d47a703e40b8801a364d98e37128f


sha256: f3bb44d52e43477ce43c91eb8d9830e356fc105b96377edd6b190fcccda61e2f filename: 7dc1e49f1664af70d85d31af70f29071


sha1: 1981f9a1d885c0ccb2d1f5910765a52d1989bc37 filename: 7dc1e49f1664af70d85d31af70f29071


sha1: 1981f9a1d885c0ccb2d1f5910765a52d1989bc37 sha256: f3bb44d52e43477ce43c91eb8d9830e356fc105b96377edd6b190fcccda61e2f


sha1: 8030f2430234426ab3bdc8cdd995be7c4805d7d2 sha256: ab801eaa9ad11199e1382a124d6024f9551a5a33ca1b9e5cafc0098621abb91f filename: Scada.Connect.Win.ConnectionImpl.dll


md5: fc3b7f47958f6c1c6a93a2f2f970734c sha256: ab801eaa9ad11199e1382a124d6024f9551a5a33ca1b9e5cafc0098621abb91f filename: Scada.Connect.Win.ConnectionImpl.dll


md5: fc3b7f47958f6c1c6a93a2f2f970734c sha1: 8030f2430234426ab3bdc8cdd995be7c4805d7d2 filename: Scada.Connect.Win.ConnectionImpl.dll


md5: fc3b7f47958f6c1c6a93a2f2f970734c sha1: 8030f2430234426ab3bdc8cdd995be7c4805d7d2 sha256: ab801eaa9ad11199e1382a124d6024f9551a5a33ca1b9e5cafc0098621abb91f


sha1: 58d03630792f287184177660d9fd846fbde5416c sha256: 4561a38ff34cc71cc73d54e2adfbd378f58d54596b012ff1841fdd7fc42063c3 filename: srond


md5: c02bee46d6a7a46f54e6abe003fec897 sha256: 4561a38ff34cc71cc73d54e2adfbd378f58d54596b012ff1841fdd7fc42063c3 filename: srond


md5: c02bee46d6a7a46f54e6abe003fec897 sha1: 58d03630792f287184177660d9fd846fbde5416c filename: srond


md5: c02bee46d6a7a46f54e6abe003fec897 sha1: 58d03630792f287184177660d9fd846fbde5416c sha256: 4561a38ff34cc71cc73d54e2adfbd378f58d54596b012ff1841fdd7fc42063c3


sha1: 3dd9bd38a8f8166b1af25cb523a9a6f25b1791df sha256: f56b7fbc5dda7e46aff1b7753a1edb1f6fad5c8953dd3dbff30b3d8675b1dbd3 filename: scrond


md5: ad5c0363e7e28c69007f891fbc3dd030 sha256: f56b7fbc5dda7e46aff1b7753a1edb1f6fad5c8953dd3dbff30b3d8675b1dbd3 filename: scrond


md5: ad5c0363e7e28c69007f891fbc3dd030 sha1: 3dd9bd38a8f8166b1af25cb523a9a6f25b1791df filename: scrond


md5: ad5c0363e7e28c69007f891fbc3dd030 sha1: 3dd9bd38a8f8166b1af25cb523a9a6f25b1791df sha256: f56b7fbc5dda7e46aff1b7753a1edb1f6fad5c8953dd3dbff30b3d8675b1dbd3


sha1: 7e3d46ce5aa7345d8b84e6145323366122bd21f4 sha256: 9bad8f88be8f143e37616556b9331af69a806281019b8a336ee6e14cd04b3c0e filename: /dev/shm/.gs-0/gsn


md5: b3a07b9f99f8d36bda871b63d55afb01 sha256: 9bad8f88be8f143e37616556b9331af69a806281019b8a336ee6e14cd04b3c0e filename: /dev/shm/.gs-0/gsn


md5: b3a07b9f99f8d36bda871b63d55afb01 sha1: 7e3d46ce5aa7345d8b84e6145323366122bd21f4 filename: /dev/shm/.gs-0/gsn


md5: b3a07b9f99f8d36bda871b63d55afb01 sha1: 7e3d46ce5aa7345d8b84e6145323366122bd21f4 sha256: 9bad8f88be8f143e37616556b9331af69a806281019b8a336ee6e14cd04b3c0e


sha1: ca9a2e18119ac348962e2112c6681268e1df73d1 sha256: 5a3a44d5482bb9b632d0a9da47e5ae7d27cd397ca08d764bdf1ed636565ef5e7 filename: check.zip


md5: c1f3f6efb9ef18268eb3b841065e6554 sha256: 5a3a44d5482bb9b632d0a9da47e5ae7d27cd397ca08d764bdf1ed636565ef5e7 filename: check.zip


md5: c1f3f6efb9ef18268eb3b841065e6554 sha1: ca9a2e18119ac348962e2112c6681268e1df73d1 filename: check.zip


md5: c1f3f6efb9ef18268eb3b841065e6554 sha1: ca9a2e18119ac348962e2112c6681268e1df73d1 sha256: 5a3a44d5482bb9b632d0a9da47e5ae7d27cd397ca08d764bdf1ed636565ef5e7


sha1: 4ba1ae554f2cfeeccf250ba5a258a4ffb8651c66 sha256: 8c545687a21481969ea4299e997cfc527a16503d042c2116801ee08f14ec6595 filename: gsn_x86_64-alpine.tar.gz


md5: e210c26d26a1395d9bc1de21fe1b2975 sha256: 8c545687a21481969ea4299e997cfc527a16503d042c2116801ee08f14ec6595 filename: gsn_x86_64-alpine.tar.gz


md5: e210c26d26a1395d9bc1de21fe1b2975 sha1: 4ba1ae554f2cfeeccf250ba5a258a4ffb8651c66 filename: gsn_x86_64-alpine.tar.gz


md5: e210c26d26a1395d9bc1de21fe1b2975 sha1: 4ba1ae554f2cfeeccf250ba5a258a4ffb8651c66 sha256: 8c545687a21481969ea4299e997cfc527a16503d042c2116801ee08f14ec6595


sha1: 0f621d371782f8e610c630f942a8951878e90bfe sha256: f6e8220dbf407300fbc78d823004de5d0c4d2816218b8e2b5f8993e97f1e6a32 filename: xlswifi


md5: 376531d8a3a19016aa64d80dec23d980 sha256: f6e8220dbf407300fbc78d823004de5d0c4d2816218b8e2b5f8993e97f1e6a32 filename: xlswifi


md5: 376531d8a3a19016aa64d80dec23d980 sha1: 0f621d371782f8e610c630f942a8951878e90bfe filename: xlswifi


md5: 376531d8a3a19016aa64d80dec23d980 sha1: 0f621d371782f8e610c630f942a8951878e90bfe sha256: f6e8220dbf407300fbc78d823004de5d0c4d2816218b8e2b5f8993e97f1e6a32


sha1: 928e4e776e82645fe14a53e2ad62b5cb75b98b53 sha256: 017e03f9185e24c30de6b94bd6a36d48788d0b72134235e3f3dd1322dca426c9 filename: xlswired


md5: fcc1ad58da960c5780a66fcc24c6c2fa sha256: 017e03f9185e24c30de6b94bd6a36d48788d0b72134235e3f3dd1322dca426c9 filename: xlswired


md5: fcc1ad58da960c5780a66fcc24c6c2fa sha1: 928e4e776e82645fe14a53e2ad62b5cb75b98b53 filename: xlswired


md5: fcc1ad58da960c5780a66fcc24c6c2fa sha1: 928e4e776e82645fe14a53e2ad62b5cb75b98b53 sha256: 017e03f9185e24c30de6b94bd6a36d48788d0b72134235e3f3dd1322dca426c9


sha1: 91eeab83ddcd82a77804f2e5572d849dc846b225 sha256: 9ec7495bb6d3a7d3bfd5d5ae9e704d0f42f3136166652a5576f15d0379126d75 filename: 3156.zip


md5: 489fbca25049e5fab9dca10541e33214 sha256: 9ec7495bb6d3a7d3bfd5d5ae9e704d0f42f3136166652a5576f15d0379126d75 filename: 3156.zip


md5: 489fbca25049e5fab9dca10541e33214 sha1: 91eeab83ddcd82a77804f2e5572d849dc846b225 filename: 3156.zip


md5: 489fbca25049e5fab9dca10541e33214 sha1: 91eeab83ddcd82a77804f2e5572d849dc846b225 sha256: 9ec7495bb6d3a7d3bfd5d5ae9e704d0f42f3136166652a5576f15d0379126d75


sha1: 1aa5b4deae98f707b0a529d97fd8e7f2372c549e sha256: 7d2ae888fd06b811f6ba880c1fec3f37d49d50e0716de1b28f978240abe7795e filename: 4034


md5: a5fa43f822b6dd88298371232d49c597 sha256: 7d2ae888fd06b811f6ba880c1fec3f37d49d50e0716de1b28f978240abe7795e filename: 4034


md5: a5fa43f822b6dd88298371232d49c597 sha1: 1aa5b4deae98f707b0a529d97fd8e7f2372c549e filename: 4034


md5: a5fa43f822b6dd88298371232d49c597 sha1: 1aa5b4deae98f707b0a529d97fd8e7f2372c549e sha256: 7d2ae888fd06b811f6ba880c1fec3f37d49d50e0716de1b28f978240abe7795e


sha1: ada92c3a38e227aa8d42b4886e036caddba2cf84 sha256: 0ac2f15f3a36e67b8e03f69685193480edf3e3b10fc69ccbec76d3d5878c708c filename: bitrix.zip


md5: d08bef69aee69d91b8cd0315175f665c sha256: 0ac2f15f3a36e67b8e03f69685193480edf3e3b10fc69ccbec76d3d5878c708c filename: bitrix.zip


md5: d08bef69aee69d91b8cd0315175f665c sha1: ada92c3a38e227aa8d42b4886e036caddba2cf84 filename: bitrix.zip


md5: d08bef69aee69d91b8cd0315175f665c sha1: ada92c3a38e227aa8d42b4886e036caddba2cf84 sha256: 0ac2f15f3a36e67b8e03f69685193480edf3e3b10fc69ccbec76d3d5878c708c


sha1: 3b1329e81739b1ea6acbb4ec4dff11f02ff42570 sha256: f34bd1d485de437fe18360d1e850c3fd64415e49d691e610711d8d232071a0b1 filename: fs


md5: 89ae36448f1922870f1a09c29f17c775 sha256: f34bd1d485de437fe18360d1e850c3fd64415e49d691e610711d8d232071a0b1 filename: fs


md5: 89ae36448f1922870f1a09c29f17c775 sha1: 3b1329e81739b1ea6acbb4ec4dff11f02ff42570 filename: fs


md5: 89ae36448f1922870f1a09c29f17c775 sha1: 3b1329e81739b1ea6acbb4ec4dff11f02ff42570 sha256: f34bd1d485de437fe18360d1e850c3fd64415e49d691e610711d8d232071a0b1


sha1: 36ef757aa3eedc3ec22bb56d60931c88cc62770e sha256: c287956c4eb683e1ee62bc9ddb739d3d1c9c5dad7a73be3977bc53468665c7f7 filename: get_wp-commentin.txt


md5: 46eb5fa7c75cc29d89f3e48be26bbd46 sha256: c287956c4eb683e1ee62bc9ddb739d3d1c9c5dad7a73be3977bc53468665c7f7 filename: get_wp-commentin.txt


md5: 46eb5fa7c75cc29d89f3e48be26bbd46 sha1: 36ef757aa3eedc3ec22bb56d60931c88cc62770e filename: get_wp-commentin.txt


md5: 46eb5fa7c75cc29d89f3e48be26bbd46 sha1: 36ef757aa3eedc3ec22bb56d60931c88cc62770e sha256: c287956c4eb683e1ee62bc9ddb739d3d1c9c5dad7a73be3977bc53468665c7f7


sha1: f67dbe68fc11139b719fec11784247c5f6e7ea93 sha256: 37affeab7fb06a052413e9cc9272ea9cb2fd160fd204b506620d4303b06298c4 filename: install


md5: 848faa5839487c4331cb2a1146811f23 sha256: 37affeab7fb06a052413e9cc9272ea9cb2fd160fd204b506620d4303b06298c4 filename: install


md5: 848faa5839487c4331cb2a1146811f23 sha1: f67dbe68fc11139b719fec11784247c5f6e7ea93 filename: install


md5: 848faa5839487c4331cb2a1146811f23 sha1: f67dbe68fc11139b719fec11784247c5f6e7ea93 sha256: 37affeab7fb06a052413e9cc9272ea9cb2fd160fd204b506620d4303b06298c4


sha1: 6ffe11b31443bd9cef4928aa3f29b11d0e47ccec sha256: 6262558adf132ae3c67d6f241c7abd62f987ce2881d459a66332234971e49e95 filename: k


md5: 0cda2ee10f5b8e9a241ef3e7e352752d sha256: 6262558adf132ae3c67d6f241c7abd62f987ce2881d459a66332234971e49e95 filename: k


md5: 0cda2ee10f5b8e9a241ef3e7e352752d sha1: 6ffe11b31443bd9cef4928aa3f29b11d0e47ccec filename: k


md5: 0cda2ee10f5b8e9a241ef3e7e352752d sha1: 6ffe11b31443bd9cef4928aa3f29b11d0e47ccec sha256: 6262558adf132ae3c67d6f241c7abd62f987ce2881d459a66332234971e49e95


sha1: 27dd8d144d0ac3af9f4ad3df8a060d86166ae7a5 sha256: c738d594d09c651109c4422acbecad23a461bab6cd4eafc41546f036816533a0 filename: kit


md5: 2cad1092a2828a33df2156a3a97d7cf1 sha256: c738d594d09c651109c4422acbecad23a461bab6cd4eafc41546f036816533a0 filename: kit


md5: 2cad1092a2828a33df2156a3a97d7cf1 sha1: 27dd8d144d0ac3af9f4ad3df8a060d86166ae7a5 filename: kit


md5: 2cad1092a2828a33df2156a3a97d7cf1 sha1: 27dd8d144d0ac3af9f4ad3df8a060d86166ae7a5 sha256: c738d594d09c651109c4422acbecad23a461bab6cd4eafc41546f036816533a0


sha1: 97a3ead87af829f77dacfa23ab2786b21b427332 sha256: c0cd580d83f4171b34b956d0c29dbc8fcafba8889594d85d471c14d7cf33be79 filename: lock.zip


md5: a2ff5b0bc0782560090574c992ccf995 sha256: c0cd580d83f4171b34b956d0c29dbc8fcafba8889594d85d471c14d7cf33be79 filename: lock.zip


md5: a2ff5b0bc0782560090574c992ccf995 sha1: 97a3ead87af829f77dacfa23ab2786b21b427332 filename: lock.zip


md5: a2ff5b0bc0782560090574c992ccf995 sha1: 97a3ead87af829f77dacfa23ab2786b21b427332 sha256: c0cd580d83f4171b34b956d0c29dbc8fcafba8889594d85d471c14d7cf33be79


sha1: f07e31056001ccc26be75772c9a2f3972cd8d96a sha256: 22ab2abda59edc1b6ba733fc140ab0c6b0c503b726a377a2e2ee6e6c95644aae filename: locker


md5: d3064fe5d8a402b26099fcdbaeaedef1 sha256: 22ab2abda59edc1b6ba733fc140ab0c6b0c503b726a377a2e2ee6e6c95644aae filename: locker


md5: d3064fe5d8a402b26099fcdbaeaedef1 sha1: f07e31056001ccc26be75772c9a2f3972cd8d96a filename: locker


md5: d3064fe5d8a402b26099fcdbaeaedef1 sha1: f07e31056001ccc26be75772c9a2f3972cd8d96a sha256: 22ab2abda59edc1b6ba733fc140ab0c6b0c503b726a377a2e2ee6e6c95644aae


sha1: 7c27d25dbc01958724fd55f0fadf966e892d181e sha256: 211a73ab3fb49957277a2efb50ad3140673b65df577961a58c3c9c90791e961e filename: m


md5: fbb3f02b37b10bde868fed9d7b750fd8 sha256: 211a73ab3fb49957277a2efb50ad3140673b65df577961a58c3c9c90791e961e filename: m


md5: fbb3f02b37b10bde868fed9d7b750fd8 sha1: 7c27d25dbc01958724fd55f0fadf966e892d181e filename: m


md5: fbb3f02b37b10bde868fed9d7b750fd8 sha1: 7c27d25dbc01958724fd55f0fadf966e892d181e sha256: 211a73ab3fb49957277a2efb50ad3140673b65df577961a58c3c9c90791e961e


sha1: 6559a9eda3b8164e0c8926b4b71780f7744c4cb7 sha256: 1b96adc3c129e7e41f7c67f0d56dc05d6cdee31f69ff85f27e6a90270cfefdcf filename: rev


md5: 9b6122f1b4f6513c22b50ef05e881f38 sha256: 1b96adc3c129e7e41f7c67f0d56dc05d6cdee31f69ff85f27e6a90270cfefdcf filename: rev


md5: 9b6122f1b4f6513c22b50ef05e881f38 sha1: 6559a9eda3b8164e0c8926b4b71780f7744c4cb7 filename: rev


md5: 9b6122f1b4f6513c22b50ef05e881f38 sha1: 6559a9eda3b8164e0c8926b4b71780f7744c4cb7 sha256: 1b96adc3c129e7e41f7c67f0d56dc05d6cdee31f69ff85f27e6a90270cfefdcf


sha1: d75faee2f8ec90a69354a2c033f20e18e5ed0589 sha256: bc159721bbe192f9c5cd24d3e9356a28f5b0c6b182de9fecf0b0ac28035f566a filename: sf


md5: bc421b337fc639749528f2e756239269 sha256: bc159721bbe192f9c5cd24d3e9356a28f5b0c6b182de9fecf0b0ac28035f566a filename: sf


md5: bc421b337fc639749528f2e756239269 sha1: d75faee2f8ec90a69354a2c033f20e18e5ed0589 filename: sf


md5: bc421b337fc639749528f2e756239269 sha1: d75faee2f8ec90a69354a2c033f20e18e5ed0589 sha256: bc159721bbe192f9c5cd24d3e9356a28f5b0c6b182de9fecf0b0ac28035f566a


sha1: f640f70d1b65b0bfc8bcbf5261f3cdc85cfe7a21 sha256: 1807c7a44da958f15e4dcb77cab78e92eeb96b3ace91d6923c2022d646d5593c filename: spark


md5: 76cc921e5b26a0720db213479bff1ea2 sha256: 1807c7a44da958f15e4dcb77cab78e92eeb96b3ace91d6923c2022d646d5593c filename: spark


md5: 76cc921e5b26a0720db213479bff1ea2 sha1: f640f70d1b65b0bfc8bcbf5261f3cdc85cfe7a21 filename: spark


md5: 76cc921e5b26a0720db213479bff1ea2 sha1: f640f70d1b65b0bfc8bcbf5261f3cdc85cfe7a21 sha256: 1807c7a44da958f15e4dcb77cab78e92eeb96b3ace91d6923c2022d646d5593c


sha1: 6ff2821bef28476341b75b67d9c9f2d66d4b6cfe sha256: a5e61987676b7aed2c6d6d32c657f9351c2daa7c36365db20713dd42a03b1504 filename: w.txt


md5: 3500760bc3e69102e01d256637f5f4a8 sha256: a5e61987676b7aed2c6d6d32c657f9351c2daa7c36365db20713dd42a03b1504 filename: w.txt


md5: 3500760bc3e69102e01d256637f5f4a8 sha1: 6ff2821bef28476341b75b67d9c9f2d66d4b6cfe filename: w.txt


md5: 3500760bc3e69102e01d256637f5f4a8 sha1: 6ff2821bef28476341b75b67d9c9f2d66d4b6cfe sha256: a5e61987676b7aed2c6d6d32c657f9351c2daa7c36365db20713dd42a03b1504


sha1: 5e79fffbbafddeb2d85c8fe835b07eeda08cc319 sha256: 86bd9caab7526f2cd7e468d692ee2bac571465d25eb0619a10b0b46ae9a5b8e2 filename: wef


md5: b7735e157273a013f26515f0c969b093 sha256: 86bd9caab7526f2cd7e468d692ee2bac571465d25eb0619a10b0b46ae9a5b8e2 filename: wef


md5: b7735e157273a013f26515f0c969b093 sha1: 5e79fffbbafddeb2d85c8fe835b07eeda08cc319 filename: wef


md5: b7735e157273a013f26515f0c969b093 sha1: 5e79fffbbafddeb2d85c8fe835b07eeda08cc319 sha256: 86bd9caab7526f2cd7e468d692ee2bac571465d25eb0619a10b0b46ae9a5b8e2


sha1: 9de84bd7118dee80f5b309ddbc46dc31283cbb0e sha256: 91136b3145a52b66a3f5edd7d8a8d06698666300f24861074df1308491f50ba5 filename: y.txt


md5: 166a248f264fbf11998c86e8b384e47a sha256: 91136b3145a52b66a3f5edd7d8a8d06698666300f24861074df1308491f50ba5 filename: y.txt


md5: 166a248f264fbf11998c86e8b384e47a sha1: 9de84bd7118dee80f5b309ddbc46dc31283cbb0e filename: y.txt


md5: 166a248f264fbf11998c86e8b384e47a sha1: 9de84bd7118dee80f5b309ddbc46dc31283cbb0e sha256: 91136b3145a52b66a3f5edd7d8a8d06698666300f24861074df1308491f50ba5


sha1: 352a62abc61c93fdb08f6f4201326f147cb819ca sha256: 895988088f25c89295f1a17f222a4553eafb2137b115f2ad4a0a25d273eb6521 filename: ps


md5: 4a04baf3c65581bcd14fbaf58aa6860b sha256: 895988088f25c89295f1a17f222a4553eafb2137b115f2ad4a0a25d273eb6521 filename: ps


md5: 4a04baf3c65581bcd14fbaf58aa6860b sha1: 352a62abc61c93fdb08f6f4201326f147cb819ca filename: ps


md5: 4a04baf3c65581bcd14fbaf58aa6860b sha1: 352a62abc61c93fdb08f6f4201326f147cb819ca sha256: 895988088f25c89295f1a17f222a4553eafb2137b115f2ad4a0a25d273eb6521


sha1: a16120cca64e0c9a73f02975691e4675bb4c44a4 sha256: a6dfef8616959969c06b65685e39929630f2819e6d5920498cdb1e89185ab7cd filename: netstat


md5: 83b8aa078be2a0a5ca0ebf1968989a4b sha256: a6dfef8616959969c06b65685e39929630f2819e6d5920498cdb1e89185ab7cd filename: netstat


md5: 83b8aa078be2a0a5ca0ebf1968989a4b sha1: a16120cca64e0c9a73f02975691e4675bb4c44a4 filename: netstat


md5: 83b8aa078be2a0a5ca0ebf1968989a4b sha1: a16120cca64e0c9a73f02975691e4675bb4c44a4 sha256: a6dfef8616959969c06b65685e39929630f2819e6d5920498cdb1e89185ab7cd


sha1: 1af6946263f4f548ffcf510c9f68378a4d7e0895 sha256: 20927a1fc3441668264673d77c81652818a630f3b2055545b0e0938c523827c3 filename: ps


md5: b7db832b2598c83b7b077ce603a3ff73 sha256: 20927a1fc3441668264673d77c81652818a630f3b2055545b0e0938c523827c3 filename: ps


md5: b7db832b2598c83b7b077ce603a3ff73 sha1: 1af6946263f4f548ffcf510c9f68378a4d7e0895 filename: ps


md5: b7db832b2598c83b7b077ce603a3ff73 sha1: 1af6946263f4f548ffcf510c9f68378a4d7e0895 sha256: 20927a1fc3441668264673d77c81652818a630f3b2055545b0e0938c523827c3


sha1: ad6653a7ee1bcb9590f5da12cf46d856135bbb71 sha256: a9b1a99729860c004fbef463958871956cbb3c8e365383042978c260012055bd filename: ss


md5: 415d091f42fc62e8dfb6f8bb5ce641c5 sha256: a9b1a99729860c004fbef463958871956cbb3c8e365383042978c260012055bd filename: ss


md5: 415d091f42fc62e8dfb6f8bb5ce641c5 sha1: ad6653a7ee1bcb9590f5da12cf46d856135bbb71 filename: ss


md5: 415d091f42fc62e8dfb6f8bb5ce641c5 sha1: ad6653a7ee1bcb9590f5da12cf46d856135bbb71 sha256: a9b1a99729860c004fbef463958871956cbb3c8e365383042978c260012055bd


sha1: 1fc930a59587fd9faf7536add47d92de0cecea53 sha256: a9b1a99729860c004fbef463958871956cbb3c8e365383042978c260012055bd filename: htop


md5: eda9ca5f9405b5e2d004a4ba5c0dcd16 sha256: a9b1a99729860c004fbef463958871956cbb3c8e365383042978c260012055bd filename: htop


md5: eda9ca5f9405b5e2d004a4ba5c0dcd16 sha1: 1fc930a59587fd9faf7536add47d92de0cecea53 filename: htop


md5: eda9ca5f9405b5e2d004a4ba5c0dcd16 sha1: 1fc930a59587fd9faf7536add47d92de0cecea53 sha256: a9b1a99729860c004fbef463958871956cbb3c8e365383042978c260012055bd


sha1: 1d4c0b3c74ddacf7459743cc60dd2a819c0c7e27 sha256: 7e8bde3e34fbf9b99b7915e12de42f6b806153e44b6aaf68b172db50e18e3b9e filename: netstat


md5: eda9ca5f9405b5e2d004a4ba5c0dcd16 sha256: 7e8bde3e34fbf9b99b7915e12de42f6b806153e44b6aaf68b172db50e18e3b9e filename: netstat


md5: eda9ca5f9405b5e2d004a4ba5c0dcd16 sha1: 1d4c0b3c74ddacf7459743cc60dd2a819c0c7e27 filename: netstat


md5: eda9ca5f9405b5e2d004a4ba5c0dcd16 sha1: 1d4c0b3c74ddacf7459743cc60dd2a819c0c7e27 sha256: 7e8bde3e34fbf9b99b7915e12de42f6b806153e44b6aaf68b172db50e18e3b9e


sha1: 7e0a4c53bf3dfcb08993231539986a220a6803fd sha256: ac0906ff674c555e102f076100d0c12ea4a4aa7d74cc15f67c4038a84100f4cf filename: ps


md5: d215a54c581ab62079389c852d9ef84f sha256: ac0906ff674c555e102f076100d0c12ea4a4aa7d74cc15f67c4038a84100f4cf filename: ps


md5: d215a54c581ab62079389c852d9ef84f sha1: 7e0a4c53bf3dfcb08993231539986a220a6803fd filename: ps


md5: d215a54c581ab62079389c852d9ef84f sha1: 7e0a4c53bf3dfcb08993231539986a220a6803fd sha256: ac0906ff674c555e102f076100d0c12ea4a4aa7d74cc15f67c4038a84100f4cf


sha1: 2683dcce7fc3886f8305030b128103bd82cea528 sha256: 8fe0ba1cb68225ab9a2cb11c1419f52adb03898c5f11d2221ba9765843443d24 filename: ss


md5: ffc418b222c08f3071ff53cde4acb22e sha256: 8fe0ba1cb68225ab9a2cb11c1419f52adb03898c5f11d2221ba9765843443d24 filename: ss


md5: ffc418b222c08f3071ff53cde4acb22e sha1: 2683dcce7fc3886f8305030b128103bd82cea528 filename: ss


md5: ffc418b222c08f3071ff53cde4acb22e sha1: 2683dcce7fc3886f8305030b128103bd82cea528 sha256: 8fe0ba1cb68225ab9a2cb11c1419f52adb03898c5f11d2221ba9765843443d24


Hashes: / 0.bat


Hashes: / 1.bat


filename: 65535.vbs


sha256: c4a1cd46c8d2ebfc08e4af584a64fee54f73020e0f2dc84dc20c1b195a954519


filename: 678117.vbs


sha256: 7c97c864aceff6ad7df548882a57165655c72f682313f3c59c5d8be37cea24fc


filename: 45535.vbs


sha256: 351fa3e33d607ff77548ba6422ac0a5264fb3e847e65996d3ef4faefc2a738c5


filename: backup.bat


sha256: 6dccb5e247c3117cb12b5f411d29b2c4bfa1f0230cd2b43bd4497671bb0f7f82


Hashes: / oculus-app.EXE.bat


filename: update.bat


sha256: 95133896517b80620f4c81af332d258da5b7d50413b30eac1cf3808e511210a1


MS word file, sha1: 71f4eaebbd9cccaa2a9ca2575dbf12a420482394 sha256: 8462bae8b5ac446fefab66d036696d4c29648052c35edb1ba7057e39808803fa


MS word file, md5: c31837a9c1ed6a540782f63d4f196b11 sha256: 8462bae8b5ac446fefab66d036696d4c29648052c35edb1ba7057e39808803fa


MS word file, md5: c31837a9c1ed6a540782f63d4f196b11 sha1: 71f4eaebbd9cccaa2a9ca2575dbf12a420482394


after scanning QR codes


Redirected Phishing


MS Word file


UTILITY, filename: gl.py


UTILITY, md5: 381b7a2a6d581e3482c829bfb542a7de


INSTALLER, filename: install-20220615.py


INSTALLER, md5: 876787f76867ecf654019bd19409c5b8


ARCHIVE, filename: lsuv2_nv.v01


ARCHIVE, md5: 827d8ae502e3a4d56e6c3a238ba855a7


ARCHIVE, filename: payload1.v00


ARCHIVE, md5: 9ea86dccd5bbde47f8641b62a1eeff07


ARCHIVE, filename: rdt


ARCHIVE, md5: fcb742b507e3c074da5524d1a7c80f7f


UTILITY, filename: sendPacket.py


UTILITY, md5: 129ba90886c5f5eb0c81d901ad10c622


UTILITY, md5: 0f76936e237bd87dfa2378106099a673


UTILITY, filename: u.py


UTILITY, md5: d18a5f1e8c321472a31c27f4985834a4


LAUNCHER, filename: vmware_ntp.sh


LAUNCHER, md5: 4ddca39b05103aeb075ebb0e03522064


GHOSTTOWN / UTILITY, filename: wp


GHOSTTOWN / UTILITY, md5: 0e43a0f747a60855209b311d727a20bf


LOOKOVER / SNIFFER, filename: aububbaditd


LOOKOVER / SNIFFER, md5: 1d89b48548ea1ddf0337741ebdb89d92


LOOKOVER / SNIFFER, filename: bubba_sniffer


LOOKOVER / SNIFFER, md5: ecb34a068eeb2548c0cbe2de00e53ed2


MOPSLED.LINUX / BACKDOOR, filename: ksbubba


MOPSLED.LINUX / BACKDOOR, md5: 89339821cdf6e9297000f3e6949f0404


MOPSLED.LINUX / LAUNCHER, filename: ksbubba.service


MOPSLED.LINUX / LAUNCHER, md5: c870ea6a598c12218e6ac36d791032b5


REPTILE / LAUNCHER, filename: 99-bubba.rules


REPTILE / LAUNCHER, md5: 1079d416e093ba40aa9e95a4c2a5b61f


REPTILE / BACKDOOR, filename: admin


REPTILE / BACKDOOR, md5: ed9be20fea9203f4c4557c66c5b9686c


REPTILE / BACKDOOR, filename: authd


REPTILE / BACKDOOR, md5: 568074d60dd4759e963adc5fe9f15eb1


REPTILE / LAUNCHER, filename: bubba


REPTILE / LAUNCHER, md5: 4d5e4f64a9b56067704a977ed89aa641


REPTILE / BACKDOOR, filename: bubba_icmp


REPTILE / BACKDOOR, md5: 1b7aee68f384e252286559abc32e6dd1


REPTILE / BACKDOOR, filename: bubba_loader


REPTILE / BACKDOOR, md5: b754237c7b5e9461389a6d960156db1e


REPTILE / BACKDOOR, filename: client


REPTILE / BACKDOOR, md5: f41ad99b8a8c95e4132e850b3663cb40


REPTILE / LAUNCHER, filename: dash


REPTILE / LAUNCHER, md5: 48f9bbdb670f89fce9c51ad433b4f200


REPTILE / BACKDOOR, filename: listener


REPTILE / BACKDOOR, md5: 4fb72d580241f27945ec187855efd84a


REPTILE / CONTROLLER, filename: packet


REPTILE / CONTROLLER, md5: e2cdf2a3380d0197aa11ff98a34cc59e


REPTILE.SHELL / BACKDOOR, filename: authdd


REPTILE.SHELL / BACKDOOR, md5: fd3834d566a993c549a13a52d843a4e1


REPTILE.SHELL / BACKDOOR, md5: 4282de95cc54829d7ac275e436e33b78


REPTILE.SHELL / BACKDOOR, filename: bubba_reverse


REPTILE.SHELL / BACKDOOR, md5: c9c00c627015bd78fda22fa28fd11cd7


REPTILE.SHELL / BACKDOOR, filename: unknown


REPTILE.SHELL / BACKDOOR, md5: 047ac6aebe0fe80f9f09c5c548233407


RIFLESPINE / BACKDOOR, filename: usbubbaxd


RIFLESPINE / BACKDOOR, md5: bca2ccff0596a9f102550976750e2a89


TINYSHELL / CONTROLLER, filename: audit


TINYSHELL / CONTROLLER, md5: 3a8a60416b7b0e1aa5d17eefb0a45a16


TINYSHELL / BACKDOOR, filename: lang_ext


TINYSHELL / BACKDOOR, md5: 6e248f5424810ea67212f1f2e4616aa5


TINYSHELL / CONTROLLER, filename: sync


TINYSHELL / CONTROLLER, md5: 5d232b72378754f7a6433f93e6380737


VIRTUALGATE / DROPPER, filename: x64


VIRTUALGATE / DROPPER, md5: 3c7316012cba3bbfa8a95d7277cda873


VIRTUALPEER / UTILITY, filename: ndc4961


VIRTUALPEER / UTILITY, md5: 9c428a35d9fc1fdaf31af186ff6eec08


VIRTUALPIE / ARCHIVE, filename: lsu_lsi_.v05


VIRTUALPIE / ARCHIVE, md5: 2716c60c28cf7f7568f55ac33313468b


VIRTUALPIE / BACKDOOR, filename: vmsyslog.py


VIRTUALPIE / BACKDOOR, md5: 61ab3f6401d60ec36cd3ac980a8deb75


VIRTUALPIE / LAUNCHER, filename: vmware_local.sh


VIRTUALPIE / LAUNCHER, md5: bd6e38b6ff85ab02c1a4325e8af29ce4


VIRTUALPITA / LAUNCHER, filename: cleanupStatefulHost.sh


VIRTUALPITA / LAUNCHER, md5: 9ef5266a9fdd25474227c3e33b8e6d77


VIRTUALPITA / BACKDOOR, filename: client


VIRTUALPITA / BACKDOOR, md5: a7cd7b61d13256f5478feb28ab34be72


VIRTUALPITA / BACKDOOR, filename: duci


VIRTUALPITA / BACKDOOR, md5: cd3e9e4df7e607f4fe83873b9d1142e3


VIRTUALPITA / ARCHIVE, filename: payload1


VIRTUALPITA / ARCHIVE, md5: 62bed88bd426f91ddbbbcfcd8508ed6a


VIRTUALPITA / BACKDOOR, filename: rdt


VIRTUALPITA / BACKDOOR, md5: 8e80b40b1298f022c7f3a96599806c43


VIRTUALPITA / BACKDOOR, filename: rhttpproxy