VIRTUALPITA / BACKDOOR, md5: c9f2476bf8db102fea7310abadeb9e01


VIRTUALPITA / BACKDOOR, filename: rhttpproxy-IO


VIRTUALPITA / BACKDOOR, md5: 2c28ec2d541f555b2838099ca849f965


VIRTUALPITA / BACKDOOR, filename: rpci


VIRTUALPITA / BACKDOOR, md5: 2bade2a5ec166d3a226761f78711ce2f


VIRTUALPITA / BACKDOOR, filename: ssh


VIRTUALPITA / BACKDOOR, md5: 969d7f092ed05c72f27eef5f2c8158d6


VIRTUALSHINE / BACKDOOR, filename: nds4961l.so


VIRTUALSHINE / BACKDOOR, md5: 084132b20ed65b2930129b156b99f5b3


45102 / Alibaba


20473 / Choopa, LLC


20473 / Gigabit Hosting Sdn Bhd


55720 / Gigabit Hosting Sdn Bhd


17444 / HKBN Enterprise Solutions Limited


135377 / Ucloud Information Technology Hk Limited


Phishing


Malicious PDF


Admin panel of ONNX Store (medium confidence)


sha1: c5540ec2ec79a21f07b0d793cc36b024a0db64cc sha256: 67b7a8fad28dcc40c0889e5c4e40aef9348441c64bba74bd6db885d88ce6d246 filename: col


md5: 6ea3feb1888ce02e3d0d2857b5ef71c4 sha256: 67b7a8fad28dcc40c0889e5c4e40aef9348441c64bba74bd6db885d88ce6d246 filename: col


md5: 6ea3feb1888ce02e3d0d2857b5ef71c4 sha1: c5540ec2ec79a21f07b0d793cc36b024a0db64cc filename: col


md5: 6ea3feb1888ce02e3d0d2857b5ef71c4 sha1: c5540ec2ec79a21f07b0d793cc36b024a0db64cc sha256: 67b7a8fad28dcc40c0889e5c4e40aef9348441c64bba74bd6db885d88ce6d246


sha1: a81373d92d798418109552fb91d4c407d4c37a89 sha256: f43c99ef85166774ed47cad96c70b8273aa82c313e55bb08d9c74e2b3f59b000 filename: coll.exe


md5: 64db61efc8acf370b91110b6f93d4dce sha256: f43c99ef85166774ed47cad96c70b8273aa82c313e55bb08d9c74e2b3f59b000 filename: coll.exe


md5: 64db61efc8acf370b91110b6f93d4dce sha1: a81373d92d798418109552fb91d4c407d4c37a89 filename: coll.exe


md5: 64db61efc8acf370b91110b6f93d4dce sha1: a81373d92d798418109552fb91d4c407d4c37a89 sha256: f43c99ef85166774ed47cad96c70b8273aa82c313e55bb08d9c74e2b3f59b000


sha1: 5a504869350a4bdbcda22b09dbe7b05a7551a860 sha256: f91c9fd27bf0e3a7e82998721946ee70735ec46ee672ca80e3062aa2d5195447 filename: 63f6de3c86de55172b147b947f29c808.virus


md5: 63f6de3c86de55172b147b947f29c808 sha256: f91c9fd27bf0e3a7e82998721946ee70735ec46ee672ca80e3062aa2d5195447 filename: 63f6de3c86de55172b147b947f29c808.virus


md5: 63f6de3c86de55172b147b947f29c808 sha1: 5a504869350a4bdbcda22b09dbe7b05a7551a860 filename: 63f6de3c86de55172b147b947f29c808.virus


md5: 63f6de3c86de55172b147b947f29c808 sha1: 5a504869350a4bdbcda22b09dbe7b05a7551a860 sha256: f91c9fd27bf0e3a7e82998721946ee70735ec46ee672ca80e3062aa2d5195447


sha1: a190448a0c01a6e58610de27d022ccba0e755f79 sha256: be246cdf932aa5b1c2ada0d74c8d1eca4028538b28fb61d7a8d930b4266fd55c filename: c.upx


md5: d3cd9d9bad6450e8fd4fd2e972639c69 sha256: be246cdf932aa5b1c2ada0d74c8d1eca4028538b28fb61d7a8d930b4266fd55c filename: c.upx


md5: d3cd9d9bad6450e8fd4fd2e972639c69 sha1: a190448a0c01a6e58610de27d022ccba0e755f79 filename: c.upx


md5: d3cd9d9bad6450e8fd4fd2e972639c69 sha1: a190448a0c01a6e58610de27d022ccba0e755f79 sha256: be246cdf932aa5b1c2ada0d74c8d1eca4028538b28fb61d7a8d930b4266fd55c


sha1: 81861a853216f78219dd8cb0b4717d5d63260e7d sha256: ec36fcd64432843292d16f601a758ba4091ada906c5c4c4e540e326676911141 filename: cad5cb82baccd1f28e381e5c924f204a.virus


md5: cad5cb82baccd1f28e381e5c924f204a sha256: ec36fcd64432843292d16f601a758ba4091ada906c5c4c4e540e326676911141 filename: cad5cb82baccd1f28e381e5c924f204a.virus


md5: cad5cb82baccd1f28e381e5c924f204a sha1: 81861a853216f78219dd8cb0b4717d5d63260e7d filename: cad5cb82baccd1f28e381e5c924f204a.virus


md5: cad5cb82baccd1f28e381e5c924f204a sha1: 81861a853216f78219dd8cb0b4717d5d63260e7d sha256: ec36fcd64432843292d16f601a758ba4091ada906c5c4c4e540e326676911141


sha1: 1d784e6c7d12fb7730895f21e4bfd3cde4b3900f sha256: 41d35016c78f86eee8972808c7de8c200ff24625639adff5b9d0ab8773fff6b4 filename: bb.exe


md5: 6f6e7fe49a8d5696f389e202d3b8c7e2 sha256: 41d35016c78f86eee8972808c7de8c200ff24625639adff5b9d0ab8773fff6b4 filename: bb.exe


md5: 6f6e7fe49a8d5696f389e202d3b8c7e2 sha1: 1d784e6c7d12fb7730895f21e4bfd3cde4b3900f filename: bb.exe


md5: 6f6e7fe49a8d5696f389e202d3b8c7e2 sha1: 1d784e6c7d12fb7730895f21e4bfd3cde4b3900f sha256: 41d35016c78f86eee8972808c7de8c200ff24625639adff5b9d0ab8773fff6b4


sha1: de243b57b087f5d1cde50db1949aa3744f1f6b5e sha256: aca34d7c3832879f6f7ebe8f7c59160896909574c94d1d12d7c71b6f7918bc50 filename: coll.exe


md5: b5dc9a67f76fa18784b51fd3c5b9607c sha256: aca34d7c3832879f6f7ebe8f7c59160896909574c94d1d12d7c71b6f7918bc50 filename: coll.exe


md5: b5dc9a67f76fa18784b51fd3c5b9607c sha1: de243b57b087f5d1cde50db1949aa3744f1f6b5e filename: coll.exe


md5: b5dc9a67f76fa18784b51fd3c5b9607c sha1: de243b57b087f5d1cde50db1949aa3744f1f6b5e sha256: aca34d7c3832879f6f7ebe8f7c59160896909574c94d1d12d7c71b6f7918bc50


sha1: 680cb0a25e4a5148f5a1f7d3b75fad4fd345cdb0 sha256: 8d055f3ad4d01f601df24a7c20ded981005adef7e6d26750415d1f95a471c2e3 filename: revsh.exe


md5: caf68b393d56548074b9434564cb0625 sha256: 8d055f3ad4d01f601df24a7c20ded981005adef7e6d26750415d1f95a471c2e3 filename: revsh.exe


md5: caf68b393d56548074b9434564cb0625 sha1: 680cb0a25e4a5148f5a1f7d3b75fad4fd345cdb0 filename: revsh.exe


md5: caf68b393d56548074b9434564cb0625 sha1: 680cb0a25e4a5148f5a1f7d3b75fad4fd345cdb0 sha256: 8d055f3ad4d01f601df24a7c20ded981005adef7e6d26750415d1f95a471c2e3


sha1: ef50067027e27bea188023fa6a8ce9054c7d4ce9 sha256: 17e57c5e71b99a386b18728eac4a27e83415756071c9e85859940da41e94976b


md5: b747c05888caf380edf6b2baab142272 sha256: 17e57c5e71b99a386b18728eac4a27e83415756071c9e85859940da41e94976b


md5: b747c05888caf380edf6b2baab142272 sha1: ef50067027e27bea188023fa6a8ce9054c7d4ce9


sha1: 4f6164321d10c7a54a54398ccc7b11c1e7390e38 sha256: 32d76f2fe1188a131cb3219356639e83c60d47a703e40b8801a364d98e37128f filename: dttcodexgigas.4f6164321d10c7a54a54398ccc7b11c1e7390e38


md5: 0385b0f83dbfc99c243ff066e3fe3cb2 sha256: 32d76f2fe1188a131cb3219356639e83c60d47a703e40b8801a364d98e37128f filename: dttcodexgigas.4f6164321d10c7a54a54398ccc7b11c1e7390e38


md5: 0385b0f83dbfc99c243ff066e3fe3cb2 sha1: 4f6164321d10c7a54a54398ccc7b11c1e7390e38 filename: dttcodexgigas.4f6164321d10c7a54a54398ccc7b11c1e7390e38


md5: 0385b0f83dbfc99c243ff066e3fe3cb2 sha1: 4f6164321d10c7a54a54398ccc7b11c1e7390e38 sha256: 32d76f2fe1188a131cb3219356639e83c60d47a703e40b8801a364d98e37128f


sha256: f3bb44d52e43477ce43c91eb8d9830e356fc105b96377edd6b190fcccda61e2f filename: 7dc1e49f1664af70d85d31af70f29071


sha1: 1981f9a1d885c0ccb2d1f5910765a52d1989bc37 filename: 7dc1e49f1664af70d85d31af70f29071


sha1: 1981f9a1d885c0ccb2d1f5910765a52d1989bc37 sha256: f3bb44d52e43477ce43c91eb8d9830e356fc105b96377edd6b190fcccda61e2f


sha1: 8030f2430234426ab3bdc8cdd995be7c4805d7d2 sha256: ab801eaa9ad11199e1382a124d6024f9551a5a33ca1b9e5cafc0098621abb91f filename: Scada.Connect.Win.ConnectionImpl.dll


md5: fc3b7f47958f6c1c6a93a2f2f970734c sha256: ab801eaa9ad11199e1382a124d6024f9551a5a33ca1b9e5cafc0098621abb91f filename: Scada.Connect.Win.ConnectionImpl.dll


md5: fc3b7f47958f6c1c6a93a2f2f970734c sha1: 8030f2430234426ab3bdc8cdd995be7c4805d7d2 filename: Scada.Connect.Win.ConnectionImpl.dll


md5: fc3b7f47958f6c1c6a93a2f2f970734c sha1: 8030f2430234426ab3bdc8cdd995be7c4805d7d2 sha256: ab801eaa9ad11199e1382a124d6024f9551a5a33ca1b9e5cafc0098621abb91f


sha1: fd7532d2a42dd3ba26a1a3453698b8bc481f4675 sha256: e2b2ebe1b82d1c122dc2750f318f2484fe5361fcd964bfdcdcae631cf32f8d37 filename: crond


md5: fad11b841d84bbe33248719341b298d3 sha256: e2b2ebe1b82d1c122dc2750f318f2484fe5361fcd964bfdcdcae631cf32f8d37 filename: crond


md5: fad11b841d84bbe33248719341b298d3 sha1: fd7532d2a42dd3ba26a1a3453698b8bc481f4675 filename: crond


md5: fad11b841d84bbe33248719341b298d3 sha1: fd7532d2a42dd3ba26a1a3453698b8bc481f4675 sha256: e2b2ebe1b82d1c122dc2750f318f2484fe5361fcd964bfdcdcae631cf32f8d37


sha1: 58d03630792f287184177660d9fd846fbde5416c sha256: 4561a38ff34cc71cc73d54e2adfbd378f58d54596b012ff1841fdd7fc42063c3 filename: srond


md5: c02bee46d6a7a46f54e6abe003fec897 sha256: 4561a38ff34cc71cc73d54e2adfbd378f58d54596b012ff1841fdd7fc42063c3 filename: srond


md5: c02bee46d6a7a46f54e6abe003fec897 sha1: 58d03630792f287184177660d9fd846fbde5416c filename: srond


md5: c02bee46d6a7a46f54e6abe003fec897 sha1: 58d03630792f287184177660d9fd846fbde5416c sha256: 4561a38ff34cc71cc73d54e2adfbd378f58d54596b012ff1841fdd7fc42063c3


sha1: 3dd9bd38a8f8166b1af25cb523a9a6f25b1791df sha256: f56b7fbc5dda7e46aff1b7753a1edb1f6fad5c8953dd3dbff30b3d8675b1dbd3 filename: scrond


md5: ad5c0363e7e28c69007f891fbc3dd030 sha256: f56b7fbc5dda7e46aff1b7753a1edb1f6fad5c8953dd3dbff30b3d8675b1dbd3 filename: scrond


md5: ad5c0363e7e28c69007f891fbc3dd030 sha1: 3dd9bd38a8f8166b1af25cb523a9a6f25b1791df filename: scrond


md5: ad5c0363e7e28c69007f891fbc3dd030 sha1: 3dd9bd38a8f8166b1af25cb523a9a6f25b1791df sha256: f56b7fbc5dda7e46aff1b7753a1edb1f6fad5c8953dd3dbff30b3d8675b1dbd3


sha1: 7e3d46ce5aa7345d8b84e6145323366122bd21f4 sha256: 9bad8f88be8f143e37616556b9331af69a806281019b8a336ee6e14cd04b3c0e filename: /dev/shm/.gs-0/gsn


md5: b3a07b9f99f8d36bda871b63d55afb01 sha256: 9bad8f88be8f143e37616556b9331af69a806281019b8a336ee6e14cd04b3c0e filename: /dev/shm/.gs-0/gsn


md5: b3a07b9f99f8d36bda871b63d55afb01 sha1: 7e3d46ce5aa7345d8b84e6145323366122bd21f4 filename: /dev/shm/.gs-0/gsn


md5: b3a07b9f99f8d36bda871b63d55afb01 sha1: 7e3d46ce5aa7345d8b84e6145323366122bd21f4 sha256: 9bad8f88be8f143e37616556b9331af69a806281019b8a336ee6e14cd04b3c0e


sha1: ca9a2e18119ac348962e2112c6681268e1df73d1 sha256: 5a3a44d5482bb9b632d0a9da47e5ae7d27cd397ca08d764bdf1ed636565ef5e7 filename: check.zip


md5: c1f3f6efb9ef18268eb3b841065e6554 sha256: 5a3a44d5482bb9b632d0a9da47e5ae7d27cd397ca08d764bdf1ed636565ef5e7 filename: check.zip


md5: c1f3f6efb9ef18268eb3b841065e6554 sha1: ca9a2e18119ac348962e2112c6681268e1df73d1 filename: check.zip


md5: c1f3f6efb9ef18268eb3b841065e6554 sha1: ca9a2e18119ac348962e2112c6681268e1df73d1 sha256: 5a3a44d5482bb9b632d0a9da47e5ae7d27cd397ca08d764bdf1ed636565ef5e7


sha1: 4ba1ae554f2cfeeccf250ba5a258a4ffb8651c66 sha256: 8c545687a21481969ea4299e997cfc527a16503d042c2116801ee08f14ec6595 filename: gsn_x86_64-alpine.tar.gz


md5: e210c26d26a1395d9bc1de21fe1b2975 sha256: 8c545687a21481969ea4299e997cfc527a16503d042c2116801ee08f14ec6595 filename: gsn_x86_64-alpine.tar.gz


md5: e210c26d26a1395d9bc1de21fe1b2975 sha1: 4ba1ae554f2cfeeccf250ba5a258a4ffb8651c66 filename: gsn_x86_64-alpine.tar.gz


md5: e210c26d26a1395d9bc1de21fe1b2975 sha1: 4ba1ae554f2cfeeccf250ba5a258a4ffb8651c66 sha256: 8c545687a21481969ea4299e997cfc527a16503d042c2116801ee08f14ec6595


sha1: 0f621d371782f8e610c630f942a8951878e90bfe sha256: f6e8220dbf407300fbc78d823004de5d0c4d2816218b8e2b5f8993e97f1e6a32 filename: xlswifi


md5: 376531d8a3a19016aa64d80dec23d980 sha256: f6e8220dbf407300fbc78d823004de5d0c4d2816218b8e2b5f8993e97f1e6a32 filename: xlswifi


md5: 376531d8a3a19016aa64d80dec23d980 sha1: 0f621d371782f8e610c630f942a8951878e90bfe filename: xlswifi


md5: 376531d8a3a19016aa64d80dec23d980 sha1: 0f621d371782f8e610c630f942a8951878e90bfe sha256: f6e8220dbf407300fbc78d823004de5d0c4d2816218b8e2b5f8993e97f1e6a32


sha1: 928e4e776e82645fe14a53e2ad62b5cb75b98b53 sha256: 017e03f9185e24c30de6b94bd6a36d48788d0b72134235e3f3dd1322dca426c9 filename: xlswired


md5: fcc1ad58da960c5780a66fcc24c6c2fa sha256: 017e03f9185e24c30de6b94bd6a36d48788d0b72134235e3f3dd1322dca426c9 filename: xlswired


md5: fcc1ad58da960c5780a66fcc24c6c2fa sha1: 928e4e776e82645fe14a53e2ad62b5cb75b98b53 filename: xlswired


md5: fcc1ad58da960c5780a66fcc24c6c2fa sha1: 928e4e776e82645fe14a53e2ad62b5cb75b98b53 sha256: 017e03f9185e24c30de6b94bd6a36d48788d0b72134235e3f3dd1322dca426c9


sha1: 91eeab83ddcd82a77804f2e5572d849dc846b225 sha256: 9ec7495bb6d3a7d3bfd5d5ae9e704d0f42f3136166652a5576f15d0379126d75 filename: 3156.zip


md5: 489fbca25049e5fab9dca10541e33214 sha256: 9ec7495bb6d3a7d3bfd5d5ae9e704d0f42f3136166652a5576f15d0379126d75 filename: 3156.zip


md5: 489fbca25049e5fab9dca10541e33214 sha1: 91eeab83ddcd82a77804f2e5572d849dc846b225 filename: 3156.zip


md5: 489fbca25049e5fab9dca10541e33214 sha1: 91eeab83ddcd82a77804f2e5572d849dc846b225 sha256: 9ec7495bb6d3a7d3bfd5d5ae9e704d0f42f3136166652a5576f15d0379126d75


sha1: 1aa5b4deae98f707b0a529d97fd8e7f2372c549e sha256: 7d2ae888fd06b811f6ba880c1fec3f37d49d50e0716de1b28f978240abe7795e filename: 4034


md5: a5fa43f822b6dd88298371232d49c597 sha256: 7d2ae888fd06b811f6ba880c1fec3f37d49d50e0716de1b28f978240abe7795e filename: 4034


md5: a5fa43f822b6dd88298371232d49c597 sha1: 1aa5b4deae98f707b0a529d97fd8e7f2372c549e filename: 4034


md5: a5fa43f822b6dd88298371232d49c597 sha1: 1aa5b4deae98f707b0a529d97fd8e7f2372c549e sha256: 7d2ae888fd06b811f6ba880c1fec3f37d49d50e0716de1b28f978240abe7795e


sha1: ada92c3a38e227aa8d42b4886e036caddba2cf84 sha256: 0ac2f15f3a36e67b8e03f69685193480edf3e3b10fc69ccbec76d3d5878c708c filename: bitrix.zip


md5: d08bef69aee69d91b8cd0315175f665c sha256: 0ac2f15f3a36e67b8e03f69685193480edf3e3b10fc69ccbec76d3d5878c708c filename: bitrix.zip


md5: d08bef69aee69d91b8cd0315175f665c sha1: ada92c3a38e227aa8d42b4886e036caddba2cf84 filename: bitrix.zip


md5: d08bef69aee69d91b8cd0315175f665c sha1: ada92c3a38e227aa8d42b4886e036caddba2cf84 sha256: 0ac2f15f3a36e67b8e03f69685193480edf3e3b10fc69ccbec76d3d5878c708c


sha1: 3b1329e81739b1ea6acbb4ec4dff11f02ff42570 sha256: f34bd1d485de437fe18360d1e850c3fd64415e49d691e610711d8d232071a0b1 filename: fs


md5: 89ae36448f1922870f1a09c29f17c775 sha256: f34bd1d485de437fe18360d1e850c3fd64415e49d691e610711d8d232071a0b1 filename: fs


md5: 89ae36448f1922870f1a09c29f17c775 sha1: 3b1329e81739b1ea6acbb4ec4dff11f02ff42570 filename: fs


md5: 89ae36448f1922870f1a09c29f17c775 sha1: 3b1329e81739b1ea6acbb4ec4dff11f02ff42570 sha256: f34bd1d485de437fe18360d1e850c3fd64415e49d691e610711d8d232071a0b1


sha1: 36ef757aa3eedc3ec22bb56d60931c88cc62770e sha256: c287956c4eb683e1ee62bc9ddb739d3d1c9c5dad7a73be3977bc53468665c7f7 filename: get_wp-commentin.txt


md5: 46eb5fa7c75cc29d89f3e48be26bbd46 sha256: c287956c4eb683e1ee62bc9ddb739d3d1c9c5dad7a73be3977bc53468665c7f7 filename: get_wp-commentin.txt


md5: 46eb5fa7c75cc29d89f3e48be26bbd46 sha1: 36ef757aa3eedc3ec22bb56d60931c88cc62770e filename: get_wp-commentin.txt


md5: 46eb5fa7c75cc29d89f3e48be26bbd46 sha1: 36ef757aa3eedc3ec22bb56d60931c88cc62770e sha256: c287956c4eb683e1ee62bc9ddb739d3d1c9c5dad7a73be3977bc53468665c7f7


sha1: f67dbe68fc11139b719fec11784247c5f6e7ea93 sha256: 37affeab7fb06a052413e9cc9272ea9cb2fd160fd204b506620d4303b06298c4 filename: install


md5: 848faa5839487c4331cb2a1146811f23 sha256: 37affeab7fb06a052413e9cc9272ea9cb2fd160fd204b506620d4303b06298c4 filename: install


md5: 848faa5839487c4331cb2a1146811f23 sha1: f67dbe68fc11139b719fec11784247c5f6e7ea93 filename: install


md5: 848faa5839487c4331cb2a1146811f23 sha1: f67dbe68fc11139b719fec11784247c5f6e7ea93 sha256: 37affeab7fb06a052413e9cc9272ea9cb2fd160fd204b506620d4303b06298c4


sha1: 6ffe11b31443bd9cef4928aa3f29b11d0e47ccec sha256: 6262558adf132ae3c67d6f241c7abd62f987ce2881d459a66332234971e49e95 filename: k


md5: 0cda2ee10f5b8e9a241ef3e7e352752d sha256: 6262558adf132ae3c67d6f241c7abd62f987ce2881d459a66332234971e49e95 filename: k


md5: 0cda2ee10f5b8e9a241ef3e7e352752d sha1: 6ffe11b31443bd9cef4928aa3f29b11d0e47ccec filename: k


md5: 0cda2ee10f5b8e9a241ef3e7e352752d sha1: 6ffe11b31443bd9cef4928aa3f29b11d0e47ccec sha256: 6262558adf132ae3c67d6f241c7abd62f987ce2881d459a66332234971e49e95


sha1: 27dd8d144d0ac3af9f4ad3df8a060d86166ae7a5 sha256: c738d594d09c651109c4422acbecad23a461bab6cd4eafc41546f036816533a0 filename: kit


md5: 2cad1092a2828a33df2156a3a97d7cf1 sha256: c738d594d09c651109c4422acbecad23a461bab6cd4eafc41546f036816533a0 filename: kit


md5: 2cad1092a2828a33df2156a3a97d7cf1 sha1: 27dd8d144d0ac3af9f4ad3df8a060d86166ae7a5 filename: kit


md5: 2cad1092a2828a33df2156a3a97d7cf1 sha1: 27dd8d144d0ac3af9f4ad3df8a060d86166ae7a5 sha256: c738d594d09c651109c4422acbecad23a461bab6cd4eafc41546f036816533a0


sha1: 97a3ead87af829f77dacfa23ab2786b21b427332 sha256: c0cd580d83f4171b34b956d0c29dbc8fcafba8889594d85d471c14d7cf33be79 filename: lock.zip


md5: a2ff5b0bc0782560090574c992ccf995 sha256: c0cd580d83f4171b34b956d0c29dbc8fcafba8889594d85d471c14d7cf33be79 filename: lock.zip


md5: a2ff5b0bc0782560090574c992ccf995 sha1: 97a3ead87af829f77dacfa23ab2786b21b427332 filename: lock.zip


md5: a2ff5b0bc0782560090574c992ccf995 sha1: 97a3ead87af829f77dacfa23ab2786b21b427332 sha256: c0cd580d83f4171b34b956d0c29dbc8fcafba8889594d85d471c14d7cf33be79


sha1: f07e31056001ccc26be75772c9a2f3972cd8d96a sha256: 22ab2abda59edc1b6ba733fc140ab0c6b0c503b726a377a2e2ee6e6c95644aae filename: locker


md5: d3064fe5d8a402b26099fcdbaeaedef1 sha256: 22ab2abda59edc1b6ba733fc140ab0c6b0c503b726a377a2e2ee6e6c95644aae filename: locker


md5: d3064fe5d8a402b26099fcdbaeaedef1 sha1: f07e31056001ccc26be75772c9a2f3972cd8d96a filename: locker


md5: d3064fe5d8a402b26099fcdbaeaedef1 sha1: f07e31056001ccc26be75772c9a2f3972cd8d96a sha256: 22ab2abda59edc1b6ba733fc140ab0c6b0c503b726a377a2e2ee6e6c95644aae


sha1: 7c27d25dbc01958724fd55f0fadf966e892d181e sha256: 211a73ab3fb49957277a2efb50ad3140673b65df577961a58c3c9c90791e961e filename: m


md5: fbb3f02b37b10bde868fed9d7b750fd8 sha256: 211a73ab3fb49957277a2efb50ad3140673b65df577961a58c3c9c90791e961e filename: m


md5: fbb3f02b37b10bde868fed9d7b750fd8 sha1: 7c27d25dbc01958724fd55f0fadf966e892d181e filename: m


md5: fbb3f02b37b10bde868fed9d7b750fd8 sha1: 7c27d25dbc01958724fd55f0fadf966e892d181e sha256: 211a73ab3fb49957277a2efb50ad3140673b65df577961a58c3c9c90791e961e


sha1: 6559a9eda3b8164e0c8926b4b71780f7744c4cb7 sha256: 1b96adc3c129e7e41f7c67f0d56dc05d6cdee31f69ff85f27e6a90270cfefdcf filename: rev


md5: 9b6122f1b4f6513c22b50ef05e881f38 sha256: 1b96adc3c129e7e41f7c67f0d56dc05d6cdee31f69ff85f27e6a90270cfefdcf filename: rev


md5: 9b6122f1b4f6513c22b50ef05e881f38 sha1: 6559a9eda3b8164e0c8926b4b71780f7744c4cb7 filename: rev


md5: 9b6122f1b4f6513c22b50ef05e881f38 sha1: 6559a9eda3b8164e0c8926b4b71780f7744c4cb7 sha256: 1b96adc3c129e7e41f7c67f0d56dc05d6cdee31f69ff85f27e6a90270cfefdcf


sha1: d75faee2f8ec90a69354a2c033f20e18e5ed0589 sha256: bc159721bbe192f9c5cd24d3e9356a28f5b0c6b182de9fecf0b0ac28035f566a filename: sf


md5: bc421b337fc639749528f2e756239269 sha256: bc159721bbe192f9c5cd24d3e9356a28f5b0c6b182de9fecf0b0ac28035f566a filename: sf


md5: bc421b337fc639749528f2e756239269 sha1: d75faee2f8ec90a69354a2c033f20e18e5ed0589 filename: sf


md5: bc421b337fc639749528f2e756239269 sha1: d75faee2f8ec90a69354a2c033f20e18e5ed0589 sha256: bc159721bbe192f9c5cd24d3e9356a28f5b0c6b182de9fecf0b0ac28035f566a


sha1: f640f70d1b65b0bfc8bcbf5261f3cdc85cfe7a21 sha256: 1807c7a44da958f15e4dcb77cab78e92eeb96b3ace91d6923c2022d646d5593c filename: spark


md5: 76cc921e5b26a0720db213479bff1ea2 sha256: 1807c7a44da958f15e4dcb77cab78e92eeb96b3ace91d6923c2022d646d5593c filename: spark


md5: 76cc921e5b26a0720db213479bff1ea2 sha1: f640f70d1b65b0bfc8bcbf5261f3cdc85cfe7a21 filename: spark


md5: 76cc921e5b26a0720db213479bff1ea2 sha1: f640f70d1b65b0bfc8bcbf5261f3cdc85cfe7a21 sha256: 1807c7a44da958f15e4dcb77cab78e92eeb96b3ace91d6923c2022d646d5593c


sha1: 6ff2821bef28476341b75b67d9c9f2d66d4b6cfe sha256: a5e61987676b7aed2c6d6d32c657f9351c2daa7c36365db20713dd42a03b1504 filename: w.txt


md5: 3500760bc3e69102e01d256637f5f4a8 sha256: a5e61987676b7aed2c6d6d32c657f9351c2daa7c36365db20713dd42a03b1504 filename: w.txt


md5: 3500760bc3e69102e01d256637f5f4a8 sha1: 6ff2821bef28476341b75b67d9c9f2d66d4b6cfe filename: w.txt


md5: 3500760bc3e69102e01d256637f5f4a8 sha1: 6ff2821bef28476341b75b67d9c9f2d66d4b6cfe sha256: a5e61987676b7aed2c6d6d32c657f9351c2daa7c36365db20713dd42a03b1504


sha1: 5e79fffbbafddeb2d85c8fe835b07eeda08cc319 sha256: 86bd9caab7526f2cd7e468d692ee2bac571465d25eb0619a10b0b46ae9a5b8e2 filename: wef


md5: b7735e157273a013f26515f0c969b093 sha256: 86bd9caab7526f2cd7e468d692ee2bac571465d25eb0619a10b0b46ae9a5b8e2 filename: wef


md5: b7735e157273a013f26515f0c969b093 sha1: 5e79fffbbafddeb2d85c8fe835b07eeda08cc319 filename: wef


md5: b7735e157273a013f26515f0c969b093 sha1: 5e79fffbbafddeb2d85c8fe835b07eeda08cc319 sha256: 86bd9caab7526f2cd7e468d692ee2bac571465d25eb0619a10b0b46ae9a5b8e2


sha1: 9de84bd7118dee80f5b309ddbc46dc31283cbb0e sha256: 91136b3145a52b66a3f5edd7d8a8d06698666300f24861074df1308491f50ba5 filename: y.txt


md5: 166a248f264fbf11998c86e8b384e47a sha256: 91136b3145a52b66a3f5edd7d8a8d06698666300f24861074df1308491f50ba5 filename: y.txt


md5: 166a248f264fbf11998c86e8b384e47a sha1: 9de84bd7118dee80f5b309ddbc46dc31283cbb0e filename: y.txt


md5: 166a248f264fbf11998c86e8b384e47a sha1: 9de84bd7118dee80f5b309ddbc46dc31283cbb0e sha256: 91136b3145a52b66a3f5edd7d8a8d06698666300f24861074df1308491f50ba5


sha1: 352a62abc61c93fdb08f6f4201326f147cb819ca sha256: 895988088f25c89295f1a17f222a4553eafb2137b115f2ad4a0a25d273eb6521 filename: ps


md5: 4a04baf3c65581bcd14fbaf58aa6860b sha256: 895988088f25c89295f1a17f222a4553eafb2137b115f2ad4a0a25d273eb6521 filename: ps


md5: 4a04baf3c65581bcd14fbaf58aa6860b sha1: 352a62abc61c93fdb08f6f4201326f147cb819ca filename: ps


md5: 4a04baf3c65581bcd14fbaf58aa6860b sha1: 352a62abc61c93fdb08f6f4201326f147cb819ca sha256: 895988088f25c89295f1a17f222a4553eafb2137b115f2ad4a0a25d273eb6521


sha1: a16120cca64e0c9a73f02975691e4675bb4c44a4 sha256: a6dfef8616959969c06b65685e39929630f2819e6d5920498cdb1e89185ab7cd filename: netstat


md5: 83b8aa078be2a0a5ca0ebf1968989a4b sha256: a6dfef8616959969c06b65685e39929630f2819e6d5920498cdb1e89185ab7cd filename: netstat


md5: 83b8aa078be2a0a5ca0ebf1968989a4b sha1: a16120cca64e0c9a73f02975691e4675bb4c44a4 filename: netstat


md5: 83b8aa078be2a0a5ca0ebf1968989a4b sha1: a16120cca64e0c9a73f02975691e4675bb4c44a4 sha256: a6dfef8616959969c06b65685e39929630f2819e6d5920498cdb1e89185ab7cd


sha1: 1af6946263f4f548ffcf510c9f68378a4d7e0895 sha256: 20927a1fc3441668264673d77c81652818a630f3b2055545b0e0938c523827c3 filename: ps


md5: b7db832b2598c83b7b077ce603a3ff73 sha256: 20927a1fc3441668264673d77c81652818a630f3b2055545b0e0938c523827c3 filename: ps


md5: b7db832b2598c83b7b077ce603a3ff73 sha1: 1af6946263f4f548ffcf510c9f68378a4d7e0895 filename: ps


md5: b7db832b2598c83b7b077ce603a3ff73 sha1: 1af6946263f4f548ffcf510c9f68378a4d7e0895 sha256: 20927a1fc3441668264673d77c81652818a630f3b2055545b0e0938c523827c3


sha1: ad6653a7ee1bcb9590f5da12cf46d856135bbb71 sha256: 10f1aa385108a88a15c281774f424e18070dcc256d0f778883efe6d7bcacacb6 filename: ss


md5: 415d091f42fc62e8dfb6f8bb5ce641c5 sha256: 10f1aa385108a88a15c281774f424e18070dcc256d0f778883efe6d7bcacacb6 filename: ss


md5: 415d091f42fc62e8dfb6f8bb5ce641c5 sha1: ad6653a7ee1bcb9590f5da12cf46d856135bbb71 filename: ss


md5: 415d091f42fc62e8dfb6f8bb5ce641c5 sha1: ad6653a7ee1bcb9590f5da12cf46d856135bbb71 sha256: 10f1aa385108a88a15c281774f424e18070dcc256d0f778883efe6d7bcacacb6


sha1: 1fc930a59587fd9faf7536add47d92de0cecea53 sha256: a9b1a99729860c004fbef463958871956cbb3c8e365383042978c260012055bd filename: htop


md5: cded33e0e37e14bbf7cac53c4e305ece sha256: a9b1a99729860c004fbef463958871956cbb3c8e365383042978c260012055bd filename: htop


md5: cded33e0e37e14bbf7cac53c4e305ece sha1: 1fc930a59587fd9faf7536add47d92de0cecea53 filename: htop


md5: cded33e0e37e14bbf7cac53c4e305ece sha1: 1fc930a59587fd9faf7536add47d92de0cecea53 sha256: a9b1a99729860c004fbef463958871956cbb3c8e365383042978c260012055bd


sha1: 1d4c0b3c74ddacf7459743cc60dd2a819c0c7e27 sha256: 7e8bde3e34fbf9b99b7915e12de42f6b806153e44b6aaf68b172db50e18e3b9e filename: netstat


md5: eda9ca5f9405b5e2d004a4ba5c0dcd16 sha256: 7e8bde3e34fbf9b99b7915e12de42f6b806153e44b6aaf68b172db50e18e3b9e filename: netstat


md5: eda9ca5f9405b5e2d004a4ba5c0dcd16 sha1: 1d4c0b3c74ddacf7459743cc60dd2a819c0c7e27 filename: netstat


md5: eda9ca5f9405b5e2d004a4ba5c0dcd16 sha1: 1d4c0b3c74ddacf7459743cc60dd2a819c0c7e27 sha256: 7e8bde3e34fbf9b99b7915e12de42f6b806153e44b6aaf68b172db50e18e3b9e


sha1: 7e0a4c53bf3dfcb08993231539986a220a6803fd sha256: ac0906ff674c555e102f076100d0c12ea4a4aa7d74cc15f67c4038a84100f4cf filename: ps


md5: d215a54c581ab62079389c852d9ef84f sha256: ac0906ff674c555e102f076100d0c12ea4a4aa7d74cc15f67c4038a84100f4cf filename: ps


md5: d215a54c581ab62079389c852d9ef84f sha1: 7e0a4c53bf3dfcb08993231539986a220a6803fd filename: ps


md5: d215a54c581ab62079389c852d9ef84f sha1: 7e0a4c53bf3dfcb08993231539986a220a6803fd sha256: ac0906ff674c555e102f076100d0c12ea4a4aa7d74cc15f67c4038a84100f4cf


sha1: 2683dcce7fc3886f8305030b128103bd82cea528 sha256: 8fe0ba1cb68225ab9a2cb11c1419f52adb03898c5f11d2221ba9765843443d24 filename: ss


md5: ffc418b222c08f3071ff53cde4acb22e sha256: 8fe0ba1cb68225ab9a2cb11c1419f52adb03898c5f11d2221ba9765843443d24 filename: ss


md5: ffc418b222c08f3071ff53cde4acb22e sha1: 2683dcce7fc3886f8305030b128103bd82cea528 filename: ss


md5: ffc418b222c08f3071ff53cde4acb22e sha1: 2683dcce7fc3886f8305030b128103bd82cea528 sha256: 8fe0ba1cb68225ab9a2cb11c1419f52adb03898c5f11d2221ba9765843443d24


Latrodectus bot


Stealer module


Sysinfo module


MD5s / Downloader Batch (tun02.bat)


MD5s / SoftEther Config (vpn_server.config)


C&C Server / VPN server


Download


AsyncRat LNK


DuckTail LNK


Rhadamathys LNK


Remcos LNK


Recon LNK


FATLNK


Forfiles LNK


An .lnk that was created following the execution of CleanUp30.dll


The hosting the malicious TMSSetup (1).exe and MSTeamsSetup_c_l_.exe


The typo-squatted that users visited


Part of the redirect chain for downloads of TMSSetup (1).exe and MSTeamsSetup_c_l_.exe


that CleanUp30.dll and CleanUp.dll attempts to communicate with


Resolving for whereverhomebe[.]com


Resolving for supfoundrysettlers[.]us


Resolving for retdirectyourman[.]eu


polyswarm link list -t CosmicLeopard


TA571 campaign reply-to / 28 May 2024


TA571 HTML Attachment Example / 28 May 2024


TA571 clipboard payload (NetSupport RAT) / 28 May 2024


TA571 clipboard payload (DarkGate) / 28 May 2024


TA571 HTA payload (DarkGate) / 28 May 2024


TA571 Clipboard to DarkGate / 28 May 2024


TA571 HTML Attachment Example / 27 May 2024


TA571 PowerShell Payload / 27 May 2024


DarkGate C2 / 27 May 2024


TA571 Payload / 17 May 2024


TA571 Clipboard to DarkGate / 17 May 2024


DarkGate C2 / 17 May 2024


ClearFake PowerShell Payload / 14 May 2024


CopyFix PowerShell Payload / 11 May 2024


TA571 HTML Attachment Example / 1 March 2024


Shinra Ransomware File


Limpopo Ransomware File


observed attempting to exploit CVE-2024-4577


sha1: c1bf9d69b90a686575c86d188e5ee88a66b72298 sha256: a73e8516105a95e699bf1ac4cb1ec7a28452c41aba1045e0483eb71dbbebd162 filename: binary.exe


md5: 7647b2fd4e998efa942aa3e6607411e0 sha256: a73e8516105a95e699bf1ac4cb1ec7a28452c41aba1045e0483eb71dbbebd162 filename: binary.exe


md5: 7647b2fd4e998efa942aa3e6607411e0 sha1: c1bf9d69b90a686575c86d188e5ee88a66b72298 filename: binary.exe


md5: 7647b2fd4e998efa942aa3e6607411e0 sha1: c1bf9d69b90a686575c86d188e5ee88a66b72298 sha256: a73e8516105a95e699bf1ac4cb1ec7a28452c41aba1045e0483eb71dbbebd162


sha1: c44ba687f87b015dd06f671f5eb7f8e25a28ec2a sha256: 0feb59cdb7082845e568eb2829a923a2ffaad84abaff43ef3eda416578470155 filename: GIT.dll


md5: 296100e39cf44e1250532c9440d48ed3 sha256: 0feb59cdb7082845e568eb2829a923a2ffaad84abaff43ef3eda416578470155 filename: GIT.dll


md5: 296100e39cf44e1250532c9440d48ed3 sha1: c44ba687f87b015dd06f671f5eb7f8e25a28ec2a filename: GIT.dll


md5: 296100e39cf44e1250532c9440d48ed3 sha1: c44ba687f87b015dd06f671f5eb7f8e25a28ec2a sha256: 0feb59cdb7082845e568eb2829a923a2ffaad84abaff43ef3eda416578470155


$ polyswarm link list -f RansomHub


UTA0137 related indicators, sha1: 1c8cfa8f36897b6b1179dc4bce49b0e2f86e1a4e sha256: 5ecbc33fe3b345f2956cff566203e33b9390a3ed9923b990a46804880ae2f59b


UTA0137 related indicators, md5: 52992eb3a59d7acb736cf9b607337d62 sha256: 5ecbc33fe3b345f2956cff566203e33b9390a3ed9923b990a46804880ae2f59b


UTA0137 related indicators, md5: 52992eb3a59d7acb736cf9b607337d62 sha1: 1c8cfa8f36897b6b1179dc4bce49b0e2f86e1a4e


UTA0137 related indicators, sha1: 31a1b6e836684c6d7b5d8f7a099dbe090282cbb0 sha256: cfb9ffb83877b421e95c9a2c3f65c106b9afb42babce7ba824671f9736bf0f7c


UTA0137 related indicators, md5: 49cbbf586ba1480599be02915e5a8b34 sha256: cfb9ffb83877b421e95c9a2c3f65c106b9afb42babce7ba824671f9736bf0f7c


UTA0137 related indicators, md5: 49cbbf586ba1480599be02915e5a8b34 sha1: 31a1b6e836684c6d7b5d8f7a099dbe090282cbb0


UTA0137 related indicators, sha1: 1443e58a298458c30ab91b37c0335bdadbacd756 sha256: 51a372fee89f885741515fa6fdf0ebce860f98145c9883f2e3e35c0fe4432885


UTA0137 related indicators, md5: 50fe93394528a0ede52f9eec6c1bf505 sha256: 51a372fee89f885741515fa6fdf0ebce860f98145c9883f2e3e35c0fe4432885


UTA0137 related indicators, md5: 50fe93394528a0ede52f9eec6c1bf505 sha1: 1443e58a298458c30ab91b37c0335bdadbacd756


UTA0137 related indicators, sha1: 0d4111ab5471c7f5b909bff336ba8cd66f9d8630 sha256: d9f29a626857fa251393f056e454dfc02de53288ebe89a282bad38d03f614529


UTA0137 related indicators, md5: d5f2e3fafbb0701dc0f1adccc7141e63 sha256: d9f29a626857fa251393f056e454dfc02de53288ebe89a282bad38d03f614529


UTA0137 related indicators, md5: d5f2e3fafbb0701dc0f1adccc7141e63 sha1: 0d4111ab5471c7f5b909bff336ba8cd66f9d8630


UTA0137 related indicators, sha1: 789b41ddcee0166349cc106044932c76bfcb8cc0 sha256: 9709b0876c2a291cb57aa0646f9179d29d89abb2f8868663147ab0ca4e6c501b


UTA0137 related indicators, md5: de115e15a6689cf32519c3a046a78626 sha256: 9709b0876c2a291cb57aa0646f9179d29d89abb2f8868663147ab0ca4e6c501b


UTA0137 related indicators, md5: de115e15a6689cf32519c3a046a78626 sha1: 789b41ddcee0166349cc106044932c76bfcb8cc0


UTA0137 related indicators, sha1: 765b17c1e2e1ab3d2fbdba3ccffcdcc4bd750102 sha256: 1cdf1f32f31e226f037fda562985e481b7aa0b809971f2e40b713b034cf1d44e


UTA0137 related indicators, md5: db0676733eb4ee2c490bdc4fe488b40f sha256: 1cdf1f32f31e226f037fda562985e481b7aa0b809971f2e40b713b034cf1d44e


UTA0137 related indicators, md5: db0676733eb4ee2c490bdc4fe488b40f sha1: 765b17c1e2e1ab3d2fbdba3ccffcdcc4bd750102


UTA0137 related indicators, sha1: 465ef9d21e73493e9d531378756f91917f9567f4 sha256: 1387b77a41e5a244c03ea7f5c90a2e528abe0ed7a4e6cb659183f7112c546046


UTA0137 related indicators, md5: da745b60b5ef5b4881c6bc4b7a48d784 sha256: 1387b77a41e5a244c03ea7f5c90a2e528abe0ed7a4e6cb659183f7112c546046


UTA0137 related indicators, md5: da745b60b5ef5b4881c6bc4b7a48d784 sha1: 465ef9d21e73493e9d531378756f91917f9567f4


UTA0137 related indicators, sha1: 8c969dbe0fe30244802cda1c8e33b04040831466 sha256: 26bf853b951e8d8ba6007e9d5c77f441faa739171e95f27f8d3851e07bc65b11


UTA0137 related indicators, md5: 13ee4bd10f05ee0499e18de68b3ea4d5 sha256: 26bf853b951e8d8ba6007e9d5c77f441faa739171e95f27f8d3851e07bc65b11


UTA0137 related indicators, md5: 13ee4bd10f05ee0499e18de68b3ea4d5 sha1: 8c969dbe0fe30244802cda1c8e33b04040831466


UTA0137 related indicators, sha1: 749a8d081e075b921436d07e323964da88bff609 sha256: 1e657d3047f3534dcd4539ce54db9f5901f7e53999bae340a850cc8d2aacc33c


UTA0137 related indicators, md5: 56cc70b66be99e01d354ba2aaf88041e sha256: 1e657d3047f3534dcd4539ce54db9f5901f7e53999bae340a850cc8d2aacc33c


UTA0137 related indicators, md5: 56cc70b66be99e01d354ba2aaf88041e sha1: 749a8d081e075b921436d07e323964da88bff609


UTA0137 related indicators, sha1: e19c23d82d7e7e8e45b1d830ddc7ddb85087c4cc sha256: fb30e5c67b92dc17d7a6e412f36d9b521842f8d7df38a00584c1362303b26655


UTA0137 related indicators, md5: f68b17f1261aaa4460d759d95124fbd4 sha256: fb30e5c67b92dc17d7a6e412f36d9b521842f8d7df38a00584c1362303b26655


UTA0137 related indicators, md5: f68b17f1261aaa4460d759d95124fbd4 sha1: e19c23d82d7e7e8e45b1d830ddc7ddb85087c4cc


UTA0137 related indicators, sha1: c45e1cc5cd0c98388ec71221278950f9b1257ed8 sha256: 5821744413146654397903128fece87d7d9d71c4ade5fd40cdcf3cece2faf8f0


UTA0137 related indicators, md5: 3d4e5dbf9b7a6e7336a354b71d4d1a8b sha256: 5821744413146654397903128fece87d7d9d71c4ade5fd40cdcf3cece2faf8f0


UTA0137 related indicators, md5: 3d4e5dbf9b7a6e7336a354b71d4d1a8b sha1: c45e1cc5cd0c98388ec71221278950f9b1257ed8


UTA0137 related indicators, sha1: d0aff8489c02230d4c0935e21125f81895bf6cde sha256: 2abaae4f6794131108adf5b42e09ee5ce24769431a0e154feabe6052cfe70bf3


UTA0137 related indicators, md5: 9821c180f81512f1b72c46e462fc759a sha256: 2abaae4f6794131108adf5b42e09ee5ce24769431a0e154feabe6052cfe70bf3


UTA0137 related indicators, md5: 9821c180f81512f1b72c46e462fc759a sha1: d0aff8489c02230d4c0935e21125f81895bf6cde


UTA0137 related indicators, sha1: 25dc7c1237e5076c80fb867fb11d058387e1d154 sha256: d3d5d0b210c3fc5c679419d6aa9014f62dcd60b0582cd8d544357f6420407b36


UTA0137 related indicators, md5: e6667ab32fbda86a2d2a72ed7e52b146 sha256: d3d5d0b210c3fc5c679419d6aa9014f62dcd60b0582cd8d544357f6420407b36


UTA0137 related indicators, md5: e6667ab32fbda86a2d2a72ed7e52b146 sha1: 25dc7c1237e5076c80fb867fb11d058387e1d154


UTA0137 related indicators, sha1: c1916403a6ad05fed4da5fb53ce743b6ce49e0cb sha256: c177361992b207575b9aeb98aad7c2d522eace7ada6f1351434dd79a921ce260


UTA0137 related indicators, md5: 60fc5dc410b7482566a74d03549d8246 sha256: c177361992b207575b9aeb98aad7c2d522eace7ada6f1351434dd79a921ce260


UTA0137 related indicators, md5: 60fc5dc410b7482566a74d03549d8246 sha1: c1916403a6ad05fed4da5fb53ce743b6ce49e0cb


UTA0137 related indicators, sha1: 5b7b0b0d7d59e616b0cf75a25ad67dfca89495c4 sha256: bac7e6776c120b2b5da4d171afaea26144e77ad54f7516a0325260ee020b3f52


UTA0137 related indicators, md5: 898bfd3df2ccd9508e0bfab672f5f61a sha256: bac7e6776c120b2b5da4d171afaea26144e77ad54f7516a0325260ee020b3f52


UTA0137 related indicators, md5: 898bfd3df2ccd9508e0bfab672f5f61a sha1: 5b7b0b0d7d59e616b0cf75a25ad67dfca89495c4


UTA0137 related indicators, sha1: 34cefe42aa8347c39a04eaca5a464fa35d6f1e62 sha256: db91e23d9715464511057f2e15c9adc97d3f27fcfa308f05ac7e2de7275fdd32


UTA0137 related indicators, md5: 237961bbba6d4aa2e0fae720d4ece439 sha256: db91e23d9715464511057f2e15c9adc97d3f27fcfa308f05ac7e2de7275fdd32


UTA0137 related indicators, md5: 237961bbba6d4aa2e0fae720d4ece439 sha1: 34cefe42aa8347c39a04eaca5a464fa35d6f1e62


pyc file which downloads and executes a file, sha1: caa130a8e3f5ca0a7f33de4b2b26e0e25dd10775 sha256: 4ddf0c70be0b81ab44f018521f788213de2ccf72b7a7f452f327b81172014182


pyc file which downloads and executes a file, md5: 199c855998aedb0ce46e8d34c05eb0cb sha256: 4ddf0c70be0b81ab44f018521f788213de2ccf72b7a7f452f327b81172014182


pyc file which downloads and executes a file, md5: 199c855998aedb0ce46e8d34c05eb0cb sha1: caa130a8e3f5ca0a7f33de4b2b26e0e25dd10775


UTA0137 related indicators, sha1: c1a80dd5be2de92a5a32d81a9fc146d4fd52ddb6 sha256: 207334927fc39278e37afe124769ed980e9a8ae86b0346408af64c86a7c99e6a


UTA0137 related indicators, md5: e0102071722a87f119b12434ae651b48 sha256: 207334927fc39278e37afe124769ed980e9a8ae86b0346408af64c86a7c99e6a


UTA0137 related indicators, md5: e0102071722a87f119b12434ae651b48 sha1: c1a80dd5be2de92a5a32d81a9fc146d4fd52ddb6


UTA0137 related indicators, sha1: 513b4b604d198f44041ed494ee8c7a7f94ac5038 sha256: 3d1b3ba5e1c1d1626595098f042913bc39601c80ab2c934cb994d3c053f218c5


UTA0137 related indicators, md5: 635864ff270cf8e366a7747fb5996766 sha256: 3d1b3ba5e1c1d1626595098f042913bc39601c80ab2c934cb994d3c053f218c5


UTA0137 related indicators, md5: 635864ff270cf8e366a7747fb5996766 sha1: 513b4b604d198f44041ed494ee8c7a7f94ac5038


UTA0137 related indicators, sha1: 88949119f88b15722a2b75ca84db7a6bfc822948 sha256: 0c284271e3d90a6673d84cf6291f92f32ade7c7f760bbe135880b949b38046ee


UTA0137 related indicators, md5: 20b4eb5787faa00474f7d27c0fea1e4b sha256: 0c284271e3d90a6673d84cf6291f92f32ade7c7f760bbe135880b949b38046ee


UTA0137 related indicators, md5: 20b4eb5787faa00474f7d27c0fea1e4b sha1: 88949119f88b15722a2b75ca84db7a6bfc822948


UTA0137 related indicators, sha1: af137c7d1481e45217abd24a96f8aa2b416d294c sha256: 03666fb1c21d8a8cf38219691d2218d78eef5b00d20f26c25afde5d9e1daf80a


UTA0137 related indicators, md5: 3ce8dfb3f1bff805cb6b85a9e950b3a2 sha256: 03666fb1c21d8a8cf38219691d2218d78eef5b00d20f26c25afde5d9e1daf80a


UTA0137 related indicators, md5: 3ce8dfb3f1bff805cb6b85a9e950b3a2 sha1: af137c7d1481e45217abd24a96f8aa2b416d294c


UTA0137 related indicators, sha1: b8fd89cf6e9aae16321553a2e632e31b2cf2f057 sha256: e89589e9ce043b28def17c91fa780322205ee08daa8b3cffe67b46bdae0e3a35


UTA0137 related indicators, md5: 01c34ccd7ca7c5cdf88272d8c9071004 sha256: e89589e9ce043b28def17c91fa780322205ee08daa8b3cffe67b46bdae0e3a35


UTA0137 related indicators, md5: 01c34ccd7ca7c5cdf88272d8c9071004 sha1: b8fd89cf6e9aae16321553a2e632e31b2cf2f057


UTA0137 related indicators, sha1: 892d434f3f59b3b8bd4ca500218a75d39c13ee5b sha256: 0cb88c8b8e2969af26678df4d3c395101c49c7c808d2cb2d7a0f00f60bdddcba


UTA0137 related indicators, md5: 501a6d48fd8f80a134cf71db3804cf95 sha256: 0cb88c8b8e2969af26678df4d3c395101c49c7c808d2cb2d7a0f00f60bdddcba


UTA0137 related indicators, md5: 501a6d48fd8f80a134cf71db3804cf95 sha1: 892d434f3f59b3b8bd4ca500218a75d39c13ee5b


UTA0137 related indicators, sha1: bcadcb345fc65a9c3d7c78566ad72a77c6076a11 sha256: 3845877017eb07be71820e8514502a3dcd24177540591c5ce2c13aca94caa4ac


UTA0137 related indicators, md5: f14e778f4d22df275c817ac3014873dc sha256: 3845877017eb07be71820e8514502a3dcd24177540591c5ce2c13aca94caa4ac


UTA0137 related indicators, md5: f14e778f4d22df275c817ac3014873dc sha1: bcadcb345fc65a9c3d7c78566ad72a77c6076a11


UTA0137 related indicators, sha1: 4e2b14b18f5d68ce3dada1061526b03eafcd50b8 sha256: af2201af8054e8e11eef7980fe15dc62eb2b7582f4f2bab4d8256f23f6db984e


UTA0137 related indicators, md5: c9969ece7bb47efac4b3b04cdc1538e5 sha256: af2201af8054e8e11eef7980fe15dc62eb2b7582f4f2bab4d8256f23f6db984e


UTA0137 related indicators, md5: c9969ece7bb47efac4b3b04cdc1538e5 sha1: 4e2b14b18f5d68ce3dada1061526b03eafcd50b8


UTA0137 related indicators, sha1: 5dd201fa53cb5c76103579785a3d220d578dd12a sha256: db9afd2c59f20e04db37ddd38d1e911cdb4bddf39c24e4ce7cedda4eec984604


UTA0137 related indicators, md5: 56cb95b63162d0dfceb30100ded1131a sha256: db9afd2c59f20e04db37ddd38d1e911cdb4bddf39c24e4ce7cedda4eec984604


UTA0137 related indicators, md5: 56cb95b63162d0dfceb30100ded1131a sha1: 5dd201fa53cb5c76103579785a3d220d578dd12a


UTA0137 related indicators, sha1: 630530b11cbde6de840d7326152c1cb6bae06e0a sha256: 6c2f18f5d70f794b8826ee2575d973ddb07cbf9d15115973fe92df74079b6412


UTA0137 related indicators, md5: fc61b985d8c590860f397d943131bfb5 sha256: 6c2f18f5d70f794b8826ee2575d973ddb07cbf9d15115973fe92df74079b6412


UTA0137 related indicators, md5: fc61b985d8c590860f397d943131bfb5 sha1: 630530b11cbde6de840d7326152c1cb6bae06e0a


UTA0137 related indicators, sha1: 6f3f3c533a2b9031362d88bb7414bf332c93dc9d sha256: 2cec6bd5e9ff046771623cfa0802cacd78b7521bf61b144e9c8dfa77d994927c


UTA0137 related indicators, md5: f2501e8b57486c427579eeda20b729fd sha256: 2cec6bd5e9ff046771623cfa0802cacd78b7521bf61b144e9c8dfa77d994927c


UTA0137 related indicators, md5: f2501e8b57486c427579eeda20b729fd sha1: 6f3f3c533a2b9031362d88bb7414bf332c93dc9d


UTA0137 related indicators, sha1: 7515a93da10b7d3f4619a38cc3f1a1bd25ddb847 sha256: dfb72668791b4fe28884706b7756b02b951b43219e528b970ceb0369c86e3fd3


UTA0137 related indicators, md5: ee8d767069faf558886f1163a92e4009 sha256: dfb72668791b4fe28884706b7756b02b951b43219e528b970ceb0369c86e3fd3


UTA0137 related indicators, md5: ee8d767069faf558886f1163a92e4009 sha1: 7515a93da10b7d3f4619a38cc3f1a1bd25ddb847


UTA0137 related indicators, sha1: 038ae7e6e6708cb58db96512515177d84b71e8c2 sha256: 1b1d1d775571232235ed6fb84413eb60593340c1c1ea3b77bd72d3b68058f55c


UTA0137 related indicators, md5: 9f3359ae571c247a8be28c0684678304 sha256: 1b1d1d775571232235ed6fb84413eb60593340c1c1ea3b77bd72d3b68058f55c


UTA0137 related indicators, md5: 9f3359ae571c247a8be28c0684678304 sha1: 038ae7e6e6708cb58db96512515177d84b71e8c2


UTA0137 related indicators, sha1: bfdd02fa593d3858399da6bf591aeb10b2d1da40 sha256: 76d9654f28bcaa713a99caa2839a572fc999a726827a0216da71ac184cee6d19


UTA0137 related indicators, md5: f5d8664cbf4a9e154d4a888e4384cb1d sha256: 76d9654f28bcaa713a99caa2839a572fc999a726827a0216da71ac184cee6d19


UTA0137 related indicators, md5: f5d8664cbf4a9e154d4a888e4384cb1d sha1: bfdd02fa593d3858399da6bf591aeb10b2d1da40


UTA0137 related indicators, sha1: c1c3454ed5bf32f22c855b19618bcd16e6549df8 sha256: 37bfa72c2820bcf9adb8707ae624452e0b769bc1c1f2a24ebb518c6e1794f3e2


UTA0137 related indicators, md5: a9182c812c7f7d3e505677a57c8a353b sha256: 37bfa72c2820bcf9adb8707ae624452e0b769bc1c1f2a24ebb518c6e1794f3e2


UTA0137 related indicators, md5: a9182c812c7f7d3e505677a57c8a353b sha1: c1c3454ed5bf32f22c855b19618bcd16e6549df8


UTA0137 related indicators, sha1: e5182d13d66c3efaa7676510581d622f98471895 sha256: c981aa1f05adf030bacffc0e279cf9dc93cef877f7bce33ee27e9296363cf002


UTA0137 related indicators, md5: 2d4a5050c7ea6c83665807df151e067e sha256: c981aa1f05adf030bacffc0e279cf9dc93cef877f7bce33ee27e9296363cf002


UTA0137 related indicators, md5: 2d4a5050c7ea6c83665807df151e067e sha1: e5182d13d66c3efaa7676510581d622f98471895


UTA0137 related indicators, sha1: 2dfe824d0298201e0efb30f16b3ce8a409ffe006 sha256: 38e1c0ca15ed83ed27148c31a31e0b33de627519ab2929d4aa69484534589086


UTA0137 related indicators, md5: cd7067d58e2319ebc8ed0ecd6b61b2b6 sha256: 38e1c0ca15ed83ed27148c31a31e0b33de627519ab2929d4aa69484534589086


UTA0137 related indicators, md5: cd7067d58e2319ebc8ed0ecd6b61b2b6 sha1: 2dfe824d0298201e0efb30f16b3ce8a409ffe006


UTA0137 related indicators, sha1: e76c3f3a7158c16c28176053286dcb88ac646dbf sha256: 8c8ef2d850bd9c987604e82571706e11612946122c6ab089bd54440c0113968e


UTA0137 related indicators, md5: 55c90ff429e4fd72034922383aa31078 sha256: 8c8ef2d850bd9c987604e82571706e11612946122c6ab089bd54440c0113968e


UTA0137 related indicators, md5: 55c90ff429e4fd72034922383aa31078 sha1: e76c3f3a7158c16c28176053286dcb88ac646dbf


UTA0137 related indicators, sha1: 2c99e7e8a8a2965a6581729ec5b254f1b2bbda4b sha256: ae59ba12ec6a42ee5b08c3e2ce91ec02071b2f5ad9338e3a19d690bd68acb860


UTA0137 related indicators, md5: 2bf596603c432fa46b494dc3edd2d30f sha256: ae59ba12ec6a42ee5b08c3e2ce91ec02071b2f5ad9338e3a19d690bd68acb860


UTA0137 related indicators, md5: 2bf596603c432fa46b494dc3edd2d30f sha1: 2c99e7e8a8a2965a6581729ec5b254f1b2bbda4b


UTA0137 related indicators, sha1: e1bdb995998ab338fc596777a78121fc49f002b5 sha256: 9c1ffafe0bb4388569fed2a8d4af591ce65ae00f47793ee97c07f686c5fab100


UTA0137 related indicators, md5: 9f24f757b151a1d81f714075fe7d33d4 sha256: 9c1ffafe0bb4388569fed2a8d4af591ce65ae00f47793ee97c07f686c5fab100


UTA0137 related indicators, md5: 9f24f757b151a1d81f714075fe7d33d4 sha1: e1bdb995998ab338fc596777a78121fc49f002b5


UTA0137 related indicators, sha1: 3dff44bede709295fffd3ae3e9599f6ab8197af4 sha256: 1e45d68106ca78f46be508427362b8ce24fdf5485c368f9369c913935cf04f99


UTA0137 related indicators, md5: 8bf9cf1363e404a9ad3e0fa9e53057cb sha256: 1e45d68106ca78f46be508427362b8ce24fdf5485c368f9369c913935cf04f99


UTA0137 related indicators, md5: 8bf9cf1363e404a9ad3e0fa9e53057cb sha1: 3dff44bede709295fffd3ae3e9599f6ab8197af4


UTA0137 related indicators, sha1: 7679f0e499edc2079a812cca945841c3680256d5 sha256: 0b5cf9bd917f0af03dd694ff4ce39b0b34a97c9f41b87feac1dc884a684f60ef


UTA0137 related indicators, md5: fbcd468dcd05cd1bf2ee25f16d09c227 sha256: 0b5cf9bd917f0af03dd694ff4ce39b0b34a97c9f41b87feac1dc884a684f60ef


UTA0137 related indicators, md5: fbcd468dcd05cd1bf2ee25f16d09c227 sha1: 7679f0e499edc2079a812cca945841c3680256d5


UTA0137 related indicators, sha1: dab2f50307c86544719ae5f72d386ac8bc4d01e3 sha256: 98b24fb7aaaece7556aea2269b4e908dd79ff332ddaa5111caec49123840f364


UTA0137 related indicators, md5: 777cbc972609d26fe6597a442cdf4589 sha256: 98b24fb7aaaece7556aea2269b4e908dd79ff332ddaa5111caec49123840f364


UTA0137 related indicators, md5: 777cbc972609d26fe6597a442cdf4589 sha1: dab2f50307c86544719ae5f72d386ac8bc4d01e3


UTA0137 related indicators, sha1: 616661c324a8dfb836bd88a3c1325dc79e030ddd sha256: 74e0af32c47e3bbe6becfb4027bbdcc01fbe36c92c70ce8edd676cc9aa3d6437


UTA0137 related indicators, md5: 95e17125be0b0f4a4ea1b3d01cc73238 sha256: 74e0af32c47e3bbe6becfb4027bbdcc01fbe36c92c70ce8edd676cc9aa3d6437


UTA0137 related indicators, md5: 95e17125be0b0f4a4ea1b3d01cc73238 sha1: 616661c324a8dfb836bd88a3c1325dc79e030ddd


UTA0137 related indicators, sha1: d6855190e00276cad29a31573f819558256abe7f sha256: 1844156b1a72a7daa8de4139175a2bdeb4bd326b9e3e1fb4dd2ae00b313b0a44


UTA0137 related indicators, md5: 04a3f16c76f2e6d9eba34dd132fc8c27 sha256: 1844156b1a72a7daa8de4139175a2bdeb4bd326b9e3e1fb4dd2ae00b313b0a44


UTA0137 related indicators, md5: 04a3f16c76f2e6d9eba34dd132fc8c27 sha1: d6855190e00276cad29a31573f819558256abe7f


UTA0137 related indicators, sha1: 9244a07ce8f961317ba49e497009e55889f1d50d sha256: fe7e7a5a1b1d634dec3fc9c6bc91c6e96ec635fece5af10cfac894fd228ca38d


UTA0137 related indicators, md5: 9012904377e6934797c8689b8c9268c6 sha256: fe7e7a5a1b1d634dec3fc9c6bc91c6e96ec635fece5af10cfac894fd228ca38d


UTA0137 related indicators, md5: 9012904377e6934797c8689b8c9268c6 sha1: 9244a07ce8f961317ba49e497009e55889f1d50d


UTA0137 related indicators, sha1: 40e4b466e41b440ff62d9ef35f7034fd157ca625 sha256: ead993c1d537c239750e19a5700a58501dab319d5d271bf85137608448c1faa0


UTA0137 related indicators, md5: b4983913d49a2a49545ebe59cd27a7d1 sha256: ead993c1d537c239750e19a5700a58501dab319d5d271bf85137608448c1faa0


UTA0137 related indicators, md5: b4983913d49a2a49545ebe59cd27a7d1 sha1: 40e4b466e41b440ff62d9ef35f7034fd157ca625


UTA0137 related indicators, sha1: fc5ccb2b0a0b536ccb9687c67cc4ce735b866635 sha256: 5ef431a481c9baeb1d8cfaf6e1c323531a57c14a5b878575b267f2f969451fdb


UTA0137 related indicators, md5: 2c06e31bc2969df108697061325b2e8a sha256: 5ef431a481c9baeb1d8cfaf6e1c323531a57c14a5b878575b267f2f969451fdb


UTA0137 related indicators, md5: 2c06e31bc2969df108697061325b2e8a sha1: fc5ccb2b0a0b536ccb9687c67cc4ce735b866635


UTA0137 related indicators


ipaddress / UTA0137 related indicators


This sample is provided to our readers to aid in their detections


Nitol MD5s


NiceRAT MD5s


AsyncRAT MD5s


NanoCore MD5s


Dropper MD5s


C&Cs


Payloads: / SolarPhantom


Payloads: / StellarInjector


Payloads: / Backdoor (initial payload), filename: IcebreakersTeamBuildingActivitiesandEnergizers.exe


Payloads: / Backdoor (initial payload), md5: 8ac77f704640fa1c8feb9172302bf313


5F0213BA62B84221C962 8F7D0A0CF87F27A45A28 / Android/Spy.AridSpy.A / The first stage of AridSpy


797073511A15EB85C1E9 D8584B26BAA3A0B14C9E / Android/Spy.AridSpy.A / AridSpy trojanized application


A934FB482F61D85DDA5E 52A7015F1699BF55B5A9 / Android/Spy.AridSpy.A / The first stage of AridSpy


F49B00896C99EA030DCC A0808B87E414BBDE1549 / Android/Spy.AridSpy.A / AridSpy trojanized application


568E62ABC0948691D672 36D9290D68DE34BD6C75 / Android/Spy.AridSpy.A / AridSpy trojanized application


DB6B6326B772257FDDCB 4BE7CF1A0CC0322387D8 / Android/Spy.AridSpy.A / AridSpy trojanized application


B806B89B8C44F4674888 8C1F8C3F05DF2387DF19 / Android/Spy.AridSpy.A / AridSpy trojanized application


E71F1484B1E3ACB4C8E8 525BA1F5F8822AB7238B / Android/Spy.AridSpy.A / The second stage of AridSpy


C999ACE5325B7735255D 9EE2DD782179AE21A673 / Android/Spy.AridSpy.A / The first stage of AridSpy


LeaseWeb USA, Inc. Seattle / 2023‑05‑25 / C&C server


LeaseWeb USA, Inc. Seattle / 2023‑08‑19 / C&C server


Hostwinds LLC. / 2023‑05‑01 / Distribution website


Google LLC / 2024‑02‑15 / C&C server


Hostinger NOC / 2023‑06‑01 / Distribution website


Nexeon Technologies, Inc. / 2023‑04‑01 / C&C server


Namecheap, Inc. / 2023‑08‑20 / Distribution website


Namecheap, Inc. / 2022‑03‑16 / C&C server


Namecheap, Inc. / 2021‑11‑13 / C&C server


Namecheap, Inc. / 2022‑01‑19 / Distribution website


Namecheap, Inc. / 2022‑09‑27 / C&C server


Namecheap, Inc. / 2022‑09‑23 / Distribution website


Namecheap, Inc. / 2021‑10‑12 / C&C server


Discovered by SANS


TellYouThePass


TellYouThePass ransomware sample


Web server malware download (multiple files)


Web server malware (appverify.dll)


PowerShell script file (ConfigureRegistrySettings.ps1)


Visual Basic Script (1.vbs)


Batch file (1.bat)


JavaScript file (gtagv1.js)


Executable ade4f437[.]exe, searches for other vulnerable hosts, continues attack propagation


Executable alidebug[.]exe, disables firewall, network server processes


Executable asusdebug[.]exe, ensures persistence of alidebug[.]exe


Works with ade4f437[.]exe process, data capture includes victim address


Works with alidebug[.]exe process, data capture includes victim address


Go backdoor C2


Go backdoor download


Go backdoor (win.exe)


Rust Trojan download


Trojan (1.exe)


C2 associated with Powercat backdoor


Password stealer download


Password stealer C2


Exploit tool


Batch script


ScreenConnect


smss.exe MD5s


mf MD5s


hotfixl.exe MD5s


main.exe MD5s


dss.exe MD5s


BulletsPassView64.exe MD5s


VNCPassView.exe MD5s


PstPassword.exe MD5s


netpass64.exe MD5s


mailpv.exe MD5s


PCHunter32.exe MD5s


fast.exe MD5s


kit.bat MD5s


zmass_2.bat MD5s


dss.bat MD5s


mimikatz.exe MD5s


ntuser.cpl MD5s


httpd.exe MD5s


check.exe MD5s


UpSql.exe MD5s


svchost.exe MD5s


svchost.com MD5s


RouterPassView.exe MD5s


rdpv.exe MD5s


mass.dll MD5s


mspass.exe MD5s


pspv.exe MD5s


& C2s


1 The Bondnet Army


2 SELECT XMRig FROM SQLServer


3 Cloudflare Docs


RtlUpd.dll / WARMCOOKIE


Phishing link


Landing page


ipv4-addr / Landing page


ipv4-addr / WARMCOOKIE C2 server


Benign PDF delivered in PUKCHONG social engineering activity targeting cryptocurrency firms, filename: Question Sheet.pdf


Benign PDF delivered in PUKCHONG social engineering activity targeting cryptocurrency firms, md5: e9841e5c218611add64c07b6d6e8b2f2


Benign PDF delivered in PUKCHONG social engineering activity targeting cryptocurrency firms, md5: a899ee32da2bb0326238b332f34bd045


Java Script (Web infection)


JScript droppers


BadSpace


Test[random-digits]


wp-import-user


administratoirr


administratoir


wwwadmin


wpadminns


Sendsdesr


LNK MD5s


SCRIPT MD5s


XenoRAT MD5s


C&C


DurianBeacon Case #1 / MultiRDP malware (m.dat) Kimsuky


DurianBeacon Case #1 / Meterpreter (setting.dat) Kimsuky


DurianBeacon Case #1 / Meterpreter (sevice.db) Kimsuky


DurianBeacon Case #1 / DurianBeacon dropper (j******n.exe)


DurianBeacon Case #1 / DurianBeacon loader (mozillasvcone.dll)


DurianBeacon Case #1 / DurianBeacon loader (c0FcEpj86LSNmZ5.dll)


DurianBeacon Case #1 / DurianBeacon encoded (mNyKQBP3vV4uX)


SmallTiger Case #1 / SmallTiger (B**Print.dll)


SmallTiger Case #1 / SmallTiger (bfsvrc.exe)


SmallTiger Case #1 / SmallTiger (1715874253290.exe)


SmallTiger Case #1 / WebBrowser Stealer (splmgr32.exe)


SmallTiger Case #1 / WebBrowserPassView


SmallTiger Case #2 / SmallTiger dropper (nav.html)


SmallTiger Case #2 / SmallTiger downloader (j******n.exe)


SmallTiger Case #2 / SmallTiger (printsys.dll)


SmallTiger Case #2 / SmallTiger (printk.dll)


SmallTiger Case #2 / SmallTiger (kiss)


SmallTiger Case #2 / SmallTiger (top.png)


SmallTiger Case #2 / Mimiktaz (bmsrec.exe)


SmallTiger Case #2 / AMSI Bypass (am.dll)


DurianBeacon Case #1 / Meterpreter Kimsuky


DurianBeacon Case #1 / DurianBeacon


SmallTiger Case #1 / SmallTiger


SmallTiger Case #2 / SmallTiger


DurianBeacon Case #1 / MultiRDP Kimsuky


DurianBeacon Case #1 / Ngrok Kimsuky


DurianBeacon Case #1 / Disguised downloader


SmallTiger Case #2 / Disguised downloader


SmallTiger Case #2 / Dropper script


SmallTiger Case #2 / SmallTiger dropper


SmallTiger Case #2 / AMSI Bypass


Invoice_order_new.uue [IOCs]


Invoice_order_new.vbs [IOCs]


Talehmmedes.txt [IOCs]


mtzDpHLetMLypaaA173.bin [IOCs]


EML file


PDF file


CobaltStrike


CSharp Streamer


Data exfiltration


Forked IcedID Loader


2nd Stage IcedID payload


sha1: 59791ec1c857d714f9b4ad6c15a78191206a7343 sha256: 5d1817065266822df9fa6e8c5589534e031bb6a02493007f88d51a9cfb92e89b filename: scs.exe


md5: 99d8c3e7806d71a2b6b28be525c8e10e sha256: 5d1817065266822df9fa6e8c5589534e031bb6a02493007f88d51a9cfb92e89b filename: scs.exe


md5: 99d8c3e7806d71a2b6b28be525c8e10e sha1: 59791ec1c857d714f9b4ad6c15a78191206a7343 filename: scs.exe


md5: 99d8c3e7806d71a2b6b28be525c8e10e sha1: 59791ec1c857d714f9b4ad6c15a78191206a7343 sha256: 5d1817065266822df9fa6e8c5589534e031bb6a02493007f88d51a9cfb92e89b


sha1: 7d130ace197f4148932306facfc8d71fa8738d86 sha256: c2ddb954877dcfbb62fd615a102ce5fa69f4525abc1884e8fe65b0c2b120cfd4 filename: cscss.exe


md5: 08fcf90499526a0a41797f8fdd67d107 sha256: c2ddb954877dcfbb62fd615a102ce5fa69f4525abc1884e8fe65b0c2b120cfd4 filename: cscss.exe


md5: 08fcf90499526a0a41797f8fdd67d107 sha1: 7d130ace197f4148932306facfc8d71fa8738d86 filename: cscss.exe


md5: 08fcf90499526a0a41797f8fdd67d107 sha1: 7d130ace197f4148932306facfc8d71fa8738d86 sha256: c2ddb954877dcfbb62fd615a102ce5fa69f4525abc1884e8fe65b0c2b120cfd4


sha1: 8837ad1bafb56019a46822da0ed8b468f380c80d sha256: 7d2e705dcaa9f36fb132b7ff329f61dd5d0393c28dcd53b2be1e3ba85c633360 filename: cscssss.exe


md5: 26239fa16d0350b2224bfb07e37cbd84 sha256: 7d2e705dcaa9f36fb132b7ff329f61dd5d0393c28dcd53b2be1e3ba85c633360 filename: cscssss.exe


md5: 26239fa16d0350b2224bfb07e37cbd84 sha1: 8837ad1bafb56019a46822da0ed8b468f380c80d filename: cscssss.exe


md5: 26239fa16d0350b2224bfb07e37cbd84 sha1: 8837ad1bafb56019a46822da0ed8b468f380c80d sha256: 7d2e705dcaa9f36fb132b7ff329f61dd5d0393c28dcd53b2be1e3ba85c633360


sha1: c83da151f26a58aecb24fc6ba4945acb934ee954 sha256: bd4876f7efbd18a03bbb401a5dc77ed68ef95c72a3f7be83cef39a4515e0c476 filename: ccs.exe


md5: 2b1b2b271bc78e67beca2dcd04354189 sha256: bd4876f7efbd18a03bbb401a5dc77ed68ef95c72a3f7be83cef39a4515e0c476 filename: ccs.exe


md5: 2b1b2b271bc78e67beca2dcd04354189 sha1: c83da151f26a58aecb24fc6ba4945acb934ee954 filename: ccs.exe


md5: 2b1b2b271bc78e67beca2dcd04354189 sha1: c83da151f26a58aecb24fc6ba4945acb934ee954 sha256: bd4876f7efbd18a03bbb401a5dc77ed68ef95c72a3f7be83cef39a4515e0c476


sha1: 1d345799307c9436698245e7383914b3a187f1ec sha256: 9c5b233efb2e2a92a65b5ee31787281dd043a342c80c7ac567ccf43be2f2843f filename: rclone.exe


md5: 581cfc2d4e02a16b9b2f8dcb70a46b8b sha256: 9c5b233efb2e2a92a65b5ee31787281dd043a342c80c7ac567ccf43be2f2843f filename: rclone.exe


md5: 581cfc2d4e02a16b9b2f8dcb70a46b8b sha1: 1d345799307c9436698245e7383914b3a187f1ec filename: rclone.exe


md5: 581cfc2d4e02a16b9b2f8dcb70a46b8b sha1: 1d345799307c9436698245e7383914b3a187f1ec sha256: 9c5b233efb2e2a92a65b5ee31787281dd043a342c80c7ac567ccf43be2f2843f


sha1: 27acb306baec022a974db50a90f48183541e12fe sha256: 94d6395dcab01250650e884f591956464d582a4f1f5da948055e6d2f0a215ace filename: BNUfUOmFT2.exe


md5: 7ff0241b28d766198743d661a2f67620 sha256: 94d6395dcab01250650e884f591956464d582a4f1f5da948055e6d2f0a215ace filename: BNUfUOmFT2.exe


md5: 7ff0241b28d766198743d661a2f67620 sha1: 27acb306baec022a974db50a90f48183541e12fe filename: BNUfUOmFT2.exe


md5: 7ff0241b28d766198743d661a2f67620 sha1: 27acb306baec022a974db50a90f48183541e12fe sha256: 94d6395dcab01250650e884f591956464d582a4f1f5da948055e6d2f0a215ace


sha1: e97b00ef58fe081170137536f28df590dbb41a0e sha256: dfa8c282178a509346fb0154e6dbd5fbb0b56c38894ce7d244f5ca26d6820e67 filename: confucius_cpp.exe


md5: fb34b1fb80b053e69d89af5330cd7d4b sha256: dfa8c282178a509346fb0154e6dbd5fbb0b56c38894ce7d244f5ca26d6820e67 filename: confucius_cpp.exe


md5: fb34b1fb80b053e69d89af5330cd7d4b sha1: e97b00ef58fe081170137536f28df590dbb41a0e filename: confucius_cpp.exe


md5: fb34b1fb80b053e69d89af5330cd7d4b sha1: e97b00ef58fe081170137536f28df590dbb41a0e sha256: dfa8c282178a509346fb0154e6dbd5fbb0b56c38894ce7d244f5ca26d6820e67


sha1: e1bc0c7cf030af31522c1160e0c70df5cecbb64a sha256: 4103cc8017409963b417c87259af2a955653567cdbf7d5504198dd350f9ef9c1 filename: cslite.exe


md5: 642bf60f06bb043c4a74d0501597cf5e sha256: 4103cc8017409963b417c87259af2a955653567cdbf7d5504198dd350f9ef9c1 filename: cslite.exe


md5: 642bf60f06bb043c4a74d0501597cf5e sha1: e1bc0c7cf030af31522c1160e0c70df5cecbb64a filename: cslite.exe


md5: 642bf60f06bb043c4a74d0501597cf5e sha1: e1bc0c7cf030af31522c1160e0c70df5cecbb64a sha256: 4103cc8017409963b417c87259af2a955653567cdbf7d5504198dd350f9ef9c1


sha1: e43ecd2f6859e4769028fbd7176bb3339393ea22 sha256: d8f51dcfe928a1674e8d88029a404005ab826527372422cac24c81467440feb0 filename: https64.dll


md5: 5548caa3b8cdd73b3a56f3f102942882 sha256: d8f51dcfe928a1674e8d88029a404005ab826527372422cac24c81467440feb0 filename: https64.dll


md5: 5548caa3b8cdd73b3a56f3f102942882 sha1: e43ecd2f6859e4769028fbd7176bb3339393ea22 filename: https64.dll


md5: 5548caa3b8cdd73b3a56f3f102942882 sha1: e43ecd2f6859e4769028fbd7176bb3339393ea22 sha256: d8f51dcfe928a1674e8d88029a404005ab826527372422cac24c81467440feb0


sha1: be8fd3c3507f02785da6f12c9b21ff73638cdf23 sha256: cd0e941587672ab1517681a7e3b4f93a00020f8c8c8479a76b9e3555bcd04121 filename: http64.dll


md5: 0decfd5e200803523c0437ff7aac7349 sha256: cd0e941587672ab1517681a7e3b4f93a00020f8c8c8479a76b9e3555bcd04121 filename: http64.dll


md5: 0decfd5e200803523c0437ff7aac7349 sha1: be8fd3c3507f02785da6f12c9b21ff73638cdf23 filename: http64.dll


md5: 0decfd5e200803523c0437ff7aac7349 sha1: be8fd3c3507f02785da6f12c9b21ff73638cdf23 sha256: cd0e941587672ab1517681a7e3b4f93a00020f8c8c8479a76b9e3555bcd04121


sha1: 41f47f8ee34c9ae7a4bb43b71e3cc85266302e8e sha256: 6a6cd64fba34aadad2df808b0fcab89ef26a897040268b24fed694036cc51d6a filename: ccslt.exe


md5: 5cbb08cd26162e8046df17d15ba6e907 sha256: 6a6cd64fba34aadad2df808b0fcab89ef26a897040268b24fed694036cc51d6a filename: ccslt.exe


md5: 5cbb08cd26162e8046df17d15ba6e907 sha1: 41f47f8ee34c9ae7a4bb43b71e3cc85266302e8e filename: ccslt.exe


md5: 5cbb08cd26162e8046df17d15ba6e907 sha1: 41f47f8ee34c9ae7a4bb43b71e3cc85266302e8e sha256: 6a6cd64fba34aadad2df808b0fcab89ef26a897040268b24fed694036cc51d6a


sha1: 514ddcf981d7d8684b3ac20e902f5017292d51c5 sha256: bc49622009b29c23ee762fe6f000936eb1c4c1b29496d5382f175c99ad941aac filename: iwiqocacod.dll


md5: efb019b1999d478a4161a030a5d9302e sha256: bc49622009b29c23ee762fe6f000936eb1c4c1b29496d5382f175c99ad941aac filename: iwiqocacod.dll


md5: efb019b1999d478a4161a030a5d9302e sha1: 514ddcf981d7d8684b3ac20e902f5017292d51c5 filename: iwiqocacod.dll


md5: efb019b1999d478a4161a030a5d9302e sha1: 514ddcf981d7d8684b3ac20e902f5017292d51c5 sha256: bc49622009b29c23ee762fe6f000936eb1c4c1b29496d5382f175c99ad941aac


sha1: 25ef7044cdf9b7c17253625a2bd5d2d6fee44227 sha256: 3336bfde9b6b8ef05f1d704d247a1a8fd0641afaecc6a71f5cfa861234c4317b filename: JNOV0135_7747811.zip


md5: 24701208c439b00a43908ae39bbf7de8 sha256: 3336bfde9b6b8ef05f1d704d247a1a8fd0641afaecc6a71f5cfa861234c4317b filename: JNOV0135_7747811.zip


md5: 24701208c439b00a43908ae39bbf7de8 sha1: 25ef7044cdf9b7c17253625a2bd5d2d6fee44227 filename: JNOV0135_7747811.zip


md5: 24701208c439b00a43908ae39bbf7de8 sha1: 25ef7044cdf9b7c17253625a2bd5d2d6fee44227 sha256: 3336bfde9b6b8ef05f1d704d247a1a8fd0641afaecc6a71f5cfa861234c4317b


[2023.10.11_08-07].vbs, sha1: 42b188e2e015a72accc50fcbde2d2c81f5258d0b sha256: 5bab2bc0843f9d5124b39f80e12ad6d1f02416b0340d7cfec8cf7b14cd4385bf


[2023.10.11_08-07].vbs, md5: 4ff5625e6bd063811ec393b315d2c714 sha256: 5bab2bc0843f9d5124b39f80e12ad6d1f02416b0340d7cfec8cf7b14cd4385bf


[2023.10.11_08-07].vbs, md5: 4ff5625e6bd063811ec393b315d2c714 sha1: 42b188e2e015a72accc50fcbde2d2c81f5258d0b


0370-1.dll, sha1: e51217efb6e33fca9f7c5f51e5c3a4ae50499a37 sha256: fab34d1f0f906f64f95b9f244ae1fe090427e606a9c808c720e18e93a08ed84d


0370-1.dll, md5: bf15a998fd84bee284ae9f7422bda640 sha256: fab34d1f0f906f64f95b9f244ae1fe090427e606a9c808c720e18e93a08ed84d


0370-1.dll, md5: bf15a998fd84bee284ae9f7422bda640 sha1: e51217efb6e33fca9f7c5f51e5c3a4ae50499a37


sha1: 39300863bcaad71e5d4efc9a1cae118440aa778f sha256: e14ba0fb92e16bb7db3b1efac4b13aee178542c6994543e7535d8efaa589870c filename: netscan.exe


md5: a768244ca664349a6d1af84a712083c0 sha256: e14ba0fb92e16bb7db3b1efac4b13aee178542c6994543e7535d8efaa589870c filename: netscan.exe


md5: a768244ca664349a6d1af84a712083c0 sha1: 39300863bcaad71e5d4efc9a1cae118440aa778f filename: netscan.exe


md5: a768244ca664349a6d1af84a712083c0 sha1: 39300863bcaad71e5d4efc9a1cae118440aa778f sha256: e14ba0fb92e16bb7db3b1efac4b13aee178542c6994543e7535d8efaa589870c


sha1: 2741c136b92aca1e890d2b67084c6867d3cbaa87 sha256: 457a2f29d395c04a6ad6012fab4d30e04d99d7fc8640a9ee92e314185cc741d3 filename: nocmd.vbs


md5: d28271ed838464d1debab434ef6d8e37 sha256: 457a2f29d395c04a6ad6012fab4d30e04d99d7fc8640a9ee92e314185cc741d3 filename: nocmd.vbs


md5: d28271ed838464d1debab434ef6d8e37 sha1: 2741c136b92aca1e890d2b67084c6867d3cbaa87 filename: nocmd.vbs


md5: d28271ed838464d1debab434ef6d8e37 sha1: 2741c136b92aca1e890d2b67084c6867d3cbaa87 sha256: 457a2f29d395c04a6ad6012fab4d30e04d99d7fc8640a9ee92e314185cc741d3


MSI Installer


PhantomLoader


Second stage of the PhantomLoader


SSLoad Downaloder


SSLoad Payload


LNK File


HPCustPartUI.dll


wwlib.dll


Book.dll


tempdata.dat


init.txt


Download


C&C


Second stage / Second stage loader DLL


Third stage / Third stage shellcode


Fourth stage / Fourth stage DLL


Final payload / ValleyRAT


Parent for downloader


C2 Endpoint


as of 7 June 2024


File


Binary location on malicious image


Linux - amd64 Linux amd64, sha1: 427aee9ff60df3c102c3feab5319da34ecbf4b70 sha256: 68656198c24d6b32c4916a5686906c62baf7d6baae3b1d7dc615e43cb6d3fca8


Linux - amd64 Linux amd64, md5: 22de8e4b08be5c2b1cc5eb2012739786 sha256: 68656198c24d6b32c4916a5686906c62baf7d6baae3b1d7dc615e43cb6d3fca8


Linux - amd64 Linux amd64, md5: 22de8e4b08be5c2b1cc5eb2012739786 sha1: 427aee9ff60df3c102c3feab5319da34ecbf4b70


Linux - amd64 Linux amd64, sha1: 7a60e8398cd4f9bd46b6bcf9bfa9863c1bf87ea8 sha256: e4aa649015b19a3c3350b0d897e23377d0487f9ea265fe94e7161fed09f283cf


Linux - amd64 Linux amd64, md5: 14e7fb298049a57222254ef0f47464a7 sha256: e4aa649015b19a3c3350b0d897e23377d0487f9ea265fe94e7161fed09f283cf


Linux - amd64 Linux amd64, md5: 14e7fb298049a57222254ef0f47464a7 sha1: 7a60e8398cd4f9bd46b6bcf9bfa9863c1bf87ea8


Linux - amd64 Linux amd64, sha1: 464c26c2ed6c06508ce975aeee2d589c9a2fdac2 sha256: 49e8422e5f273a564c15755711ab2a35a1deb2105bbe1a0a8ce670c9b38721e5


Linux - amd64 Linux amd64, md5: cc47cb1bbef442d2f6aa7bc0b0843c88 sha256: 49e8422e5f273a564c15755711ab2a35a1deb2105bbe1a0a8ce670c9b38721e5


Linux - amd64 Linux amd64, md5: cc47cb1bbef442d2f6aa7bc0b0843c88 sha1: 464c26c2ed6c06508ce975aeee2d589c9a2fdac2


Linux - amd64 Linux amd64, sha1: 244e98c20acb54d7ef65b57d4cd364aa9d46731d sha256: ad2ee0040f88a9001a32f945ce15de2dd1126c0f9f6cb626f2de0163792d8ff7


Linux - amd64 Linux amd64, md5: b6224dc51657a32e1aec1ca2a74c424a sha256: ad2ee0040f88a9001a32f945ce15de2dd1126c0f9f6cb626f2de0163792d8ff7


Linux - amd64 Linux amd64, md5: b6224dc51657a32e1aec1ca2a74c424a sha1: 244e98c20acb54d7ef65b57d4cd364aa9d46731d


Linux - amd64 Linux amd64, sha1: 02e20e6d1b870d1365028246617ede951f399567 sha256: 649a6fa70b26e5382652808348522b5e7f43f2f77a1b10a4cc5e5bfd5cb80327


Linux - amd64 Linux amd64, md5: eea6a4938a53eb5e4e254812b3f150c6 sha256: 649a6fa70b26e5382652808348522b5e7f43f2f77a1b10a4cc5e5bfd5cb80327


Linux - amd64 Linux amd64, md5: eea6a4938a53eb5e4e254812b3f150c6 sha1: 02e20e6d1b870d1365028246617ede951f399567


Linux - amd64 Linux amd64, sha1: 59a835e812374c748d038498b70c04d0f36a8751 sha256: 06d080c816f099cccab56e4b596128e73cd63f524bdc2ddf5dd78c26f409f219


Linux - amd64 Linux amd64, md5: 0576d33ec4bcd20966c3a24c210e0cad sha256: 06d080c816f099cccab56e4b596128e73cd63f524bdc2ddf5dd78c26f409f219


Linux - amd64 Linux amd64, md5: 0576d33ec4bcd20966c3a24c210e0cad sha1: 59a835e812374c748d038498b70c04d0f36a8751


Linux - amd64 Linux amd64, sha1: 812860c0db73cb2224fe862c0bfd8c7485fc0807 sha256: 561790bd60258e056c72755bbaf848cfe5c3af548882c6a6579a599192bce3d2


Linux - amd64 Linux amd64, md5: 207e358ed42fe1346213480f64a91442 sha256: 561790bd60258e056c72755bbaf848cfe5c3af548882c6a6579a599192bce3d2


Linux - amd64 Linux amd64, md5: 207e358ed42fe1346213480f64a91442 sha1: 812860c0db73cb2224fe862c0bfd8c7485fc0807


Linux dropper (ddns.sh), sha1: 8fd9157811ea69a7253d3fadbea19b4cbb1a6ccd sha256: e1de787777faba85dcca4e10d945553aefdba14b1995cca7cf0721ee571c7e96


Linux dropper (ddns.sh), md5: 7c28e0727c74890b3998716967ab8339 sha256: e1de787777faba85dcca4e10d945553aefdba14b1995cca7cf0721ee571c7e96


Linux dropper (ddns.sh), md5: 7c28e0727c74890b3998716967ab8339 sha1: 8fd9157811ea69a7253d3fadbea19b4cbb1a6ccd


Linux – arm, sha1: c744dbf1bfa9f410111625f0b1c605a2b5f968d8 sha256: d6b14a4fbe5b9adbc0094098b4690ba5f5426247e21474915c408ca4553fcd49


Linux – arm, md5: 806b91c933e2202d5b6d836af9162e28 sha256: d6b14a4fbe5b9adbc0094098b4690ba5f5426247e21474915c408ca4553fcd49


Linux – arm, md5: 806b91c933e2202d5b6d836af9162e28 sha1: c744dbf1bfa9f410111625f0b1c605a2b5f968d8


Windows, sha1: 8c6793ec6b0459a75f114d0d18785af9ca56b75e sha256: 9131aac1df4b3a610f5fe69c55fdc19f07055648c0081e61536eb903e0914dc2


Windows, md5: 42e82a37cc6b44f7bc58c6ef6bf3e9e2 sha256: 9131aac1df4b3a610f5fe69c55fdc19f07055648c0081e61536eb903e0914dc2


Windows, md5: 42e82a37cc6b44f7bc58c6ef6bf3e9e2 sha1: 8c6793ec6b0459a75f114d0d18785af9ca56b75e


FTP Server List


RTF document


The loader-module


Agent Tesla Executable


as of 7 June 2024


EXE


LNK


Decoy


Files: / Setuper_KMS-ACTIV.exe


filename: Flour.pif


md5: b06e67f9767e5023892d9698703ad098


sha1: fe339e89013a194e1206209397ded98485405663 sha256: e13422d9d35231c40986c5814c0b4c62d8e418d0397606f43c19c009a21215e7


md5: 9d3574051db8716b39c62628e0e41c23 sha256: e13422d9d35231c40986c5814c0b4c62d8e418d0397606f43c19c009a21215e7


md5: 9d3574051db8716b39c62628e0e41c23 sha1: fe339e89013a194e1206209397ded98485405663


hosting ZIP archive


Christian


Loader: / Christian


Loader


Payload: / Payload Download


Payload


Payload: / Malicious JavaScript File (MD5), filename: 7E9CB3FBF4FD0B07.txt


Payload: / Malicious JavaScript File (MD5), md5: ea979d9743c2526b5b1781c3ea238ad5


Payload: / Malicious JavaScript File (MD5), filename: 1A4D05F30007.txt


Payload: / Malicious JavaScript File (MD5), md5: 428ae3a47e9afa51e2b395ba2f1bbd91


xFileSyncerx / 0.0.2


туррель.фоп.вовчок.rar, sha256: b452b0043533625da67e687c6050e9475d1a83337fa2b64735fc9a248179df10


туррель.фоп.вовчок.rar, md5: 30a590611403c94c41289ab68b56ca48


туррель.фоп.вовчок.sfx.rar.scr, sha256: db1e53f9b03363d595c9daf1eaafd1d851b5d984af9e4062204f18746b012d37


туррель.фоп.вовчок.sfx.rar.scr, md5: b51d8875e2502704416209c9eb46edf0


sha256: 456732417161a749541bbc4016c9334a01ff3b209c29bc3995f3589dccb80f31 filename: run_user.bat


md5: 5aaa6594f0249df48190568edfcc01ef filename: run_user.bat


md5: 5aaa6594f0249df48190568edfcc01ef sha256: 456732417161a749541bbc4016c9334a01ff3b209c29bc3995f3589dccb80f31


sha256: b4d4e2602cd6c5286be56b71a8659dff380eafd4bf65b61268b5d29a2bd6c52b filename: sync.exe


md5: 251d8e41f89e5807140b786c89723d4c filename: sync.exe


md5: 251d8e41f89e5807140b786c89723d4c sha256: b4d4e2602cd6c5286be56b71a8659dff380eafd4bf65b61268b5d29a2bd6c52b


SyncThing, sha256: bf895dca1ea67bf39a6bd87168af8d4fdfd6321d2f2d071295dbd4d25508eb68 filename: syncthing.exe


SyncThing, md5: 63892a6d1eccbaf0edd7cd55654e0150 filename: syncthing.exe


SyncThing, md5: 63892a6d1eccbaf0edd7cd55654e0150 sha256: bf895dca1ea67bf39a6bd87168af8d4fdfd6321d2f2d071295dbd4d25508eb68


sha256: 48adf2450c4ae087c1c4982a2a789d8f1b1e88b8d959fb26db273a76ef8b1888 filename: SyncthingFirewallRule.js


md5: 49c40fb4f001a9b267b799f6d0b18500 filename: SyncthingFirewallRule.js


md5: 49c40fb4f001a9b267b799f6d0b18500 sha256: 48adf2450c4ae087c1c4982a2a789d8f1b1e88b8d959fb26db273a76ef8b1888


sha256: 8cccf28333d822da6b5d851ae4cb188fed6dd27a3046627c7a32850c9d959124 filename: SetSyncthingConfig.js


md5: b283b1d1e746ccc6112ef85a6d2d73ef filename: SetSyncthingConfig.js


md5: b283b1d1e746ccc6112ef85a6d2d73ef sha256: 8cccf28333d822da6b5d851ae4cb188fed6dd27a3046627c7a32850c9d959124


sha256: 4d3c48917973daaf7e31aeab167e4611c60feed29bae25303c0543824bef027c filename: SyncthingLogonTask.js


md5: f357833157928395b65e9d17b26dee0e filename: SyncthingLogonTask.js


md5: f357833157928395b65e9d17b26dee0e sha256: 4d3c48917973daaf7e31aeab167e4611c60feed29bae25303c0543824bef027c


sha256: 29d9cc9a79750c6c1a3052317fb172b9d76a7044b94cd1da3be00ace748a9878 filename: ConfigSyncthingService.js


md5: f3a89edd5efe3a9269b4697ff3b386be filename: ConfigSyncthingService.js


md5: f3a89edd5efe3a9269b4697ff3b386be sha256: 29d9cc9a79750c6c1a3052317fb172b9d76a7044b94cd1da3be00ace748a9878


sha256: 1cc0257d93b4d1c0b3bb5c923c2997f222d271591addbd2da0da019dbb5fe579 filename: StartSyncthing.js


md5: f6e436ad88fdf391b960ff28df25e80b filename: StartSyncthing.js


md5: f6e436ad88fdf391b960ff28df25e80b sha256: 1cc0257d93b4d1c0b3bb5c923c2997f222d271591addbd2da0da019dbb5fe579


sha256: 67571ad65881dd4feb309c22f8e508da40bbf4f573fd97c45265394ac5b06659 filename: config_final.xml


md5: bd335dad7c46ec91d2816b5a0ca6d29a filename: config_final.xml


md5: bd335dad7c46ec91d2816b5a0ca6d29a sha256: 67571ad65881dd4feb309c22f8e508da40bbf4f573fd97c45265394ac5b06659


sha256: 9b3994f395309b0fb4db23e66d8de822b47cd9d4c9544bc48ed0e0fa082251b0 filename: startProc.ps1


md5: a1199e11d307e2c649c4b2487297896d filename: startProc.ps1


md5: a1199e11d307e2c649c4b2487297896d sha256: 9b3994f395309b0fb4db23e66d8de822b47cd9d4c9544bc48ed0e0fa082251b0


Install-SyncthingService.ps1, sha256: 711100e90de58762aa121a5f4a5fc50f1efc05499f1ee63b6bc1e3d479eb4c69


Install-SyncthingService.ps1, md5: 2d1814ea39c8b33db1394dd2bf8e4a2a


sha256: 0a43d77c67c0ff31660a19e69cdb26e55b5322cf63b51a97d4de0c4b48f78841 filename: modConf.ps1


md5: 74874b31fcddef67d98cac666d86d375 filename: modConf.ps1


md5: 74874b31fcddef67d98cac666d86d375 sha256: 0a43d77c67c0ff31660a19e69cdb26e55b5322cf63b51a97d4de0c4b48f78841


sha256: 87f73bc1762913e46d4dad6464f92d0d3e3c785da4cc30a24460601a3ceed970 filename: install.ps1


md5: 64b378abcd1bb4f2d064dbbe72570d3e filename: install.ps1


md5: 64b378abcd1bb4f2d064dbbe72570d3e sha256: 87f73bc1762913e46d4dad6464f92d0d3e3c785da4cc30a24460601a3ceed970


sha256: 806db134f3b9db4a58dd8ff65498d2841f645ef7252857e57c46cd6680edcec7 filename: startps.exe


md5: 45a58147de34d9d3029b62ac48636f26 filename: startps.exe


md5: 45a58147de34d9d3029b62ac48636f26 sha256: 806db134f3b9db4a58dd8ff65498d2841f645ef7252857e57c46cd6680edcec7


sha256: 4c4db56997d9a44cfc5a03f3b401f96d6890a56cd32146c5605f159a97112df9 filename: nssm.exe


md5: 8f3125d49dd0e38e2fd7a1351281005e filename: nssm.exe


md5: 8f3125d49dd0e38e2fd7a1351281005e sha256: 4c4db56997d9a44cfc5a03f3b401f96d6890a56cd32146c5605f159a97112df9


документ-приманка, sha256: 5ef47edc207e404c57ac83e2b55fb0b7c1687d721f26fc7a5a6e5294b28a2f6f filename: Wowchok.pdf


документ-приманка, md5: d70e7aa26e5b90b971aaa5e16017249c filename: Wowchok.pdf


документ-приманка, md5: d70e7aa26e5b90b971aaa5e16017249c sha256: 5ef47edc207e404c57ac83e2b55fb0b7c1687d721f26fc7a5a6e5294b28a2f6f


sha256: bef8cf172fd4535738e3aa06a9c303f93c83a4da0053aba4cbea986729d4620b filename: README.txt


md5: bb38d0bf2246ed55b46dd61dcf5693a6 filename: README.txt


md5: bb38d0bf2246ed55b46dd61dcf5693a6 sha256: bef8cf172fd4535738e3aa06a9c303f93c83a4da0053aba4cbea986729d4620b


sha256: 9221c2f936159b8446d329249fb4c0f25be510f447383a0f13336ac7985668a3 filename: LICENSE.txt


md5: 8761d7bce160c25d9b2f1d0a72ad89a4 filename: LICENSE.txt


md5: 8761d7bce160c25d9b2f1d0a72ad89a4 sha256: 9221c2f936159b8446d329249fb4c0f25be510f447383a0f13336ac7985668a3


sha256: 892a45e8adc92eb281a8f4cdba824cd69134bcb8378977747998b87c5a7fdec8 filename: AUTHORS.txt


md5: 471bdb3bb2807636f56fb238e6a2e047 filename: AUTHORS.txt


md5: 471bdb3bb2807636f56fb238e6a2e047 sha256: 892a45e8adc92eb281a8f4cdba824cd69134bcb8378977747998b87c5a7fdec8


SPECTR DLLs, sha256: 2b6622cc433aff6cb4bc582c7bc3bffc09e0fc6f0e1a97bab17485058bdcf3c9 filename: SpecMon_x86.dll


SPECTR DLLs, md5: 076586ea295ad521e7dc793a5a2c38b7 filename: SpecMon_x86.dll


SPECTR DLLs, md5: 076586ea295ad521e7dc793a5a2c38b7 sha256: 2b6622cc433aff6cb4bc582c7bc3bffc09e0fc6f0e1a97bab17485058bdcf3c9


SPECTR DLLs, sha256: 0ad1cf00eed24ab07765d3670d1c8394b3d232f58bf939b69ada9e88c45b4b03 filename: SpecMon_x64.dll


SPECTR DLLs, md5: 2666479686a91389afc44a02ee70038e filename: SpecMon_x64.dll


SPECTR DLLs, md5: 2666479686a91389afc44a02ee70038e sha256: 0ad1cf00eed24ab07765d3670d1c8394b3d232f58bf939b69ada9e88c45b4b03


SPECTR DLLs, sha256: 7198094549e30b8bff6865ce364e48dc324d92f2346dec9b0ce6664921c21888 filename: PluginLoader.dll


SPECTR DLLs, md5: 52df00ffcb487f4967c480bc425376ba filename: PluginLoader.dll


SPECTR DLLs, md5: 52df00ffcb487f4967c480bc425376ba sha256: 7198094549e30b8bff6865ce364e48dc324d92f2346dec9b0ce6664921c21888


SPECTR DLLs, sha256: c208408170c429af873849cecc4b7553598ba5a70fce7616e6adca66cfeb8d75 filename: Common.dll


SPECTR DLLs, md5: 09570ab8f371adf8893c7e0da786cd2e filename: Common.dll


SPECTR DLLs, md5: 09570ab8f371adf8893c7e0da786cd2e sha256: c208408170c429af873849cecc4b7553598ba5a70fce7616e6adca66cfeb8d75


SPECTR DLLs, sha256: f8b696ae1011f6c5457eea1e215da81e85aef1b1a62c56dce3606e0512afdbb4 filename: MediaDevices.dll


SPECTR DLLs, md5: 39534c1234b3dbfe37b774b967cfb4ee filename: MediaDevices.dll


SPECTR DLLs, md5: 39534c1234b3dbfe37b774b967cfb4ee sha256: f8b696ae1011f6c5457eea1e215da81e85aef1b1a62c56dce3606e0512afdbb4


SPECTR DLLs, sha256: 00b3599f4bb48e2599f953191d526da432c280d5ae5bc43392eb37352fde5cb2 filename: Management.dll


SPECTR DLLs, md5: cd4bc0795ce5d04efc0a7644d8ff6159 filename: Management.dll


SPECTR DLLs, md5: cd4bc0795ce5d04efc0a7644d8ff6159 sha256: 00b3599f4bb48e2599f953191d526da432c280d5ae5bc43392eb37352fde5cb2


SPECTR DLLs, sha256: 117078cd63225cfed7cbe4bc4c2ffed6db4d4bd93bf353a87cc10fb05cc0151c filename: Commander.dll


SPECTR DLLs, md5: debf2157d6192ac4d5be67104f7ba312 filename: Commander.dll


SPECTR DLLs, md5: debf2157d6192ac4d5be67104f7ba312 sha256: 117078cd63225cfed7cbe4bc4c2ffed6db4d4bd93bf353a87cc10fb05cc0151c


SPECTR DLLs, sha256: b05c65897fc449760fa5867e436205313448007e904e02aa77c0733a21d15bb2 filename: Browsers.dll


SPECTR DLLs, md5: e508a05a71d29688b7916429894c09d5 filename: Browsers.dll


SPECTR DLLs, md5: e508a05a71d29688b7916429894c09d5 sha256: b05c65897fc449760fa5867e436205313448007e904e02aa77c0733a21d15bb2


SPECTR DLLs, sha256: c3ac906b3228c4c9ce3dd0e46b6c5b0bed4dacd61911dc006730a31f90f424c7 filename: Social.dll


SPECTR DLLs, md5: 83811960db65d0d430062ad1ff92b7ca filename: Social.dll


SPECTR DLLs, md5: 83811960db65d0d430062ad1ff92b7ca sha256: c3ac906b3228c4c9ce3dd0e46b6c5b0bed4dacd61911dc006730a31f90f424c7


SPECTR DLLs, sha256: fbd8883e659d8082fe8e1ee15de12e2b710fd4c92d8d72b2cf34befcdc5be7fb filename: Usb.dll


SPECTR DLLs, md5: ebe83a11b39bfd848fa557a79f2dff1b filename: Usb.dll


SPECTR DLLs, md5: ebe83a11b39bfd848fa557a79f2dff1b sha256: fbd8883e659d8082fe8e1ee15de12e2b710fd4c92d8d72b2cf34befcdc5be7fb


SPECTR DLLs, sha256: 6a13b98c7dc82ea2a492c0022fd93fa97247912dfa8ad5f015fb4b50e6c05fbb filename: FileGrabber.dll


SPECTR DLLs, md5: aeda6f2d3669fb0d30b3e21437405d81 filename: FileGrabber.dll


SPECTR DLLs, md5: aeda6f2d3669fb0d30b3e21437405d81 sha256: 6a13b98c7dc82ea2a492c0022fd93fa97247912dfa8ad5f015fb4b50e6c05fbb


SPECTR DLLs, sha256: bf62d5e034b4ce4fd122ab72fa388ea461fd6e5f317ad3274fe847a526c00282 filename: Screengrabber.dll


SPECTR DLLs, md5: a816830220abe0cc2e3877eeadae0580 filename: Screengrabber.dll


SPECTR DLLs, md5: a816830220abe0cc2e3877eeadae0580 sha256: bf62d5e034b4ce4fd122ab72fa388ea461fd6e5f317ad3274fe847a526c00282


Інфраструктура SyncThing


Ransom.Linux.TARGETCOMP.YXEEQT / TargetCompany Linux Variant


Trojan.SH.TARGETCOMP.THEAGBD / Shell Script


Ransom.Win64.TARGETCOMP.YXECMT / TargetCompany samples related to affiliate vampire


Ransom.Win64.TARGETCOMP.YXECFT / TargetCompany samples related to affiliate vampire


Ransom.Win32.TARGETCOMP.SMYXCLAZ / TargetCompany samples related to affiliate vampire


90 - Untested / Download of script


79 – Disease Vector / Download of ransomware payload


79 – Disease Vector / Upload


RansomHub


Knight


NetScan


Splashtop


Atera


smss.exe MD5s


mf MD5s


hotfixl.exe MD5s


main.exe MD5s


dss.exe MD5s


BulletsPassView64.exe MD5s


VNCPassView.exe MD5s


PstPassword.exe MD5s


netpass64.exe MD5s


mailpv.exe MD5s


PCHunter32.exe MD5s


fast.exe MD5s


kit.bat MD5s


zmass_2.bat MD5s


dss.bat MD5s


mimikatz.exe MD5s


ntuser.cpl MD5s


httpd.exe MD5s


check.exe MD5s


UpSql.exe MD5s


svchost.exe MD5s


svchost.com MD5s


RouterPassView.exe MD5s


rdpv.exe MD5s


mass.dll MD5s


mspass.exe MD5s


pspv.exe MD5s


& C2s


html


header.png


qhsddxna


script.a3x in xcdttafq


dark.hta


rdyjyany


script.a3x in yoomzhda


umkglnks


script.a3x in iinkqrwu


Download


textinputhost.exe (renamed rc.exe)


TextInputHost.dat


sc.cfg


appmgmt.dll (Stowaway)


check.exe (NUPAKAGE)


swprvs.dll


winbridge.dll


sslwnd64.exe (PhantomNet)


nethood.exe (PhantomNet)


oci.dll (PhantomNet)


X64.dll (PhantomNet, renamed to oci.dll)


wlbsctrl.dll (EAGERBEE)


TSVIPSrv.dll (EAGERBEE)


C:\ProgramData\Microsoft\DeviceSync\jli.dll (EAGERBEE)


C:\ProgramData\Microsoft\Vault\vmnat.dll (Merlin)


pc2msupp.dll (Malicious DLL sideloaded by MOBPOPUP.exe)


MSI64.exe (RUDEBIRD)


ba0oddof.dll (CSC compilation artifact from 1.ps1 execution)


SophosUD.exe (PowHeartBeat)


SophosUD2.exe (PowHeartBeat)


SensAPI.dll (Malicious DLL sideloaded by ph.exe)


Merlin C2


RUDEBIRD C2


RUDEBIRD C2; EAGERBEE C2


PhantomNet C2


PhantomNet C2; RUDEBIRD C2


PowHeartBeat C2


PhantomNet C2; EAGERBEE C2


EAGERBEE C2


dllhost.exe


3.ps1 (PowerShell script)


EvtxParser.exe (EVTX dump)


2.vbs (VBS script)


r.vbs (VBS script)


mscorsvc.dll (CCoreDoor)


ntpsapi.dll (signed, benign, ntdll.dll used for EDR unhooking)


CCoreDoor C2


443.txt (PocoProxy)


4413.txt (PocoProxy)


chrome.log (PocoProxy)


PocoProxy


a8.txt (PocoProxy)


s.dat (Malicious file)


msedge_elf.dll (HUI Loader)


hideschtasks.exe (Custom binary; remotely creates scheduled tasks)


log.ini (Masquerading DLL generating C2)


11.log (LSASS credential interceptor)


1.dat (Cobalt Strike)


sssa.exe (Malicious file)


McPvNs.dll (Malicious DLL sideloaded by McPvTray.exe)


rsndispot.sys , EDR evasion


rspot.sys, EDR evasion


PocoProxy C2


Cobalt Strike C2


C:\Windows\Help\Help\mscorsvc.dll (Malicious DLL)


C:\ProgramData\mscorsvc.dll (Malicious DLL)


C:\Windows\Temp\ntpsapi.dll (EDR unhooking, benign version of ntdll.dll)


C:\windows\syswow64\WWindows.Data.Devices.Config.dll (SharpHound/BloodHound)


locale.nlp (ATK/DonutLdr-A)


C:\Windows\debug\net.LOG (Havoc)


swprv.dll (Malicious DLL sideloaded by swprv service)


iscsiexe.dll (MSiSCSI payload)


version.dll (Malicious DLL sideloaded by swi_update.exe)


file_path_name / Malicious DLL sideloaded by PTWatchDog.exe


DecrptDumper.exe (Malicious File, no execution data)


c:\windows\help\prow.xml (Havoc)


~docpdf.tmp (Havoc)


C:/PerfLogs/libcef.dll (Havoc)


<REDACTED>DOC20231100001603KMAP.pdf (webshell)


111 (Shellcode loader)


C:/Windows/Vss/Writers/Application/libcef.dll (Shellcode Loader for Havoc)


<REDACTED>DOC20231200001922KMAP.asp (webshell)


<REDACTED>DOC20231200002062KMAP.php (webshell)


log.ini (Havoc)


1.exe (Invoke WMI)


msedge_elf.dll (Shellcode Loader, Havoc)


chrome.exe (Shellcode Loader, Havoc)


C:/ProgramData/conhost.exe (Alcatraz Git Project EDR Evasion)


file_path_name / (Shellcode loader)


C:\PerfLogs\pt.exe (unsigned executable with certificate stating that it is MS Edge)


C:\Users\Public\r2.exe (Unknown threat file)


mios.exe C2


Cobalt Strike C2


Interacted with webshell (VPN subnet)


Dropped webshell (VPN subnet)


Havoc C2


Havoc C2 URI


Havoc C2 payload host


swprv.dll C2


Havoc C2 / XiebroC2


Network Activity


URI


Backdoored


Malicious


CobaltStrike beacon shellcode


Other typo-squatted domains that are still active include


CobaltStrike Beacon Configuration


sslwnd64.exe (PhantomNet)


nethood.exe (PhantomNet)


oci.dll (PhantomNet)


X64.dll (PhantomNet, renamed to oci.dll)


wlbsctrl.dll (EAGERBEE)


TSVIPSrv.dll (EAGERBEE)


C:\ProgramData\Microsoft\DeviceSync\jli.dll (EAGERBEE)


C:\ProgramData\Microsoft\Vault\vmnat.dll (Merlin)


pc2msupp.dll (Malicious DLL sideloaded by MOBPOPUP.exe)


MSI64.exe (RUDEBIRD)


ba0oddof.dll (CSC compilation artifact from 1.ps1 execution)


SophosUD.exe (PowHeartBeat)


SophosUD2.exe (PowHeartBeat)


SensAPI.dll (Malicious DLL sideloaded by ph.exe)


Merlin C2


RUDEBIRD C2


RUDEBIRD C2; EAGERBEE C2


PhantomNet C2


PhantomNet C2; RUDEBIRD C2


PowHeartBeat C2


PhantomNet C2; EAGERBEE C2


EAGERBEE C2


dllhost.exe


3.ps1 (PowerShell script)


EvtxParser.exe (EVTX dump)


2.vbs (VBS script)


r.vbs (VBS script)


mscorsvc.dll (CCoreDoor)


ntpsapi.dll (signed, benign, ntdll.dll used for EDR unhooking)


CCoreDoor C2


443.txt (PocoProxy)


4413.txt (PocoProxy)


chrome.log (PocoProxy)


PocoProxy


a8.txt (PocoProxy)


s.dat (Malicious file)


msedge_elf.dll (HUI Loader)


hideschtasks.exe (Custom binary; remotely creates scheduled tasks)


log.ini (Masquerading DLL generating C2)


11.log (LSASS credential interceptor)


1.dat (Cobalt Strike)


sssa.exe (Malicious file)


McPvNs.dll (Malicious DLL sideloaded by McPvTray.exe)


rsndispot.sys , EDR evasion


rspot.sys, EDR evasion


PocoProxy C2


Cobalt Strike C2


textinputhost.exe (renamed rc.exe)


TextInputHost.dat


sc.cfg


appmgmt.dll (Stowaway)


check.exe (NUPAKAGE)


swprvs.dll


winbridge.dll


C:\Windows\Help\Help\mscorsvc.dll (Malicious DLL)


C:\ProgramData\mscorsvc.dll (Malicious DLL)


C:\Windows\Temp\ntpsapi.dll (EDR unhooking, benign version of ntdll.dll)


C:\windows\syswow64\WWindows.Data.Devices.Config.dll (SharpHound/BloodHound)


locale.nlp (ATK/DonutLdr-A)


C:\Windows\debug\net.LOG (Havoc)


swprv.dll (Malicious DLL sideloaded by swprv service)


iscsiexe.dll (MSiSCSI payload)


version.dll (Malicious DLL sideloaded by swi_update.exe)


file_path_name / Malicious DLL sideloaded by PTWatchDog.exe


DecrptDumper.exe (Malicious File, no execution data)


c:\windows\help\prow.xml (Havoc)


~docpdf.tmp (Havoc)


C:/PerfLogs/libcef.dll (Havoc)


<REDACTED>DOC20231100001603KMAP.pdf (webshell)


111 (Shellcode loader)


C:/Windows/Vss/Writers/Application/libcef.dll (Shellcode Loader for Havoc)


<REDACTED>DOC20231200001922KMAP.asp (webshell)


<REDACTED>DOC20231200002062KMAP.php (webshell)


log.ini (Havoc)


1.exe (Invoke WMI)


msedge_elf.dll (Shellcode Loader, Havoc)


chrome.exe (Shellcode Loader, Havoc)


C:/ProgramData/conhost.exe (Alcatraz Git Project EDR Evasion)


file_path_name / (Shellcode loader)


C:\PerfLogs\pt.exe (unsigned executable with certificate stating that it is MS Edge)


C:\Users\Public\r2.exe (Unknown threat file)


mios.exe C2


Cobalt Strike C2


Interacted with webshell (VPN subnet)


Dropped webshell (VPN subnet)


Havoc C2


Havoc C2 URI


Havoc C2 payload host


swprv.dll C2


Havoc C2 / XiebroC2


Attacker


IRC Server


IRC server


Muhstik malware


sha256: d0d6c1f07382ca03866fc3ca198efa8e4a777ecd7ccdc517a4b6ddb7d2d1245e filename: Plan10062024.exe


md5: 6903635dc38959f87bbc9aeee3f3555a filename: Plan10062024.exe


md5: 6903635dc38959f87bbc9aeee3f3555a sha256: d0d6c1f07382ca03866fc3ca198efa8e4a777ecd7ccdc517a4b6ddb7d2d1245e


sha256: f26ec43245406c30cc5efb7ad6d8e9018117919c4a03cec2972520e526db3b0c filename: Plan01062024.exe


md5: 2e7ef5d68ad7e8df8d621f624127aa14 filename: Plan01062024.exe


md5: 2e7ef5d68ad7e8df8d621f624127aa14 sha256: f26ec43245406c30cc5efb7ad6d8e9018117919c4a03cec2972520e526db3b0c


DarkCrystal RAT, sha256: f59e4490a26c421b7d01d05193de927c773b9cbd6cbd91903b422a903ec301a1 filename: DarkCrystalRAT.exe


DarkCrystal RAT, md5: a64b994390f907703c40d81ec892a5a0 filename: DarkCrystalRAT.exe


DarkCrystal RAT, md5: a64b994390f907703c40d81ec892a5a0 sha256: f59e4490a26c421b7d01d05193de927c773b9cbd6cbd91903b422a903ec301a1


sha256: a7f896b2a2433fd178afffba59ace1c27ec4b4fa20ecc59ee7da7c96314c6b09 filename: du5a30GGdpnw9V1NAPFxiabLpStvK7yQccZnAiiXNdT4B.bat


md5: 8b64442e76a6bc0db99e74a95964d3e0 filename: du5a30GGdpnw9V1NAPFxiabLpStvK7yQccZnAiiXNdT4B.bat


md5: 8b64442e76a6bc0db99e74a95964d3e0 sha256: a7f896b2a2433fd178afffba59ace1c27ec4b4fa20ecc59ee7da7c96314c6b09


sha256: 1418111224c143fba191efa1fe1a1c4a653b951e4bb07f6fd0b7782631571b93 filename: NjNYM6fdF5Fixp.vbe


md5: 5a7b9f20b7990c54a716ebcd43960123 filename: NjNYM6fdF5Fixp.vbe


md5: 5a7b9f20b7990c54a716ebcd43960123 sha256: 1418111224c143fba191efa1fe1a1c4a653b951e4bb07f6fd0b7782631571b93


DarkCrystal RAT, sha256: ef6cd2c75b3370d1bcc95beb573ad09861e0ed22b2becc1c16cfff88dae5a157 filename: agentWinintoHostDhcp.exe


DarkCrystal RAT, md5: 47aa8d5d45c05c05be3941e43009a5ec filename: agentWinintoHostDhcp.exe


DarkCrystal RAT, md5: 47aa8d5d45c05c05be3941e43009a5ec sha256: ef6cd2c75b3370d1bcc95beb573ad09861e0ed22b2becc1c16cfff88dae5a157


sha256: 3ad5473cee7a16bddce171e42b2dbb42caf1bdfbf8f2ef280d956a9940500520 filename: Plan_na_10.06.2024.rar


md5: 27e9287a7ac9ca4d8f2ebd7751756594 filename: Plan_na_10.06.2024.rar


md5: 27e9287a7ac9ca4d8f2ebd7751756594 sha256: 3ad5473cee7a16bddce171e42b2dbb42caf1bdfbf8f2ef280d956a9940500520


sha256: 8cc204cdd79c811b2d48d878f4cbfcc2e4db88bfaa17bf2c13351e338f8547b3 filename: Plan_na_10.06.2024.pif


md5: 94124f22d7aa29ab91d40d4f207e1887 filename: Plan_na_10.06.2024.pif


md5: 94124f22d7aa29ab91d40d4f207e1887 sha256: 8cc204cdd79c811b2d48d878f4cbfcc2e4db88bfaa17bf2c13351e338f8547b3


sha256: 6bdd44d7b55d47ebd1a00fec6cfda0506efbacbe05022dada9c9dccb5d60909f filename: 2VGPnHOLToAOwqq.vbe


md5: c917930fd0f91e5c038c8b06719efca4 filename: 2VGPnHOLToAOwqq.vbe


md5: c917930fd0f91e5c038c8b06719efca4 sha256: 6bdd44d7b55d47ebd1a00fec6cfda0506efbacbe05022dada9c9dccb5d60909f


sha256: b60ac68e278045aadb9ec3196327a90efebf8b48bbe7819c6bf0f5a4678efd62 filename: 0WgIlnTNpgbtjiE2xGB5FgwFA.bat


md5: 52c52b15629514b8527892644e7ea818 filename: 0WgIlnTNpgbtjiE2xGB5FgwFA.bat


md5: 52c52b15629514b8527892644e7ea818 sha256: b60ac68e278045aadb9ec3196327a90efebf8b48bbe7819c6bf0f5a4678efd62


DarkCrystal RAT, sha256: 02d657729837838d18bbe6b4bae44cab0e6d3a357836d7cd6a9bb7288543facb filename: bridgeSurrogatewin.exe


DarkCrystal RAT, md5: 3bd344b53bd70e1e77f42bf40c22dfb1 filename: bridgeSurrogatewin.exe


DarkCrystal RAT, md5: 3bd344b53bd70e1e77f42bf40c22dfb1 sha256: 02d657729837838d18bbe6b4bae44cab0e6d3a357836d7cd6a9bb7288543facb


released by Snowflake


Fog ransomware binary (lck.exe)


Fog ransomware binary (locker_out.exe)


Fog ransomware binary (fs.exe)


Fog ransomware binary (mon.dll)


PsExec (psexesvc.exe)


Advanced Port Scanner (advanced_port_scanner.exe)


Advanced Port Scanner (advanced_port_scanner_2.5.3869.exe)


SharpShares (sharpshares(1).exe)


Ransom note


Log created by ransomware binary


PowerShell script used to obtain passwords from Veeam Backup and Replication Credentials Manager


PsExec


SoftPerfect Network Scanner


Appended extension to encrypted


address used by the threat actor to login to VPN appliance


Malware Excel (May 2024)


DLL loader


Download encrypted payload


Malware Excel (April 2024)


Malware


2024-02-29T00:00:00Z / 2024-04-07T00:00:00Z


2023-12-13T00:00:00Z / 2024-01-19T00:00:00Z


2023-12-07T00:00:00Z / 2024-05-26T00:00:00Z


2023-05-21T00:00:00Z / 2023-06-20T00:00:00Z


2024-03-05T00:00:00Z / 2024-04-12T00:00:00Z


2024-02-08T00:00:00Z / 2024-03-25T00:00:00Z


2024-02-16T00:00:00Z / 2024-03-25T00:00:00Z


2023-11-06T00:00:00Z / 2023-12-14T00:00:00Z


2023-12-18T00:00:00Z / 2024-01-26T00:00:00Z


2023-12-14T00:00:00Z / 2024-01-13T00:00:00Z


2023-12-18T00:00:00Z / 2024-02-29T00:00:00Z


2023-05-17T00:00:00Z / 2023-08-18T00:00:00Z


2023-10-23T00:00:00Z / 2023-11-29T00:00:00Z


2023-11-03T00:00:00Z / 2023-12-09T00:00:00Z


2023-11-01T00:00:00Z / 2023-12-08T00:00:00Z


2023-11-06T00:00:00Z / 2023-12-19T00:00:00Z


2024-02-14T00:00:00Z / 2024-03-20T00:00:00Z


2023-12-18T00:00:00Z / 2024-01-25T00:00:00Z


2024-03-06T00:00:00Z / 2024-04-05T00:00:00Z


2023-11-13T00:00:00Z / 2023-12-20T00:00:00Z


2024-04-24T00:00:00Z / 2024-05-24T00:00:00Z


2023-12-15T00:00:00Z / 2024-01-23T00:00:00Z


2024-02-14T00:00:00Z / 2024-03-23T00:00:00Z


2023-09-25T00:00:00Z / 2024-06-06T00:00:00Z


2023-10-11T00:00:00Z / 2023-11-23T00:00:00Z


2023-12-23T00:00:00Z / 2024-01-29T00:00:00Z


2023-10-01T00:00:00Z / 2023-12-08T00:00:00Z


2024-02-14T00:00:00Z / 2024-03-21T00:00:00Z


2023-12-20T00:00:00Z / 2024-01-27T00:00:00Z


2023-12-20T00:00:00Z / 2024-01-19T00:00:00Z


2023-10-24T00:00:00Z / 2023-11-30T00:00:00Z


2023-12-08T00:00:00Z / 2024-01-18T00:00:00Z


2023-10-01T00:00:00Z / 2024-01-20T00:00:00Z


2024-03-26T00:00:00Z / 2024-05-16T00:00:00Z


2023-12-07T00:00:00Z / 2024-01-14T00:00:00Z


2023-12-19T00:00:00Z / 2024-01-18T00:00:00Z


2024-03-06T00:00:00Z / 2024-04-17T00:00:00Z


2023-11-09T00:00:00Z / 2023-12-16T00:00:00Z


2023-12-16T00:00:00Z / 2024-01-23T00:00:00Z


2023-10-24T00:00:00Z / 2023-12-02T00:00:00Z


2023-10-01T00:00:00Z / 2023-12-27T00:00:00Z


2023-10-01T00:00:00Z / 2023-12-21T00:00:00Z


2023-12-07T00:00:00Z / 2024-05-26T00:00:00Z


2023-12-01T00:00:00Z / 2024-02-05T00:00:00Z


2024-02-14T00:00:00Z / 2024-03-27T00:00:00Z


2024-02-08T00:00:00Z / 2024-03-25T00:00:00Z


2023-12-11T00:00:00Z / 2024-04-26T00:00:00Z


2023-12-19T00:00:00Z / 2024-01-25T00:00:00Z


2024-02-08T00:00:00Z / 2024-04-10T00:00:00Z


2023-12-07T00:00:00Z / 2024-01-17T00:00:00Z


2023-12-20T00:00:00Z / 2024-01-19T00:00:00Z


2024-01-23T00:00:00Z / 2024-04-26T00:00:00Z


2023-11-15T00:00:00Z / 2023-12-22T00:00:00Z


2024-02-19T00:00:00Z / 2024-04-17T00:00:00Z


2023-12-06T00:00:00Z / 2024-05-26T00:00:00Z


2023-12-21T00:00:00Z / 2024-01-29T00:00:00Z


2023-12-13T00:00:00Z / 2024-01-20T00:00:00Z


2023-10-03T00:00:00Z / 2023-11-02T00:00:00Z


2024-02-14T00:00:00Z / 2024-03-21T00:00:00Z


2024-02-17T00:00:00Z / 2024-03-23T00:00:00Z


2023-05-21T00:00:00Z / 2023-06-20T00:00:00Z


2024-02-14T00:00:00Z / 2024-03-15T00:00:00Z


2023-11-06T00:00:00Z / 2023-12-06T00:00:00Z


2023-12-18T00:00:00Z / 2024-01-25T00:00:00Z


2023-12-17T00:00:00Z / 2024-01-23T00:00:00Z


2024-02-13T00:00:00Z / 2024-05-03T00:00:00Z


2023-10-01T00:00:00Z / 2023-10-31T00:00:00Z


2023-11-15T00:00:00Z / 2023-12-21T00:00:00Z


2024-02-08T00:00:00Z / 2024-03-25T00:00:00Z


2023-11-09T00:00:00Z / 2023-12-16T00:00:00Z


2023-10-18T00:00:00Z / 2023-11-25T00:00:00Z


2023-10-30T00:00:00Z / 2023-12-06T00:00:00Z


2023-12-21T00:00:00Z / 2024-01-29T00:00:00Z


2024-02-14T00:00:00Z / 2024-03-20T00:00:00Z


2023-12-20T00:00:00Z / 2024-01-19T00:00:00Z


2023-12-01T00:00:00Z / 2024-01-23T00:00:00Z


2023-12-11T00:00:00Z / 2024-04-26T00:00:00Z


2023-05-21T00:00:00Z / 2023-06-20T00:00:00Z


2023-12-20T00:00:00Z / 2024-01-27T00:00:00Z


2023-12-01T00:00:00Z / 2024-01-21T00:00:00Z


2023-12-21T00:00:00Z / 2024-01-28T00:00:00Z


2024-02-12T00:00:00Z / 2024-04-15T00:00:00Z


2023-12-08T00:00:00Z / 2024-01-17T00:00:00Z


2023-10-18T00:00:00Z / 2023-11-26T00:00:00Z


2023-12-11T00:00:00Z / 2024-01-18T00:00:00Z


2024-01-23T00:00:00Z / 2024-04-26T00:00:00Z


2023-05-17T00:00:00Z / 2023-06-30T00:00:00Z


2023-12-13T00:00:00Z / 2024-01-20T00:00:00Z


2023-12-06T00:00:00Z / 2024-01-05T00:00:00Z


2023-10-20T00:00:00Z / 2023-11-19T00:00:00Z


2024-02-19T00:00:00Z / 2024-04-17T00:00:00Z


2024-02-19T00:00:00Z / 2024-03-26T00:00:00Z


2023-10-01T00:00:00Z / 2023-12-27T00:00:00Z


2023-10-23T00:00:00Z / 2023-12-03T00:00:00Z


2024-05-06T00:00:00Z / 2024-06-06T00:00:00Z


2023-12-14T00:00:00Z / 2024-01-23T00:00:00Z


2023-12-13T00:00:00Z / 2024-01-19T00:00:00Z


2023-12-01T00:00:00Z / 2024-01-14T00:00:00Z


2023-11-17T00:00:00Z / 2023-12-24T00:00:00Z


2023-10-04T00:00:00Z / 2023-11-03T00:00:00Z


2023-10-28T00:00:00Z / 2023-12-05T00:00:00Z


2024-03-26T00:00:00Z / 2024-05-05T00:00:00Z


2024-03-26T00:00:00Z / 2024-05-08T00:00:00Z


2023-10-11T00:00:00Z / 2023-11-24T00:00:00Z


2023-12-18T00:00:00Z / 2024-01-26T00:00:00Z


2023-10-17T00:00:00Z / 2023-11-24T00:00:00Z


2023-11-13T00:00:00Z / 2023-12-20T00:00:00Z


2023-11-15T00:00:00Z / 2023-12-25T00:00:00Z


2023-11-01T00:00:00Z / 2023-12-08T00:00:00Z


2023-10-20T00:00:00Z / 2023-11-19T00:00:00Z


2023-10-30T00:00:00Z / 2023-11-29T00:00:00Z


2023-10-03T00:00:00Z / 2023-11-02T00:00:00Z


2023-10-27T00:00:00Z / 2023-12-04T00:00:00Z


2023-10-01T00:00:00Z / 2023-12-08T00:00:00Z


2023-12-13T00:00:00Z / 2024-01-19T00:00:00Z


2023-05-21T00:00:00Z / 2023-07-06T00:00:00Z


2023-12-21T00:00:00Z / 2024-01-20T00:00:00Z


2023-12-21T00:00:00Z / 2024-01-29T00:00:00Z


2023-10-04T00:00:00Z / 2023-11-03T00:00:00Z


2023-12-20T00:00:00Z / 2024-01-27T00:00:00Z


2023-10-31T00:00:00Z / 2023-11-30T00:00:00Z


2024-02-19T00:00:00Z / 2024-03-26T00:00:00Z


2024-02-20T00:00:00Z / 2024-03-21T00:00:00Z


2023-10-23T00:00:00Z / 2023-12-06T00:00:00Z


2023-12-16T00:00:00Z / 2024-01-15T00:00:00Z


2024-02-21T00:00:00Z / 2024-03-22T00:00:00Z


2023-11-09T00:00:00Z / 2023-12-16T00:00:00Z


2024-02-08T00:00:00Z / 2024-03-25T00:00:00Z


2023-12-07T00:00:00Z / 2024-01-15T00:00:00Z


2023-10-28T00:00:00Z / 2023-12-04T00:00:00Z


2023-10-11T00:00:00Z / 2023-11-23T00:00:00Z


2023-10-03T00:00:00Z / 2023-11-13T00:00:00Z


2023-10-04T00:00:00Z / 2023-11-12T00:00:00Z


2023-12-11T00:00:00Z / 2024-01-18T00:00:00Z


2023-10-24T00:00:00Z / 2023-11-30T00:00:00Z


2023-12-07T00:00:00Z / 2024-01-18T00:00:00Z


2024-03-26T00:00:00Z / 2024-05-03T00:00:00Z


2023-11-09T00:00:00Z / 2023-12-17T00:00:00Z


2023-11-18T00:00:00Z / 2023-12-25T00:00:00Z


2023-12-07T00:00:00Z / 2024-01-14T00:00:00Z


2024-02-20T00:00:00Z / 2024-03-21T00:00:00Z


2023-12-18T00:00:00Z / 2024-01-25T00:00:00Z


2023-12-06T00:00:00Z / 2024-01-05T00:00:00Z


2023-11-01T00:00:00Z / 2023-12-08T00:00:00Z


2023-12-07T00:00:00Z / 2024-05-26T00:00:00Z


2023-12-14T00:00:00Z / 2024-01-23T00:00:00Z


2024-03-23T00:00:00Z / 2024-04-22T00:00:00Z


2023-10-01T00:00:00Z / 2024-01-14T00:00:00Z


2023-12-20T00:00:00Z / 2024-01-19T00:00:00Z


2023-12-06T00:00:00Z / 2024-01-13T00:00:00Z


2023-09-25T00:00:00Z / 2023-11-29T00:00:00Z


2023-10-24T00:00:00Z / 2023-12-01T00:00:00Z


2023-10-20T00:00:00Z / 2023-11-19T00:00:00Z


2024-03-06T00:00:00Z / 2024-04-05T00:00:00Z


2023-12-18T00:00:00Z / 2024-01-26T00:00:00Z


2023-12-12T00:00:00Z / 2024-01-11T00:00:00Z


2023-12-21T00:00:00Z / 2024-01-20T00:00:00Z


2024-02-15T00:00:00Z / 2024-03-23T00:00:00Z


2023-05-22T00:00:00Z / 2023-06-21T00:00:00Z


2023-10-30T00:00:00Z / 2023-11-29T00:00:00Z


2023-12-01T00:00:00Z / 2024-01-21T00:00:00Z


2023-11-13T00:00:00Z / 2023-12-21T00:00:00Z


2023-10-17T00:00:00Z / 2023-11-23T00:00:00Z


2023-10-18T00:00:00Z / 2023-11-25T00:00:00Z


2023-12-11T00:00:00Z / 2024-01-18T00:00:00Z


2023-12-09T00:00:00Z / 2024-01-18T00:00:00Z


2023-10-09T00:00:00Z / 2023-11-10T00:00:00Z


2023-12-15T00:00:00Z / 2024-01-21T00:00:00Z


2023-12-21T00:00:00Z / 2024-01-29T00:00:00Z


2023-12-13T00:00:00Z / 2024-01-19T00:00:00Z


2023-10-01T00:00:00Z / 2023-12-16T00:00:00Z


2023-12-15T00:00:00Z / 2024-01-22T00:00:00Z


2023-10-20T00:00:00Z / 2023-11-19T00:00:00Z


2024-02-08T00:00:00Z / 2024-03-25T00:00:00Z


2024-02-09T00:00:00Z / 2024-03-25T00:00:00Z


2023-12-19T00:00:00Z / 2024-01-18T00:00:00Z


2024-02-12T00:00:00Z / 2024-03-19T00:00:00Z


2024-03-06T00:00:00Z / 2024-04-23T00:00:00Z


2023-12-07T00:00:00Z / 2024-01-15T00:00:00Z


2023-12-21T00:00:00Z / 2024-01-28T00:00:00Z


2024-02-19T00:00:00Z / 2024-03-26T00:00:00Z


2023-12-18T00:00:00Z / 2024-01-25T00:00:00Z


2024-04-04T00:00:00Z / 2024-05-10T00:00:00Z


2023-12-01T00:00:00Z / 2024-01-21T00:00:00Z


2024-02-16T00:00:00Z / 2024-03-23T00:00:00Z


2023-11-06T00:00:00Z / 2023-12-06T00:00:00Z


2023-10-11T00:00:00Z / 2023-11-23T00:00:00Z


2023-05-22T00:00:00Z / 2023-06-21T00:00:00Z


2023-11-17T00:00:00Z / 2023-12-24T00:00:00Z


2024-02-19T00:00:00Z / 2024-04-17T00:00:00Z


2023-12-13T00:00:00Z / 2024-01-20T00:00:00Z


2023-10-19T00:00:00Z / 2023-11-26T00:00:00Z


2023-10-01T00:00:00Z / 2023-12-28T00:00:00Z


2023-10-23T00:00:00Z / 2023-11-29T00:00:00Z


2023-12-20T00:00:00Z / 2024-01-27T00:00:00Z


2023-12-21T00:00:00Z / 2024-01-29T00:00:00Z


2023-10-24T00:00:00Z / 2023-12-03T00:00:00Z


2023-10-31T00:00:00Z / 2023-12-08T00:00:00Z


2023-12-01T00:00:00Z / 2024-01-22T00:00:00Z


2024-03-26T00:00:00Z / 2024-05-03T00:00:00Z


2023-12-20T00:00:00Z / 2024-01-28T00:00:00Z


2023-11-07T00:00:00Z / 2023-12-14T00:00:00Z


2023-10-23T00:00:00Z / 2024-03-25T00:00:00Z


2023-12-18T00:00:00Z / 2024-01-25T00:00:00Z


2023-12-15T00:00:00Z / 2024-01-21T00:00:00Z


2024-03-06T00:00:00Z / 2024-04-23T00:00:00Z


2024-02-12T00:00:00Z / 2024-04-06T00:00:00Z


2023-12-20T00:00:00Z / 2024-01-19T00:00:00Z


2023-11-06T00:00:00Z / 2023-12-06T00:00:00Z


2023-11-15T00:00:00Z / 2023-12-21T00:00:00Z


2023-10-01T00:00:00Z / 2023-12-09T00:00:00Z


2023-12-20T00:00:00Z / 2024-01-27T00:00:00Z


2024-02-14T00:00:00Z / 2024-03-20T00:00:00Z


2024-03-01T00:00:00Z / 2024-04-07T00:00:00Z


2023-12-13T00:00:00Z / 2024-01-19T00:00:00Z


2023-10-24T00:00:00Z / 2023-11-30T00:00:00Z


2024-02-19T00:00:00Z / 2024-04-09T00:00:00Z


2023-12-20T00:00:00Z / 2024-01-28T00:00:00Z


2024-02-08T00:00:00Z / 2024-03-25T00:00:00Z


2023-12-01T00:00:00Z / 2024-01-21T00:00:00Z


2023-11-06T00:00:00Z / 2023-12-14T00:00:00Z


2023-10-24T00:00:00Z / 2023-11-23T00:00:00Z


2023-05-17T00:00:00Z / 2023-06-16T00:00:00Z


2023-12-18T00:00:00Z / 2024-01-25T00:00:00Z


2023-10-19T00:00:00Z / 2023-11-18T00:00:00Z


2023-11-13T00:00:00Z / 2023-12-20T00:00:00Z


2024-03-06T00:00:00Z / 2024-04-13T00:00:00Z


2023-11-17T00:00:00Z / 2023-12-24T00:00:00Z


2023-10-01T00:00:00Z / 2023-12-08T00:00:00Z


2023-05-21T00:00:00Z / 2023-07-06T00:00:00Z


2023-11-09T00:00:00Z / 2023-12-16T00:00:00Z


2023-10-21T00:00:00Z / 2023-11-20T00:00:00Z


2023-12-07T00:00:00Z / 2024-05-26T00:00:00Z


2024-01-23T00:00:00Z / 2024-04-26T00:00:00Z


2023-10-30T00:00:00Z / 2023-12-08T00:00:00Z


2023-12-20T00:00:00Z / 2024-01-27T00:00:00Z


2023-10-23T00:00:00Z / 2023-11-29T00:00:00Z


2023-11-15T00:00:00Z / 2023-12-22T00:00:00Z


2024-02-13T00:00:00Z / 2024-03-21T00:00:00Z


2023-10-20T00:00:00Z / 2023-11-19T00:00:00Z


2024-02-14T00:00:00Z / 2024-03-15T00:00:00Z


2023-12-07T00:00:00Z / 2024-01-06T00:00:00Z


2023-12-15T00:00:00Z / 2024-01-22T00:00:00Z


2023-12-13T00:00:00Z / 2024-01-19T00:00:00Z


2023-10-30T00:00:00Z / 2023-12-06T00:00:00Z


2023-10-23T00:00:00Z / 2023-12-18T00:00:00Z


2023-12-20T00:00:00Z / 2024-01-28T00:00:00Z


2023-12-14T00:00:00Z / 2024-01-22T00:00:00Z


2023-10-23T00:00:00Z / 2023-12-06T00:00:00Z


2023-12-18T00:00:00Z / 2024-01-25T00:00:00Z


2024-03-26T00:00:00Z / 2024-05-16T00:00:00Z


2023-10-01T00:00:00Z / 2024-05-26T00:00:00Z


2023-12-20T00:00:00Z / 2024-01-19T00:00:00Z


2023-12-18T00:00:00Z / 2024-01-26T00:00:00Z


2023-09-25T00:00:00Z / 2023-11-06T00:00:00Z


2023-10-31T00:00:00Z / 2023-11-30T00:00:00Z


2023-10-31T00:00:00Z / 2023-12-08T00:00:00Z


2023-12-08T00:00:00Z / 2024-01-17T00:00:00Z


2024-03-06T00:00:00Z / 2024-04-05T00:00:00Z


2023-10-20T00:00:00Z / 2023-11-19T00:00:00Z


2023-10-24T00:00:00Z / 2023-12-01T00:00:00Z


2023-05-17T00:00:00Z / 2023-08-30T00:00:00Z


2023-11-06T00:00:00Z / 2023-12-14T00:00:00Z


2023-12-21T00:00:00Z / 2024-01-20T00:00:00Z


2024-02-19T00:00:00Z / 2024-03-26T00:00:00Z


2024-01-24T00:00:00Z / 2024-02-23T00:00:00Z


2023-11-04T00:00:00Z / 2023-12-10T00:00:00Z


2023-10-01T00:00:00Z / 2023-12-27T00:00:00Z


2023-10-23T00:00:00Z / 2023-12-06T00:00:00Z


2023-10-01T00:00:00Z / 2023-12-08T00:00:00Z


2023-11-13T00:00:00Z / 2023-12-19T00:00:00Z


2024-02-14T00:00:00Z / 2024-03-20T00:00:00Z


2023-12-20T00:00:00Z / 2024-01-19T00:00:00Z


2023-12-13T00:00:00Z / 2024-01-20T00:00:00Z


2023-12-07T00:00:00Z / 2024-05-26T00:00:00Z


2023-10-19T00:00:00Z / 2023-11-26T00:00:00Z


2024-03-01T00:00:00Z / 2024-03-31T00:00:00Z


2023-12-06T00:00:00Z / 2024-01-05T00:00:00Z


2023-11-06T00:00:00Z / 2023-12-06T00:00:00Z


2024-04-05T00:00:00Z / 2024-05-15T00:00:00Z