md5: 6599e4da1afec4ae137573079974e53c sha256: a9fa267cf207b22087949be81e0dd517ff1ffff80427428aff1f1d0fff8e6963


md5: 6599e4da1afec4ae137573079974e53c sha1: 0ce831123aa802f1c73274c24ffe5eb528428199


sha1: 2c91261b9ccf6a2694beba1ff67ad9484e0a213b sha256: fc3bf4ea10198590a96198f39dd3137dbe9c4fb1b0cc7b66194597abeed22f9e


md5: fd1a3618c2c4f485ae10874304199abd sha256: fc3bf4ea10198590a96198f39dd3137dbe9c4fb1b0cc7b66194597abeed22f9e


md5: fd1a3618c2c4f485ae10874304199abd sha1: 2c91261b9ccf6a2694beba1ff67ad9484e0a213b


sha1: 3401a683f2bfa1eed1782027bf13808a76cb0385 sha256: 51bf3ac2ac26d9c785fad35b017f127a62d6504ab7ef1866fd0e9184efd849a2


md5: 77c999f1c2fe5a3f26bfc0182e0c48e5 sha256: 51bf3ac2ac26d9c785fad35b017f127a62d6504ab7ef1866fd0e9184efd849a2


md5: 77c999f1c2fe5a3f26bfc0182e0c48e5 sha1: 3401a683f2bfa1eed1782027bf13808a76cb0385


sha1: 5f30dbda075f5b3c53bbf1ac11019e6257f1dff2 sha256: 8ff239968d651fbd9b430ba541dd91a330951919a4ffd45e5d3ad05d003f85ad


md5: de110276f77ca7efdcb89a33afc47454 sha256: 8ff239968d651fbd9b430ba541dd91a330951919a4ffd45e5d3ad05d003f85ad


md5: de110276f77ca7efdcb89a33afc47454 sha1: 5f30dbda075f5b3c53bbf1ac11019e6257f1dff2


sha1: d2c9b124827176694369b8f146381ce5a1ddad49 sha256: fc23f736d086e3d1f728af5f27033fb728102ec2f9860b4a454f9f2959dd576b


md5: 321c09c39b075e588d8715c18df8c1da sha256: fc23f736d086e3d1f728af5f27033fb728102ec2f9860b4a454f9f2959dd576b


md5: 321c09c39b075e588d8715c18df8c1da sha1: d2c9b124827176694369b8f146381ce5a1ddad49


sha1: 395a8c7b96c5f0065c57bc83f2be85b8f17acd89 sha256: 88cdf1d38fedfe4b8fceb746d4a02afba19a7ab3d260adac5481fdac28c98a60


md5: cb3df003e8071428556c806ca9d79c79 sha256: 88cdf1d38fedfe4b8fceb746d4a02afba19a7ab3d260adac5481fdac28c98a60


md5: cb3df003e8071428556c806ca9d79c79 sha1: 395a8c7b96c5f0065c57bc83f2be85b8f17acd89


sha1: 98c9a598ba8c6022c64736e6b1abcfe24e8d0023 sha256: 74bed7d6574e89dd1d05f01e003cccc9548aaf59afdf8867133e090b00e4526e


md5: 5ba8c93c9efbe47ba1d26b5090fdcbe7 sha256: 74bed7d6574e89dd1d05f01e003cccc9548aaf59afdf8867133e090b00e4526e


md5: 5ba8c93c9efbe47ba1d26b5090fdcbe7 sha1: 98c9a598ba8c6022c64736e6b1abcfe24e8d0023


sha1: 36f975355b374c25887e3f5133095d8b6ba35914 sha256: 6cc18268fdbb75def41e48e0c2435937d209eb38c160da3d67b1f733bb17daa3


md5: 1805c0fb33f51b15c4aa441ab57cc431 sha256: 6cc18268fdbb75def41e48e0c2435937d209eb38c160da3d67b1f733bb17daa3


md5: 1805c0fb33f51b15c4aa441ab57cc431 sha1: 36f975355b374c25887e3f5133095d8b6ba35914


Hosted the contents of the suspicous script a.ps1


Hosted a combined installer for Atera Agent and Splashtop Remote


Hosted PUA.Win32.RAdmin.E


Outbound connection for SimpleHelp Remote Access


Attacker


Hadooken malware


Mallox malware


Packed Cryptominer


Unpacked Cryptominer


Tsunami malware


C


Y


Crystal Rans0m


Discord webhook used for data exfiltration


Malware working folder


Defanged


vbs.jpeg


instantflowercaseneedbeautygirlsherealways[1].gz


JNN.txt


Remcos


C2 / Cobalt Strike


C2 / Zloader


filename: 100_x64.ps1


md5: f059dcf7acbf05887076d713a29884c6


filename: Dns84.exe


md5: 5c5b0a4a700532589f708aef417f3da9


filename: Stotri.exe


md5: 87a929b09075325dda765e2cb9d3d22b


filename: Stotri.dll


md5: 8d2300b4ad8c8dacda2e7ba45b474e8a


filename: GrapheneMatrix.exe


md5: 1eed5fee8bf942798dbde5752941910e


filename: SoftwareGrabber.dll


md5: bbbc51064235f7a8dc30bfc8ecc59e00


filename: HttpGrabber.dll


md5: 4f403afc3d9c0616ca85aca29ccb527b


filename: Vnc64.dll


md5: 55fa76f4da12133c53a9f446e7fd950d


filename: Vnc32.dll


md5: b6b5490e55f95335abada5cf706aceb5


filename: ftp64.dll


md5: db01e97a0dcde93e51d7d817b924aa55


Veaty and spearal


Listner


CacheHttp


Gosecretsdump


Sliver


BlackCat Ransomware


Phishing HTML Template


Hosting Concepts B.V d/b/a


AS-CHOOPA


DIGITALOCEAN-ASN


LNK


HTA (EXE)


HTA (EXE) / Hosting Server


HTA (EXE) / Pinged by PowerShell Script


ZIP


ZIP / Hosting Server


IDATLOADER


Unpacked from IDATLOADER YASS (Stealer)


YASS (Stealer)


NetSupport RAT / Hosting Server


NetSupport RAT


Win32/Filecoder.Spacecolon.A / Auto variant of ScRansom, filename: auto.exe


Win32/Filecoder.Spacecolon.A / Auto variant of ScRansom, sha1: 4497406d6ee7e2ef561c949ac88bb973bdbd214b


Win32/Filecoder.Spacecolon.B / Auto variant of ScRansom, filename: Project1.exe


Win32/Filecoder.Spacecolon.B / Auto variant of ScRansom, sha1: 3c32031696db109d5fa1a09af035038bfe1ebe30


Win32/Filecoder.Spacecolon.A / Static variant of ScRansom, filename: New.exe


Win32/Filecoder.Spacecolon.A / Static variant of ScRansom, sha1: 26d9f3b92c10e248b7dd7be2cb59b87a7a011af7


Win32/Filecoder.Spacecolon.B / Auto encryptor variant of ScRansom Turkish ransom note, filename: Project1.exe


Win32/Filecoder.Spacecolon.B / Auto encryptor variant of ScRansom Turkish ransom note, sha1: 1ce78474088c14afb8495f7abb22c31b397b57c7


Win32/Filecoder.Spacecolon.A / Static SSH encryptor variant of ScRansom, filename: Project1.exe


Win32/Filecoder.Spacecolon.A / Static SSH encryptor variant of ScRansom, sha1: 1b635cb0a4549106d8b4cd4edaff384b1e4177f6


Win32/Filecoder.Spacecolon.A / Decryptor variant of ScRansom (oldest), filename: Project1.exe


Win32/Filecoder.Spacecolon.A / Decryptor variant of ScRansom (oldest), sha1: dae100afc12f3de211bff9607dd53e5e377630c5


filename: Rarlab_sib.msi


sha1: 705280a2dcc311b75af1619b4ba29e3622ed53b6


Namecheap Inc / 2023‑11‑04 / Fake LockBit leak site


CT-HangZhou-IDC / C2 for xl_ext_chrome.crx


Executable hosted on 182.92.116[.]32:12777 that downloads the below extensions, filename: protect.distribution.exe


Executable hosted on 182.92.116[.]32:12777 that downloads the below extensions, sha256: b553cd19fefd923981b8a14685630f844f9c3ced2fc392b0fad76d216f7334da


Browser extension copied from Extension-Code-Injector project, filename: browser-extension.crx


Browser extension copied from Extension-Code-Injector project, sha256: d664a8714aefb5b30c06c44386f3915dda03d2995d18c901a030896dae6a6e96


Chrome extension with C2 server information, filename: xl.ext.chrome.crx


Chrome extension with C2 server information, sha256: 8121538813de80b44ccaf093867984f17a5165741c427eb9e492c044b95b4bab


Executable, filename: Acrobat.exe


Executable, sha256: 326abef91a6676241c915ff2e070cb210a1c5e9b6cfe72b4ac33bc080075f271


Decoy Cobalt Strike Manual that connects to 182.92.116[.]32:12777, filename: test.pdf.lnk


Decoy Cobalt Strike Manual that connects to 182.92.116[.]32:12777, sha256: 8bfab1a4aefc72faf96a424526428b4209f265ebb6020308cba45bbd0ff1952f


Malicious


Detection Description / Trojan.MSIL.FDMTP.ZCLH FDMTP dropper


Detection Description / Trojan.Win32.FDMTP.ZYLH FDMTP


Detection Description / Legitimate executable to load PUBLOAD


Detection Description / Trojan.Win32.PUBLOAD.ZALE PUBLOAD loader


Detection Description / Trojan.Win32.PUBLOAD.ZCLE PUBLOAD shellcode component


Detection Description / HIUPAN


Detection Description / Worm.Win32.HIUPAN.ZBLE HIUPAN main component


Detection Description / HIUPAN config


Detection Description / Trojan.Win32.FDMTP.ZBLH FDMTP


Detection Description / Legitimate executable to load FDMTP


Detection Description / Trojan.Win64.FDMTP.ZBLE FDMTP loader


Detection Description / Trojan.Win32.PUBLOAD.ZALH FDMTP loader


Detection Description / Trojan.Win32.PUBLOAD.ZALH PUBLOAD


Detection Description / Trojan.MSIL.PTSOCKET.ZBLE PTSOCKET


Detection Description / Trojan.Win64.FDMTP.ZYLE FDMTP loader


Detection Description / Trojan.MSIL.FDMTP.ZALH FDMTP


Detection Description / Trojan.Win32.FDMTP.ZYLE FDMTP


Detection Description / Trojan.MSIL.FDMTP.ZCLE FDMTP


Detection Description / Trojan.Win64.DOWNBAIT.ZCLF DOWNBAIT


Detection Description / Trojan.Win64.PULLBAIT.ZALF PULLBAIT


Detection Description / Backdoor.Win32.CBROVER.ZALF CBROVER


Detection Description / Trojan.Win32.INEXLOAD.ZBLF Loader for CBROVER


Detection Description / TrojanSpy.Win32.FILESAC.ZBLF FILESAC


Detection Description / Trojan.Win32.DULLOAD.ZCLF Loader for PLUGX


Detection Description / Backdoor.Win32.PLUGX.ZBLF PLUGX


IPv4 Description / PUBLOAD C&C


IPv4 Description / FDMTP C&C


IPv4 Description / Download site


IPv4 Description / CBROVER C&C


Description / PLUGX C&C


sha256: 2d823c8b6076e932d696e8cb8a2c5c5df6d392526cba8e39b64c43635f683009 filename: TDSSKiller.exe


md5: ff1eff0e0f1f2eabe1199ae71194e560 filename: TDSSKiller.exe


md5: ff1eff0e0f1f2eabe1199ae71194e560 sha256: 2d823c8b6076e932d696e8cb8a2c5c5df6d392526cba8e39b64c43635f683009


sha256: 467e49f1f795c1b08245ae621c59cdf06df630fc1631dc0059da9a032858a486 filename: LaZagne.exe


md5: 5075f994390f9738e8e69f4de09debe6 filename: LaZagne.exe


md5: 5075f994390f9738e8e69f4de09debe6 sha256: 467e49f1f795c1b08245ae621c59cdf06df630fc1631dc0059da9a032858a486


FDMTP


PUBLOAD


HIUPAN


PTSOCKET


DOWNBAIT


PULLBAIT


CBROVER


FILESAC


PLUGX


CapCut_7376550521366298640_installer.zip


JamPlus Builder – POC


Python Stealer


Remote server


Phishing site


copyright-infringement-images.zip


Injected Process


0Aeon, filename: 0Aeon Timeline.exe


SHA256 0Aeon, sha256: fbef3b6316cd8cf77978c8eac780fe471654c0b5dbbc812e4e266475bde39dcc


C2 / Found inside the binary


Infrastructure


asr.node


Malware / node-relay


Malware / node-r-control


fsy.bin


Malware / netd


Malware / rlogin


Malware / alogin


Malware / zylogin


Malware / axlogin


Malware / UPDTAE backdoor


Voldemort


filename: Node.exe


sha256: 8c4daf5e4ced10c3b7fd7c17c7c75a158f08867aeb6bccab6da116affa424a89


sha256: e74dac040ec85d4812b479647e11c3382ca22d6512541e8b42cf8f9fbc7b4af6


Decryptable executable


July loader version


May loader version


Main module


gTunnel


ngrok


filename: update.zip


sha256: 96dec6e07229201a02f538310815c695cf6147c548ff1c6a0def2fe38f3dcbc8


Phishing attachment (pdf)


filename: OpenFileFinder.dll


sha256: 8316065c4536384611cbe7b6ba6a5f12f10db09949e66cb608c92ae8b69e4d67


Block


Monitor


AMOS sample


which hosted AMOS malware


Malvertising


url_path / Malvertising


XHTML


Malicious


Exfiltration


Fog Ransom Note


Threat Actors Communication Channel


Rage Stealer Angry Stealer Dropper Builder Component


Rage Stealer


Umbraco Webshells


Post-Exploitation Tools


Paths


Tropic Trooper Loaders


and


data exfiltration site


Note This is legitimate service leveraged for malicious purposes


ShrinkLocker


sha1: 892be61f0cf68425e42efda9aa31f0e14bc963b5 sha256: eab7c6ef336c0fe2e0d15e2ccfe851f7ee172bdc14cee2d25e1c245e9034279d


md5: f772f5c65d65412f61ef5f2660e33ceb sha256: eab7c6ef336c0fe2e0d15e2ccfe851f7ee172bdc14cee2d25e1c245e9034279d


md5: f772f5c65d65412f61ef5f2660e33ceb sha1: 892be61f0cf68425e42efda9aa31f0e14bc963b5


sha1: 91f7690be7d36bde7537193987610848289e0f56 sha256: 3c02aeeb57d3c64feae109f50a89774111a443142859891bae4fb2f469fa0466


md5: afbb9459d4a0f60d7ffb3b3532d11bc2 sha256: 3c02aeeb57d3c64feae109f50a89774111a443142859891bae4fb2f469fa0466


md5: afbb9459d4a0f60d7ffb3b3532d11bc2 sha1: 91f7690be7d36bde7537193987610848289e0f56


sha1: d33f12dbcdd427c527a8285fd9ab0c848051288b sha256: fd4a5398e55beacb2315687a75af5aa15b776b5d36b9800a1792ede3955616c2


md5: 29d83f29c0b0a0b7499e71e7d5cb713f sha256: fd4a5398e55beacb2315687a75af5aa15b776b5d36b9800a1792ede3955616c2


md5: 29d83f29c0b0a0b7499e71e7d5cb713f sha1: d33f12dbcdd427c527a8285fd9ab0c848051288b


sha256: 0dd61a16c625c49ffefaf4ce24cabf9a074028a06640d9bbb804f735ff56dfa3


md5: 9b1191f1ceddf312b0d609cd929c6631


sha1: d2d96f0d819abd771617e806994effc180c7438c sha256: 489ab4819830d231c3fc3572c5386cad9d18773a8121373ea8174de981cc9166


md5: de85ca91e1e8100a619de1c25112f1a5 sha256: 489ab4819830d231c3fc3572c5386cad9d18773a8121373ea8174de981cc9166


md5: de85ca91e1e8100a619de1c25112f1a5 sha1: d2d96f0d819abd771617e806994effc180c7438c


sha1: 7070b7e9d537c96a2218b3907b05af2d7378661c sha256: 35feefe6bd2b982cb1a5d4c1d094e8665c51752d0a6f7e3cae546d770c280f3a


md5: 5a537673c34933fc854fbfb65477a686 sha256: 35feefe6bd2b982cb1a5d4c1d094e8665c51752d0a6f7e3cae546d770c280f3a


md5: 5a537673c34933fc854fbfb65477a686 sha1: 7070b7e9d537c96a2218b3907b05af2d7378661c


sha256: aa79afbf82b06cda268664b7c83900d8f7a33e0f0071facba0b3d8f7a68ce56a


md5: 764f691b2168e8b3b6f9fb6582e2f819


sha256: b9e64b58d7746cb1d3bed20405ef34d097af08c809d8dad10b9296b0bebb2b0b


md5: eac0ae655d344c25ff467a929790885c


sha1: 50566fdea2f4b8a3466427f9c6798dabe2587823 sha256: bc2e7451995e188f50581efb2b564dfbc5b593f57f7b52072eeba235a0861670


md5: 6154760e602bd71192d93f72fbdb486e sha256: bc2e7451995e188f50581efb2b564dfbc5b593f57f7b52072eeba235a0861670


md5: 6154760e602bd71192d93f72fbdb486e sha1: 50566fdea2f4b8a3466427f9c6798dabe2587823


sha1: 731dab83ef1d02203db64fbefbe59f3791db1e21 sha256: aa212493331277dd28a8b9b2f535c7b719ff9c6d4ccad121fd0a59dcb78697d9


md5: 394e056cb6cb732dfd5e0d45d3dae938 sha256: aa212493331277dd28a8b9b2f535c7b719ff9c6d4ccad121fd0a59dcb78697d9


md5: 394e056cb6cb732dfd5e0d45d3dae938 sha1: 731dab83ef1d02203db64fbefbe59f3791db1e21


sha1: c3181fd7cb463893fc73974acc0016605d90ef6c sha256: a05f2999844495bffb3405b1db2d1927e5237e61d71edb599a5fa64e3e575856


md5: dd2431b1f858b4ca14a4ea05fb8c4a06 sha256: a05f2999844495bffb3405b1db2d1927e5237e61d71edb599a5fa64e3e575856


md5: dd2431b1f858b4ca14a4ea05fb8c4a06 sha1: c3181fd7cb463893fc73974acc0016605d90ef6c


sha1: f6acdc16c695c3c219116aea3d585efedcafdab5 sha256: d3a80ce2fded8144d347ee0b42c18ff6ad8cb386c3a2fc884ef2348afe7633c9


md5: 58dc7c9577ff90a046359ca255c0c9f4 sha256: d3a80ce2fded8144d347ee0b42c18ff6ad8cb386c3a2fc884ef2348afe7633c9


md5: 58dc7c9577ff90a046359ca255c0c9f4 sha1: f6acdc16c695c3c219116aea3d585efedcafdab5


sha1: db370ee79d9b4bd44e07f425d7b06beffc8bdded sha256: 7f8d4a36d05b60f0dd986a3bbde1be34b10a2d80297d1ae28d3fdaaa914fb8bf


md5: 869742fb9db71fdb66f00528fe2966ec sha256: 7f8d4a36d05b60f0dd986a3bbde1be34b10a2d80297d1ae28d3fdaaa914fb8bf


md5: 869742fb9db71fdb66f00528fe2966ec sha1: db370ee79d9b4bd44e07f425d7b06beffc8bdded


sha1: 2e113050a81bbd0774db7e86fad4abd44e5b6ec2 sha256: 4ff07f308da5b18f4a71ef09eea3f3c968683c93e8aa55d3f03975207e3b19ce


md5: 9345425cf07b4c39a80cd8540e08bfde sha256: 4ff07f308da5b18f4a71ef09eea3f3c968683c93e8aa55d3f03975207e3b19ce


md5: 9345425cf07b4c39a80cd8540e08bfde sha1: 2e113050a81bbd0774db7e86fad4abd44e5b6ec2


sha1: 88c76d31b046227d82f94db87697b25e482eb398 sha256: 3de02a782987b4463e02dda90df57a06fb0022eb8840a17c4c812631705ebf7c


md5: 9c695be3703194fdb71c212a0832bcf3 sha256: 3de02a782987b4463e02dda90df57a06fb0022eb8840a17c4c812631705ebf7c


md5: 9c695be3703194fdb71c212a0832bcf3 sha1: 88c76d31b046227d82f94db87697b25e482eb398


sha1: 27c176bbd3e254d5e46ccb865d29c8c166ba4a9f sha256: a5833236a73c66add109c8b53adda6f998bf92d63955fa06787d66d670d7889e


md5: 9606b4720a0e73ef1f00505a11aab2f7 sha256: a5833236a73c66add109c8b53adda6f998bf92d63955fa06787d66d670d7889e


md5: 9606b4720a0e73ef1f00505a11aab2f7 sha1: 27c176bbd3e254d5e46ccb865d29c8c166ba4a9f


sha1: 90fa56e79765d27d35706d028d32dc5be7efb623 sha256: c27a3b0ffaba2258d66d595c5478f12ee8a107cd590132a4a72d8bfdaf486fc1


md5: d33f608f561096be24cba91797e0da2f sha256: c27a3b0ffaba2258d66d595c5478f12ee8a107cd590132a4a72d8bfdaf486fc1


md5: d33f608f561096be24cba91797e0da2f sha1: 90fa56e79765d27d35706d028d32dc5be7efb623


sha1: 5fbd9bd73040d7a2cac0fc21d2fe29ebe57fb597 sha256: 887936dc1db271c6970ca78f25c4eb62d3816761b675db2cf4a46645c98a5fd9


md5: dc795cb9290b1bc0b7fb1ce9d6ae7c93 sha256: 887936dc1db271c6970ca78f25c4eb62d3816761b675db2cf4a46645c98a5fd9


md5: dc795cb9290b1bc0b7fb1ce9d6ae7c93 sha1: 5fbd9bd73040d7a2cac0fc21d2fe29ebe57fb597


sha1: fb83899dc633c59a8473a3048c9aacce7e1bf8d8 sha256: b72e8c0e4291e85ad683d6dcba449f18eacd31e8e5395c7064dcb05077db4a06


md5: b85538f665fdb6c8d9a74f2df7369832 sha256: b72e8c0e4291e85ad683d6dcba449f18eacd31e8e5395c7064dcb05077db4a06


md5: b85538f665fdb6c8d9a74f2df7369832 sha1: fb83899dc633c59a8473a3048c9aacce7e1bf8d8


sha1: b5e3e65cd6b09b17d4819a1379dde7db3e33813b sha256: fae14137605c6a173eaca1e89ad92961e6cb2b66b924087f2f109c0ab38a0d71


md5: 618d62dd95fd9aeb855fe2ef1403dce5 sha256: fae14137605c6a173eaca1e89ad92961e6cb2b66b924087f2f109c0ab38a0d71


md5: 618d62dd95fd9aeb855fe2ef1403dce5 sha1: b5e3e65cd6b09b17d4819a1379dde7db3e33813b


sha1: a67205dc84ec29eb71bb259b19c1a1783865c0fc sha256: 34ca75a8c190f20b8a7596afeb255f2228cb2467bd210b2637965b61ac7ea907


md5: 3907c7fbd4148395284d8e6e3c1dba5d sha256: 34ca75a8c190f20b8a7596afeb255f2228cb2467bd210b2637965b61ac7ea907


md5: 3907c7fbd4148395284d8e6e3c1dba5d sha1: a67205dc84ec29eb71bb259b19c1a1783865c0fc


sha1: 9a4a1581cc3971579574f837e110f3bd6d529dab sha256: 29ae7b30ed8394c509c561f6117ea671ec412da50d435099756bbb257fafb10b


md5: 17fc12902f4769af3a9271eb4e2dacce sha256: 29ae7b30ed8394c509c561f6117ea671ec412da50d435099756bbb257fafb10b


md5: 17fc12902f4769af3a9271eb4e2dacce sha1: 9a4a1581cc3971579574f837e110f3bd6d529dab


sha1: 4f06d376648def0bb8a325e70046a5030d2cb1d1 sha256: db5a204a34969f60fe4a653f51d64eee024dbf018edea334e8b3df780eda846f


md5: 6eed4ee0cc57126e9a096ab9905f471c sha256: db5a204a34969f60fe4a653f51d64eee024dbf018edea334e8b3df780eda846f


md5: 6eed4ee0cc57126e9a096ab9905f471c sha1: 4f06d376648def0bb8a325e70046a5030d2cb1d1


sha1: 5d60c8507ac9b840a13ffdf19e3315a3e14de66a sha256: 5e0f28bd2d49b73e96a87f5c20283ebe030f4bb39b3107d4d68015dce862991d


md5: 896e0f54fc67d72d94b40d7885f10c51 sha256: 5e0f28bd2d49b73e96a87f5c20283ebe030f4bb39b3107d4d68015dce862991d


md5: 896e0f54fc67d72d94b40d7885f10c51 sha1: 5d60c8507ac9b840a13ffdf19e3315a3e14de66a


MSI


filename: rnp.dll


md5: 1825d0310bf5029899f42004c4a1ef83


filename: nijboq.rar


md5: a21e6b776daaaa3508efcf5c535a1549


filename: notifications.js


md5: ea64dd9b3f06eb84b9db9f4f2c39ccc8


filename: proxy.js


md5: ba7321b07561c6625c6f1aa6c8e89173


filename: screenshot.js


md5: d4bd73d3cc8f755b3e6e0ad65b2db5f3


filename: screenshotRules.js


md5: d2cd208fdaa55a5071b4c35a17dd405b


filename: settings.js


md5: 3b094e98f1b330e73b139c1af0feb033


filename: tabs.js


md5: b431647fe881f706620905d93f53c5fe


filename: utils.js


md5: a796507df34f81f22711cb9eea0c3bc2


filename: gmail.js


md5: ba52c08f800fc904307d9980c00c88d3


filename: clipper.js


md5: ad3161c606f7ed6959b3589702f991e6


filename: commands.js


md5: 155c9fda27acbd168f06975cfaf1ff8e


filename: domain.js


md5: d34aa86ef943d25b7167c2bc496fc370


filename: extensions.js


md5: 9a4439dd4111a14bc1903c5d7643cde7


filename: getMachineInfo.js


md5: 27c5a32786f92096674b21dc0a4e3e41


filename: injections.js


md5: 6b07dba80731bd58366018a015094001


filename: background.js


md5: d8fe80128e758cd7362399854276033b


filename: manifest.json


md5: 12bcb0fb1d3d9f2b92d1a2c4102c5700


filename: config.js


md5: 49e49ae063ad8c6a5a578f598510077c


BlotchyQuasar sample


Paste containing the encrypted C2 of BlotchyQuasar


BlotchyQuasar C2 for the analyzed sample


Additional BlotchyQuasar C2


Hash(es)


Trojan.BAT.MEKOTIO.B


PowerShell / Trojan.PS1.MEKOTIO.AA


PowerShell


Trojan.MSIL.BBTOK.A


controller.exe


PDFview.exe


C&C


Backdoor


Earth Lusca’s archive


Earth Lusca’s LNK


Earth Lusca’s DLL decryptor


Extracted C&Cs


filename: FCCCall.msi


sha256: fd9e8fcc5bda88870b12b47cbb1cc8775ccff285f980c4a2b683463b26e36bf0


sha256: 36cac29ff3c503c2123514ea903836d5ad81067508a8e16f7947e3e675a08670


sha256: d502f822e6c52345227b64e3c326e2dbefdd8fc3f844df0821598f8d3732f763


filename: FCCCall.exe


sha256: d5c0b89e1dfbe9f5e5b2c3f745af895a36adf772f0b72a22052ae6dfa045cea6


sha256: 0621d37818c35e2557fdd8a729e50ea662ba518df8ca61a44cc3add5c6deb3cd


sha256: c0110cb21ae0e7fb5dec83ca90db9e250b47a394662810f230eb621b0728aa97


filename: FCCCall


sha256: d801ad1beeab3500c65434da51326d7648a3c54923d794b2411b7b6a2960f31e


filename: FCCCall.dmg


sha256: 000b4a77b1905cabdb59d2b576f6da1b2ef55a0258004e4a9e290e9f41fb6923


sha256: 24b89c77eaeebd4b02c8e8ab6ad3bd7abaa18893ecd469a6a04eda5e374dd305


sha256: b8e69d6a766b9088d650e850a638d7ab7c9f59f4e24e2bc8eac41c380876b0d8


filename: MiroTalk.dmg


sha256: 9abf6b93eafb797a3556bea1fe8a3b7311d2864d5a9a3687fce84bc1ec4a428c


filename: Jami


sha256: 0f5f0a3ac843df675168f82021c24180ea22f764f87f82f9f77fe8f0ba0b7132


filename: MiroTalk.msi


sha256: de6f9e9e2ce58a604fe22a9d42144191cfc90b4e0048dffcc69d696826ff7170


filename: MiroTalk.exe


sha256: 9e3a9dbf10793a27361b3cef4d2c87dbd3662646f4470e5242074df4cb96c6b4


BeaverTail (Python)


filename: CivetQ


sha256: 7180f5a1c2554b77b4c21a727cca65cc0f9f023f6cac05b295d7172dad07023f


sha256: 306adab1769c48e09e5a637c82b6b32cd57e4895cc727860f02b558f406e7f34


sha256: 7f13ca9848086e3de9be971ea8d44ea97ec289c4565ce35b0049c8b534fccbef


sha256: 01b7306554f6e6bac63f5524588ff5c880b5afb4394074d1c132ecc554c72c83


sha256: 2f86acdfdf19c1719189fb121cc9391453d83989aa5c07d4144c9fb6585610cc


Various malicious Javascript


to stop IIS services


qoakeifm-unknown.txt


C2 (Victims)


202401 202408


C2 / United States California Los Angeles AS834 IPXO LLC


C2 / Japan Osaka Osaka AS34985 ASN block not managed by the RIPE NCC


AvNeutralizer


XMRig packed with PackXOR+Hidden Malware Builder+SilentCryptoMiner


XMRig packed with PackXOR+SilentCryptoMiner


XMRig+R77 packed with PackXOR+SilentCryptoMiner


Data exfiltrator/bot packed with PackXOR


XMRig+R77 packed with SilentCryptoMiner


XMRig packed with Hidden Malware Builder+SilentCryptoMiner


XMRig packed with SilentCryptoMiner


exfiltrator/bot


27ff4f44289c5c66cac5bfdeca9a391 HYDRA, 27ff4f44289c5c66cac5bfdeca9a391 HYDRA, filename: Griselda.apk


27ff4f44289c5c66cac5bfdeca9a391 HYDRA, 27ff4f44289c5c66cac5bfdeca9a391 HYDRA, sha256: 852fb97e23fe551c4a962ea752b19c5479e91d9c637f31589bdd79f91c8216bf


Очі, Очі, sha256: c8c5d2e0d2a29417c4a89c55c4a0e452b948b1429418eda84be725774504a35c filename: 1.9.4.apk


Очі, Очі, md5: d6171caf4a5e9ff657558f30b595f8b0 filename: 1.9.4.apk


Очі, Очі, md5: d6171caf4a5e9ff657558f30b595f8b0 sha256: c8c5d2e0d2a29417c4a89c55c4a0e452b948b1429418eda84be725774504a35c


sha256: 28f07bdcafaebb2c37d206649022ccbe2938b0381d7febfe0b8154292dd04f39 filename: Crew.java


md5: 9275cb60e85eb039c2806548381af78d filename: Crew.java


md5: 9275cb60e85eb039c2806548381af78d sha256: 28f07bdcafaebb2c37d206649022ccbe2938b0381d7febfe0b8154292dd04f39


sha256: 61e5651c5bba683bcf93e27a040d6c5fd64399dab6d59d834518a6aadde18954 filename: LocationEntity.java


md5: eb58e0e223c84a46b4e5ad6154e869d1 filename: LocationEntity.java


md5: eb58e0e223c84a46b4e5ad6154e869d1 sha256: 61e5651c5bba683bcf93e27a040d6c5fd64399dab6d59d834518a6aadde18954


Topway Global Limited / 80 443 3389 / WIN-USLKI5BA743 / C2


Lure document, filename: IISS Prague Defence Summit 2024.zip


Lure document, sha256: 1387ec22a3391647e25d2cb722cd89e255d3ebfe586cf5f699eae22c6e008c34


Legit modified executable meant to trick users Drops a PE and DLL containing ToneShell, filename: Annex 1 - IISS PRAGUE DEFENCE SUMMIT (8 – 10 November 2024).pif


Annex 1 - IISS PRAGUE DEFENCE SUMMIT (8 – 10 November 2024).pif

Legit modified executable meant to trick users Drops a PE and DLL containing ToneShell, sha256: 057fd248e0219dd31e1044afb7bc77c5f30a7315e136adfcca55ce1593d6cf5d


Decoy PDF document, filename: Annex 2 - IISS PRAGUE DEFENCE SUMMIT (8 – 10 November 2024) - Copy.pdf


Annex 2 - IISS PRAGUE DEFENCE SUMMIT (8 – 10 November 2024) - Copy.pdf

Decoy PDF document, sha256: 901d713d4d12afbcee5e33603459ebc638afd6b4e2b13c72480c90313b796a66


Dropped immediately upon execution of Annex 1 IISS PRAGUE DEFENCE SUMMIT (8 – 10 November 2024).pif, filename: SFFWallpaperCore.exe


Dropped immediately upon execution of Annex 1 IISS PRAGUE DEFENCE SUMMIT (8 – 10 November 2024).pif, sha256: 057fd248e0219dd31e1044afb7bc77c5f30a7315e136adfcca55ce1593d6cf5d


Dropped immediately upon execution of Annex 1 IISS PRAGUE DEFENCE SUMMIT (8 – 10 November 2024).pif, filename: libemb.dll


Dropped immediately upon execution of Annex 1 IISS PRAGUE DEFENCE SUMMIT (8 – 10 November 2024).pif, sha256: f8e130e5cbbc4fb85d1b41e1c5bb2d7a6d0511ff3b224eb3076a175e69909b0d


Password-Stealer ( 005a3e671 )


October


December


September and December


Address


address


Phishing mail


Delivery


Malware


January 2024 / August 2024


July 2024 / August 2024


February 2024 / August 2024


March 2024 / August 2024


September 2022 / August 2024


September 2023 / November 2023


September 2023 / January 2024


September 2023 / December 2023


October 2023 / January 2024


October 2023 / November 2023


Proxy Server


Server Address/C2


qoakeifm-unknown.txt


C2 (Victims)


202401 202408


C2 / United States California Los Angeles AS834 IPXO LLC


C2 / Japan Osaka Osaka AS34985 ASN block not managed by the RIPE NCC


During the attacks Microsoft


Underground Ransomware


_Fake human CAPTCHA pages as of 2024-08-28:_


_Infection traffic from fake verification page:_


_Infection traffic from fake verification page:_ / parked returned small non malicious PNG image


_Infection traffic from fake verification page:_ / HTTPS Lumma Stealer C2 traffic


_Windows EXE for Lumma Stealer:_


184,056 / location


180,702 / location


201,092 / location


description Windows EXE for Lumma Stealer


WSF


filename: uzopuzbkrpcziwca.txt


md5: a332817fd302e05b131c7a7a0cdb1a04


filename: lAOdPuUqwXLVFvqT.jpg


md5: c86280bd532eec707f106542a4458400


filename: IRUAHCKDFAFDCHUV.vbs


md5: 1eefdb23f7c63922756eafb532127b8e


filename: CEIULUDEZFCEVSMM.bat


md5: ac0f2aa2c5caf791f0310c2c07a1e1c3


filename: YXRPNPSMGCOBEURV.ps1


md5: 315bc30cd580b750b4afc294fa38a8bc


filename: WJVIQQFZMZLSZTJJ.bat


md5: ec348cf15e839b8912862352bc916d22


filename: NewPE2.dll


md5: dcce5bc3e27295a1cbe13a411244fe93


AsyncRAT


PowerShell Script / First Seen 2024-08-17 16:20:50 UTC, sha256: 65025475c24f4647b6140cbeced6899f8958f1c72ec17ee24816aa35d1a5639e filename: mekotio_xored.ps1


PowerShell Script / First Seen 2024-08-17 16:20:50 UTC, md5: cc1582ca08498560a84fdf4e795fb63f filename: mekotio_xored.ps1


PowerShell Script / First Seen 2024-08-17 16:20:50 UTC, md5: cc1582ca08498560a84fdf4e795fb63f sha256: 65025475c24f4647b6140cbeced6899f8958f1c72ec17ee24816aa35d1a5639e


Sends telemetry and downloads further payload


filename: Archive.zip (renamed)


sha256: 8e77101d3f615a58b8d759e8b82ca3dffd4823b9f72dc5c6989bb4311bdffa86


sha256: 04bcf25d07e5cf060e742325d6123242f262888705acac649f8d5010a5eb6a87


sha256: c35ea8498ed7ae33513e26fac321fecf0fc9306dda8c783904968e3c51648c37


filename: 20240739人员名单信息.zip


sha256: 3a9b64a61f6373ee427f27726460e7047b21ddcfd1d0d45ee4145192327a0408


filename: ╠Õ╝ý▒¿©µ.lnk


╠Õ╝ý▒¿©µ.lnk

sha256: 28030e8cf4c9c39665a0552e82da86781b00f099e240db83f1d1a3ae0e990ab6


filename: 违规远程控制软件人员名单.docx.lnk


违规远程控制软件人员名单.docx.lnk

sha256: 1ba77dd1f5bf31d45fdb160c52ebe5829ec373350cde35818fb90d45352b3601


filename: dui70.dll


sha256: 1189d34e983a6fc9d2dc37ad591287c9e3e4d4ba83f66c7ede692c36274ba648


filename: gogo.windows.amd64.exe


sha256: 706bd7e05f275814c3b86eec1a87148662029d91d0ce9b80386aaffe7aa3753b


filename: iox.exe


sha256: c6cf82919b809967d9d90ea73772a8aa1c1eb3bc59252d977500f64f1a0d6731


filename: LLD.exe


sha256: 0bd048e0bce956edfbcee6edf32b8b67e08275bd38125b40a98665fab4926c9d


filename: netspy.exe


sha256: 97c5cd06b543b0bdb270666092348efba0a9670af05b11f3b56bf4b418dec43a


filename: PVEFindADUser.exe


sha256: 7dc0e13a5f1a70c4e41f4b92372259b050a395104650d57385ecaa148481ae5c


filename: fpr.exe


sha256: 1f510ded0d181b4636e83c69b66c92465dc0e64f6db946fa4c246e7741f66141


filename: sharpdecryptpwd.exe


sha256: 9f650117288b26312e84f32e23783fe3c81fcba771c8ae58119be92344c006cc


filename: pvefindaduser.exe


filename: tmp.log


sha256: efe53f18d282516149bc6feac44c17dde9f0704d95598aecba3e7d734727b07e


filename: sa64.gif


sha256: 33a910162eafe750316adfad4ab0955be24c1ba048c2ec236c95e4a795c42932


Malicious archive, filename: Advanced_IP_Scanner_v.3.5.2.1.zip


Malicious archive, md5: 5310d6b73d19592860e81e4e3a5459eb


Malvertising landing page


Malvertising landing page / Cloudflare Netblock


Cloaked lure page


Malware download


Malware download / Amazon Netblock


Redirect Target / Landing Page / 2024-08-12


Redirect Target / Landing Page / 2024-08-06


Redirect Target / Landing Page / 2024-08-13


Redirect Target / Landing Page / 2024-08-05


Python Payload (Renamed ZIP containing Voldemort) / 2024-08-05


Python Payload (Decoy PDFs) / 2024-08-05


Python Payload (Decoy PDFs) / 2024-08-06


Python Payload (Decoy PDFs) / 2024-08-12


Python Payload (Decoy PDFs) / 2024-08-13


test.png/zip / 2024-08-05


CiscoSparkLauncher.dll (Voldemort Malware) / 2024-08-05


CiscoCollabHost.exe (Benign used for side-loading) / 2024-08-05


TryCloudflare Tunnel / 2024-08-05


Voldemort C2 / 2024-08-05


Redirect Target / Landing Page / 2024-08-19


Python Payload (Renamed ZIP containing Voldemort) / 2024-08-19


Python Payload (Decoy PDFs) / 2024-08-19


logo.png/zip / 2024-08-19


CiscoSparkLauncher.dll (Voldemort Malware) / 2024-08-19


TryCloudflare Tunnel / 2024-08-19


JavaScript


MSI


Latrodectus payload


Payload


ethersscan-api


helmet-validate


qq-console


sass-notification


telegram-con


temp-etherscan-api


Trojan.Win32.GLOBALSHADOW.A, filename: Setup.exe


Trojan.Win32.GLOBALSHADOW.A, sha1: 79b38c4be5ac888e38ec5f21ac3710f3d0936a72


Backdoor.MSIL.GLOBALSHADOW.A, filename: GlobalProtect.exe


Backdoor.MSIL.GLOBALSHADOW.A, sha1: 72cdd3856a3ffd530db50e0f48e71f089858e44f


used to return the result to the C&C server


to upload machine information to the C&C server


main for beaconing


phishing Lookalike


phishing Lookalike – Zero Day DNS


suspicious Nameserver


Network Communication


HTML/Agent.HQ / MHTML-formatted WPS Spreadsheet exploit – CVE‑2024‑7262, filename: input.htm


HTML/Agent.HQ / MHTML-formatted WPS Spreadsheet exploit – CVE‑2024‑7262, sha1: 7509b4c506c01627c1a4c396161d07277f044ac6


Win32/TrojanDownloader Agent.HRP / Downloader component, filename: WPS_TEST_DLL.dll


Win32/TrojanDownloader Agent.HRP / Downloader component, sha1: 08906644b0ef1ee6478c45a6e0dd28533a9efc29


PhoenixNAP / 2024-03-08 / C&C server hosting next stages


filename: msadobe.jar


sha256: 300ef93872cc574024f2402b5b899c834908a0c7da70477a3aeeaee2e458a891


filename: 1lpiozkc.node


sha256: b31bfa8782cb691178081d6685d8429a2a2787b1130c6620d3486b4c3e02d441


filename: 1.bat


sha256: 1bd17369848c297fb30e424e613c10ccae44aa0556b9c88f6bf51d84d2cbf327


filename: 1.txt


sha256: 6cf19d0582c6c31b9e198cd0a3d714b397484a3b16518981d935af9fd6cdb2eb


filename: logo.png


sha256: f8773628cdeb821bd7a1c7235bb855e9b41aa808fed1510418a7461f7b82fd6c


filename: goopdate.dll


sha256: c03cc808b64645455aba526be1ea018242fcd39278acbbf5ec3df544f9cf9595


sha256: aa69c6c22f1931d90032a2d825dbee266954fac33f16c6f9ce7714e012404ec1


filename: adobe.png


sha256: a6072e7b0fafb5f09fd02c37328091abfede86c7c8cb802852985a37147bfa19


filename: iisexpressshim.sdb


sha256: 09f53e68e55a38c3e989841f59a9c4738c34c308e569d23315fd0e2341195856


filename: cachuri.dll


sha256: aa5ff1126a869b8b5a0aa72f609215d8e3b73e833c60e4576f2d3583cc5af4f4


filename: DropboxUpdate.bin


sha256: c7e2dbc3df04554daa19ef125bc07a6fa52b5ea0ba010f187a082dc9fc2e97ed


sha256: a217fe01b34479c71d3a7a524cb3857809e575cd223d2dd6666cdd47bd286cd6


filename: adobe.jar


sha256: efc373b0cda3f426d25085938cd02b7344098e773037a70404c6028c76cc16fc


filename: MSSharePoint.vbs


sha256: 6c08a004a915ade561aee4a4bec7dc588c185bd945621ec8468575a399ab81f4


filename: cloud.bat


sha256: ea8a00813853038820ba50360c5c1d57a47d72237e3f76c581d316f0f1c6e85f


filename: logo.png


sha256: 82e94417a4c4a6a0be843ddc60f5e595733ed99bbfed6ac508a5ac6d4dd31813


filename: iisutil2.dll


sha256: 47af8a33aac2e70ab6491a4c0a94fd7840ff8014ad43b441d01bfaf9bf6c4ab7


filename: SoftwareUpdate.exe


sha256: a166751b82eac59a44fd54cf74295e71e7e95474fc038fc8cca069da05158586


renamed, filename: Wdiservicehost.exe


renamed, sha256: 3124fcb79da0bdf9d0d1995e37b06f7929d83c1c4b60e38c104743be71170efe


renamed, filename: mcoemcpy.exe


filename: TpmInit.exe


sha256: 29863f612d2da283148cb327a1d57d0a658d75c8e65f9ef4e5b19835855e981e


DNS: ASN: OVH SAS DNS ASN OVH SAS


DNS


ASN: WIBO Baltic UAB ASN WIBO Baltic UAB


A


Security Protector / com.example.securityprotector


Livelo Pontos, sha256: 64ec090ea5e22648e46651b12569107f94b10c1e8e4635ef42716aaec28fd6bd


Livelo Pontos, domain: com.resgatelivelo.cash


Módulo de Segurança, sha256: a4886346e8bcfd20f6b5131f2440004675cf851fa86fef7594f8096f63eb6a38


Módulo de Segurança, domain: com.viberotion1414.app


Módulo de Segurança, sha256: a39a3acc18c84624489d91d25c4517097f18bf4cc3bb8282aa2689bcfd860b0f


Send JSON in Base64 Encoding


Send JSON


Receive a command


Delete a specific command for an ID


Delete all commands for an ID


Pair a client ID with an Installation token


Phishing site


filename: Zoom.exe


sha256: 4e81851729d58f321bb83bdb03200f62bc5ee56e0703b2d609a3923a033d5b53


Remote server


IPv4 / Resolved


Windows Ancillary Function Driver for WinSock with zero-day flaw


filename: RtCore64.sys


sha256: 01aa278b07b58dc46c84bd0b1b5c8e9ee4e62ea0bf7a695862444af32e87f1fd


filename: DBUtil_2_3.sys


sha256: 0296e2ce999e67c76352613a718e11516fe1b0efc3ffdb8918fc999dd76a73a5


filename: zamguard64.sys


sha256: 543991ca8d1c65113dff039b85ae3f9a87f503daec30f46929fd454bc57e5a91


identification._, filename: gdrv.sys


identification._, sha256: 31f4cfb4c71da44120752721103a16512444c13c2ac2d857a7e6f13cb679b427


Tickler samples and related indicators, filename: YAHSAT NETWORK_INFRASTRUCTURE_SECURITY_GUIDE_20240421.pdf.exe


Tickler samples and related indicators, sha256: 7eb2e9e8cd450fc353323fd2e8b84fbbdfe061a8441fd71750250752c577d198


Tickler samples and related indicators, filename: Sold.dll


Tickler samples and related indicators, sha256: ccb617cc7418a3b22179e00d21db26754666979b4c4f34c7fda8c0082d08cec4


Tickler samples and related indicators / Batch script


Tickler samples and related indicators / Malicious DLL


Trojan.SH.STARTMINER.A


Trojan.SH.MALXMR.UWELT


filename: CZ_army_NATO_cooperation.zip


sha256: 9549d3d2b8e8b4e8f163a8b9fa3b02b8a28d78e4b583baccb6210ef267559c6e


filename: The importance of and outlook for the Czech Republic in NATO.pdf.lnk


The importance of and outlook for the Czech Republic in NATO.pdf.lnk

sha256: 436994d4a5c8d54acb2b521d0847d77e6af6c2c0e40468248b1dd019c6dafa84


filename: AdobeAcrobatReader.bat


sha256: ace33243994a9da0797601bdd4191e25967a1da2644f0d0b530e26c71854d5d9


filename: NatoDoc.pdf


sha256: a05d053174b52a9b158a5ec841c1a7633b9368c4ac2da371a11a9364f8a8dc60


filename: vihu.exe


sha256: 1dbcade04333b9dc81ba0746bc604d12489da49b9b65fcb5b1f61d139dc5949c


filename: gnobya.exe


sha256: 38da8d1576bdd0a03e649e8e6543594b35a423aa5b0a0c4081fc477c8e487e09


filename: x64.demon.dll


sha256: b29ed89e0428ba476459adabb5630c8d29f7fee5905c5de10d792fe3a02e52a6


sha256: 6e0d12cd0252599fd1dec7aa460cae7a12a1b2e322b6664e64c773c23627d1b4


filename: Inter-Regular.woff


sha256: ed6775184051ef36c3049e24167471ab42bd4301e99631c8423d4d753cdad455


filename: The importance of and outlook for the Czech Republic in NATO.pdf


The importance of and outlook for the Czech Republic in NATO.pdf

sha256: fda71a7de6d473826465bb83210107501e66a5d96e533772444b3b24806286fd


filename: Postup_zmeny_hesla_z_IMO.pdf


sha256: 8820e0c249305ffa3d38e72a7f27c0e2195bc739d08f5d270884be6237eea500


r


sh


mips


filename: swift copy.xls


sha256: 8406a1d7a33b3549dd44f551e5a68392f85b5ef9cf8f9f3db68bd7e02d1eaba7


filename: 107.hta


sha256: 6f6a660ce89f6ea5bbe532921ddc4aa17bcd3f2524aa2461d4be265c9e7328b9


The Loader module/sahost.exe, filename: WeENKtk.exe


The Loader module/sahost.exe, sha256: 484e5a871ad69d6b214a31a3b7f8cfced71ba7a07e62205a90515f350cc0f723


The Loader module/sahost.exe, filename: utGw.exe


Snake Keylogger core module, filename: lfwhUWZlmFnGhDYPudAJ.exe


Snake Keylogger core module, sha256: 207dd751868995754f8c1223c08f28633b47629f78faaf70a3b931459ee60714


Own Registrar / Gigabit Hosting Sdn Bhd / Initial that started investigation


Own Registrar / CloudFlare / C2 for MeDExt.dll


PDR Ltd. / CloudFlare, Hostgnome Ltd / C2 for MeDExt.dll


PDR Ltd. / Gigabit Hosting Sdn Bhd / Jarm fingerprint + HTML response


HOSTINGER / BlueVPS OU / Identified as a possible Latrodectus C2 by Symantec


Seen, filename: MeDExt.dll


Seen, sha256: 23546ec67474ed6788a14c9410f3fc458b5c5ff8bd13885100fb4f3e930a30bf


Seen, filename: GoogleAuthSetup.ex


Seen, sha256: 62536e1486be7e31df6c111ed96777b9e3f2a912a2d7111253ae6a5519e71830


Seen, filename: confrontation.d46a184c.exe


Seen, sha256: a459ce4bfb5d649410231bd4776c194b0891c8c5328bafc22184fe3111c0b3e7


sha256: c5d11d6d9036a7a500242fb080f5a1600cba4c4a639d516ee7b1a6b7e185e0db filename: 6PYADPZW.exe


md5: ccf817dcd04c768f8d2def4e4e393375 filename: 6PYADPZW.exe


md5: ccf817dcd04c768f8d2def4e4e393375 sha256: c5d11d6d9036a7a500242fb080f5a1600cba4c4a639d516ee7b1a6b7e185e0db


sha256: 7162415a7e65c042589e67ad9246d0dca89447693b4e92d0f4beca011e1ad4c4 filename: 8UDR7AZ1.exe


md5: 9d1a08093886cb0b887bec36c3876a9d filename: 8UDR7AZ1.exe


md5: 9d1a08093886cb0b887bec36c3876a9d sha256: 7162415a7e65c042589e67ad9246d0dca89447693b4e92d0f4beca011e1ad4c4


sha256: ae2030f9b43c5bb039b219327391fda049be38fe092df02f3bbc1832f25a764c filename: GYIUCWUH.exe


md5: e359ec4832daa9c0d5868ffa1d58e9bd filename: GYIUCWUH.exe


md5: e359ec4832daa9c0d5868ffa1d58e9bd sha256: ae2030f9b43c5bb039b219327391fda049be38fe092df02f3bbc1832f25a764c


sha256: 89302b545705212059fb591aeea54b1de8f63f0b7fa2b83e16ac7be94421cefa filename: KRIYTA2E.exe


md5: 00db5602ec3b7ebd4299064aedd21733 filename: KRIYTA2E.exe


md5: 00db5602ec3b7ebd4299064aedd21733 sha256: 89302b545705212059fb591aeea54b1de8f63f0b7fa2b83e16ac7be94421cefa


sha256: eb2e795dd56f6ed38b964d6a2d75cbe0c05c4ad8e66786cdbe6ac51c1582499a filename: SHH8A94U.exe


md5: c1dfc103a9d04db26640cd1a461702ae filename: SHH8A94U.exe


md5: c1dfc103a9d04db26640cd1a461702ae sha256: eb2e795dd56f6ed38b964d6a2d75cbe0c05c4ad8e66786cdbe6ac51c1582499a


sha256: e657103f40f61395147f31baaca9ada6efb8bfa3da83c078557e3494c2755503 filename: VFUJTG9Q.exe


md5: fb9bd9ed8e1fb782123a9614d7d46483 filename: VFUJTG9Q.exe


md5: fb9bd9ed8e1fb782123a9614d7d46483 sha256: e657103f40f61395147f31baaca9ada6efb8bfa3da83c078557e3494c2755503


sha256: 972430371601ec17396e7bc7c62d3838cc95bec62bfed893a61919ac411b2bf2 filename: XQL3KQIJ.exe


md5: 1f83080a421c95234b8a54a95e507447 filename: XQL3KQIJ.exe


md5: 1f83080a421c95234b8a54a95e507447 sha256: 972430371601ec17396e7bc7c62d3838cc95bec62bfed893a61919ac411b2bf2


sha256: 445d709ea4ae38706a0cc47ffc6c100fb9a354ff1ac718d0c23415524bdfc895 filename: Kill$-Arab.bat


md5: b57545cb36ef6a19fdde4b2208ebb225 filename: Kill$-Arab.bat


md5: b57545cb36ef6a19fdde4b2208ebb225 sha256: 445d709ea4ae38706a0cc47ffc6c100fb9a354ff1ac718d0c23415524bdfc895


sha256: c207a7a561ab726fb272b5abd99c4da8e927b5da788210d5dd186023c2783990 filename: Kill-Delete.bat


md5: 1726416850d3bba46eeb804fae57083d filename: Kill-Delete.bat


md5: 1726416850d3bba46eeb804fae57083d sha256: c207a7a561ab726fb272b5abd99c4da8e927b5da788210d5dd186023c2783990


Prefix of the encrypted


extension - Extension to encrypted


Possible exfiltration endpoint


CRYPTBOT / erefgojgbu


CRYPTBOT / zip


CRYPTBOT / Sеexe


LUMMAC.V2 / oqnhustu


LUMMAC.V2 / dll


PEAKLIGHT / Downloader


SHADOWLADDER / exe


SHADOWLADDER / cfg


SHADOWLADDER / doc


SHADOWLADDER / zip


SHADOWLADDER / dll


SHADOWLADDER / txt


filename: File.exe


sha256: 6a4d5fa1f240b1ea51164de317aa376bbc1bbddeb57df23238413c5c21ca9db0


Backdoor


Malicious installation package


Malicious


html


lnk


bat


py


SystemBC C2


Cobalt Strike C2


Cobalt Strike C2 / Cobalt Strike Beacon


imphash:6015e6e85d0d93e60041fa68c6a89776 / Cobalt Strike Beacon


imphash:1b2b0fc8f126084d18c48b4f458c798b / Cobalt Strike Beacon


imphash:bed5688a4a2b5ea6984115b458755e90 / Cobalt Strike Beacon


C&C


sha256: c477b037e8fe3ab68b4c1da6f9bfe01e9ea818a5b4f94ed9e2757e25035be06d


md5: 56a579cb88eb4bb93a45b163ab9825d8


sha256: bb72a4c76034bd0b757b6a1e0c8265868563d11271a22d4ae26cb9fe3584a07d filename: Stepasha.exe


md5: 365bf209a1d5eb01eb38586c51f47817 filename: Stepasha.exe


md5: 365bf209a1d5eb01eb38586c51f47817 sha256: bb72a4c76034bd0b757b6a1e0c8265868563d11271a22d4ae26cb9fe3584a07d


sha256: bb72a4c76034bd0b757b6a1e0c8265868563d11271a22d4ae26cb9fe3584a07d filename: MotherRussia.exe


md5: 08c3cb87aa0bf981a3503c116a952b04 filename: MotherRussia.exe


md5: 08c3cb87aa0bf981a3503c116a952b04 sha256: bb72a4c76034bd0b757b6a1e0c8265868563d11271a22d4ae26cb9fe3584a07d


FQDN


File


Malicious


Malicious Domains


filename: Launch.dmg


sha256: 6483094f7784c424891644a85d5535688c8969666e16a194d397dc66779b0b12


filename: GTAIV_EarlyAccess_MACOS_Release.dmg


sha256: e3f1e91de8af95cd56ec95737669c3512f90cecbc6696579ae2be349e30327a7


filename: AdobeGenP.dmg


sha256: f79b7cbc653696af0dbd867c0a5d47698bcfc05f63b665ad48018d2610b7e97b


filename: Setup2024.dmg


sha256: de33b7fb6f3d77101f81822c58540c87bd7323896913130268b9ce24f8c61e24


filename: CleanMyMac.dmg


sha256: 96f80fef3323e5bc0ce067cd7a93b9739174e29f786b09357125550a033b0288


SYSTEMBC / Backdoor.Win32.COROXY.SMRTI


GRIXBA / Trojan.MSIL.GRIXBA.A


PsExec / OAT: Suspicious Creation in Uncommon Folder


PsExec / OAT: Suspicious File Creation in Uncommon Folder


install-linux.sh


install.bat


install.sh


main.zip


main.py


fflg.py


helperwd.py


utils.py


Warpvpn.zip


Phishing site


C&C


Renamed curl


Malicious library


PEAKLIGHT NBIs


LUMMAC.V2 C2s


CRYPTBOT C2s


SHADOWLADDER


CRYPTBOT, CRYPTBOT, filename: erefgojgbu


CRYPTBOT, md5: d6ea5dcdb2f88a65399f87809f43f83c


CRYPTBOT, filename: L2.zip


CRYPTBOT, md5: 307f40ebc6d8a207455c96d34759f1f3


CRYPTBOT, filename: Setup.exe


CRYPTBOT, md5: d8e21ac76b228ec144217d1e85df2693


LUMMAC.V2, filename: oqnhustu


LUMMAC.V2, md5: 43939986a671821203bf9b6ba52a51b4


LUMMAC.V2, filename: WebView2Loader.dll


LUMMAC.V2, md5: 58c4ba9385139785e9700898cb097538


PEAKLIGHT: / Downloader


SHADOWLADDER, filename: Aaaa.exe


SHADOWLADDER, md5: b15bac961f62448c872e1dc6d3931016


SHADOWLADDER, filename: bentonite.cfg


SHADOWLADDER, md5: e7c43dc3ec4360374043b872f934ec9e


SHADOWLADDER, filename: cymophane.doc


SHADOWLADDER, md5: f98e0d9599d40ed032ff16de242987ca


SHADOWLADDER, filename: K1.zip


SHADOWLADDER, md5: b6b8164feca728db02e6b636162a2960


SHADOWLADDER, md5: bb9641e3035ae8c0ab6117ecc82b65a1


SHADOWLADDER, filename: K2.zip


SHADOWLADDER, md5: 236c709bbcb92aa30b7e67705ef7f55a


SHADOWLADDER, md5: d7aff07e7cd20a5419f2411f6330f530


SHADOWLADDER, filename: L1.zip


SHADOWLADDER, md5: a6c4d2072961e9a8c98712c46be588f8


SHADOWLADDER, filename: LiteSkinUtils.dll


SHADOWLADDER, md5: 059d94e8944eca4056e92d60f7044f14


SHADOWLADDER, filename: toughie.txt


SHADOWLADDER, md5: dfdc331e575dae6660d6ed3c03d214bd


SHADOWLADDER, filename: WCLDll.dll


SHADOWLADDER, md5: 47eee41b822d953c47434377006e01fe


Android/Spy.NGate.B / NGate Android malware, filename: csob.smart.klic.apk


Android/Spy.NGate.B / NGate Android malware, sha1: 7225ed2cba9cb6c038d8615a47423e45522a9ad1


Android/Spy.NGate.C / NGate Android malware, filename: csob.smart.klic.apk


Android/Spy.NGate.C / NGate Android malware, sha1: 66de1e0a2e9a421dd16bd54b371558c93e59874f


Android/Spy.NGate.C / NGate Android malware, filename: george.klic.apk


Android/Spy.NGate.C / NGate Android malware, sha1: da84bc78ff2117ddbfdcba4e5c4e3666eea2013e


Android/Spy.NGate.C / NGate Android malware, filename: george.klic-0304.apk


Android/Spy.NGate.C / NGate Android malware, sha1: e7ae59cd44204461edbddf292d36eeed38c83696


Android/Spy.NGate.A / NGate Android malware, filename: rb.klic.apk


Android/Spy.NGate.A / NGate Android malware, sha1: 103d78a180eb973b9ffc289e9c53425d29a77229


Android/Spy.NGate.C / NGate Android malware, filename: rb.klic.apk


Android/Spy.NGate.C / NGate Android malware, sha1: 11be9715be9b41b1c8527c9256f0010e26534fdb


Cloudflare, Inc. / 2024‑03‑03 / Phishing website Cloudflare, Inc. / 024‑03‑03 / Phishing website


Divya Quamara / 2024‑04‑07 / NGate C&C server Divya Quamara / 024‑04‑07 / NGate C&C server


Serverius / 2024‑02‑21 / NGate C&C server Serverius / 024‑02‑21 / NGate C&C server


URI


Malicious file


Malicious Endpoint


Backdoor.Msupedge


Web shell


not malicious used by the lambda function


Tor Exit Nodes


VPS Endpoints


VPN Endpoints


for lambda.sh


Android/Spy.Banker.CIC / Android mobile phishing app, filename: base.apk


Android/Spy.Banker.CIC / Android mobile phishing app, sha1: d3d5ae6b8ae9c7c1f8690452760745e18640150d


Android/Spy.Banker.CLW / Android mobile phishing app, filename: base.apk


Android/Spy.Banker.CLW / Android mobile phishing app, sha1: 66f97405a1538a74cee4209e59a1e22192bc6c08


Cloudflare, Inc. / 2024‑03‑05 / C&C server Cloudflare, Inc. / 024‑03‑05 / C&C server


NETH LLC / 2024‑02‑21 / C&C server NETH LLC / 024‑02‑21 / C&C server


Cloudflare, Inc. / 2024‑04‑07 / C&C server Cloudflare, Inc. / 024‑04‑07 / C&C server


Distribution


Malicious TAR Archive


Looks for specified Path


2024-05-08 024-05-08


Podcast Plan 2024.zip / 2024-05-08 Podcast Plan 024.zip / 024-05-08


PDF / 2024-05-08 PDF / 024-05-08


Beautifull.jpg / 2024-05-08 Beautifull.jpg / 024-05-08


mary.dll / 2022-02-18 mary.dll / 022-02-18


qemus (AnvilEcho) / 2024-05-08 qemus (AnvilEcho) / 024-05-08


soshi.dll / 2024-05-08 soshi.dll / 024-05-08


toni.dll / 2024-05-08 toni.dll / 024-05-08


Lure / 2024-02-01 Lure / 024-02-01


Storage/Stager / 2024-03-04 Storage/Stager / 024-03-04


C2 / 2024-02-22 C2 / 024-02-22


sha256: 4d8918cfcc97ca63666937e5d53373793f3695a2b1177e27a78aa34303c2ee80 filename: spysok.kursk.zip


md5: 65e5f73193f87e233244479859a00fd1 filename: spysok.kursk.zip


md5: 65e5f73193f87e233244479859a00fd1 sha256: 4d8918cfcc97ca63666937e5d53373793f3695a2b1177e27a78aa34303c2ee80


список вп що вибувають курск.chm, sha256: 68fe595237eec1261184a5f3a00cc0f678a33751615796942001997575887557


список вп що вибувають курск.chm, md5: 4dd66548c1022822cf8247ca615ceea9


sha256: d44ff1bd3c7ff81228548c82ea68c33bdea780772ce55dc4be2d4156985a326a filename: part.html


md5: b58e45c4707b88dc1e89fd58359bfd5b filename: part.html


md5: b58e45c4707b88dc1e89fd58359bfd5b sha256: d44ff1bd3c7ff81228548c82ea68c33bdea780772ce55dc4be2d4156985a326a


sha256: 8612668466f9c8a180e0e9a3c92c85a03788f2f0bb3c6bf70f52c356e02702db filename: Browser.txt


md5: 580a05ffdb0f3d5d703ccb2bcf04f9b7 filename: Browser.txt


md5: 580a05ffdb0f3d5d703ccb2bcf04f9b7 sha256: 8612668466f9c8a180e0e9a3c92c85a03788f2f0bb3c6bf70f52c356e02702db


sha256: eef9f73dc7e0cdd4b1780ecd20845496a91e0f1c096264208d991935c5e97308 filename: Files.txt


md5: b99d5bfcdf9535f094204137ab064c96 filename: Files.txt


md5: b99d5bfcdf9535f094204137ab064c96 sha256: eef9f73dc7e0cdd4b1780ecd20845496a91e0f1c096264208d991935c5e97308


sha256: 8987952745a8d46a8f2e6d1666cc9c542b6a9a96787ef467c76b779a8b6c1a66 filename: Social.txt


md5: 7d439f13a55f082fd674875f898197d7 filename: Social.txt


md5: 7d439f13a55f082fd674875f898197d7 sha256: 8987952745a8d46a8f2e6d1666cc9c542b6a9a96787ef467c76b779a8b6c1a66


sha256: ad30e29ba883c3f528d2782dbc3d1b5258815b619c6dfc3639fee416cf27fb1f filename: Screen.txt


md5: 522c2988dd63e162503c41dc87d631f6 filename: Screen.txt


md5: 522c2988dd63e162503c41dc87d631f6 sha256: ad30e29ba883c3f528d2782dbc3d1b5258815b619c6dfc3639fee416cf27fb1f


sha256: 3e6c13f9e4cee9b8d55d7a83fd3c3d5d6d09b6c477c4f84fd79db6cc8de7ea42 filename: USB.txt


md5: a3c977578212134897a864795e769a8d filename: USB.txt


md5: a3c977578212134897a864795e769a8d sha256: 3e6c13f9e4cee9b8d55d7a83fd3c3d5d6d09b6c477c4f84fd79db6cc8de7ea42


sha256: 180f9a2d3de0b5f031408797286837bb4b10b2a6d8797cf985347f5d80f9e4a0 filename: IDCLIPNET_x86.txt


md5: d657fa0c86523d0376cc0c988c6c9e11 filename: IDCLIPNET_x86.txt


md5: d657fa0c86523d0376cc0c988c6c9e11 sha256: 180f9a2d3de0b5f031408797286837bb4b10b2a6d8797cf985347f5d80f9e4a0


sha256: 8d4808ed167ac91724e8ab4da24bcc3bd2159a4972c212a1cd4062f02a3731d0 filename: chrome.updater.txt


md5: e2c25142f08cd8f9c6f87266c7ffb829 filename: chrome.updater.txt


md5: e2c25142f08cd8f9c6f87266c7ffb829 sha256: 8d4808ed167ac91724e8ab4da24bcc3bd2159a4972c212a1cd4062f02a3731d0


sha256: 21c33c8365218b7fb1bbb0d45af77926877fb33384ef58fbbb6db04b9df55eb6 filename: Browser.dll


md5: f8efa529dff81b0e02a786fc766ffca3 filename: Browser.dll


md5: f8efa529dff81b0e02a786fc766ffca3 sha256: 21c33c8365218b7fb1bbb0d45af77926877fb33384ef58fbbb6db04b9df55eb6


sha256: 087158ad28080ef438047b88896dfa1962d1cd6fed8fce06e35c25f91ad5f1ff filename: Files.dll


md5: ef123bc71a5f0e323b6a5c809d17d048 filename: Files.dll


md5: ef123bc71a5f0e323b6a5c809d17d048 sha256: 087158ad28080ef438047b88896dfa1962d1cd6fed8fce06e35c25f91ad5f1ff


sha256: b95ef984bfb22c55881931b134deaf1b848fbfda4180fc393b9f532f51089cbb filename: Screen.dll


md5: 2972616c870bffdb1978b487df290dfe filename: Screen.dll


md5: 2972616c870bffdb1978b487df290dfe sha256: b95ef984bfb22c55881931b134deaf1b848fbfda4180fc393b9f532f51089cbb


sha256: f00c85d9db7a2a2bf248771b8d81d978fa6d2153e6a3095d9c5896b604e9d00d filename: Social.dll


md5: 7dc1016e78f8c243b3b0fa59eb648567 filename: Social.dll


md5: 7dc1016e78f8c243b3b0fa59eb648567 sha256: f00c85d9db7a2a2bf248771b8d81d978fa6d2153e6a3095d9c5896b604e9d00d


sha256: 6a18392e3e062ce0fcd4688c0b09e482855cf709eb178437d8fe2cdc9cfdf51f filename: USB.dll


md5: a973224da0ebfca023ab3e55913447a9 filename: USB.dll


md5: a973224da0ebfca023ab3e55913447a9 sha256: 6a18392e3e062ce0fcd4688c0b09e482855cf709eb178437d8fe2cdc9cfdf51f


sha256: d16239cfbee14a8621637934aebe2d5253fea04940d2eb082bd8dcdc41111d4b filename: IDCLIPNET_x86.dll


md5: a9261e37a5a2fadbf58c71f15f48ad18 filename: IDCLIPNET_x86.dll


md5: a9261e37a5a2fadbf58c71f15f48ad18 sha256: d16239cfbee14a8621637934aebe2d5253fea04940d2eb082bd8dcdc41111d4b


sha256: f94b8d2391b53dfb96035a2ba628224c3bfedf77021c896b64a0d7c8f2121e17 filename: chrome.updater.dll


md5: e5b69e06a2452914250e34be1de4ae6a filename: chrome.updater.dll


md5: e5b69e06a2452914250e34be1de4ae6a sha256: f94b8d2391b53dfb96035a2ba628224c3bfedf77021c896b64a0d7c8f2121e17


sha256: ea1945d887cbe8a56234cec6da2c46ed7a28ae6a69fd49181b3d13a71943ffd9 filename: agent.cer


md5: f6b21151b924a31b936d3b299c0129b7 filename: agent.cer


md5: f6b21151b924a31b936d3b299c0129b7 sha256: ea1945d887cbe8a56234cec6da2c46ed7a28ae6a69fd49181b3d13a71943ffd9


@beget.com


sha1: 9ceb6e0e4ad0a2c03751d0563a82a79ebb94ec95 sha256: 95489af84596a21b6fcca078ed10746a32e974a84d0daed28cc56e77c38cc5a8 filename: 20200308-sitrep-48-covid-19.pdf.lnk


md5: 21a51a834372ab11fba72fb865d6830e sha256: 95489af84596a21b6fcca078ed10746a32e974a84d0daed28cc56e77c38cc5a8 filename: 20200308-sitrep-48-covid-19.pdf.lnk


md5: 21a51a834372ab11fba72fb865d6830e sha1: 9ceb6e0e4ad0a2c03751d0563a82a79ebb94ec95 filename: 20200308-sitrep-48-covid-19.pdf.lnk


md5: 21a51a834372ab11fba72fb865d6830e sha1: 9ceb6e0e4ad0a2c03751d0563a82a79ebb94ec95 sha256: 95489af84596a21b6fcca078ed10746a32e974a84d0daed28cc56e77c38cc5a8


sha1: 992d530d4bb35fb8dbdfb690740ead6e0fa974ec sha256: f74199f59533fbbe57f0b2aae45c837b3ed5e4f5184e74c02e06c12c6535f0f9 filename: oGhPGUDC03tURV.tmp


md5: 37f78b1ad43959a788162f560bdc9c79 sha256: f74199f59533fbbe57f0b2aae45c837b3ed5e4f5184e74c02e06c12c6535f0f9 filename: oGhPGUDC03tURV.tmp


md5: 37f78b1ad43959a788162f560bdc9c79 sha1: 992d530d4bb35fb8dbdfb690740ead6e0fa974ec filename: oGhPGUDC03tURV.tmp


md5: 37f78b1ad43959a788162f560bdc9c79 sha1: 992d530d4bb35fb8dbdfb690740ead6e0fa974ec sha256: f74199f59533fbbe57f0b2aae45c837b3ed5e4f5184e74c02e06c12c6535f0f9


sha1: e00b982a14835dae781bbbe06055d7d18acc6eb0 sha256: a49133ed68bebb66412d3eb5d2b84ee71c393627906f574a29247d8699f1f38e filename: OINFO12.OCX


md5: 83d04f21515c7e6316f9cd0bb393a118 sha256: a49133ed68bebb66412d3eb5d2b84ee71c393627906f574a29247d8699f1f38e filename: OINFO12.OCX


md5: 83d04f21515c7e6316f9cd0bb393a118 sha1: e00b982a14835dae781bbbe06055d7d18acc6eb0 filename: OINFO12.OCX


md5: 83d04f21515c7e6316f9cd0bb393a118 sha1: e00b982a14835dae781bbbe06055d7d18acc6eb0 sha256: a49133ed68bebb66412d3eb5d2b84ee71c393627906f574a29247d8699f1f38e


sha1: 2fd4eb78e53af6a5b210943ca8f0e521bb567afb sha256: 70b8397f87e4a0d235d41b00a980a8be9743691318d30293f7aa6044284ffc9c filename: 9sOXN6Ltf0afe7.js


md5: 4f8ff5e70647dbc5d91326346c393729 sha256: 70b8397f87e4a0d235d41b00a980a8be9743691318d30293f7aa6044284ffc9c filename: 9sOXN6Ltf0afe7.js


md5: 4f8ff5e70647dbc5d91326346c393729 sha1: 2fd4eb78e53af6a5b210943ca8f0e521bb567afb filename: 9sOXN6Ltf0afe7.js


md5: 4f8ff5e70647dbc5d91326346c393729 sha1: 2fd4eb78e53af6a5b210943ca8f0e521bb567afb sha256: 70b8397f87e4a0d235d41b00a980a8be9743691318d30293f7aa6044284ffc9c


sha1: 88f23b0913ef5f94cd888605504e1e54c3a6e48f sha256: 604679789c46a01aa320eb1390da98b92721b7144e57ef63853c3c8f6d7ea85d filename: MSOSTYLE.EXE


md5: 371e896d818784934bd1456296b99cbe sha256: 604679789c46a01aa320eb1390da98b92721b7144e57ef63853c3c8f6d7ea85d filename: MSOSTYLE.EXE


md5: 371e896d818784934bd1456296b99cbe sha1: 88f23b0913ef5f94cd888605504e1e54c3a6e48f filename: MSOSTYLE.EXE


md5: 371e896d818784934bd1456296b99cbe sha1: 88f23b0913ef5f94cd888605504e1e54c3a6e48f sha256: 604679789c46a01aa320eb1390da98b92721b7144e57ef63853c3c8f6d7ea85d


sha1: 4e0c1a05360c6bebf903a708acf6792b13f43870 sha256: 2dd886cc041ea6e5e80880ccbbc54be42079598acf0c1e7e459616c3f9c0dd34 filename: 20200308-sitrep-48-covid-19.pdf


md5: faf5ef01f4a9bf2aba7ede67dcc5a2d4 sha256: 2dd886cc041ea6e5e80880ccbbc54be42079598acf0c1e7e459616c3f9c0dd34 filename: 20200308-sitrep-48-covid-19.pdf


md5: faf5ef01f4a9bf2aba7ede67dcc5a2d4 sha1: 4e0c1a05360c6bebf903a708acf6792b13f43870 filename: 20200308-sitrep-48-covid-19.pdf


md5: faf5ef01f4a9bf2aba7ede67dcc5a2d4 sha1: 4e0c1a05360c6bebf903a708acf6792b13f43870 sha256: 2dd886cc041ea6e5e80880ccbbc54be42079598acf0c1e7e459616c3f9c0dd34


sha1: c400e10a8f2b5b62f919033e2db0a1f99b1a3c38 sha256: 9d52d8f10673518cb9f19153ddbe362acc7ca885974a217a52d1ee8257f22cfc filename: cSi1r0uywDNvDu.tmp


md5: eefeb76d26338e09958aae5d81479178 sha256: 9d52d8f10673518cb9f19153ddbe362acc7ca885974a217a52d1ee8257f22cfc filename: cSi1r0uywDNvDu.tmp


md5: eefeb76d26338e09958aae5d81479178 sha1: c400e10a8f2b5b62f919033e2db0a1f99b1a3c38 filename: cSi1r0uywDNvDu.tmp


md5: eefeb76d26338e09958aae5d81479178 sha1: c400e10a8f2b5b62f919033e2db0a1f99b1a3c38 sha256: 9d52d8f10673518cb9f19153ddbe362acc7ca885974a217a52d1ee8257f22cfc


sha1: 6e7e3277801669f3053bf364ae6be89f00017c89 sha256: b578a237587054f351f71bd41bede49197f77a1409176f839ebde105f3aee44c filename: MiZl5xsDRylf0W.tmp


md5: c1d8966fa1bd7aee41b2c4ad731407d3 sha256: b578a237587054f351f71bd41bede49197f77a1409176f839ebde105f3aee44c filename: MiZl5xsDRylf0W.tmp


md5: c1d8966fa1bd7aee41b2c4ad731407d3 sha1: 6e7e3277801669f3053bf364ae6be89f00017c89 filename: MiZl5xsDRylf0W.tmp


md5: c1d8966fa1bd7aee41b2c4ad731407d3 sha1: 6e7e3277801669f3053bf364ae6be89f00017c89 sha256: b578a237587054f351f71bd41bede49197f77a1409176f839ebde105f3aee44c


sha1: d0e0d641f3a063fb02c7f862ea8586312af5fa2e sha256: 002c9e0578a8b76f626e59b755a8aac18b5d048f1cc76e2c12f68bc3dd18b124 filename: Wordcnvpxy.exe


md5: fd648c3b7495abbe86b850587e2e5431 sha256: 002c9e0578a8b76f626e59b755a8aac18b5d048f1cc76e2c12f68bc3dd18b124 filename: Wordcnvpxy.exe


md5: fd648c3b7495abbe86b850587e2e5431 sha1: d0e0d641f3a063fb02c7f862ea8586312af5fa2e filename: Wordcnvpxy.exe


md5: fd648c3b7495abbe86b850587e2e5431 sha1: d0e0d641f3a063fb02c7f862ea8586312af5fa2e sha256: 002c9e0578a8b76f626e59b755a8aac18b5d048f1cc76e2c12f68bc3dd18b124


sha1: ea02db9b92cbf1d243b502d130aa2dd6c98637d2 sha256: 500b6037ddb5efff0dd91f75b22ccce5b04d996c459d83d1f07fae8780b24e09 filename: 邀请函.doc


md5: 2123bf482c9c80cb1896ff9288ad7d60 sha256: 500b6037ddb5efff0dd91f75b22ccce5b04d996c459d83d1f07fae8780b24e09 filename: 邀请函.doc


md5: 2123bf482c9c80cb1896ff9288ad7d60 sha1: ea02db9b92cbf1d243b502d130aa2dd6c98637d2 filename: 邀请函.doc


md5: 2123bf482c9c80cb1896ff9288ad7d60 sha1: ea02db9b92cbf1d243b502d130aa2dd6c98637d2 sha256: 500b6037ddb5efff0dd91f75b22ccce5b04d996c459d83d1f07fae8780b24e09


sha1: a29ce0331015f2a3e87fd7fe1ce9dae228808b59 sha256: 1b978324df504451c2a3430e32dc577742e2ac93b2602d68d771d89be4199a58 filename: intel.wll


md5: 59a55c7bbc0ee488ec9e2cf50b792a56 sha256: 1b978324df504451c2a3430e32dc577742e2ac93b2602d68d771d89be4199a58 filename: intel.wll


md5: 59a55c7bbc0ee488ec9e2cf50b792a56 sha1: a29ce0331015f2a3e87fd7fe1ce9dae228808b59 filename: intel.wll


md5: 59a55c7bbc0ee488ec9e2cf50b792a56 sha1: a29ce0331015f2a3e87fd7fe1ce9dae228808b59 sha256: 1b978324df504451c2a3430e32dc577742e2ac93b2602d68d771d89be4199a58


sha1: 46833928f75db90220451e026997d039730906fa sha256: 1acd3cbc83dd4153f07b869b3142594aa9e77df33aa5319312439ecf7f606152 filename: 360ShellPro.exe


md5: d5e42cc18906f09d5bab62df45b5fcf6 sha256: 1acd3cbc83dd4153f07b869b3142594aa9e77df33aa5319312439ecf7f606152 filename: 360ShellPro.exe


md5: d5e42cc18906f09d5bab62df45b5fcf6 sha1: 46833928f75db90220451e026997d039730906fa filename: 360ShellPro.exe


md5: d5e42cc18906f09d5bab62df45b5fcf6 sha1: 46833928f75db90220451e026997d039730906fa sha256: 1acd3cbc83dd4153f07b869b3142594aa9e77df33aa5319312439ecf7f606152


sha1: 07dbfaa430a201ce81f5079dd1e48379fac27177 sha256: f2c60274e625bcb051909797b35095dc5f37fae155cfdd96287c4ac112664a65 filename: FileSmasher.exe


md5: ea628fef3b547a1476d915963415e64c sha256: f2c60274e625bcb051909797b35095dc5f37fae155cfdd96287c4ac112664a65 filename: FileSmasher.exe


md5: ea628fef3b547a1476d915963415e64c sha1: 07dbfaa430a201ce81f5079dd1e48379fac27177 filename: FileSmasher.exe


md5: ea628fef3b547a1476d915963415e64c sha1: 07dbfaa430a201ce81f5079dd1e48379fac27177 sha256: f2c60274e625bcb051909797b35095dc5f37fae155cfdd96287c4ac112664a65


sha1: c8ccf6e20cde537f3da64aebd1f80b144a4c8e0a sha256: 9a977571296ae1548c32df94be75eec2a414798bee7064b0bf44859e886a0cfa


md5: 7e0c85852b2cd932626fcf284ca72978 sha256: 9a977571296ae1548c32df94be75eec2a414798bee7064b0bf44859e886a0cfa


md5: 7e0c85852b2cd932626fcf284ca72978 sha1: c8ccf6e20cde537f3da64aebd1f80b144a4c8e0a


sha1: 2be016b6b0dd9d57f2985a6ad0df85f5538d9623 sha256: 4d30fd05c3bdac792e0a011892e2cad02818436484e81b6de6a02928149bc92d


md5: 2c016c91181d4182a16845725bf0b315 sha256: 4d30fd05c3bdac792e0a011892e2cad02818436484e81b6de6a02928149bc92d


md5: 2c016c91181d4182a16845725bf0b315 sha1: 2be016b6b0dd9d57f2985a6ad0df85f5538d9623


sha1: 5ebf1dbcd5e16bcd4695777a7931ff4dc13d586a sha256: e27d1bab901c1bb414d0849c5c132faa8c7c6a61357d9627a7d2785270034793


md5: 4479cc492fa443af1461ebd768dcd1c3 sha256: e27d1bab901c1bb414d0849c5c132faa8c7c6a61357d9627a7d2785270034793


md5: 4479cc492fa443af1461ebd768dcd1c3 sha1: 5ebf1dbcd5e16bcd4695777a7931ff4dc13d586a


sha1: c0fd9928b1755c047529a0b91517882bf74bc5e4 sha256: 31b21de71f2162e8da1be8483f3a5d019b0c817832bc11a9f307b6b36821ca54


md5: ef6c7eb5518d58bc0b921d37265b0db4 sha256: 31b21de71f2162e8da1be8483f3a5d019b0c817832bc11a9f307b6b36821ca54


md5: ef6c7eb5518d58bc0b921d37265b0db4 sha1: c0fd9928b1755c047529a0b91517882bf74bc5e4


sha1: c4ef4c518c44eda803200b8f9d080c0f1ff3ed15 sha256: 18d4a3a92b24b2ad75115a44fe2727081316eca346499a4aa00aa13713cf00cb


md5: 3dc4391eb6170c26336938839246022f sha256: 18d4a3a92b24b2ad75115a44fe2727081316eca346499a4aa00aa13713cf00cb


md5: 3dc4391eb6170c26336938839246022f sha1: c4ef4c518c44eda803200b8f9d080c0f1ff3ed15


sha1: b1fceda9a56d17fd1520105a6d52fdf868c4cead sha256: 9a96c7b0595f628027c4f4caeece475ef742c420adf2fde8df934c6ce6481fb5


md5: 321e4b64bcedc76a89cca86853d30c09 sha256: 9a96c7b0595f628027c4f4caeece475ef742c420adf2fde8df934c6ce6481fb5


md5: 321e4b64bcedc76a89cca86853d30c09 sha1: b1fceda9a56d17fd1520105a6d52fdf868c4cead


sha1: dc76c7586e1946ac120111d3a35937526a7cf140 sha256: d9a8151aff9d1c061826a9812ed9a6600805c74a519df333513fd4a79d2d4e61


md5: 9200c356b485ca61ec88258f0800657a sha256: d9a8151aff9d1c061826a9812ed9a6600805c74a519df333513fd4a79d2d4e61


md5: 9200c356b485ca61ec88258f0800657a sha1: dc76c7586e1946ac120111d3a35937526a7cf140


sha1: 6f30131181d81129c2f59d050214f47a6eedabbe sha256: 07fe71b256c1c913b0f3e3fa67e53d21a3d1f499beb4e550597f5743797a77c4


md5: b8932033b53ca08967100c58e12126be sha256: 07fe71b256c1c913b0f3e3fa67e53d21a3d1f499beb4e550597f5743797a77c4


md5: b8932033b53ca08967100c58e12126be sha1: 6f30131181d81129c2f59d050214f47a6eedabbe


AccSrvX64__STABLE__2016-11-10.exe, sha1: fc5936e0e290f2f41a46eb14c05500a4236ac0c7 sha256: 1b8b4be020d3350d025c7a245eb0d7166ff2c329dc92af175ef0499cba583071


AccSrvX64__STABLE__2016-11-10.exe, md5: 8d6e4cd33145ae084aa184fd0875c8f6 sha256: 1b8b4be020d3350d025c7a245eb0d7166ff2c329dc92af175ef0499cba583071


AccSrvX64__STABLE__2016-11-10.exe, md5: 8d6e4cd33145ae084aa184fd0875c8f6 sha1: fc5936e0e290f2f41a46eb14c05500a4236ac0c7


R_TARIF.VIEWS_X86.EXE, sha1: 83c8168f7706148a6f28145872a7f3bf01037239 sha256: a03e2ca143e867a99e2bc73bd4e5c2dd078a9f671aa0a4ce9611a8bc39a769e2


R_TARIF.VIEWS_X86.EXE, md5: e908da6041ae249f478bb22ac05e4b18 sha256: a03e2ca143e867a99e2bc73bd4e5c2dd078a9f671aa0a4ce9611a8bc39a769e2


R_TARIF.VIEWS_X86.EXE, md5: e908da6041ae249f478bb22ac05e4b18 sha1: 83c8168f7706148a6f28145872a7f3bf01037239


sha1: b3a6f0d8daf0347f56e95bf56cb60a7ea6f711cb sha256: e19dc185e99cfdc0c25f18fb34ffabff2a4877d6d5843e4c67c05ce182f9780e


md5: 10be9ca61ef86589951ddcfddc3d9672 sha256: e19dc185e99cfdc0c25f18fb34ffabff2a4877d6d5843e4c67c05ce182f9780e


md5: 10be9ca61ef86589951ddcfddc3d9672 sha1: b3a6f0d8daf0347f56e95bf56cb60a7ea6f711cb


r_tarif.dll2Qur, sha1: 54984e656f2bf1ed874b8b281d5abacdd517e51b sha256: 106436a4fafe00112b19b1374456c1746b988950b71d700680088d74494e4936


r_tarif.dll2Qur, md5: 914f932feb7e08f3e0396e40b8ea46e7 sha256: 106436a4fafe00112b19b1374456c1746b988950b71d700680088d74494e4936


r_tarif.dll2Qur, md5: 914f932feb7e08f3e0396e40b8ea46e7 sha1: 54984e656f2bf1ed874b8b281d5abacdd517e51b


systemd-inputd, sha1: 06335756b2a9afcf4147af25b06e30f63e5d52b9 sha256: bca6da159bbf6af3ba6adfdb4f1da0e855c6ed2ac9076c98bcc702169dbeab40


systemd-inputd, md5: c89d431abb6b5cc28c86196fbf898684 sha256: bca6da159bbf6af3ba6adfdb4f1da0e855c6ed2ac9076c98bcc702169dbeab40


systemd-inputd, md5: c89d431abb6b5cc28c86196fbf898684 sha1: 06335756b2a9afcf4147af25b06e30f63e5d52b9


sha1: a1790420cb2f546a79ddaeefacfd3b3a3b781e7c sha256: 9d9097e76b04b8e4e53e366a215a6debd8ada6efd0102694bf518da373d25e82


md5: 2a9137f615fa56f9ae11fa7c17963dad sha256: 9d9097e76b04b8e4e53e366a215a6debd8ada6efd0102694bf518da373d25e82


md5: 2a9137f615fa56f9ae11fa7c17963dad sha1: a1790420cb2f546a79ddaeefacfd3b3a3b781e7c


salt-slave, sha1: be428ac644a1cd1173f9c2a8b5db3c5fb38f795b sha256: 299a7888e960b7be5b7dc75e3a4bfd0c38f0f0e7313b630dcca62b6093794535


salt-slave, md5: 485ad3a834d81e63be6c03e94371c007 sha256: 299a7888e960b7be5b7dc75e3a4bfd0c38f0f0e7313b630dcca62b6093794535


salt-slave, md5: 485ad3a834d81e63be6c03e94371c007 sha1: be428ac644a1cd1173f9c2a8b5db3c5fb38f795b


snapmount, sha1: ee7ce10b16d4052cf15c897d98a9e286ab63c30b sha256: 75bf7d3aae0ed409c2c7e4f9b15e49d2f8dac6f9ecc27219d837e806894fe2a0


snapmount, md5: 5e672d6d5c2fc6190bd670409b987dfd sha256: 75bf7d3aae0ed409c2c7e4f9b15e49d2f8dac6f9ecc27219d837e806894fe2a0


snapmount, md5: 5e672d6d5c2fc6190bd670409b987dfd sha1: ee7ce10b16d4052cf15c897d98a9e286ab63c30b


plymouthd, sha1: cb883f4ea73eef125d9ba2b945ed1797a679ca7e sha256: 8184a41a1275751c018a7433f1a48a8eb2f271d8f8fef98a90b70926f2755754


plymouthd, md5: 04fcea4bf75070e47f5f3e7e6958995f sha256: 8184a41a1275751c018a7433f1a48a8eb2f271d8f8fef98a90b70926f2755754


plymouthd, md5: 04fcea4bf75070e47f5f3e7e6958995f sha1: cb883f4ea73eef125d9ba2b945ed1797a679ca7e


crond, sha1: c3669cc6fcc8a4eed8c3cad540a8f5402e4ddb79 sha256: 83a29477939ba8e70f8f401da1fefbaad17b155c194c35a2b328530038b3539b


crond, md5: b28b70b981a3b8e98874d23b24fc7dbd sha256: 83a29477939ba8e70f8f401da1fefbaad17b155c194c35a2b328530038b3539b


crond, md5: b28b70b981a3b8e98874d23b24fc7dbd sha1: c3669cc6fcc8a4eed8c3cad540a8f5402e4ddb79


mysqlrestore, sha1: b7724bfa0041c0ae9882d880669751e290f6e88e sha256: e67c5731bed1e4d8c7947a6f474a161237ca9d795f8e86927b2faf1a17c94a79


mysqlrestore, md5: 15ebf623c05744403a163bd958522511 sha256: e67c5731bed1e4d8c7947a6f474a161237ca9d795f8e86927b2faf1a17c94a79


mysqlrestore, md5: 15ebf623c05744403a163bd958522511 sha1: b7724bfa0041c0ae9882d880669751e290f6e88e


sha1: e46c422e5336c499b852ca77b4ab97b2607e54bf sha256: 04241c476f7ff0b86987dbc74f7f236d1bd1fcc05896ad704bd8c152920e2ee9


md5: bf27f6608cea8343c287b355244762e9 sha256: 04241c476f7ff0b86987dbc74f7f236d1bd1fcc05896ad704bd8c152920e2ee9


md5: bf27f6608cea8343c287b355244762e9 sha1: e46c422e5336c499b852ca77b4ab97b2607e54bf


dtmf, sha1: 24e7b9e904e90bfc9a9aadd8e347512ccbc895f6 sha256: 2c726b0bee65f2290c233f84139baf9dfee736d46978f42fcf8033215c1ccd19


dtmf, md5: bc0200af1ac2e44cdeefcb9907f4d1d3 sha256: 2c726b0bee65f2290c233f84139baf9dfee736d46978f42fcf8033215c1ccd19


dtmf, md5: bc0200af1ac2e44cdeefcb9907f4d1d3 sha1: 24e7b9e904e90bfc9a9aadd8e347512ccbc895f6


atd, sha1: dd053b9cb14429cd4eec1b36e1a87f0a47289193 sha256: 07dfb5b3e666400469fa451cdca5f29a346a5c9036e00c6587ef2b3b43631f10


atd, md5: adac1dc0ec3dcf28157ab09d35d0cfcc sha256: 07dfb5b3e666400469fa451cdca5f29a346a5c9036e00c6587ef2b3b43631f10


atd, md5: adac1dc0ec3dcf28157ab09d35d0cfcc sha1: dd053b9cb14429cd4eec1b36e1a87f0a47289193


sha1: 3ab8a4e40f91febfdc2e6d69e162e3efc8b8b448 sha256: 5264dcb00fd0e7261f95173e44df2023d9842c61befd3a3e5a1677d187331576


md5: 5be93fc5c858c3474bbfbc2555843966 sha256: 5264dcb00fd0e7261f95173e44df2023d9842c61befd3a3e5a1677d187331576


md5: 5be93fc5c858c3474bbfbc2555843966 sha1: 3ab8a4e40f91febfdc2e6d69e162e3efc8b8b448


sha1: a864cf53550d6daf38149d345d4563b65dd8580a sha256: e42e43e01e2ca96562fa67e58a4d539fcaf50054e631dd259351f95c69672288


md5: 885fa41b7e8e7d033cd01ee2e224cca2 sha256: e42e43e01e2ca96562fa67e58a4d539fcaf50054e631dd259351f95c69672288


md5: 885fa41b7e8e7d033cd01ee2e224cca2 sha1: a864cf53550d6daf38149d345d4563b65dd8580a


atd, sha1: 01e71387a3ab05d73caed5435a8437faa8b66198 sha256: 025d91fa1609138b30d9f95da41800aa5633913a8598ae54e95f0bc92cab2820


atd, md5: 9f29794effd56e4075bb9f6e28b14678 sha256: 025d91fa1609138b30d9f95da41800aa5633913a8598ae54e95f0bc92cab2820


atd, md5: 9f29794effd56e4075bb9f6e28b14678 sha1: 01e71387a3ab05d73caed5435a8437faa8b66198


atd, sha1: ac0fe4a4a400265a7d6a68a558443dfe77e0dfb4 sha256: d53fe08be9391ed668cdbcccecc4736e9d0e5dbc7cecbd32a7df21487d593232


atd, md5: f19890d3f004cb9ae23398a006e358f5 sha256: d53fe08be9391ed668cdbcccecc4736e9d0e5dbc7cecbd32a7df21487d593232


atd, md5: f19890d3f004cb9ae23398a006e358f5 sha1: ac0fe4a4a400265a7d6a68a558443dfe77e0dfb4


atd, sha1: 8107ca980e32c8c905aa86c81c20fe799181bef8 sha256: 9517212c7f840355ec02f71eb5e4ec87ae869d4b0a8bdd52331677433cca66bf


atd, md5: b8b11cfde33f285402ac17c50e89ce5e sha256: 9517212c7f840355ec02f71eb5e4ec87ae869d4b0a8bdd52331677433cca66bf


atd, md5: b8b11cfde33f285402ac17c50e89ce5e sha1: 8107ca980e32c8c905aa86c81c20fe799181bef8


dcrond, sha1: 286dc3e3a055e37f47ceef45cf0fa55a6ab10111 sha256: dd83e7b5788588d3a6b806ce0e5ad4acc0343c99548a342bfca9d54ea64625e3


dcrond, md5: 6f40bc303944be1e322dcf5c40e3cde8 sha256: dd83e7b5788588d3a6b806ce0e5ad4acc0343c99548a342bfca9d54ea64625e3


dcrond, md5: 6f40bc303944be1e322dcf5c40e3cde8 sha1: 286dc3e3a055e37f47ceef45cf0fa55a6ab10111


dcrond, sha1: b79b0fba2e698ef78747fb412cfbab3364fe3125 sha256: f11afd0d02e936e56aad7e5e86f3bc6781a1c67c4abb98fe7b3d831e8d67e312


dcrond, md5: 8816c53603205717e5f1269385841784 sha256: f11afd0d02e936e56aad7e5e86f3bc6781a1c67c4abb98fe7b3d831e8d67e312


dcrond, md5: 8816c53603205717e5f1269385841784 sha1: b79b0fba2e698ef78747fb412cfbab3364fe3125


TNTb, sha1: 506386147d393cef81019dda55ac85125914c6be sha256: 0eb2c98d14fce41db0ac9352484438fc40489d6f40c915b659ecc84342aa83a6


TNTb, md5: f09c0d5883a221d2e5f762480e946a78 sha256: 0eb2c98d14fce41db0ac9352484438fc40489d6f40c915b659ecc84342aa83a6


TNTb, md5: f09c0d5883a221d2e5f762480e946a78 sha1: 506386147d393cef81019dda55ac85125914c6be


sha1: 39a54217868490ce71d6d0eaf6b9b2a2d747b3ca sha256: 30617ff59db71da76e05828bf8eaf4c92553044bcf81870743cb35e1b482b1d8


md5: 5f721ea01a017832be0bc4ed60f73f9d sha256: 30617ff59db71da76e05828bf8eaf4c92553044bcf81870743cb35e1b482b1d8


md5: 5f721ea01a017832be0bc4ed60f73f9d sha1: 39a54217868490ce71d6d0eaf6b9b2a2d747b3ca


ucs-25.1.1034-debian10.tar, sha1: b86ac0e9c1d0ef17c9f7ec406d51d4b2ed08ff67 sha256: f1aa7cb84e515e6d4818531ecb6cf9241338c68ebcb93e181ab9dfebb6be9123


ucs-25.1.1034-debian10.tar, md5: 6f18d4f75e0cb13dbb868ce7c6fe8ab8 sha256: f1aa7cb84e515e6d4818531ecb6cf9241338c68ebcb93e181ab9dfebb6be9123


ucs-25.1.1034-debian10.tar, md5: 6f18d4f75e0cb13dbb868ce7c6fe8ab8 sha1: b86ac0e9c1d0ef17c9f7ec406d51d4b2ed08ff67


crond, sha1: b0827b53e4d2a3d53f3ab467157f17377a243eaf sha256: 30fd37421f35748b2adb1a45e71e77c38c4b4ebb6854112520bc27726a5d4424


crond, md5: 639826f50120006342e23a409ff6fa70 sha256: 30fd37421f35748b2adb1a45e71e77c38c4b4ebb6854112520bc27726a5d4424


crond, md5: 639826f50120006342e23a409ff6fa70 sha1: b0827b53e4d2a3d53f3ab467157f17377a243eaf


nmbtrapd, sha1: 98c4d06e1c09907c3a4734668fef1ccd2a5ffcbb sha256: 5ab7025a477fba68821be7cd3b425b74a5adcccbddbfe90dbce9bbb028cca4c4


nmbtrapd, md5: 250af8e186b4d72b70036f090e9aee25 sha256: 5ab7025a477fba68821be7cd3b425b74a5adcccbddbfe90dbce9bbb028cca4c4


nmbtrapd, md5: 250af8e186b4d72b70036f090e9aee25 sha1: 98c4d06e1c09907c3a4734668fef1ccd2a5ffcbb


nmbd, sha1: eaf5fc2f0d9a84ff77008f805be4025df1085c20 sha256: 66b7ce1c90ade1556469c4b9ef868bc6da2faea63987fbbfa4fa320723760a4e


nmbd, md5: 67aee8a9d41240c462ee7d7023977d84 sha256: 66b7ce1c90ade1556469c4b9ef868bc6da2faea63987fbbfa4fa320723760a4e


nmbd, md5: 67aee8a9d41240c462ee7d7023977d84 sha1: eaf5fc2f0d9a84ff77008f805be4025df1085c20


dtmf, sha1: 943918176f941b162d668ea9642ba63d51450ff9 sha256: cb1993e26580d51a6676890b87e4b3c9a2f8562815a291d9829988f00d616683


dtmf, md5: cd10a6c402c6ccc870afa0001409c27f sha256: cb1993e26580d51a6676890b87e4b3c9a2f8562815a291d9829988f00d616683


dtmf, md5: cd10a6c402c6ccc870afa0001409c27f sha1: 943918176f941b162d668ea9642ba63d51450ff9


sha1: 8f943b9f82892292162eb7964da3c9168df28116 sha256: d89671386dd794996e7fbf57645a6ab8d40dc5d0d634ca9deec235ae31f5c500


md5: 9fb96e93ba9962919b261ae7dfe2b120 sha256: d89671386dd794996e7fbf57645a6ab8d40dc5d0d634ca9deec235ae31f5c500


md5: 9fb96e93ba9962919b261ae7dfe2b120 sha1: 8f943b9f82892292162eb7964da3c9168df28116


nmbtrapd, sha1: f4c1f2882e20792463638cb75c4bb64e7aaf0401 sha256: e38dcc222f770a4d11be0bd31b6d22f69a9f5bce8306c1c96390a0701647c1f3


nmbtrapd, md5: bc7b5aa2a7f1e178fa8997c8d76ef041 sha256: e38dcc222f770a4d11be0bd31b6d22f69a9f5bce8306c1c96390a0701647c1f3


nmbtrapd, md5: bc7b5aa2a7f1e178fa8997c8d76ef041 sha1: f4c1f2882e20792463638cb75c4bb64e7aaf0401


sha1: 2c568ee8524a72cee2ae3002039f846988bea670 sha256: f466ecd2edc5481853f1e4613cf49dd5bd075e246436ad28b3558c2fd4069aca


md5: 093f35facc67cee3a8c2cca8be8b2d6a sha256: f466ecd2edc5481853f1e4613cf49dd5bd075e246436ad28b3558c2fd4069aca


md5: 093f35facc67cee3a8c2cca8be8b2d6a sha1: 2c568ee8524a72cee2ae3002039f846988bea670


nmbd, sha1: 50105c6e64ccf058d604cdcf9123ed8bf163c41b sha256: fd7298c3be42560f7a7e78903cc7ad5db3a14185eafc76a5bdac9bd2f2bf6bfc


nmbd, md5: b2538dbf30dc3acb95930394e0ff3498 sha256: fd7298c3be42560f7a7e78903cc7ad5db3a14185eafc76a5bdac9bd2f2bf6bfc


nmbd, md5: b2538dbf30dc3acb95930394e0ff3498 sha1: 50105c6e64ccf058d604cdcf9123ed8bf163c41b


aptitude-common, sha1: d7f31bbb9a7cbe911f5ae3253e650b1fa7cc4b4c sha256: b3538ce6d66a8a104f15a3431914da7214b54d1de2594f4ee536a6e7372ed664


aptitude-common, md5: 0e22f3587c519c1f0e4fc57a04d66edb sha256: b3538ce6d66a8a104f15a3431914da7214b54d1de2594f4ee536a6e7372ed664


aptitude-common, md5: 0e22f3587c519c1f0e4fc57a04d66edb sha1: d7f31bbb9a7cbe911f5ae3253e650b1fa7cc4b4c


sha1: 226d3a29149e36690b50b93beabed4481b1a48e6 sha256: c67f28a2b85b0b242c2337f8717f9ddda13d471648ea56eccaaf92750b0da4dc


md5: 537b8e319ef65435740b3e0c28722925 sha256: c67f28a2b85b0b242c2337f8717f9ddda13d471648ea56eccaaf92750b0da4dc


md5: 537b8e319ef65435740b3e0c28722925 sha1: 226d3a29149e36690b50b93beabed4481b1a48e6


sha1: 15a6fdc79f0724d4c3b18742e5f1d73fc6839ac4 sha256: 6da74c7e2bf3d77ac2f2cfddd114d27d08d01c2131d05d36e9c54de1c2565b2b


md5: 4f2529e5be66a80e44acaeaa418b575c sha256: 6da74c7e2bf3d77ac2f2cfddd114d27d08d01c2131d05d36e9c54de1c2565b2b


md5: 4f2529e5be66a80e44acaeaa418b575c sha1: 15a6fdc79f0724d4c3b18742e5f1d73fc6839ac4


dcrond, sha1: 67006e298844b578cce9888c243640f7e1f2e7c7 sha256: 00625fe8a6573f1774bfd9d58ba4a73d2c6307126271aa9accda89cd4b7270a9


dcrond, md5: e35199eacd0bbc06cfb2c72e14f7a659 sha256: 00625fe8a6573f1774bfd9d58ba4a73d2c6307126271aa9accda89cd4b7270a9


dcrond, md5: e35199eacd0bbc06cfb2c72e14f7a659 sha1: 67006e298844b578cce9888c243640f7e1f2e7c7


dcrond, sha1: fb0f1226903dde243ef08c26ec0c5d7880e9c291 sha256: 7f55c71e064c000906afad1ff649d5c2d3fb6d61d7e84338c9ecf95b4958c7a4


dcrond, md5: 453833594493c5064eeff8210d571224 sha256: 7f55c71e064c000906afad1ff649d5c2d3fb6d61d7e84338c9ecf95b4958c7a4


dcrond, md5: 453833594493c5064eeff8210d571224 sha1: fb0f1226903dde243ef08c26ec0c5d7880e9c291


dcrond, sha1: 444a7b477e6f7bd0d9be7add79b3e0415566169c sha256: d59fcb3e138b9eea0d70a1127f7b9d927f381a133720cae0c4fd5fc803e4b9dd


dcrond, md5: f28c7c354b9e27e8908dd0b8dc7da01b sha256: d59fcb3e138b9eea0d70a1127f7b9d927f381a133720cae0c4fd5fc803e4b9dd


dcrond, md5: f28c7c354b9e27e8908dd0b8dc7da01b sha1: 444a7b477e6f7bd0d9be7add79b3e0415566169c


atd, sha1: 7c440e9421c26fe7b73ae8e213ef58b3b615ed6f sha256: 25ff8d416a4158c7401f6c23e040c592ff29855da83ea67340342a3dfacd99a5


atd, md5: 74ed22250182d13df4e1ad4b4f91d519 sha256: 25ff8d416a4158c7401f6c23e040c592ff29855da83ea67340342a3dfacd99a5


atd, md5: 74ed22250182d13df4e1ad4b4f91d519 sha1: 7c440e9421c26fe7b73ae8e213ef58b3b615ed6f


atd, sha1: 27fedf90846efe5357e11c53d87612fbf6c421d4 sha256: 82746a68612661c699ff2998502c9a252d52f76284a6c623d5c7f45d97dcefba


atd, md5: 6218ad1e81b1cd9364bbe0059b99bc9a sha256: 82746a68612661c699ff2998502c9a252d52f76284a6c623d5c7f45d97dcefba


atd, md5: 6218ad1e81b1cd9364bbe0059b99bc9a sha1: 27fedf90846efe5357e11c53d87612fbf6c421d4


atd, sha1: 2ba1a6808db393296a08968c220b193fae42c21b sha256: ee8dd2626a4465f49f6d4aaf3b6d3735ca938e5e289304ba0664e4c9fb957672


atd, md5: e1a93ced3a55b34a54b5ac0dd095da59 sha256: ee8dd2626a4465f49f6d4aaf3b6d3735ca938e5e289304ba0664e4c9fb957672


atd, md5: e1a93ced3a55b34a54b5ac0dd095da59 sha1: 2ba1a6808db393296a08968c220b193fae42c21b


smartmond, sha1: 2b1b5b4c7f9d4a963b0ec92a5eb2e28cb6cdc0b7 sha256: ae6c7656a973c797ad8c3a344da99fbca8452c471d26900a2300364ddeb959b9


smartmond, md5: d80b3ff086aed177bb87c317188b92c2 sha256: ae6c7656a973c797ad8c3a344da99fbca8452c471d26900a2300364ddeb959b9


smartmond, md5: d80b3ff086aed177bb87c317188b92c2 sha1: 2b1b5b4c7f9d4a963b0ec92a5eb2e28cb6cdc0b7


dcrond, sha1: 4450d904f695dd51eaea24e4e449707707c7852e sha256: b21e9a3581497eafbd92a45b670b9e6f18aa09f8375ed8ebb03a199d531b2d39


dcrond, md5: cc7a6656832b6929722b1c38cc14b550 sha256: b21e9a3581497eafbd92a45b670b9e6f18aa09f8375ed8ebb03a199d531b2d39


dcrond, md5: cc7a6656832b6929722b1c38cc14b550 sha1: 4450d904f695dd51eaea24e4e449707707c7852e


atd, sha1: e3ce85ababbc7b8b4291551abb9f0928caeb2646 sha256: 121ab168fd3d59f83d127eb6a049e67ffdea9a3d4cdc6044f92116f4b1beb26d


atd, md5: b514157f9b8cbb08d476e838171050d8 sha256: 121ab168fd3d59f83d127eb6a049e67ffdea9a3d4cdc6044f92116f4b1beb26d


atd, md5: b514157f9b8cbb08d476e838171050d8 sha1: e3ce85ababbc7b8b4291551abb9f0928caeb2646


dcrond, sha1: 685ecfba19ad58f81acbb62a3fc9010128bf2000 sha256: 64af32f631c4ace6604ee84e2875c3393a54a0e8ad838a85833c086757d343fe


dcrond, md5: 33f3dd60e87aafd96adf62fcb5af725f sha256: 64af32f631c4ace6604ee84e2875c3393a54a0e8ad838a85833c086757d343fe


dcrond, md5: 33f3dd60e87aafd96adf62fcb5af725f sha1: 685ecfba19ad58f81acbb62a3fc9010128bf2000


atd, sha1: 8daf7589f2e417363e3cfbc714fc9b299f54a36e sha256: 834d7a3ccd82dd51ead09f18d9e466f6b5cb79d3054d12e3c3771e0477e0bc75


atd, md5: 5da97bbd438a030b0427a15c69af0037 sha256: 834d7a3ccd82dd51ead09f18d9e466f6b5cb79d3054d12e3c3771e0477e0bc75


atd, md5: 5da97bbd438a030b0427a15c69af0037 sha1: 8daf7589f2e417363e3cfbc714fc9b299f54a36e


dcrond, sha1: 26199b999facada1d6dafe78524321e575621d73 sha256: 33e9020a2d6e6604ac0abafaa9427738937a282d3e418723e4857519c9bf99bc


dcrond, md5: 84f2fa4d139ac10124f915584dda6476 sha256: 33e9020a2d6e6604ac0abafaa9427738937a282d3e418723e4857519c9bf99bc


dcrond, md5: 84f2fa4d139ac10124f915584dda6476 sha1: 26199b999facada1d6dafe78524321e575621d73


htop, sha1: 3ca21bde29ff0744edacd611d82b50d297bb447a sha256: 494c857b3abe11ab66024c605648dfeb23804d554e32b0411215d83b1bde4434


htop, md5: 6ee38226efedabbf794a37d0c972702c sha256: 494c857b3abe11ab66024c605648dfeb23804d554e32b0411215d83b1bde4434


htop, md5: 6ee38226efedabbf794a37d0c972702c sha1: 3ca21bde29ff0744edacd611d82b50d297bb447a


systemd-crgoupsd, sha1: 4811d92b307a2929b25b39638b35f3e5692f4451 sha256: 49cda974e0f9fdf1a99c76ab1f02c501cd720700efcc303e05dfb7d1e71f0d16


systemd-crgoupsd, md5: 26e10db16c4b00c9d4afa1d3f2c5f080 sha256: 49cda974e0f9fdf1a99c76ab1f02c501cd720700efcc303e05dfb7d1e71f0d16


systemd-crgoupsd, md5: 26e10db16c4b00c9d4afa1d3f2c5f080 sha1: 4811d92b307a2929b25b39638b35f3e5692f4451


sha1: db3ea044e32773c12d67a49588f5a12aae09e257 sha256: 510da6d88ae4dd51d62796023a18b39db08a016ee4ee7178b1afdc91c58f9e1e


md5: b0b2176187e24710ad9b4fbbb38573b1 sha256: 510da6d88ae4dd51d62796023a18b39db08a016ee4ee7178b1afdc91c58f9e1e


md5: b0b2176187e24710ad9b4fbbb38573b1 sha1: db3ea044e32773c12d67a49588f5a12aae09e257


sha1: 480c2a12dfc1900ab9bad635caf6c507a300623c sha256: 6cb2979aa1fddd42df2ba596f705ce9bbdb2ec246649218d598d779769857c21


md5: fd13efb096377f8bbf8b754874c40262 sha256: 6cb2979aa1fddd42df2ba596f705ce9bbdb2ec246649218d598d779769857c21


md5: fd13efb096377f8bbf8b754874c40262 sha1: 480c2a12dfc1900ab9bad635caf6c507a300623c


db-healthmon, sha1: ac469df608ef049708ba6efe72f4493ac20cdfd0 sha256: 1b7d26b2547ceb7f44dc9cabeb54d9c0c90b1ffb354dd1da711e269710f5d75c


db-healthmon, md5: 18417672efbe00f3ecdd700c442137fd sha256: 1b7d26b2547ceb7f44dc9cabeb54d9c0c90b1ffb354dd1da711e269710f5d75c


db-healthmon, md5: 18417672efbe00f3ecdd700c442137fd sha1: ac469df608ef049708ba6efe72f4493ac20cdfd0


mind-live_3.12.30+23.06.23.01.30.iso, sha1: 9206f83e69c53c4460a30cc4046e59f50e25a1ad sha256: 0d6d89023c7e4d72d8c68d5d7308eb2a58286a0ecc2ddcbe325d78f6b2149680


mind-live_3.12.30+23.06.23.01.30.iso, md5: 8a1834e81ffb4ded5b818db7db8e543b sha256: 0d6d89023c7e4d72d8c68d5d7308eb2a58286a0ecc2ddcbe325d78f6b2149680


mind-live_3.12.30+23.06.23.01.30.iso, md5: 8a1834e81ffb4ded5b818db7db8e543b sha1: 9206f83e69c53c4460a30cc4046e59f50e25a1ad


mind-live_3.12.30+23.06.23.01.50.iso, sha1: 1d3ab04ace6895b042beb2d7ccfcd6c6cf5e620c sha256: c620742a863ab20ad0f211bf0e7a1be0725f2682af96db15c1a0d610875dd613


mind-live_3.12.30+23.06.23.01.50.iso, md5: 6703e425619a766ab521109885b51248 sha256: c620742a863ab20ad0f211bf0e7a1be0725f2682af96db15c1a0d610875dd613


mind-live_3.12.30+23.06.23.01.50.iso, md5: 6703e425619a766ab521109885b51248 sha1: 1d3ab04ace6895b042beb2d7ccfcd6c6cf5e620c


INC


Rhysida


CandidateCDHash sha256


CandidateCDHashFull


g8e92i39f8h320kd394fhj0w2ksjd38fhj02jhd3f8jk02j9hd3jf0j3h9d0k2j3f0/”


ufidwowifbgreowdnweirfjoibfgeiosndwiefmoshifg/”


ohdfifehjkdejpdmimoefaoddjgndplf


filename: GAGNANTS_CONCOURS_2024.zip


sha256: 7566a8bce13dcbf1137b44776711ac2c471cf54a8bd7891c5b00b091f2aaa796


filename: 1.jpg.lnk


sha256: da9122c56c0da8f4e336f811435783b22994a9109162f3be6558aed7ac1c08da


filename: 2.jpg.lnk


sha256: 3a169ce08fa1ab70f452c2bdfe3638805579a5cca1b45eb8ce81f68c98c932da


filename: 3.jpg.lnk


sha256: 43cfef5db47162dda0c11320d3fcee76ef83308a7d0b7c9afd16c8dd974834a7


filename: KB.dll


sha256: d9b4ed0f77045b79989b31fa32fdb1b461e9602d0c150a4052f9ae6a79a98ff5


Aunteficator_em_BHdAOse8_installer_Win7-Win11_x86_x64.msi


Salome.zip


script.a3x (Salome.zip)


Core.zip


script.a3x (Core.zip)


Rhadamanthys


DarkGate loader


Rhadamanthys C2


SectopRAT


updater.py


autocrypt.ini


RMM instance


BANSHEE stealer C2


Samples


August 2024 samples August 024 samples


Cluster (if applicable)


Post Ltd


Both


SmartApe


MichelinNight.zip


Pupy RAT


MichelinNight.lnk


lzh.zip


LNK File


faultrep.dll Loader DLL


Encrypted Payload


Download


C&C


Cyclops


Cyclops validator


Cyclops SSH C2 and validator NS


Cyclops REST API endpoint


Possible BellaCiao or Cyclops validator


Possible former BellaCiao or Cyclops validator


Possible BellaCiao or Cyclops infrastructure


Possible former BellaCiao or Cyclops infrastructure


Possible former BellaCiao or Cyclops infrastructur


File


Fake Google Authenticator site


Another fake Authenticator site


DigitalOcean / Microsoft Office 365 login spoof DigitalOcean / Microsoft Office 65 login spoof


DigitalOcean / Mimics solana blockchain air drop site, fairdrop[.]org, chatbot app, chatie


DigitalOcean / Spoof compliance call recording company, callcabinet[.]com


DigitalOcean / Microsoft Office 365 spoof DigitalOcean / Microsoft Office 65 spoof


Microsoft / Likely attempt to mimic private equity firm, anacap[.]com


Domains


PowerShell scripts


C:\Windows\system32\NvWinSearchOptimizer.ps1 – 2024 version

PowerShell scripts


C:\Windows\system32\kondserp_optimizer.ps1 – May 2024 version

PowerShell scripts


Installer Examples (NOT All are Included)


Scan_docs#40562153.msi, sha256: a7297883de84d73fb4965c00228144a0e53c573ad3b7291be39bc6d9c284454c


Scan_docs#40562153.msi, md5: 5b1323cfcddc4fd7de98c94ce9ce8b66


Scan_docs#14107386.exe, sha256: 02ec55a5a2ad775adccd333edd94ac0bd82129a233736f7240044e085b73b0b3


Scan_docs#14107386.exe, md5: ce65c8134821032063d54ca07e8a73ae


sha256: 4c4872202abb5a60a8764bf44b370578a2b3d6f449b3881e96cc38f1b55f9cda filename: 32x.ex


md5: 6ab9f278a420ac86fc7ec85647ce99f1 filename: 32x.ex


md5: 6ab9f278a420ac86fc7ec85647ce99f1 sha256: 4c4872202abb5a60a8764bf44b370578a2b3d6f449b3881e96cc38f1b55f9cda


легітимний сервіс pCloud


@webnic.cc (Cloudflare)


@cloudflare.com


AE @iqweb.io


US @contaboserver.net


EML


MSC File


QuasarRAT


C2 server


PoshC2 Address


SystemBC


Used to make external Microsoft Teams calls after email bombing users


C2 address used by the threat actor to connect via Anydesk


Socks proxy server


SystemBC C2


SystemBC C2 address


Cobalt Strike


Cobalt Strike C2 address


C2 address


Credential harvester, version 1 Credential harvester, version, filename: AntiSpam.exe


Credential harvester, version 1 Credential harvester, version, sha256: ed062c189419bca7d8c816bcdb1a150c7ca7dd1ad6e30e1f46fae0c10ab062ef


Credential harvester, version 2 Credential harvester, version, filename: AntiSpam.exe


Credential harvester, version 2 Credential harvester, version, sha256: d512bf205fb9d1c429a7f11f3b720c74680ea88b62dda83372be8f0de1073a08


Credential harvester, version 3 Credential harvester, version, filename: AntiSpam.exe


Credential harvester, version 3 Credential harvester, version, sha256: dc5c9310a2e6297caa4304002cdfb6fbf7d6384ddbd58574f77a411f936fab0b


Original filename: YandexDiskSetup.exe, filename: update1.exe


Original filename: YandexDiskSetup.exe, sha256: 24b6ddd3028c28d0a13da0354333d19cbc8fd12d4351f083c8cb3a93ec3ae793


Original filename: APEXScan.exe. Socks proxy, filename: update4.exe


Original filename: APEXScan.exe. Socks proxy, sha256: 9c1e0c8c5b9b9fe9d0aa533fb7d9d1b57db98fd70c4f66a26a3ed9e06ac132a7


Used to attempt exploitation of CVE-2022-26923 for privilege escalation, filename: update6.exe


Used to attempt exploitation of CVE-2022-26923 for privilege escalation, sha256: ac22ab152ed2e4e7b4cd1fc3025b58cbcd8d3d3ae3dbc447223dd4eabb17c45c


Original filename: KLDW.exe. SystemBC malware, filename: update7.exe


Original filename: KLDW.exe. SystemBC malware, sha256: ab1f101f6cd7c0cffc65df720b92bc8272f82a1e13f207dff21caaff7675029f


Original filename: YandexDiskSetup.exe. SystemBC malware, filename: update8.exe


Original filename: YandexDiskSetup.exe. SystemBC malware, sha256: 9ed2b4d88b263f5078003ef35654ed5c205ac2f2c0e9225d4cdb4c24a5ea9af2


Original filename: atiumdag.dll, filename: update2.dll


Original filename: atiumdag.dll, sha256: ab3daec39332ddeeba64a2f1916e6336a36ffcc751554954511121bd699b0caa


Original filename: Log.dll. Socks proxy, filename: update5.dll


Original filename: Log.dll. Socks proxy, sha256: 7d96ec8b72015515c4e0b5a1ae6c799801cf7b86861ade0298a372c7ced5fd93


Socks proxy script, filename: update7.ps1


Socks proxy script, sha256: 9dc809b2e5fbf38fa01530609ca7b608e2e61bd713145f84cf22c68809aec372


Not analyzed in this blog, likely cred harvester, filename: AntiSpam.exe


Not analyzed in this blog, likely cred harvester, sha256: fb4fa180a0eee68c06c85e1e755f423a64aa92a3ec6cf76912606ac253973506


Not analyzed in this blog, likely cred harvester, sha256: fcf59559731574c845e42cd414359067e73fca108878af3ace99df779d48cbc3


Not analyzed in this blog, likely socks proxy, filename: update5.dll


Not analyzed in this blog, likely socks proxy, sha256: 949faad2c2401eb854b9c32a6bb6e514ad075e5cbe96154c172f5f6628af43ed


Not analyzed in this blog, likely Golang HTTP beacon, filename: update2.dll


Not analyzed in this blog, likely Golang HTTP beacon, sha256: b92cf617a952f0dd2c011d30d8532d895c0cfbfd9556f7595f5b220e99d14d64


Not analyzed in this blog, likely socks proxy, filename: APEXScan.exe


Not analyzed in this blog, likely socks proxy, sha256: cff5c6694d8925a12ce13a85e969bd468e28313af2fb46797bdcf77092012732


Not analyzed in this blog, likely the same BOF contained within update6.exe, filename: unnamed


Not analyzed in this blog, likely the same BOF contained within update6.exe, sha256: cb03b206d63be966ddffa7a2115ea99f9fec50d351dce03dff1240bb073b5b50


Not analyzed in this blog, likely Golang HTTP beacon, filename: update1.exe


Not analyzed in this blog, likely Golang HTTP beacon, sha256: ccaa8c8b39cb4a4de4944200936bcd4796367c16421a89e6a7d5476ae2da78cd


Not analyzed in this blog, likely socks proxy, filename: update4.exe


Not analyzed in this blog, likely socks proxy, sha256: 1ade6a15ebcbe8cb9bda1e232d7e4111b808fd4128e0d5db15bfafafc3ec7b8e


FQDN


SocGholish


Agent Tesla


CoinMiner


NanoCore


ZPHP


Mirai


Magecart


DarkGate


Lumma Stealer


[Detection name] / Trojan.Win64.STEALTHVECTOR.ZYLH


[Detection name] / Trojan.Win64.STEALTHVECTOR.ZALG


[Detection name] / Trojan.Win64.STEALTHVECTOR.E


[Detection name] / Trojan.Win64.STEALTHVECTOR.ZBLG


[Detection name] / Trojan.Win64.STEALTHREACHER.ZYLH


[Detection name] / Trojan.Win64.STEALTHREACHER.ZBLH


[Detection name] / Backdoor.Win64.COBEACON.ZYLH


[Detection name] / Backdoor.Win64.COBEACON.ZALH


[Detection name] / Backdoor.Win64.SNEAKCROSS.ZBLG


SHA256] [Detection name, filename: Backdoor.Win64.COBEACON.ZBLF.enc


SHA256] [Detection name, sha256: e5f1360d4c299bb32e33e081115f2b520251a983af2ebc649b4b9b70308246fe


Type] [URL/IP address


filename: Enquiry-Dubai.js


md5: 42436fb03b579a159464fb2af53696f1


Ande Loader, filename: 177.txt


Ande Loader, md5: d1c9c2c55d5c287ebdc9f9a7f5f2e630


filename: new-image.js


md5: 41914711cfdaba63ddf1701270077855


bj3ctivity Stealer


Observed in traffic to remote ports 7777 and 11288


Observed in traffic to remote port 11288 11288, 63256, and 63260


Observed in traffic to remote port 11288


Play Ransomware


mach-O


Stage C2


data exfil C2


Upload recorded face video


Sends stolen bank details


Upload contacts


Upload from an infected device


Receives configuration list


Gigabud unpacked sample, sha1: 327c041ba063d32e7378483aa7ebdf73ea6787db sha256: d19a134f8e4961ec53e53fc21b3606063d821579ef4427ddaac011c7624b0af4


Gigabud unpacked sample, md5: 4d1d13cb7ce979cdb3a22838c8885794 sha256: d19a134f8e4961ec53e53fc21b3606063d821579ef4427ddaac011c7624b0af4


Gigabud unpacked sample, md5: 4d1d13cb7ce979cdb3a22838c8885794 sha1: 327c041ba063d32e7378483aa7ebdf73ea6787db


Packed Gigabud sample, sha1: 2337bf80e136ee99ee59096081d7a937fd79adc3 sha256: b700cee5e89305186b65a7c42c545263b3c11587ac1feb91fc3747353bde59e9


Packed Gigabud sample, md5: 853c98feaec405722c8353ff2d697f9e sha256: b700cee5e89305186b65a7c42c545263b3c11587ac1feb91fc3747353bde59e9


Packed Gigabud sample, md5: 853c98feaec405722c8353ff2d697f9e sha1: 2337bf80e136ee99ee59096081d7a937fd79adc3


C&C server


Phishing


GoogleAuthSetup.exe


Latrodectus


ACR Stealer


C&C of Latrodectus


Config file of ACR Stealer


Phishing Site


An executable suspected to be a colbalt strike beacon dropped by the TA


file_path_name / An executable suspected to be a colbalt strike beacon dropped by the TA


Cobalt Strike Loader


file_path_name / Cobalt Strike Loader


Hex encoded DLL in cobalt strike loader (userenv.dll)


Malicious DLL - CLR_module.dll Malicious DLL CLR_module.dll


file_name / Malicious DLL - CLR_module.dll file_name / Malicious DLL CLR_module.dll


Malicious file (Mal/Generic) detected on machine


file_path_name / Malicious file (Mal/Generic) detected on machine


Malicious file renamed from C:\users\public\downloads\1.png


file_path_name / Malicious file renamed from C:\users\public\downloads\1.png


Mimic ransomware executable


file_name / Mimic ransomware executable


Observed TA command execution through this binary


file_path_name / Observed TA command execution through this binary


Payload dropper


file_path_name / Payload dropper


PrintSpoofer


file_path_name / PrintSpoofer


Ransomware launcher binary


file_path_name / Ransomware launcher binary


Related to mimic ransomware (troj/ransom-hcl)


file_name / Related to mimic ransomware (troj/ransom-hcl)


Used to run build.txt and safeboot the network


file_path_name / Used to run build.txt and safeboot the network


webshell


file_path_name / webshell


Trojan.Gogra


Trojan.Grager


Trojan.Ondritols


Trojan.Moontag


Whipweave


Trojan.Grager download


Zip typosquatted


MoonTag C&C


Whipweave C&C


filename: paypal.charges.doc


sha256: 69b6bc4db69680118781e7a9f2580738088930fa04884755f23904fa19e638e3


sha256: 9ebf60ad31f0eb1fa303e0b00f9cc605c5013ea30771e6b14409cb70af7416cb


filename: ~WRL003.tmp


sha256: afb95b1b2092020ed98312602c300f51daca14bb3d65503df3c5ca4776027987


filename: 8eef4df388f2217caec3dc26.ps1


sha256: 629587e592130b86418d17d6b8cc52b6f378f39f1b5e8caa4038cfa7120b2a53


filename: TEStxx.dll


sha256: dd78c6dc62463aba24cdbea3968cbcc1c7b97a736ef069d99d6512b10c5e91f3


filename: p000.exe


sha256: 42551531be1c5abfdd24a3465788c659a038141de61976787b0862664df95aad


page/6297aa368 ec25


File


APK file


Yandex Disk encrypted credential sources


ipaddress / C2 server used during the DNS poisoining


ipaddress / MACMA C2 Server


ipaddress / CATCHDNS C2


CATCHDNS, sha1: d14431e79dc109d7aad91a5411d406c99ffc524c sha256: 4f3d35f4f8b810362cbd4c59bfe5a961e559fe5713c9478294ccb3af2d306515


CATCHDNS, md5: 049e8677406de5f0061f3960f9655b5f sha256: 4f3d35f4f8b810362cbd4c59bfe5a961e559fe5713c9478294ccb3af2d306515


CATCHDNS, md5: 049e8677406de5f0061f3960f9655b5f sha1: d14431e79dc109d7aad91a5411d406c99ffc524c


CATCHDNS, sha1: bb030c405f33557bc5441165a0f8bf9a6d5a82a6 sha256: 3f76933e053b2e8e3458f2e69d72e10b6b6a97fb8ba0f0300aa415b99c032aea


CATCHDNS, md5: ce5fdde7db4ee41808f9c7d121311f78 sha256: 3f76933e053b2e8e3458f2e69d72e10b6b6a97fb8ba0f0300aa415b99c032aea


CATCHDNS, md5: ce5fdde7db4ee41808f9c7d121311f78 sha1: bb030c405f33557bc5441165a0f8bf9a6d5a82a6


CATCHDNS, sha1: 038bc60a0bf004e9a7cbc3a3cf814613e61ba7cc sha256: 17aebd011dcd3e7c11484c2f98fa0901c2ea1325fdd6c03904d30ebfc8747a99


CATCHDNS, md5: 2a6c10a34fa1e2a38673f4ca20c303a1 sha256: 17aebd011dcd3e7c11484c2f98fa0901c2ea1325fdd6c03904d30ebfc8747a99


CATCHDNS, md5: 2a6c10a34fa1e2a38673f4ca20c303a1 sha1: 038bc60a0bf004e9a7cbc3a3cf814613e61ba7cc


RELOADEXT installer, sha1: 66346b3d841dc56a387f48b4dfba96083c37ec2e sha256: 07e3b067dc5e5de377ce4a5eff3ccd4e6a2f1d7a47c23fe06b1ededa7aed1ab3


RELOADEXT installer, md5: ee28b3137d65d74c0234eea35fa536af sha256: 07e3b067dc5e5de377ce4a5eff3ccd4e6a2f1d7a47c23fe06b1ededa7aed1ab3


RELOADEXT installer, md5: ee28b3137d65d74c0234eea35fa536af sha1: 66346b3d841dc56a387f48b4dfba96083c37ec2e


MACMA keylogger, sha1: 68853cafd395edd08cd38ab6100c58e291a3a3d7 sha256: 77406e090ad9214942d7ca91ddd09b0435bafe42ffa2512819a7bc6cdec112b8


MACMA keylogger, md5: 4958ede3b968ad464c983054479bf4d2 sha256: 77406e090ad9214942d7ca91ddd09b0435bafe42ffa2512819a7bc6cdec112b8


MACMA keylogger, md5: 4958ede3b968ad464c983054479bf4d2 sha1: 68853cafd395edd08cd38ab6100c58e291a3a3d7


RELOADEXT extension, sha1: c68e86985a4cb2f69e16fb943723af63833859b3 sha256: 7e2e1fba2fabf677d08611a59b03d646a92bb6110182b61adae207c8a88b6d13


RELOADEXT extension, md5: 6abf9a7926415dc00bcb482456cc9467 sha256: 7e2e1fba2fabf677d08611a59b03d646a92bb6110182b61adae207c8a88b6d13


RELOADEXT extension, md5: 6abf9a7926415dc00bcb482456cc9467 sha1: c68e86985a4cb2f69e16fb943723af63833859b3


MACMA sample, sha1: 37ee872f05a0273446dc7e2539b9dbf9bf7d80b4 sha256: 806eabfa6ee245eaaf817c0336e07982fffc42efb1f39a2bfb44a5db2c89b126


MACMA sample, md5: 25e4eef79ad4126d5dc5567949848070 sha256: 806eabfa6ee245eaaf817c0336e07982fffc42efb1f39a2bfb44a5db2c89b126


MACMA sample, md5: 25e4eef79ad4126d5dc5567949848070 sha1: 37ee872f05a0273446dc7e2539b9dbf9bf7d80b4


MACMA-GIMMICK sample, sha1: 84875b2cf9f8c778ff1462ef478918b4ac964afe sha256: b76a9034e9abc7a62171e80f9d1f7fdf565cda286bd10fd3984eae769113c8c5


MACMA-GIMMICK sample, md5: acfc69c743b733dd80c1d551ae01172b sha256: b76a9034e9abc7a62171e80f9d1f7fdf565cda286bd10fd3984eae769113c8c5


MACMA-GIMMICK sample, md5: acfc69c743b733dd80c1d551ae01172b sha1: 84875b2cf9f8c778ff1462ef478918b4ac964afe


DUSTPAN malware, sha1: e8e4a3fa69173a46cdb60c53877c7ad557accc51 sha256: b77bcfb036f5a6a3973fdd68f40c0bd0b19af1246688ca4b1f9db02f2055ef9d


DUSTPAN malware, md5: 4c8a326899272d2fe30e818181f6f67f sha256: b77bcfb036f5a6a3973fdd68f40c0bd0b19af1246688ca4b1f9db02f2055ef9d


DUSTPAN malware, md5: 4c8a326899272d2fe30e818181f6f67f sha1: e8e4a3fa69173a46cdb60c53877c7ad557accc51


filename: LogUpdate.bat


sha256: d2e7729c64c0dac2309916ce95f6a8253ca7f3c7a2b92b452e7cfb69a601fbf6


filename: Wiaphoh7um.t


sha256: 3f1443be65525bd71d13341017e469c3e124e6f06b09ae4da67fdeaa6b6c381f


filename: ipscan-3.9.1-setup.exe


sha256: 223aa5d93a00b41bf92935b00cb94bb2970c681fc44c9c75f245a236d617d9bb


filename: kautix2aeX.t


sha256: 9a8967e9e5ed4ed99874bfed58dea8fa7d12c53f7521370b8476d8783ebe5021


filename: WindowsUpdate.bat


sha256: b57ec2ea899a92598e8ea492945f8f834dd9911cff425abf6d48c660e747d722


sha256: 09b5e780227caa97a042be17450ead0242fd7f58f513158e26678c811d67e264


Command & Control


Initial Download Site


Spammer profiles


Stolen pages


Link


Phishing pages


Stolen data collector


Fake websites


token / Kia5weA1


token / o2e0uS6K


token / LLyOK4DZ


Lumma Stealer C&C server


BlankBot APK


BlankBot control servers


SEXi


Key Group


Mallox


NetSupportRAT C2


NetSupportRAT


Malicious ZIP archive


Malicious JavaScript


Trycloudflare / May 2024 Trycloudflare / May 024


May 2024 May 024


LNK / May 2024 LNK / May 024


CMD / May 2024 CMD / May 024


Xworm C2 / May 2024 Xworm C2 / May 024


AsyncRAT C2 / May 2024 AsyncRAT C2 / May 024


HTML / July 2024 HTML / July 024


LNK / July 2024 LNK / July 024


Trycloudflare / July 2024 Trycloudflare / July 024


BAT / July 2024 BAT / July 024


AsyncRAT C2 / July 2024 AsyncRAT C2 / July 024


Xworm C2 / July 2024 Xworm C2 / July 024


Simple indicator of observable {0f9c0d9b77678d7360e492e00a7fa00af9b78331dc926b0747b07299b4e64afd}


Simple indicator of observable {0944b17a4330e1c97600f62717d6bae7e4a4260604043f2390a14c8d76ef1507}


Simple indicator of observable {4fb6dd11e723209d12b2d503a9fcf94d8fed6084aceca390ac0b7e7da1874f50}


Simple indicator of observable {dfb76bcf5a3e29225559ebbdae8bdd24f69262492eca2f99f7a9525628006d88}


Simple indicator of observable {4a4356faad620bf12ff53bcfac62e12eb67783bd22e66bf00a19a4c404bf45df}


Simple indicator of observable {15.235.132.67}


Simple indicator of observable {45.116.13.178}


Simple indicator of observable {216.238.121.132}


Phishing site


Manual_installer_Sora_OpenaiPro_v4.1.zip


Manual_installer_Sora_OpenaiPro_v4.1.bat


VIDEOHD.zip


Run batch script


Setup-Createstudio.bat


Braodo Stealer


lolMiner.zip


Open AI Sora 4.0 Version 4.56.zip Open AI Sora .0 Version .56.zip


Open AI Sora 4.0 Version 4.56.exe Open AI Sora .0 Version .56.exe


Phishing sites


Malicious


ngrok


HTA


VBS file


Obfuscated JScript


AutoIt Script


filename: onlinestoreforhirog.zip


sha256: 6263b94884726751bf4de6f1a4dc309fb19f29b53cce0d5ec521a6c0f5119264


filename: printfulRoute.js


sha256: bc4a082e2b999d18ef2d7de1948b2bfd9758072f5945e08798f47827686621f2


filename: .npl


sha256: 0639d8eaad9df842d6f358831b0d4c654ec4d9ebec037ab5defa240060956925


sha256: 63238b8d083553a8341bf6599d3d601fbf06708792642ad513b5e03d5e770e9b


sha256: eff2a9fca46425063dca080466427353dc52ac225d9df7c1ef0ec8ba49109b71


sha256: 2d10b48454537a8977affde99f6edcbb7cd6016d3683f9c28a4ec01b127f64d8


sha256: 7e5828382c9ef9cd7a643bc329154a37fe046346fd2cf4698da2b91050c9fe12


filename: pay


filename: run.py


sha256: b31f5bde1bdbc2dfd453b91bab2e9be0becec555ee6edd70744c77f2ad15d18c


filename: DXJS.zip


md5: b325d948f463871ff10be13f8ea4b555


filename: FTSP.zip


md5: 1875b80d552feed0c1bd5592056d109a


filename: new.bat


md5: 0d79c56f9198117a98334ead5d033974


filename: startuppppp.bat


md5: 1e5fa94c5be0d6f6d57c181c60622b80


Files: / XWorm, filename: Xwrm3v.exe


Files: / XWorm, md5: e4093e66d377d1f1552220fb7342385f


Files: / XWorm, filename: Xvwrm5v.exe


Files: / XWorm, md5: a8bfb9877be0daf890333c91c88c77d8


Files: / AsyncRAT, filename: AsyncClient.exe


Files: / AsyncRAT, md5: c9562d033d5e13674af5b5fdc3e5801c


Files: / AsyncRAT, filename: Anarchynostart.exe


Files: / AsyncRAT, md5: e618be3fea2925a6637d8fcf05ff5c8a


Files: / PureLogs Stealer, filename: Dghucwmscrj.exe


Files: / PureLogs Stealer, md5: 1e66092482f2738ff808c2fc076185e6


Files: / VenomRAT, filename: ClientVRNM8520.exe


Files: / VenomRAT, md5: 58e6b6b4b7f6849749b6374ffbd7fa2e


filename: 1.py


md5: 9320932e570d27bd88ee600b3961eecc


filename: 2.py


md5: a84994e9e9de4fd82f721dbf2c8d9c58


filename: 3.py


md5: 94e1a61c69eb01d7acba395d826824ce


filename: 4.py


md5: 74502d4da814015cd36620734e248b5f


filename: 5.py


md5: cff45bdc81bc10205d914dd3a84c74f7


filename: 6.py


md5: ab95a98ee521483eee3903ab9733639b


filename: kam.py


md5: 42f067738951f58979ce7267456ff05a


filename: moment.py


md5: 987b4d5ab393fb625813d240f0329fa1


filename: money.py


md5: e80bc60a63f437f01e30ad6414988d65


filename: time.py


md5: 91ff771b1f48c809167a37862b14f070


filename: update.py


md5: 83105bbdfb9b25c0abf68a3ca5401801


filename: upload.py


md5: de2a195f2ff18433ccfd0f1d9dae07ef


Donut Loader


VenomRAT


AsyncRAT


XWorm v3


XWorm v4


PureLogs Stealer C2


com.vdd.weddebum900k, sha1: 610e5002a8f2b13a7be41b04b81e75b280fcfc5d sha256: 775f7b2ce1861a3ef59f002ccaff76f5e864e2a7125d935281847e5fbf6b5c0b


com.vdd.weddebum900k, md5: 8374fa3dc2333aafb74a9fbc29ef82b0 sha256: 775f7b2ce1861a3ef59f002ccaff76f5e864e2a7125d935281847e5fbf6b5c0b


com.vdd.weddebum900k, md5: 8374fa3dc2333aafb74a9fbc29ef82b0 sha1: 610e5002a8f2b13a7be41b04b81e75b280fcfc5d


com.app.vmccc200ks, sha1: 9629fa835ca107a83853b8d42b9a19c334b0f8d1 sha256: cf4e485ae895d0d65d2d4f051fb8cd577c7be162e53e178e1413e5682fd31a5f


com.app.vmccc200ks, md5: 3d8f213722634379b1102edc4dee1932 sha256: cf4e485ae895d0d65d2d4f051fb8cd577c7be162e53e178e1413e5682fd31a5f


com.app.vmccc200ks, md5: 3d8f213722634379b1102edc4dee1932 sha1: 9629fa835ca107a83853b8d42b9a19c334b0f8d1


com.app.hzdeal499k, sha1: e676f1eed27a481dd3eee65443fbb35b375e340b sha256: 9f69baf63c0e3a062d5e2fef4c6c4e1f0c7aa4a86f71075803964b6c545a49cc