2023-10-17T00:00:00Z / 2023-11-16T00:00:00Z


2023-12-20T00:00:00Z / 2024-01-29T00:00:00Z


2023-11-15T00:00:00Z / 2023-12-21T00:00:00Z


2023-12-13T00:00:00Z / 2024-01-20T00:00:00Z


2023-12-07T00:00:00Z / 2024-01-14T00:00:00Z


2023-12-01T00:00:00Z / 2024-01-21T00:00:00Z


2023-12-21T00:00:00Z / 2024-01-20T00:00:00Z


2023-11-06T00:00:00Z / 2023-12-09T00:00:00Z


2023-10-28T00:00:00Z / 2023-12-05T00:00:00Z


2023-10-24T00:00:00Z / 2023-12-02T00:00:00Z


2023-10-01T00:00:00Z / 2023-12-21T00:00:00Z


2023-11-06T00:00:00Z / 2023-12-06T00:00:00Z


2023-12-20T00:00:00Z / 2024-01-19T00:00:00Z


2024-02-14T00:00:00Z / 2024-03-20T00:00:00Z


filename: iviewers.exe


md5: d1e6767900c85535f300e08d76aac9ab


sha1: 4a0f328e7672ee7ba83f265d48a6077a0c9068d4


sha256: 91f6547bceddfb2f241570ac82c00de700e311e4a38dea60d8619638f1ed3520


md5: 0d5abbe83e5eeb2cb79630caba3a33c7


sha1: d80427c922db5fcd8cf490a028915485ff833666


sha256: d663b323d132a3c811bb53a48a686ea85c6bf8faeef3b48dfa93528be8f4133b


filename: iviewers.exe.ui


md5: 977a7e48f8b05c12249a28dbc4054d78


sha1: 291bcceef6e03a9f4f0c524f1dd3a4b77d870cd8


sha256: 9a7a24b1c785b3c7c39f7e33e99897290165693dea1f46ed4f3c7919aef93928


md5: 4cdeffe8c379e6b702f2d22160c59ccf


sha1: f07272762b322cea1d8cc0845718371f1af0bd4a


sha256: 75fa71e65344b61a80f0e598349b735912be39d04a7e2159748423bd860d3454


md5: dacfc13d17cda55e58fab7d66d5417d1


sha1: 37d3665d3b803eeddfad245c0e96172b9c3e8a29


sha256: be852d7a59ba168d93eb975fbed652617046433e6fdc177d0087331f9a095f02


md5: 74a6c8bb6fb08c68d0ff4a6efad64242


sha1: 2c5d678948938de4d10095db35390c064305413c


sha256: 0acc25396ef78c00631c64df538678a323982115bafbfa7487a4370d4b4129ac


md5: cefbb71fd132df7fb913ec747080da7c


sha1: 6003f8042d375ec5c6d56a1d6e363e2d2cc9eb67


sha256: 859c823eb3e7420e0db234ba224764faa62d391bddd25e9ad415b11d853741f9


md5: ababde83c740651f014d9671d4dab557


filename: iviewers.exe.ui


sha1: 1fc7b986e55f116d92e77e3b2bee86b720ffa155


sha256: 9b9d2da73b510276d38d1698f3b87671958e338b40230e6a004ccaf3dcceb03b


md5: ad2d2126fe198b35a657804c7cbbf84f


sha1: 0b400eb4451c3148fa48bc72cb8a84fdcf4461d3


sha256: b4d71b0ac0bc1495789501f9afce6f950b601a36c0836534294640f2db6b2f40


md5: 654349edf1ac14dabce9bec435f06f98


sha1: 49d2e3dfabd21ed4a11c6fca6236ced7b17fa97e


sha256: 3a6a5b1d76dfcac5920e6e9163c08543304ba013425eb2c2e64071b15d26996e


md5: 113779c96c005ac50729462ec1b81f96


sha1: e6bd682c47f1a9d564f45a54427100b42e19d2e9


sha256: bdf8a8c7f0298484dc95895dbddf367689ca361618453597129343838b94debb


md5: 0b0b592ec201605503b4a245f024b37c


sha1: fc06519154e3a4b28fe16606dec05ec02dd2f647


sha256: 7c9336afd7530576b6a0f2e978b36955e8f264fee429d810309ce157a4918aaa


md5: 7266fb2e71fc97036ad642fb592d3444


sha1: ca7331e0c8dda90054eb941a2fdd0cc943a04fc4


filename: iviewers.exe.ui


sha256: c456747731141c2ea0f8e69f89193e8bb823da4667527fe90b614b97f1d425ae


md5: c5af1894f9806fafc6eae449a4021362


sha1: 61a382b2139512f8c816ceae93ec823c88bd6eed


sha256: 55d6c4a95b5172ea47381ab66ea9ea37fa0afb53b9bb10a1d752ac4acc8f6cd4


md5: 52692f03f7c14bc6a6bd35679beb7fab


sha1: 8e722b2c6b114b69bd71c37759dc3410a32b7594


sha256: 527df166af23cd0d139ebad9d219f125137b5a7b619fa50e5e245ccaf8c0b7d6


md5: b9a46c2960ddbece1a5fc4db1a810d92


sha1: 35e0cbec56e6ad052c3cf53a052b254490995453


sha256: 4965f809b71ffb71fe8456d88dcd0a80a99fa6aa4ffd6ba96e1a1d810d41bbd0


md5: 805fa6261f5fb268e56fd9f11fd13e01


sha1: 7dc223a47fa35011d9e5ed8ef0bbeaf7bd08500f


sha256: b5aa86fd97624a317945d110541a07fc80b83dd960fbf16642720fc275d8f04f


md5: f0293d80323383dcb494b12ceb313105


sha1: 0667f44b8dc20d0d1b8f1a5c2fe2f8011204664b


sha256: 9092cdd52109531f9f58c28bda25b0c3f82d9bd2d261ce5fcb0137873dbb0868


filename: iviewers.exe.ui


md5: 3e32bcdc16db8baf98065b29faeaa18d


sha1: 86a219232410f236665c51854425fbe5e37b07b3


sha256: bcbc3184756a6cacfd5ca2b879708cfd015e84050c9b9ede096cfb70282f870c


md5: 5312ba28ce0105cf4563279508bf83fa


sha1: 3faf065a9987ade102f20dd1ac6b857c7c191b97


sha256: febe116a87860e42bbcfd7c6e2c710446f33bdacc56e990f69493837c01f1059


md5: d8a1805843925a0394d64d1574b15388


sha1: 2b3b897dd7ef6a54bc038a9afc9d79d5989b6c5f


sha256: 7e118a6c4d6f162d8c6a53faf972bd3e675da7f9d0a0b67a1988b4e2102ebb53


md5: f26edb1d8a61d6bee6da5b5214cce77e


sha1: 44e2b73f6f5ec010681cb1fa5681ca0903f0a080


sha256: cc48a02f06066a37c90d063b6d28ae17d9503e4ba6df69aef1b55b5fa5a5ff48


md5: 9003d7c01c4f2b2e2632a86815eb40a2


sha1: ddb59cf25b40273ef0f394c6f164923b6872d7cf


sha256: 562974ea1325a88c916a55719fb9263eb6c710ba281fdee4ba7e9a98a3f4a5a8


filename: iviewers.dll


md5: ad9267c5c64390d1ed2d6cfa498b5339


sha1: 1f2e03650afbbd10b9cff21116b7b8d9b192cee3


sha256: 92b2535373e55b16b6f3b2d134a1d5545e837d3c19fff4cead4e92558e302b6e


md5: c5a873b83798a7ad21990eff4c90cb98


sha1: 3a5ea30f0ff6928a26c4e67352d0adf44dd978da


sha256: a9556cc05422cae960e36f76eeff7168b8e3cfeb16a20855a93d4f2ed4a65a8b


VELVETSTING (PMCD)


VELVETTAP (MCDP)


ESRDE


SAMRID


C&C


Cobalt Strike C2


XLSX


HTML


VBScript


Powershell


AutoHotKey script


Payload


DarkGate payload


installer.exe


com.ariashirazi.instabrowser / LMRA


com.npra.bahrain.five / LMRA Bahrain


com.lmra.nine.lmranine / LMRA


com.stich.inches / Visa Update


com.ariashirazi.instabrowser / EasyLoan


com.ariashirazi.instabrowser / BTC Flasher


com.ariashirazi.instabrowser / BenefitPay


com.lymors.lulumoney / BBK Loan App


LNK File


Loader Scripts


DLLs / MSI variants


@ Microsoft Azure


Initial download


LNK file @ Azure


PurpleInk


Network


filename: SoundP2.muc


md5: 2b7ba71d66acfabbc67099ea3b45560a


filename: Start.exe


md5: b8b6d0053cc3c7d9d58a19874b7807b1


C&C Server


Smoke C2


MD5s / Malware disguised as cracked software (oinstall.exe)


MD5s / Downloader (software_reporter_tool.exe)


MD5s / 3Proxy Dropper (dwm.exe)


MD5s / 3Proxy (dwm.exe)


MD5s / Orcus RAT (dwm.exe)


MD5s / PureCrypter (dwm.exe)


MD5s / AntiAV (dwm.exe)


MD5s / XMRig (InstallUtil.exe)


MD5s / XMRig encoded


MD5s / XMRig decoded


C&Cs / PureCrypter


C&Cs / Orcus RAT


C&Cs / XMRig


Download / Malware disguised as cracked software


Download / PowerShell commands encoded in Base64


AsukaStealer


Coinminer


MD5s / Nestdoor TigerRAT attack case (psfile.exe)


MD5s / Nestdoor Recent attack case (nest.exe)


MD5s / Nestdoor OpenVPN attack case (openvpnsvc.exe)


MD5s / Nestdoor launcher (FirewallAPI.dll)


MD5s / Dora RAT dropper (spsvc.exe)


MD5s / Dora RAT dropper (emaupdate.exe)


MD5s / Dora RAT injector (version.dll)


MD5s / Dora RAT (emaupdate.exe)


MD5s / Dora RAT (msload.exe)


MD5s / Dora RAT (emagent.exe)


MD5s / Keylogger/Cliplogger (conhosts.exe)


MD5s / Stealer (msload.exe)


C&Cs / Nestdoor Recent attack case


C&Cs / Nestdoor TigerRAT attack case


C&Cs / Nestdoor OpenVPN attack case


C&Cs / Dora RAT


RAR archive, filename: Заборгованість по ЖКП.rar


Заборгованість по ЖКП.rar

RAR archive, sha256: a0a294f85c8a19be048ffcc05ede6fd5a7ac5e2f0032a3ca0050dc1ae960c314


COOKBOX Sample (contained in RAR archive), filename: Рахунок на оплату.pdf
                                                                                .cmd


Рахунок на оплату.pdf
                                                                                .cmd

COOKBOX Sample (contained in RAR archive), sha256: 0cca8f795c7a81d33d36d5204fcd9bc73bdc2af7de315c1449cbc3551ef4fb59


Benign Word Document with Tracking Link (contained in RAR archive), filename: Реструктуризація боргу за житлово комунальні послуги.docx


Реструктуризація боргу за житлово комунальні послуги.docx

Benign Word Document with Tracking Link (contained in RAR archive), sha256: 915721b94e3dffa6cef3664532b586be6cf989fec923b26c62fdaf201ee81d2c


Benign Word Document with Tracking Link (contained in RAR archive), filename: Угода користувача.docx


Угода користувача.docx

Benign Word Document with Tracking Link (contained in RAR archive), sha256: 79a9740f5e5ea4aa2157d9d96df34ee49a32e2d386fe55fedfd1aa33e151c06d


Random Binary Data (contained in RAR archive), filename: Рахунок на оплату.pdf


Рахунок на оплату.pdf

Random Binary Data (contained in RAR archive), sha256: 19e25456c2996ded3e29577b609de54a2bef90dad8f868cdad795c18df05a79b


Random Binary Data (contained in RAR archive), filename: Заборгованість по ЖКП станом на 26.04.24.docx


Заборгованість по ЖКП станом на 26.04.24.docx

Random Binary Data (contained in RAR archive), sha256: e0d65e2d36afd3db1b603f10e0488cee3f58ade24d8abc6bee240314d8696708


Phishing page


Worker that fetches malicious RAR file


Dummy payload


Tracking link


COOKBOX C2


script


File


Stage 0 Exploit


Control servers


Stage1 Dropper, downloader


Bash script unxored


Ddss – decryption binary


Stage 2 Updater, Orchestrator


update-file


update.plist


The Core (C40F0D27 file)


C40F0D27 XOR-decoded


WifiList


LanDevices


CameraShot


FileManage


AudioRecorder


KeyChains


ScreenRecorder


ProcessAndApp


BrowserHistory


ShellCommand


filename: 0x.txt


md5: d2e9de8671fd61605ff5f8b8f3249d6b


a.txt


s.txt


z.txt


Compromised Wordpress Site hosting Fake Browser Update


BitRat C2


Possible Malicious Endpoint


Malicious Endpoint


Likely Malicious Endpoint


DLL loader, Shellcode in a separate file / XLoader


EXE loader, Shellcode in a separate file / XLoader


Shellcode is embedded in the DLL / XLoader


EXE Loader, Shellcode in resources / Remcos


Payload is RC4-encrypted / XLoader


EXE loader, Shellcode in a separate file / Agent Tesla


EXE loader, Shellcode in a separate file / 404 Keylogger


EXE loader, Shellcode in a separate file / Formbook


EXE loader, Shellcode in a separate file / Lokibot


DLL loader, Shellcode in a separate file / Warzone


EXE loader, Shellcode in a separate file / Azorult


filename: putty.exe (drops SplitLoader)


sha256: f59035192098e44b86c4648a0de4078edbe80352260276f4755d15d354f5fc58


sha256: cb97ec024c04150ad419d1af2d1eb66b5c48ab5f345409d9d791db574981a3fb


filename: [random].dat (SplitLoader)


sha256: 39d7407e76080ec5d838c8ebca5182f3ac4a5f416ff7bda9cbc4efffd78b4ff5


filename: Package.db, thumbs.db (YouieLoad via npm)


Package.db, thumbs.db (YouieLoad via npm)

sha256: 70c5b64589277ace59db86d19d846a9236214b48aacabbaf880f2b6355ab5260


filename: adb.bin, u.bin, Id.bin
(YouieLoad)


sha256: cafaa7bc3277711509dc0800ed53b82f645e86c195e85fbf34430bbc75c39c24


filename: data.tmp (YouieLoad)


sha256: 9863173e0a45318f776e36b1a8529380362af8f3e73a2b4875e30d31ad7bd3c1


filename: delfi-tank-unity.exe


sha256: f66122a3e1eaa7dcb7c13838037573dace4e5a1c474a23006417274c0c8608be


filename: DeTankWar.exe


sha256: 56554117d96d12bd3504ebef2a8f28e790dd1fe583c33ad58ccbf614313ead8c


sha256: ecce739b556f26de07adbfc660a958ba2dca432f70a8c4dd01466141a6551146


filename: NVUnityPlugin.dll, Unityplayer.dll (YouieLoad via tank game)


NVUnityPlugin.dll, Unityplayer.dll (YouieLoad via tank game)

sha256: 09d152aa2b6261e3b0a1d1c19fa8032f215932186829cfcca954cc5e84a6cc38


08 CITACION DEMANDA.zip


08 CITACION DEMANDA.exe


cutcherry.vcf


Register.dll


Malicious LNK (NotaFiscal.pdf.lnk)


BPyCode launcher (c.cmd)


BPyCode launcher (a3.cmd)


BPyCode


BPyCode persistence (C:\Users\Public\<filename>.txt)


ExecutorLoader (executor.dll)


ExecutorLoader (Execute_dll.exe)


UPX-packed AllaSenha


UPX-unpacked AllaSenha


AllaSenha


Phishing root


Possibly malicious and/or associated


com.appandutilitytools.fileqrutility


N/A(hanihani)


com.nfctnofxy.tmzcwkcjd


com.ultimatefilesviewer.filemanagerwithpdfsupport


SynapseCrypter.exe


SynapseCrypter.exe Demonstration Variant


Free Space Wiper executable, embedded in SynapseCrypter.exe


Sends report about execution and encryption


Embargo Ransomware (Windows)


Embargo Ransomware (ESXi)


Embargo Ranosmware (Linux)


Iluria Stealer


Similar Malware


Loader


Encrypted payload


Decrypted payload


Gh0st RAT


Address Overlaps


SSL/TLS Certificate Overlaps/Pivoting


Медичні_Аналізи_від_20.05.2024.scr, sha256: 10a6c318be4f1a2f56eedd855e7e5fd4a883a17022b933cd58fa73c184363019


Медичні_Аналізи_від_20.05.2024.scr, md5: a46317e7c238be03b317840d7c0e3636


sha256: 57162522bdf6cab0c596672a0e21ecdbdbf9c967b77848f9a25f3e5be3291be1 filename: image.jpg


md5: 0d2968cf9bb938bad91d59bec617ef28 filename: image.jpg


md5: 0d2968cf9bb938bad91d59bec617ef28 sha256: 57162522bdf6cab0c596672a0e21ecdbdbf9c967b77848f9a25f3e5be3291be1


sha256: 30e5f5b2ec76b99e3ac5fbbb8e484047cefe7a04b39f8e31b60c6b1e86f349e4 filename: data.zip


md5: a5c49a5691a0a30f76d2d140fdc377af filename: data.zip


md5: a5c49a5691a0a30f76d2d140fdc377af sha256: 30e5f5b2ec76b99e3ac5fbbb8e484047cefe7a04b39f8e31b60c6b1e86f349e4


sha256: dee0e820c2582badd477ccfbe197d6a5803b86b0c1b25503449d9691b6f6166a filename: 7A99IAJSMFI8_2KGVBADXSI68_windows_x64.msi


md5: d2caf4d50fdf083cda1a5f781e4f1bdf filename: 7A99IAJSMFI8_2KGVBADXSI68_windows_x64.msi


md5: d2caf4d50fdf083cda1a5f781e4f1bdf sha256: dee0e820c2582badd477ccfbe197d6a5803b86b0c1b25503449d9691b6f6166a


sha256: 46337cb1cc51378858d5e47713b450c063f994c7909fcb010053a70cb9a592fe filename: info_statement_ID00000235135381.scr


md5: a027d7045c669e365d0ef01768223329 filename: info_statement_ID00000235135381.scr


md5: a027d7045c669e365d0ef01768223329 sha256: 46337cb1cc51378858d5e47713b450c063f994c7909fcb010053a70cb9a592fe


Document_ChaseStatement0003241353491 (1).scr, sha256: 690ce2375759e1c31998011265d31c063615413495cf3596beffe3c11dbaaf06


Document_ChaseStatement0003241353491 (1).scr, md5: 3c74cf1cc59462e98cfec647d42c5dca


sha256: f91a54d4e13e94c0e1b74b1b074a222ce50e258fc63dbbb9f2e651c9485771be filename: img00.jpg


md5: 65f9c3b459cdd5db1a8cad007ca12155 filename: img00.jpg


md5: 65f9c3b459cdd5db1a8cad007ca12155 sha256: f91a54d4e13e94c0e1b74b1b074a222ce50e258fc63dbbb9f2e651c9485771be


sha256: 987751d2052b4e04e619b431239f286a789a647c0b99cc702d402110bdcdf8a5 filename: data.zip


md5: f6a1ed6f81498ee3bdb3842c3f93ddea filename: data.zip


md5: f6a1ed6f81498ee3bdb3842c3f93ddea sha256: 987751d2052b4e04e619b431239f286a789a647c0b99cc702d402110bdcdf8a5


sha256: 9ff032282abcc4f82dbb71052033f7a5bfbc334dad0e6ddb65fecb8de30a1865 filename: DGEY39OGHDS0_1XLVGTIHXL1J4_windows_x64.msi


md5: a6205a0cf9bec9aa4753939dbe41ec0b filename: DGEY39OGHDS0_1XLVGTIHXL1J4_windows_x64.msi


md5: a6205a0cf9bec9aa4753939dbe41ec0b sha256: 9ff032282abcc4f82dbb71052033f7a5bfbc334dad0e6ddb65fecb8de30a1865


sha256: 5a223bf043e552e85f8fe91693221c34aafdfd2b3867e733f756f288a38410a1 filename: CCleaner1.zip


md5: 1c5d4add00c4170283d4d4f338ac8871 filename: CCleaner1.zip


md5: 1c5d4add00c4170283d4d4f338ac8871 sha256: 5a223bf043e552e85f8fe91693221c34aafdfd2b3867e733f756f288a38410a1


sha256: 1cb846e9cf851247ea3955f7c3a310bd87209eff37a031c0c072f1f05bd5c38b filename: 1SIQ42DK7TWCG_1IXOK8MU075KW_windows_x64.msi


md5: 70d376d638868eefb81ffdc480744bf1 filename: 1SIQ42DK7TWCG_1IXOK8MU075KW_windows_x64.msi


md5: 70d376d638868eefb81ffdc480744bf1 sha256: 1cb846e9cf851247ea3955f7c3a310bd87209eff37a031c0c072f1f05bd5c38b


sha256: dfcd0510f07ca6c2979c4953f6e88447fda360b6a4ff995fd1bb3dc9e0aa9edb filename: ImportantSecurityUpdate.vbs


md5: 7c18d18c4f933e4aa056e86e900adf5e filename: ImportantSecurityUpdate.vbs


md5: 7c18d18c4f933e4aa056e86e900adf5e sha256: dfcd0510f07ca6c2979c4953f6e88447fda360b6a4ff995fd1bb3dc9e0aa9edb


sha256: d60bc54742e1e4f49b2ae74080ef293150f38d7e6e624008ef53a7a8dc30d42a filename: BankOfAmerica_Statement_0543922.scr


md5: a3a28d0e8b567a2f485d7e3dce2e8fd4 filename: BankOfAmerica_Statement_0543922.scr


md5: a3a28d0e8b567a2f485d7e3dce2e8fd4 sha256: d60bc54742e1e4f49b2ae74080ef293150f38d7e6e624008ef53a7a8dc30d42a


sha256: 08d39909da1a5b36350493982cf05771445b7f63f11007642fd450cee07b7cde filename: ChaseOnline_Statement_ID034241356941.txt


md5: 8cb4012458d390b9a2866278473c696b filename: ChaseOnline_Statement_ID034241356941.txt


md5: 8cb4012458d390b9a2866278473c696b sha256: 08d39909da1a5b36350493982cf05771445b7f63f11007642fd450cee07b7cde


Lexical Analysis Software Ltd


fffmpeg.exe / Reaches


Dll2.dll / A “Hello World” test library bundled with the malicious installer


firefox_updater.exe / Found hosted on C2 over port 8000. Contains StealC InfoStealer


filename: JAVS.Viewer8.Setup_8.3.7.250-1.exe


sha256: fe408e2df48237b11cb724fa51b6d5e9c74c8f5d5b2955c22962095c7ed70b2c


Reaches, filename: fffmpeg.exe


Reaches, sha256: aace6f617ef7e2e877f3ba8fc8d82da9d9424507359bb7dcf6b81c889a755535


REDACTED ORG NAME remittance 05212024.html


sha256: 9a977571296ae1548c32df94be75eec2a414798bee7064b0bf44859e886a0cfa


domain: azure.microsoft.com


sha256: 4d30fd05c3bdac792e0a011892e2cad02818436484e81b6de6a02928149bc92d


domain: mp0.ignorelist.com


domain: mp0.ptsecurity.com


sha256: 31b21de71f2162e8da1be8483f3a5d019b0c817832bc11a9f307b6b36821ca54


domain: act0.microsoft.com


domain: dns.msftncsi.com


sha256: 18d4a3a92b24b2ad75115a44fe2727081316eca346499a4aa00aa13713cf00cb


sha256: 9a96c7b0595f628027c4f4caeece475ef742c420adf2fde8df934c6ce6481fb5


sha256: 07fe71b256c1c913b0f3e3fa67e53d21a3d1f499beb4e550597f5743797a77c4


domain: mvs05.zyns.com


sha256: e19dc185e99cfdc0c25f18fb34ffabff2a4877d6d5843e4c67c05ce182f9780e


domain: net-sensors.net


domain: dynamic-dns.net


sha256: 106436a4fafe00112b19b1374456c1746b988950b71d700680088d74494e4936


27.12.2023 / Sliver / C2: 31.184.204.42 7.12.2023 / Sliver / C2: 1.184.204.42


testvec.exe, sha1: c8ccf6e20cde537f3da64aebd1f80b144a4c8e0a sha256: 9a977571296ae1548c32df94be75eec2a414798bee7064b0bf44859e886a0cfa


testvec.exe, md5: 7e0c85852b2cd932626fcf284ca72978 sha256: 9a977571296ae1548c32df94be75eec2a414798bee7064b0bf44859e886a0cfa


testvec.exe, md5: 7e0c85852b2cd932626fcf284ca72978 sha1: c8ccf6e20cde537f3da64aebd1f80b144a4c8e0a


MaxPatrol SIEM Agent.exe, sha1: 2be016b6b0dd9d57f2985a6ad0df85f5538d9623 sha256: 4d30fd05c3bdac792e0a011892e2cad02818436484e81b6de6a02928149bc92d


MaxPatrol SIEM Agent.exe, md5: 2c016c91181d4182a16845725bf0b315 sha256: 4d30fd05c3bdac792e0a011892e2cad02818436484e81b6de6a02928149bc92d


MaxPatrol SIEM Agent.exe, md5: 2c016c91181d4182a16845725bf0b315 sha1: 2be016b6b0dd9d57f2985a6ad0df85f5538d9623


Microsoft.exe, sha1: 5ebf1dbcd5e16bcd4695777a7931ff4dc13d586a sha256: e27d1bab901c1bb414d0849c5c132faa8c7c6a61357d9627a7d2785270034793


Microsoft.exe, md5: 4479cc492fa443af1461ebd768dcd1c3 sha256: e27d1bab901c1bb414d0849c5c132faa8c7c6a61357d9627a7d2785270034793


Microsoft.exe, md5: 4479cc492fa443af1461ebd768dcd1c3 sha1: 5ebf1dbcd5e16bcd4695777a7931ff4dc13d586a


sha1: c0fd9928b1755c047529a0b91517882bf74bc5e4 sha256: 31b21de71f2162e8da1be8483f3a5d019b0c817832bc11a9f307b6b36821ca54


md5: ef6c7eb5518d58bc0b921d37265b0db4 sha256: 31b21de71f2162e8da1be8483f3a5d019b0c817832bc11a9f307b6b36821ca54


md5: ef6c7eb5518d58bc0b921d37265b0db4 sha1: c0fd9928b1755c047529a0b91517882bf74bc5e4


sha1: c4ef4c518c44eda803200b8f9d080c0f1ff3ed15 sha256: 18d4a3a92b24b2ad75115a44fe2727081316eca346499a4aa00aa13713cf00cb


md5: 3dc4391eb6170c26336938839246022f sha256: 18d4a3a92b24b2ad75115a44fe2727081316eca346499a4aa00aa13713cf00cb


md5: 3dc4391eb6170c26336938839246022f sha1: c4ef4c518c44eda803200b8f9d080c0f1ff3ed15


sha1: b1fceda9a56d17fd1520105a6d52fdf868c4cead sha256: 9a96c7b0595f628027c4f4caeece475ef742c420adf2fde8df934c6ce6481fb5


md5: 321e4b64bcedc76a89cca86853d30c09 sha256: 9a96c7b0595f628027c4f4caeece475ef742c420adf2fde8df934c6ce6481fb5


md5: 321e4b64bcedc76a89cca86853d30c09 sha1: b1fceda9a56d17fd1520105a6d52fdf868c4cead


NtpService.exe, sha1: dc76c7586e1946ac120111d3a35937526a7cf140 sha256: d9a8151aff9d1c061826a9812ed9a6600805c74a519df333513fd4a79d2d4e61


NtpService.exe, md5: 9200c356b485ca61ec88258f0800657a sha256: d9a8151aff9d1c061826a9812ed9a6600805c74a519df333513fd4a79d2d4e61


NtpService.exe, md5: 9200c356b485ca61ec88258f0800657a sha1: dc76c7586e1946ac120111d3a35937526a7cf140


Apache ActiveMQ.exe, sha1: 6f30131181d81129c2f59d050214f47a6eedabbe sha256: 07fe71b256c1c913b0f3e3fa67e53d21a3d1f499beb4e550597f5743797a77c4


Apache ActiveMQ.exe, md5: b8932033b53ca08967100c58e12126be sha256: 07fe71b256c1c913b0f3e3fa67e53d21a3d1f499beb4e550597f5743797a77c4


Apache ActiveMQ.exe, md5: b8932033b53ca08967100c58e12126be sha1: 6f30131181d81129c2f59d050214f47a6eedabbe


AccSrvX64__STABLE__2016-11-10.exe, sha1: fc5936e0e290f2f41a46eb14c05500a4236ac0c7 sha256: 1b8b4be020d3350d025c7a245eb0d7166ff2c329dc92af175ef0499cba583071


AccSrvX64__STABLE__2016-11-10.exe, md5: 8d6e4cd33145ae084aa184fd0875c8f6 sha256: 1b8b4be020d3350d025c7a245eb0d7166ff2c329dc92af175ef0499cba583071


AccSrvX64__STABLE__2016-11-10.exe, md5: 8d6e4cd33145ae084aa184fd0875c8f6 sha1: fc5936e0e290f2f41a46eb14c05500a4236ac0c7


R_TARIF.VIEWS_X86.EXE, sha1: 83c8168f7706148a6f28145872a7f3bf01037239 sha256: a03e2ca143e867a99e2bc73bd4e5c2dd078a9f671aa0a4ce9611a8bc39a769e2


R_TARIF.VIEWS_X86.EXE, md5: e908da6041ae249f478bb22ac05e4b18 sha256: a03e2ca143e867a99e2bc73bd4e5c2dd078a9f671aa0a4ce9611a8bc39a769e2


R_TARIF.VIEWS_X86.EXE, md5: e908da6041ae249f478bb22ac05e4b18 sha1: 83c8168f7706148a6f28145872a7f3bf01037239


NPipeX64_32.dll, sha1: b3a6f0d8daf0347f56e95bf56cb60a7ea6f711cb sha256: e19dc185e99cfdc0c25f18fb34ffabff2a4877d6d5843e4c67c05ce182f9780e


NPipeX64_32.dll, md5: 10be9ca61ef86589951ddcfddc3d9672 sha256: e19dc185e99cfdc0c25f18fb34ffabff2a4877d6d5843e4c67c05ce182f9780e


NPipeX64_32.dll, md5: 10be9ca61ef86589951ddcfddc3d9672 sha1: b3a6f0d8daf0347f56e95bf56cb60a7ea6f711cb


r_tarif.dll2Qur, sha1: 54984e656f2bf1ed874b8b281d5abacdd517e51b sha256: 106436a4fafe00112b19b1374456c1746b988950b71d700680088d74494e4936


r_tarif.dll2Qur, md5: 914f932feb7e08f3e0396e40b8ea46e7 sha256: 106436a4fafe00112b19b1374456c1746b988950b71d700680088d74494e4936


r_tarif.dll2Qur, md5: 914f932feb7e08f3e0396e40b8ea46e7 sha1: 54984e656f2bf1ed874b8b281d5abacdd517e51b


systemd-inputd, sha1: 06335756b2a9afcf4147af25b06e30f63e5d52b9 sha256: bca6da159bbf6af3ba6adfdb4f1da0e855c6ed2ac9076c98bcc702169dbeab40


systemd-inputd, md5: c89d431abb6b5cc28c86196fbf898684 sha256: bca6da159bbf6af3ba6adfdb4f1da0e855c6ed2ac9076c98bcc702169dbeab40


systemd-inputd, md5: c89d431abb6b5cc28c86196fbf898684 sha1: 06335756b2a9afcf4147af25b06e30f63e5d52b9


sha1: a1790420cb2f546a79ddaeefacfd3b3a3b781e7c sha256: 9d9097e76b04b8e4e53e366a215a6debd8ada6efd0102694bf518da373d25e82


md5: 2a9137f615fa56f9ae11fa7c17963dad sha256: 9d9097e76b04b8e4e53e366a215a6debd8ada6efd0102694bf518da373d25e82


md5: 2a9137f615fa56f9ae11fa7c17963dad sha1: a1790420cb2f546a79ddaeefacfd3b3a3b781e7c


salt-slave, sha1: be428ac644a1cd1173f9c2a8b5db3c5fb38f795b sha256: 299a7888e960b7be5b7dc75e3a4bfd0c38f0f0e7313b630dcca62b6093794535


salt-slave, md5: 485ad3a834d81e63be6c03e94371c007 sha256: 299a7888e960b7be5b7dc75e3a4bfd0c38f0f0e7313b630dcca62b6093794535


salt-slave, md5: 485ad3a834d81e63be6c03e94371c007 sha1: be428ac644a1cd1173f9c2a8b5db3c5fb38f795b


snapmount, sha1: ee7ce10b16d4052cf15c897d98a9e286ab63c30b sha256: 75bf7d3aae0ed409c2c7e4f9b15e49d2f8dac6f9ecc27219d837e806894fe2a0


snapmount, md5: 5e672d6d5c2fc6190bd670409b987dfd sha256: 75bf7d3aae0ed409c2c7e4f9b15e49d2f8dac6f9ecc27219d837e806894fe2a0


snapmount, md5: 5e672d6d5c2fc6190bd670409b987dfd sha1: ee7ce10b16d4052cf15c897d98a9e286ab63c30b


plymouthd, sha1: cb883f4ea73eef125d9ba2b945ed1797a679ca7e sha256: 8184a41a1275751c018a7433f1a48a8eb2f271d8f8fef98a90b70926f2755754


plymouthd, md5: 04fcea4bf75070e47f5f3e7e6958995f sha256: 8184a41a1275751c018a7433f1a48a8eb2f271d8f8fef98a90b70926f2755754


plymouthd, md5: 04fcea4bf75070e47f5f3e7e6958995f sha1: cb883f4ea73eef125d9ba2b945ed1797a679ca7e


crond, sha1: c3669cc6fcc8a4eed8c3cad540a8f5402e4ddb79 sha256: 83a29477939ba8e70f8f401da1fefbaad17b155c194c35a2b328530038b3539b


crond, md5: b28b70b981a3b8e98874d23b24fc7dbd sha256: 83a29477939ba8e70f8f401da1fefbaad17b155c194c35a2b328530038b3539b


crond, md5: b28b70b981a3b8e98874d23b24fc7dbd sha1: c3669cc6fcc8a4eed8c3cad540a8f5402e4ddb79


mysqlrestore, sha1: b7724bfa0041c0ae9882d880669751e290f6e88e sha256: e67c5731bed1e4d8c7947a6f474a161237ca9d795f8e86927b2faf1a17c94a79


mysqlrestore, md5: 15ebf623c05744403a163bd958522511 sha256: e67c5731bed1e4d8c7947a6f474a161237ca9d795f8e86927b2faf1a17c94a79


mysqlrestore, md5: 15ebf623c05744403a163bd958522511 sha1: b7724bfa0041c0ae9882d880669751e290f6e88e


sha1: e46c422e5336c499b852ca77b4ab97b2607e54bf sha256: 04241c476f7ff0b86987dbc74f7f236d1bd1fcc05896ad704bd8c152920e2ee9


md5: bf27f6608cea8343c287b355244762e9 sha256: 04241c476f7ff0b86987dbc74f7f236d1bd1fcc05896ad704bd8c152920e2ee9


md5: bf27f6608cea8343c287b355244762e9 sha1: e46c422e5336c499b852ca77b4ab97b2607e54bf


dtmf, sha1: 24e7b9e904e90bfc9a9aadd8e347512ccbc895f6 sha256: 2c726b0bee65f2290c233f84139baf9dfee736d46978f42fcf8033215c1ccd19


dtmf, md5: bc0200af1ac2e44cdeefcb9907f4d1d3 sha256: 2c726b0bee65f2290c233f84139baf9dfee736d46978f42fcf8033215c1ccd19


dtmf, md5: bc0200af1ac2e44cdeefcb9907f4d1d3 sha1: 24e7b9e904e90bfc9a9aadd8e347512ccbc895f6


atd, sha1: dd053b9cb14429cd4eec1b36e1a87f0a47289193 sha256: 07dfb5b3e666400469fa451cdca5f29a346a5c9036e00c6587ef2b3b43631f10


atd, md5: adac1dc0ec3dcf28157ab09d35d0cfcc sha256: 07dfb5b3e666400469fa451cdca5f29a346a5c9036e00c6587ef2b3b43631f10


atd, md5: adac1dc0ec3dcf28157ab09d35d0cfcc sha1: dd053b9cb14429cd4eec1b36e1a87f0a47289193


sha1: 3ab8a4e40f91febfdc2e6d69e162e3efc8b8b448 sha256: 5264dcb00fd0e7261f95173e44df2023d9842c61befd3a3e5a1677d187331576


md5: 5be93fc5c858c3474bbfbc2555843966 sha256: 5264dcb00fd0e7261f95173e44df2023d9842c61befd3a3e5a1677d187331576


md5: 5be93fc5c858c3474bbfbc2555843966 sha1: 3ab8a4e40f91febfdc2e6d69e162e3efc8b8b448


UPDATE.SH, sha1: a864cf53550d6daf38149d345d4563b65dd8580a sha256: e42e43e01e2ca96562fa67e58a4d539fcaf50054e631dd259351f95c69672288


UPDATE.SH, md5: 885fa41b7e8e7d033cd01ee2e224cca2 sha256: e42e43e01e2ca96562fa67e58a4d539fcaf50054e631dd259351f95c69672288


UPDATE.SH, md5: 885fa41b7e8e7d033cd01ee2e224cca2 sha1: a864cf53550d6daf38149d345d4563b65dd8580a


atd, sha1: 01e71387a3ab05d73caed5435a8437faa8b66198 sha256: 025d91fa1609138b30d9f95da41800aa5633913a8598ae54e95f0bc92cab2820


atd, md5: 9f29794effd56e4075bb9f6e28b14678 sha256: 025d91fa1609138b30d9f95da41800aa5633913a8598ae54e95f0bc92cab2820


atd, md5: 9f29794effd56e4075bb9f6e28b14678 sha1: 01e71387a3ab05d73caed5435a8437faa8b66198


atd, sha1: ac0fe4a4a400265a7d6a68a558443dfe77e0dfb4 sha256: d53fe08be9391ed668cdbcccecc4736e9d0e5dbc7cecbd32a7df21487d593232


atd, md5: f19890d3f004cb9ae23398a006e358f5 sha256: d53fe08be9391ed668cdbcccecc4736e9d0e5dbc7cecbd32a7df21487d593232


atd, md5: f19890d3f004cb9ae23398a006e358f5 sha1: ac0fe4a4a400265a7d6a68a558443dfe77e0dfb4


atd, sha1: 8107ca980e32c8c905aa86c81c20fe799181bef8 sha256: 9517212c7f840355ec02f71eb5e4ec87ae869d4b0a8bdd52331677433cca66bf


atd, md5: b8b11cfde33f285402ac17c50e89ce5e sha256: 9517212c7f840355ec02f71eb5e4ec87ae869d4b0a8bdd52331677433cca66bf


atd, md5: b8b11cfde33f285402ac17c50e89ce5e sha1: 8107ca980e32c8c905aa86c81c20fe799181bef8


dcrond, sha1: 286dc3e3a055e37f47ceef45cf0fa55a6ab10111 sha256: dd83e7b5788588d3a6b806ce0e5ad4acc0343c99548a342bfca9d54ea64625e3


dcrond, md5: 6f40bc303944be1e322dcf5c40e3cde8 sha256: dd83e7b5788588d3a6b806ce0e5ad4acc0343c99548a342bfca9d54ea64625e3


dcrond, md5: 6f40bc303944be1e322dcf5c40e3cde8 sha1: 286dc3e3a055e37f47ceef45cf0fa55a6ab10111


dcrond, sha1: b79b0fba2e698ef78747fb412cfbab3364fe3125 sha256: f11afd0d02e936e56aad7e5e86f3bc6781a1c67c4abb98fe7b3d831e8d67e312


dcrond, md5: 8816c53603205717e5f1269385841784 sha256: f11afd0d02e936e56aad7e5e86f3bc6781a1c67c4abb98fe7b3d831e8d67e312


dcrond, md5: 8816c53603205717e5f1269385841784 sha1: b79b0fba2e698ef78747fb412cfbab3364fe3125


TNTb, sha1: 506386147d393cef81019dda55ac85125914c6be sha256: 0eb2c98d14fce41db0ac9352484438fc40489d6f40c915b659ecc84342aa83a6


TNTb, md5: f09c0d5883a221d2e5f762480e946a78 sha256: 0eb2c98d14fce41db0ac9352484438fc40489d6f40c915b659ecc84342aa83a6


TNTb, md5: f09c0d5883a221d2e5f762480e946a78 sha1: 506386147d393cef81019dda55ac85125914c6be


sha1: 39a54217868490ce71d6d0eaf6b9b2a2d747b3ca sha256: 30617ff59db71da76e05828bf8eaf4c92553044bcf81870743cb35e1b482b1d8


md5: 5f721ea01a017832be0bc4ed60f73f9d sha256: 30617ff59db71da76e05828bf8eaf4c92553044bcf81870743cb35e1b482b1d8


md5: 5f721ea01a017832be0bc4ed60f73f9d sha1: 39a54217868490ce71d6d0eaf6b9b2a2d747b3ca


ucs-25.1.1034-debian10.tar, sha1: b86ac0e9c1d0ef17c9f7ec406d51d4b2ed08ff67 sha256: f1aa7cb84e515e6d4818531ecb6cf9241338c68ebcb93e181ab9dfebb6be9123


ucs-25.1.1034-debian10.tar, md5: 6f18d4f75e0cb13dbb868ce7c6fe8ab8 sha256: f1aa7cb84e515e6d4818531ecb6cf9241338c68ebcb93e181ab9dfebb6be9123


ucs-25.1.1034-debian10.tar, md5: 6f18d4f75e0cb13dbb868ce7c6fe8ab8 sha1: b86ac0e9c1d0ef17c9f7ec406d51d4b2ed08ff67


crond, sha1: b0827b53e4d2a3d53f3ab467157f17377a243eaf sha256: 30fd37421f35748b2adb1a45e71e77c38c4b4ebb6854112520bc27726a5d4424


crond, md5: 639826f50120006342e23a409ff6fa70 sha256: 30fd37421f35748b2adb1a45e71e77c38c4b4ebb6854112520bc27726a5d4424


crond, md5: 639826f50120006342e23a409ff6fa70 sha1: b0827b53e4d2a3d53f3ab467157f17377a243eaf


nmbtrapd, sha1: 98c4d06e1c09907c3a4734668fef1ccd2a5ffcbb sha256: 5ab7025a477fba68821be7cd3b425b74a5adcccbddbfe90dbce9bbb028cca4c4


nmbtrapd, md5: 250af8e186b4d72b70036f090e9aee25 sha256: 5ab7025a477fba68821be7cd3b425b74a5adcccbddbfe90dbce9bbb028cca4c4


nmbtrapd, md5: 250af8e186b4d72b70036f090e9aee25 sha1: 98c4d06e1c09907c3a4734668fef1ccd2a5ffcbb


nmbd, sha1: eaf5fc2f0d9a84ff77008f805be4025df1085c20 sha256: 66b7ce1c90ade1556469c4b9ef868bc6da2faea63987fbbfa4fa320723760a4e


nmbd, md5: 67aee8a9d41240c462ee7d7023977d84 sha256: 66b7ce1c90ade1556469c4b9ef868bc6da2faea63987fbbfa4fa320723760a4e


nmbd, md5: 67aee8a9d41240c462ee7d7023977d84 sha1: eaf5fc2f0d9a84ff77008f805be4025df1085c20


dtmf, sha1: 943918176f941b162d668ea9642ba63d51450ff9 sha256: cb1993e26580d51a6676890b87e4b3c9a2f8562815a291d9829988f00d616683


dtmf, md5: cd10a6c402c6ccc870afa0001409c27f sha256: cb1993e26580d51a6676890b87e4b3c9a2f8562815a291d9829988f00d616683


dtmf, md5: cd10a6c402c6ccc870afa0001409c27f sha1: 943918176f941b162d668ea9642ba63d51450ff9


sha1: 8f943b9f82892292162eb7964da3c9168df28116 sha256: d89671386dd794996e7fbf57645a6ab8d40dc5d0d634ca9deec235ae31f5c500


md5: 9fb96e93ba9962919b261ae7dfe2b120 sha256: d89671386dd794996e7fbf57645a6ab8d40dc5d0d634ca9deec235ae31f5c500


md5: 9fb96e93ba9962919b261ae7dfe2b120 sha1: 8f943b9f82892292162eb7964da3c9168df28116


nmbtrapd, sha1: f4c1f2882e20792463638cb75c4bb64e7aaf0401 sha256: e38dcc222f770a4d11be0bd31b6d22f69a9f5bce8306c1c96390a0701647c1f3


nmbtrapd, md5: bc7b5aa2a7f1e178fa8997c8d76ef041 sha256: e38dcc222f770a4d11be0bd31b6d22f69a9f5bce8306c1c96390a0701647c1f3


nmbtrapd, md5: bc7b5aa2a7f1e178fa8997c8d76ef041 sha1: f4c1f2882e20792463638cb75c4bb64e7aaf0401


rpc_lan.so, sha1: 2c568ee8524a72cee2ae3002039f846988bea670 sha256: f466ecd2edc5481853f1e4613cf49dd5bd075e246436ad28b3558c2fd4069aca


rpc_lan.so, md5: 093f35facc67cee3a8c2cca8be8b2d6a sha256: f466ecd2edc5481853f1e4613cf49dd5bd075e246436ad28b3558c2fd4069aca


rpc_lan.so, md5: 093f35facc67cee3a8c2cca8be8b2d6a sha1: 2c568ee8524a72cee2ae3002039f846988bea670


nmbd, sha1: 50105c6e64ccf058d604cdcf9123ed8bf163c41b sha256: fd7298c3be42560f7a7e78903cc7ad5db3a14185eafc76a5bdac9bd2f2bf6bfc


nmbd, md5: b2538dbf30dc3acb95930394e0ff3498 sha256: fd7298c3be42560f7a7e78903cc7ad5db3a14185eafc76a5bdac9bd2f2bf6bfc


nmbd, md5: b2538dbf30dc3acb95930394e0ff3498 sha1: 50105c6e64ccf058d604cdcf9123ed8bf163c41b


aptitude-common, sha1: d7f31bbb9a7cbe911f5ae3253e650b1fa7cc4b4c sha256: b3538ce6d66a8a104f15a3431914da7214b54d1de2594f4ee536a6e7372ed664


aptitude-common, md5: 0e22f3587c519c1f0e4fc57a04d66edb sha256: b3538ce6d66a8a104f15a3431914da7214b54d1de2594f4ee536a6e7372ed664


aptitude-common, md5: 0e22f3587c519c1f0e4fc57a04d66edb sha1: d7f31bbb9a7cbe911f5ae3253e650b1fa7cc4b4c


UPDATE.SH, sha1: 226d3a29149e36690b50b93beabed4481b1a48e6 sha256: c67f28a2b85b0b242c2337f8717f9ddda13d471648ea56eccaaf92750b0da4dc


UPDATE.SH, md5: 537b8e319ef65435740b3e0c28722925 sha256: c67f28a2b85b0b242c2337f8717f9ddda13d471648ea56eccaaf92750b0da4dc


UPDATE.SH, md5: 537b8e319ef65435740b3e0c28722925 sha1: 226d3a29149e36690b50b93beabed4481b1a48e6


sha1: 15a6fdc79f0724d4c3b18742e5f1d73fc6839ac4 sha256: 6da74c7e2bf3d77ac2f2cfddd114d27d08d01c2131d05d36e9c54de1c2565b2b


md5: 4f2529e5be66a80e44acaeaa418b575c sha256: 6da74c7e2bf3d77ac2f2cfddd114d27d08d01c2131d05d36e9c54de1c2565b2b


md5: 4f2529e5be66a80e44acaeaa418b575c sha1: 15a6fdc79f0724d4c3b18742e5f1d73fc6839ac4


dcrond, sha1: 67006e298844b578cce9888c243640f7e1f2e7c7 sha256: 00625fe8a6573f1774bfd9d58ba4a73d2c6307126271aa9accda89cd4b7270a9


dcrond, md5: e35199eacd0bbc06cfb2c72e14f7a659 sha256: 00625fe8a6573f1774bfd9d58ba4a73d2c6307126271aa9accda89cd4b7270a9


dcrond, md5: e35199eacd0bbc06cfb2c72e14f7a659 sha1: 67006e298844b578cce9888c243640f7e1f2e7c7


dcrond, sha1: fb0f1226903dde243ef08c26ec0c5d7880e9c291 sha256: 7f55c71e064c000906afad1ff649d5c2d3fb6d61d7e84338c9ecf95b4958c7a4


dcrond, md5: 453833594493c5064eeff8210d571224 sha256: 7f55c71e064c000906afad1ff649d5c2d3fb6d61d7e84338c9ecf95b4958c7a4


dcrond, md5: 453833594493c5064eeff8210d571224 sha1: fb0f1226903dde243ef08c26ec0c5d7880e9c291


dcrond, sha1: 444a7b477e6f7bd0d9be7add79b3e0415566169c sha256: d59fcb3e138b9eea0d70a1127f7b9d927f381a133720cae0c4fd5fc803e4b9dd


dcrond, md5: f28c7c354b9e27e8908dd0b8dc7da01b sha256: d59fcb3e138b9eea0d70a1127f7b9d927f381a133720cae0c4fd5fc803e4b9dd


dcrond, md5: f28c7c354b9e27e8908dd0b8dc7da01b sha1: 444a7b477e6f7bd0d9be7add79b3e0415566169c


atd, sha1: 7c440e9421c26fe7b73ae8e213ef58b3b615ed6f sha256: 25ff8d416a4158c7401f6c23e040c592ff29855da83ea67340342a3dfacd99a5


atd, md5: 74ed22250182d13df4e1ad4b4f91d519 sha256: 25ff8d416a4158c7401f6c23e040c592ff29855da83ea67340342a3dfacd99a5


atd, md5: 74ed22250182d13df4e1ad4b4f91d519 sha1: 7c440e9421c26fe7b73ae8e213ef58b3b615ed6f


atd, sha1: 27fedf90846efe5357e11c53d87612fbf6c421d4 sha256: 82746a68612661c699ff2998502c9a252d52f76284a6c623d5c7f45d97dcefba


atd, md5: 6218ad1e81b1cd9364bbe0059b99bc9a sha256: 82746a68612661c699ff2998502c9a252d52f76284a6c623d5c7f45d97dcefba


atd, md5: 6218ad1e81b1cd9364bbe0059b99bc9a sha1: 27fedf90846efe5357e11c53d87612fbf6c421d4


atd, sha1: 2ba1a6808db393296a08968c220b193fae42c21b sha256: ee8dd2626a4465f49f6d4aaf3b6d3735ca938e5e289304ba0664e4c9fb957672


atd, md5: e1a93ced3a55b34a54b5ac0dd095da59 sha256: ee8dd2626a4465f49f6d4aaf3b6d3735ca938e5e289304ba0664e4c9fb957672


atd, md5: e1a93ced3a55b34a54b5ac0dd095da59 sha1: 2ba1a6808db393296a08968c220b193fae42c21b


smartmond, sha1: 2b1b5b4c7f9d4a963b0ec92a5eb2e28cb6cdc0b7 sha256: ae6c7656a973c797ad8c3a344da99fbca8452c471d26900a2300364ddeb959b9


smartmond, md5: d80b3ff086aed177bb87c317188b92c2 sha256: ae6c7656a973c797ad8c3a344da99fbca8452c471d26900a2300364ddeb959b9


smartmond, md5: d80b3ff086aed177bb87c317188b92c2 sha1: 2b1b5b4c7f9d4a963b0ec92a5eb2e28cb6cdc0b7


dcrond, sha1: 4450d904f695dd51eaea24e4e449707707c7852e sha256: b21e9a3581497eafbd92a45b670b9e6f18aa09f8375ed8ebb03a199d531b2d39


dcrond, md5: cc7a6656832b6929722b1c38cc14b550 sha256: b21e9a3581497eafbd92a45b670b9e6f18aa09f8375ed8ebb03a199d531b2d39


dcrond, md5: cc7a6656832b6929722b1c38cc14b550 sha1: 4450d904f695dd51eaea24e4e449707707c7852e


atd, sha1: e3ce85ababbc7b8b4291551abb9f0928caeb2646 sha256: 121ab168fd3d59f83d127eb6a049e67ffdea9a3d4cdc6044f92116f4b1beb26d


atd, md5: b514157f9b8cbb08d476e838171050d8 sha256: 121ab168fd3d59f83d127eb6a049e67ffdea9a3d4cdc6044f92116f4b1beb26d


atd, md5: b514157f9b8cbb08d476e838171050d8 sha1: e3ce85ababbc7b8b4291551abb9f0928caeb2646


dcrond, sha1: 685ecfba19ad58f81acbb62a3fc9010128bf2000 sha256: 64af32f631c4ace6604ee84e2875c3393a54a0e8ad838a85833c086757d343fe


dcrond, md5: 33f3dd60e87aafd96adf62fcb5af725f sha256: 64af32f631c4ace6604ee84e2875c3393a54a0e8ad838a85833c086757d343fe


dcrond, md5: 33f3dd60e87aafd96adf62fcb5af725f sha1: 685ecfba19ad58f81acbb62a3fc9010128bf2000


atd, sha1: 8daf7589f2e417363e3cfbc714fc9b299f54a36e sha256: 834d7a3ccd82dd51ead09f18d9e466f6b5cb79d3054d12e3c3771e0477e0bc75


atd, md5: 5da97bbd438a030b0427a15c69af0037 sha256: 834d7a3ccd82dd51ead09f18d9e466f6b5cb79d3054d12e3c3771e0477e0bc75


atd, md5: 5da97bbd438a030b0427a15c69af0037 sha1: 8daf7589f2e417363e3cfbc714fc9b299f54a36e


dcrond, sha1: 26199b999facada1d6dafe78524321e575621d73 sha256: 33e9020a2d6e6604ac0abafaa9427738937a282d3e418723e4857519c9bf99bc


dcrond, md5: 84f2fa4d139ac10124f915584dda6476 sha256: 33e9020a2d6e6604ac0abafaa9427738937a282d3e418723e4857519c9bf99bc


dcrond, md5: 84f2fa4d139ac10124f915584dda6476 sha1: 26199b999facada1d6dafe78524321e575621d73


htop, sha1: 3ca21bde29ff0744edacd611d82b50d297bb447a sha256: 494c857b3abe11ab66024c605648dfeb23804d554e32b0411215d83b1bde4434


htop, md5: 6ee38226efedabbf794a37d0c972702c sha256: 494c857b3abe11ab66024c605648dfeb23804d554e32b0411215d83b1bde4434


htop, md5: 6ee38226efedabbf794a37d0c972702c sha1: 3ca21bde29ff0744edacd611d82b50d297bb447a


systemd-crgoupsd, sha1: 4811d92b307a2929b25b39638b35f3e5692f4451 sha256: 49cda974e0f9fdf1a99c76ab1f02c501cd720700efcc303e05dfb7d1e71f0d16


systemd-crgoupsd, md5: 26e10db16c4b00c9d4afa1d3f2c5f080 sha256: 49cda974e0f9fdf1a99c76ab1f02c501cd720700efcc303e05dfb7d1e71f0d16


systemd-crgoupsd, md5: 26e10db16c4b00c9d4afa1d3f2c5f080 sha1: 4811d92b307a2929b25b39638b35f3e5692f4451


AzimuthF.exe_, sha1: db3ea044e32773c12d67a49588f5a12aae09e257 sha256: 510da6d88ae4dd51d62796023a18b39db08a016ee4ee7178b1afdc91c58f9e1e


AzimuthF.exe_, md5: b0b2176187e24710ad9b4fbbb38573b1 sha256: 510da6d88ae4dd51d62796023a18b39db08a016ee4ee7178b1afdc91c58f9e1e


AzimuthF.exe_, md5: b0b2176187e24710ad9b4fbbb38573b1 sha1: db3ea044e32773c12d67a49588f5a12aae09e257


AzimuthF_2.exe_, sha1: 480c2a12dfc1900ab9bad635caf6c507a300623c sha256: 6cb2979aa1fddd42df2ba596f705ce9bbdb2ec246649218d598d779769857c21


AzimuthF_2.exe_, md5: fd13efb096377f8bbf8b754874c40262 sha256: 6cb2979aa1fddd42df2ba596f705ce9bbdb2ec246649218d598d779769857c21


AzimuthF_2.exe_, md5: fd13efb096377f8bbf8b754874c40262 sha1: 480c2a12dfc1900ab9bad635caf6c507a300623c


db-healthmon, sha1: ac469df608ef049708ba6efe72f4493ac20cdfd0 sha256: 1b7d26b2547ceb7f44dc9cabeb54d9c0c90b1ffb354dd1da711e269710f5d75c


db-healthmon, md5: 18417672efbe00f3ecdd700c442137fd sha256: 1b7d26b2547ceb7f44dc9cabeb54d9c0c90b1ffb354dd1da711e269710f5d75c


db-healthmon, md5: 18417672efbe00f3ecdd700c442137fd sha1: ac469df608ef049708ba6efe72f4493ac20cdfd0


mind-live_3.12.30+23.06.23.01.30.iso, sha1: 9206f83e69c53c4460a30cc4046e59f50e25a1ad sha256: 0d6d89023c7e4d72d8c68d5d7308eb2a58286a0ecc2ddcbe325d78f6b2149680


mind-live_3.12.30+23.06.23.01.30.iso, md5: 8a1834e81ffb4ded5b818db7db8e543b sha256: 0d6d89023c7e4d72d8c68d5d7308eb2a58286a0ecc2ddcbe325d78f6b2149680


mind-live_3.12.30+23.06.23.01.30.iso, md5: 8a1834e81ffb4ded5b818db7db8e543b sha1: 9206f83e69c53c4460a30cc4046e59f50e25a1ad


mind-live_3.12.30+23.06.23.01.50.iso, sha1: 1d3ab04ace6895b042beb2d7ccfcd6c6cf5e620c sha256: c620742a863ab20ad0f211bf0e7a1be0725f2682af96db15c1a0d610875dd613


mind-live_3.12.30+23.06.23.01.50.iso, md5: 6703e425619a766ab521109885b51248 sha256: c620742a863ab20ad0f211bf0e7a1be0725f2682af96db15c1a0d610875dd613


mind-live_3.12.30+23.06.23.01.50.iso, md5: 6703e425619a766ab521109885b51248 sha1: 1d3ab04ace6895b042beb2d7ccfcd6c6cf5e620c


Sample


Bulgaria None None AS204428 SS-Net


Bulgaria Sofia Sofia AS204428 SS-Net


Romania Timis Timisoara AS48874 HOSTMAZE INC SRL-D


The Netherlands Noord-Holland Amsterdam AS0


The Netherlands Noord-Holland Amsterdam AS206264 Amarutu Technology Ltd


The Netherlands Noord-Holland Amsterdam AS211760 Suisse Limited


The Netherlands Noord-Holland Amsterdam AS211760 Suisse Limit


Hashes: File Name: Weapon Type


Local File


work.docm / Malicious document


afd.exe / Python downloader


win_hta.zip / ZIP archive


win_service.zip / ZIP archive


win_service.exe / Windows version of GLOBSHELL


win_hta.exe / Windows version of GLOBSHELL


cinnamon-gui / Poseidon agent – Mythic


stg_1.sh / Obfuscated Shell Script downloader


Silverlining.sh / Sliver implant


swift_uzb.sh / Obfuscated Shell script USB file gatherer


boss_preempt / Poseidon agent – Mythic


bossload / Poseidon agent – Mythic


boss-gnu / Poseidon agent – Mythic


gnu-journal / Poseidon agent – Mythic


k_swap / Poseidon agent – Mythic


z_swap / Poseidon agent – Mythic


gnu-events / Poseidon agent – Mythic


nm_applet / GLOBSHELL


opentab / PYSHELLFOX (partial)


ziputils-help / Poseidon agent – Mythic


sample all ELF.rar / ZIP archive containing numerous malicious samples


bossconfig / Poseidon agent – Mythic


bosscache / Poseidon agent – Mythic


clamav_base / Poseidon agent – Mythic


notification-update / Poseidon agent – Mythic


Poseidon agent – Mythic


Minutes_Quarterly_Review_Meeting.zip / ZIP archive


Minutes Quarterly Review Meeting / Downloader (Aldndr.py)


AGs_BRANCH.iso / ISO image


AGS BRANCH.PDF / PDF lure


AGS BRANCH.DOC.LNK / Shortcut LNK file


service.exe / Python-based Telegram RAT (Nutika compiled)


your pics album.pdf.exe / Dropper


update_service.exe / Python-based Telegram RAT (Nutika compiled)


Pay statement.iso / ISO image


NODAL OFFICER FOR SPARSH (PBORS) RECORD OFFICEWISE.BAT - SHORTCUT.LNK / Shortcut LNK file


All details.html / HTML – Download script


NODAL OFFICER FOR SPARSH (PBORS) RECORD OFFICEWISE.PDF / PDF lure


NODAL OFFICER FOR SPARSH (PBORS) RECORD OFFICEWISE.BAT / Batch file


Minutes_of_meeting.zip / ZIP archive


Minutes of meeting of Secy(DP with chairman OFB and CMDs of DPSUs / Downloader (Aldndr.py)


13th september.zip Brief_on_UAE.zip / ZIP archive


Fwd Concept paper for enhancing Defense export.zip / ZIP archive


Concept_paper.zip / ZIP archive


MoD.zip / ZIP archive


Meeting Notice / Downloader (Aldndr.py)


Best Desert Camp in Jaisalmer.zip / ZIP archive


advisory toll fee for army personel / Downloader (Aldndr.py)


help-mod / Poseidon agent – Mythic


Best Desert Camp in Jaisalmer / Downloader (Aldndr.py)


DSOP_Fund_Nomination_Form / Downloader


Proforma for items for indigenisation / Downloader (Aldndr.py)


Meeting_Notice .zip / ZIP Archive


libexec-kworker / Poseidon agent – Mythic


libexec_pworker / Poseidon agent – Mythic


Air HQ PR Policy.iso / ISO image Reference


Air HQ PR Policy.lnk / Shortcut LNK file Reference


temp/.tmp.exe / Golang stealer Reference


temp/sample.pdf / PDF lure Reference


SU-30_Aircraft_Procurement.zip / ZIP archive Reference


SU-30 Aircraft Procurement.iso / ISO image Reference


Revised_NIC_Application.zip / ZIP archive


revised telephone directory / Downloader (Aldndr.py)


Revised_NIC_Application / Downloader (sample.py)


libfile-basedir / Poseidon agent – Mythic


dconf-dirmngr / Poseidon agent – Mythic


qml-gtk-rpc / Poseidon agent – Mythic


6dfe3eb1-sample / ISO image Reference


invitation-letter.lnk / Shortcut LNK file Reference


t/scholar.exe / Golang modified HackBrowserData Reference


t/invitation.pdf / PDF lure Reference


ibus-media-pack / Poseidon agent – Mythic


apci-common / GLOBSHELL


apci-filter / GLOBSHELL


certificate-bolt / PYSHELLFOX


dir-event-tools / GLOBSHELL


Python Telegram RAT C2 (Nutika Compiled)


PDF Lure


boss_preempt / Mythic / AS-CHOOPA


bossload / Mythic / AS-CHOOPA


boss-gnu / Mythic / AS-CHOOPA


gnu-journal / Mythic / AS-CHOOPA


k_swap / Mythic / AS-CHOOPA


z_swap / Mythic / AS-CHOOPA


bosstype / Mythic / AS-CHOOPA


Bosshelp / Mythic / AS-CHOOPA


bossstart / Mythic / AS-CHOOPA


cinnamon-gui / Mythic / AS-CHOOPA


gnu-events / Mythic / AS-CHOOPA


ziputils-help / Mythic / AS-CHOOPA


bossconfig / Mythic / AS-CHOOPA


bosscache / Mythic / AS-CHOOPA


clamav_base / Mythic / AS-CHOOPA


Mythic / AS-CHOOPA


notification-update / Mythic / AS-CHOOPA


help-mod / Mythic / AS-CHOOPA


libexec-kworker / Mythic / AS-CHOOPA


libexec_pworker / Mythic / AS-CHOOPA


libfile-basedir / Mythic / Kaopu Cloud HK Limited


dconf-dirmngr / Mythic / Kaopu Cloud HK Limited


qml-gtk-rpc / Mythic / Kaopu Cloud HK Limited


ibus-media-pack / Mythic / Kaopu Cloud HK Limited


Silverlining.sh / Silver / Phanes Networks B.V, sha256: 99bd4285e38413c3a961d70cfa6c8b5f8e4ae3b4c559af1d9f213e34d3b56976


Silverlining.sh / Silver / Phanes Networks B.V, ip: 45.148.120.192


Simple indicator of observable {93.95.225.137}


Simple indicator of observable {111.90.158.40}


Simple indicator of observable {online.yrnvtklot.com}


Simple indicator of observable {ftp.yrnvtklot.com}


Simple indicator of observable {download.yrnvtklot.com}


sha1: 792d5430ef2c60088fbc388714eb4aff63f5f593 sha256: 7c242a08ee2dfd5da8a4c6bc86231985e2c26c7b9931ad0b3ea4723e49ceb1c1


md5: 587b173ef971d242933e18f43c18256b sha256: 7c242a08ee2dfd5da8a4c6bc86231985e2c26c7b9931ad0b3ea4723e49ceb1c1


md5: 587b173ef971d242933e18f43c18256b sha1: 792d5430ef2c60088fbc388714eb4aff63f5f593


sha1: 4b851160b5f87dee9c526e36c0d7e0a28c6de0a9 sha256: cc4384510576131c126db3caca027c5d159d032d33ef90ef30db0daa2a0c4104


md5: b9e37dd582a6ff810672f9b33865c217 sha256: cc4384510576131c126db3caca027c5d159d032d33ef90ef30db0daa2a0c4104


md5: b9e37dd582a6ff810672f9b33865c217 sha1: 4b851160b5f87dee9c526e36c0d7e0a28c6de0a9


sha1: 8de84714fe4e0fc52c3ff988653b9c69e5753cb2 sha256: 6f3e913c93887a58e64da5070d96dc34d3265f456034446be89167584a0b347e


md5: 271520c83f847743aa6eaccd1b949797 sha256: 6f3e913c93887a58e64da5070d96dc34d3265f456034446be89167584a0b347e


md5: 271520c83f847743aa6eaccd1b949797 sha1: 8de84714fe4e0fc52c3ff988653b9c69e5753cb2


sha1: 9a77e7e641f1336b4b6fbe0dadb54ea4356212f1 sha256: aac7f8e174ba66d62620bd07613bac1947f996bb96b9627b42910a1db3d3e22b


md5: bf05392d1205ce66a45a1104fb67adf8 sha256: aac7f8e174ba66d62620bd07613bac1947f996bb96b9627b42910a1db3d3e22b


md5: bf05392d1205ce66a45a1104fb67adf8 sha1: 9a77e7e641f1336b4b6fbe0dadb54ea4356212f1


sha1: d25340ae8e92a6d29f599fef426a2bc1b5217299 sha256: 11bd2c9f9e2397c9a16e0990e4ed2cf0679498fe0fd418a3dfdac60b5c160ee5


md5: 0c0195c48b6b8582fa6f6373032118da sha256: 11bd2c9f9e2397c9a16e0990e4ed2cf0679498fe0fd418a3dfdac60b5c160ee5


md5: 0c0195c48b6b8582fa6f6373032118da sha1: d25340ae8e92a6d29f599fef426a2bc1b5217299


sha1: 993323c62dab609fd1d8f5876f604d9da861fb35 sha256: 786591953336594473d171e269c3617d7449876993b508daa9b96eedc12ea1ca


md5: cf66c76445f74b90be8914dfe06697cb sha256: 786591953336594473d171e269c3617d7449876993b508daa9b96eedc12ea1ca


md5: cf66c76445f74b90be8914dfe06697cb sha1: 993323c62dab609fd1d8f5876f604d9da861fb35


sha1: 41fce204948df6af1fe2f3f6dec02086678eab3b sha256: 35eb368c14ad25e3b1c58579ebaeae71bdd8ef7f9ccecfc00474aa066b32a03f


md5: bd877072c51ee58ec7aaf091bff0b80c sha256: 35eb368c14ad25e3b1c58579ebaeae71bdd8ef7f9ccecfc00474aa066b32a03f


md5: bd877072c51ee58ec7aaf091bff0b80c sha1: 41fce204948df6af1fe2f3f6dec02086678eab3b


sha1: 1c552f0ade7213e81c3aeb581faab24061f03485 sha256: 3b2724f3350cb5f017db361bd7aae49a8dbc6faa7506de6a4b8992ef3fd9d7ab


md5: f8f3a7faa13d6370b96d07d4d184357f sha256: 3b2724f3350cb5f017db361bd7aae49a8dbc6faa7506de6a4b8992ef3fd9d7ab


md5: f8f3a7faa13d6370b96d07d4d184357f sha1: 1c552f0ade7213e81c3aeb581faab24061f03485


sha1: d6dfce664ee28cdcf143da2ec71d2a0ff18c1280 sha256: 3ced0552b9ecf3dfecd14cbcc3a0d246b10595d5048d7f0d4690e26ecccc1150


md5: 4c8e4c5c0e150c210cd2014a84e39ec6 sha256: 3ced0552b9ecf3dfecd14cbcc3a0d246b10595d5048d7f0d4690e26ecccc1150


md5: 4c8e4c5c0e150c210cd2014a84e39ec6 sha1: d6dfce664ee28cdcf143da2ec71d2a0ff18c1280


sha1: 288daefd1ce65fb01011dc8a64491111207d3965 sha256: 2b33df9aff7cb99a782b252e8eb65ca49874a112986a1c49cd9971210597a8ae


md5: d7b749051da5fb4604f4141f19c47660 sha256: 2b33df9aff7cb99a782b252e8eb65ca49874a112986a1c49cd9971210597a8ae


md5: d7b749051da5fb4604f4141f19c47660 sha1: 288daefd1ce65fb01011dc8a64491111207d3965


sha1: 5d6b9e80e12bfc595d4d26f6afb099b3cb471dd4 sha256: 4b5229b3250c8c08b98cb710d6c056144271de099a57ae09f5d2097fc41bd4f1


md5: a179c4093d05a3e1ee73f6ff07f994aa sha256: 4b5229b3250c8c08b98cb710d6c056144271de099a57ae09f5d2097fc41bd4f1


md5: a179c4093d05a3e1ee73f6ff07f994aa sha1: 5d6b9e80e12bfc595d4d26f6afb099b3cb471dd4


sha1: 125982676af23e93fa58b31ef1bdb93725cb91c3 sha256: 2fe78941d74d35f721556697491a438bf3573094d7ac091b42e4f59ecbd25753


md5: 18957d83337a7f6a879d739be02b173e sha256: 2fe78941d74d35f721556697491a438bf3573094d7ac091b42e4f59ecbd25753


md5: 18957d83337a7f6a879d739be02b173e sha1: 125982676af23e93fa58b31ef1bdb93725cb91c3


Acrid


ScarletStealer


DustyExfilTool


Loader that uses xyz123xyz for AES decryption


Network Scanner


WPD USB monitor tool


SharpJSHandler, OneDrive variant


Net loader used by Ps2dllLoader


Stubbedoor


SharpJSHandler


SharpJSHandler DropBox variant


InsidiousGh0st .NET variant


SerialPktdoor loader


Xkeylog keylogger


Malicious C# script


Hid.dll loader


Hid Dropper


Eventlog info extractor


SerialPktDoor loader


Network scanner


InsidiousGh0st go variant


SharpZulip


Sample


Bulgaria None None AS204428 SS-Net


Bulgaria Sofia Sofia AS204428 SS-Net


Romania Timis Timisoara AS48874 HOSTMAZE INC SRL-D


The Netherlands Noord-Holland Amsterdam AS0


The Netherlands Noord-Holland Amsterdam AS206264 Amarutu Technology Ltd


The Netherlands Noord-Holland Amsterdam AS211760 Suisse Limited


The Netherlands Noord-Holland Amsterdam AS211760 Suisse Limit


WHITE / Second stage DoppelGänger


Zip Archive


filename: KZAH.exe
RFQ-101432620247flxslx.exe


sha256: b89d6be0bcfb915492beb7ae726f815dcf289a284e650c200bda4faf5db60fa1


filename: 4.exe (renamed)


sha256: 4c37f3db024afd425301666e318c03e34f8813d21d90d95efb4018b3196d07b8


filename: 20240416.xlsx


sha256: 5f0642383ca70a3fd2c4491b2826002763e90ca25a7413869fd824e7745d0465


filename: 3156.vbs


sha256: 59c49f31b5f389c1c0109b0e603e2679c4f63c3f5c64432e820a50f50b80124f


filename: i4703.vbs


sha256: 51d758fc04d05b997c651f658cdd30819ef5cf795d4498fad919e75a320e72ea


filename: i6050.vbs


sha256: 4cb1e5ca257c709154b38704c34f4f0ade5305263fb21e6142c90c10a5764d52


filename: 68904.tmp


sha256: 09fee43f923faaa30857a09c74d96fca9354653835165a01b274cad4c24460c7


filename: 97468.tmp


sha256: 590353941bab80f38d77b2139bc7da6888b3dff9c8817c4b7e058f50173288bf


filename: Tmp703.tmp


sha256: 9b9a3da9c602bf70a60cdb9b2bca6f4472222e8431b6b5ecf82b010fe274bba3


filename: Tmp912.tmp


sha256: f96631cdffa6ae69e5432c38778f3b93e5335a935f62939cd0094e5ccb886460


filename: tmpdbx.ps1


sha256: 8955585100f75c59472e4c2c77fcddd7422400f745ae75132c81c6144aa86824


filename: zz.ps1


sha256: 7bb7ca87149b6407e1e7c11c1a528a2e2147d3096337e3da6f6be130f76ff6ac


Post-ex PowerShell script


Gzip payload


9231f86da8cfe84b4cc9de1b0144605 Новая


Новая папка.img, sha256: 4c9b55906b1d9774cb3a43f3ca11cde266b6ebec0afdcab2dd1bcffa1bd99ec3


Новая папка.img, md5: 49971fb6daddfd893d2753f23df819fc


Акт_звiрки_за_травень.xls.exe, sha256: 82c78f76eabaab176b69b671865d3605d6af7e66a06bbc57d58d1494d44475b4


Акт_звiрки_за_травень.xls.exe, md5: 408cff891cbade705d9e720831aecb23


sha256: 41bfd96d49bf35bf4ca946b9a51fa8784baf683d634f7ce9e068f6bded979fa2 filename: smoke.exe


md5: 4affa48a16a972442d8c401962b5c723 filename: smoke.exe


md5: 4affa48a16a972442d8c401962b5c723 sha256: 41bfd96d49bf35bf4ca946b9a51fa8784baf683d634f7ce9e068f6bded979fa2


Додаток.accdb, sha256: 5713b230f0aa6e8a78c655494c40885b606a5ed2e2ba5a1c8729974158e683fd


Додаток.accdb, md5: bd5e7e4a03d07749c8ee058f9f7f5e24


Оплата_документи.accdb, sha256: 96e1fc4906cb79eab198dc76dbed47afc5855d26be0ca37910f8359b2683aef0


Оплата_документи.accdb, md5: 6ea31e8fa244e26b552320114ff75130


1.exe, sha256: a546e49506f7144ff08c824c0503f8625d17f760d8ac20074aac870b0a3941d7


1.exe, md5: 5ad45fc2b7ca8db7385227a5831fdae9


sha256: 9c9df8669f1b07ec66e7b82ac97e188412f82ce549fb3552cca84413005fec9f filename: smoke.exe


md5: 36da0a1d6f88800b96c2f4cf69ec79d0 filename: smoke.exe


md5: 36da0a1d6f88800b96c2f4cf69ec79d0 sha256: 9c9df8669f1b07ec66e7b82ac97e188412f82ce549fb3552cca84413005fec9f


sha256: 49127fcef058750578d87b6a4a25c8da77185cdd8796bc589dc5cf31f884c171 filename: WmiPrvSE.ex


md5: 09f4f3a9a0b5a8c7ab42bf1a41ae623c filename: WmiPrvSE.ex


md5: 09f4f3a9a0b5a8c7ab42bf1a41ae623c sha256: 49127fcef058750578d87b6a4a25c8da77185cdd8796bc589dc5cf31f884c171


sinkholed


C:\Windows\System32\schtasks.exe" /run /tn \Microsoft\Windows\DiskCleanup\SilentCleanup /I


Archive file ( Probably email attachment)


Malicious .LNK file


Malicious MSBuild Project File ( final payload)


Decoy PDF


C&C


Zip file


LNK


EML Samples


JAR


EXECUTABLE


Description


Command-and-Control Server


SamsStealer


Other Sample


– Type - Description / Redirected Link


External Source Address Malicious Endpoint


Linux.Gomir


GoBear Dropper


Troll Stealer


MD5s / ViperSoftX Dropper (win32.exe)


MD5s / ViperSoftX Installer (Svchost.exe)


MD5s / ViperSoftX Installer (System32.exe)


MD5s / ViperSoftX PowerShell Installer (update.ps1)


MD5s / ViperSoftX PowerShell (update.ps1)


MD5s / ViperSoftX Downloader PowerShell


MD5s / VenomSoftX PowerShell (Decrypted)


MD5s / Quasar RAT July (microsoft.exe)


MD5s / Quasar RAT July (csrss.exe)


MD5s / Quasar RAT July (NVIDIA.exe)


MD5s / Quasar RAT after March (powershells.exe)


MD5s / Quasar RAT after March (dllhost.exe)


MD5s / Quasar RAT after March (conhost.exe)


MD5s / Quasar RAT Tor after March (java.exe)


MD5s / TesseractStealer (56cb4553-d33a-42b8-8d77-bb3f279f5191.x)


C&C Servers / ViperSoftX PowerShell


C&C Servers / ViperSoftX DownLoader PowerShell


bideo.duckdns[.]org:7: Quasar RAT (July 2023) / Quasar RAT (after March


win32updates.duckdns[.]org:1: Quasar RAT (after March 2024) / Quasar RAT (after March


win32updates.duckdns[.]org:1: Quasar RAT (after March 2024) / TesseractStealer


Download / Quasar RAT


Download / TesseractStealer


TRUFOS.DLL / LATRODECTUS


LATRODECTUS C2


ICEDID C2


Malicious Archive Download Link


ZIP Archive


Grandoreiro Loader Component


Grandoreiro


Address / Sender


IPv4 / Grandoreiro C2 server


Antidot Android Banking Trojan, sha1: c48240ce763e07b690e4fe79d6dfe69eeeebf8bd sha256: a6f6e6fb44626f8e609b3ccb6cbf73318baf01d08ef84720706b205f2864b116


Antidot Android Banking Trojan, md5: ac79187fd3024fb9cb5d1a872461503c sha256: a6f6e6fb44626f8e609b3ccb6cbf73318baf01d08ef84720706b205f2864b116


Antidot Android Banking Trojan, md5: ac79187fd3024fb9cb5d1a872461503c sha1: c48240ce763e07b690e4fe79d6dfe69eeeebf8bd


C&C server


Antidot Android Banking Trojan, sha1: 13479bb7364b710b2bb4a55ded4877d8232c0d90 sha256: 7a0664c3a9914531c84d875669f6249b433d09155b1c06ad3654c210a1798ee0


Antidot Android Banking Trojan, md5: 0b6f0790c32a16e413c89bf65018ec6d sha256: 7a0664c3a9914531c84d875669f6249b433d09155b1c06ad3654c210a1798ee0


Antidot Android Banking Trojan, md5: 0b6f0790c32a16e413c89bf65018ec6d sha1: 13479bb7364b710b2bb4a55ded4877d8232c0d90


Antidot Android Banking Trojan, sha1: 1c1d2fc881ea0565a372f71baf26454756bd3243 sha256: 9f8a49432e76b9c69d33ea228cc44254bc0a58bfa15eb0c51a302c59db81caa3


Antidot Android Banking Trojan, md5: 588d01860865256c378715ad728757cf sha256: 9f8a49432e76b9c69d33ea228cc44254bc0a58bfa15eb0c51a302c59db81caa3


Antidot Android Banking Trojan, md5: 588d01860865256c378715ad728757cf sha1: 1c1d2fc881ea0565a372f71baf26454756bd3243


Dropper file, sha1: bb2a1b5909f31f1c4d694899d502b1d9f95c66c2 sha256: 654cfe773e92261a7e2c74f4b16bd36be9286a95840b49139cf18c8d4333345b


Dropper file, md5: b877636c060e5fb47f467e557acdc9ac sha256: 654cfe773e92261a7e2c74f4b16bd36be9286a95840b49139cf18c8d4333345b


Dropper file, md5: b877636c060e5fb47f467e557acdc9ac sha1: bb2a1b5909f31f1c4d694899d502b1d9f95c66c2


was submitted from Canada once on March


some problems.zip / 2024-05-08


some problems.lnk / 2024-05-08


SHA2256 ~235232302.js / 2024-05-08


SugarGh0st RAT C2 / 2024-05-08


Linux.Gomir


GoBear Dropper


Troll Stealer


– Type – Description / Name Suspicious Link


names


ScreenConnect relay


NetSupport C2


Cobalt Strike Beacon C2


754FB657156643FD09A6 8EC9FC124528578CAB0C / Win32/LunarWeb.A / LunarWeb backdoor (x86)


2020‑02‑01 / Domain (Free DNS) pinged by malicious Word macro


2020‑02‑01 / (Free DNS) pinged by malicious Word macro


Akamai Connected Cloud / 2020‑05‑20 / C&C server of LunarWeb (compromised VPS)


Hetzner Online GmbH / 2023‑10‑29 / C&C server of LunarWeb (compromised VPS)


Host Department NJ, LLC / 2023‑10‑29 / C&C server of LunarWeb


IONOS SE / 2022‑08‑03 / C&C server of LunarWeb (compromised VPS)


Akamai Connected Cloud / 2023‑06‑15 / C&C server of LunarWeb (compromised VPS)


Contabo GmbH / 2023‑10‑29 / C&C server of LunarWeb


Contabo GmbH / 2023‑06‑15 / C&C server of LunarWeb


Webglobe, a.s. / 2023‑06‑02 / C&C server of LunarWeb (compromised VPS)


filename: Stage1.exe


md5: 5cbb3f38dd686033f58f2c16f5f9a6d9


filename: Stage2.exe


md5: 18c0d4d076dcf852682a1e928ea6fd20


filename: Stage3.exe


md5: fc959011ba6fa9ed33dc38f1d7d7846f


Ransom note / was not retrievable


Remote access and management software / was not retrievable


filename: file.bat


sha1: 6e7ad80da2f43af160dad06cd54805ee0ea1bd83


Ransomware payload / was not retrievable


Network scanning tool / was not retrievable


Randomly generated 8- character ransomware binary / Each ransomware binary had a different


Remote access and management software, filename: rustdesk.exe


Remote access and management software, sha1: 0f5f4ab3572e194340d887b02068357149b86ac2


Ransomware binary, filename: w.exe


Ransomware binary, sha1: 422613a3ef460dc829ae26f50a0e905adf28ba81


Data compression tool, filename: winrar.exe


Data compression tool, sha1: 151c8b4295630a71f2c1bed76326055100378b66


File transfer tool, filename: winscp.exe


File transfer tool, sha1: 078301fc29aa6ca907ad956145d62a4d67d1e917


C2 domain


DOCX [IOCs]


DOTM [IOCs]


Danabot EXE [IOCs]


Parent sample, filename: Notepads.exe


Parent sample, md5: 27bb3968cc18fb0df5b14e6d1b805552


filename: Install.vbs


md5: a7fe45cc57afb3dba91ab77483fffa0a


Shortcut (LNK) file, sha1: af707ed85e03449729e6b04bcfb4c176d71faa6c sha256: bc1acdca196f1ff72722243be2afe1429b88122afb9d4852d6d6e57689411d3d


Shortcut (LNK) file, md5: 6e02fe7c188c417802008e147c248eb1 sha256: bc1acdca196f1ff72722243be2afe1429b88122afb9d4852d6d6e57689411d3d


Shortcut (LNK) file, md5: 6e02fe7c188c417802008e147c248eb1 sha1: af707ed85e03449729e6b04bcfb4c176d71faa6c


Shortcut (LNK) file, sha1: 868570ac0ff9ea4e281b2ef4176619aabf6bf59b sha256: 81038a217237afd16d80da7fc9219cbd145f9698bb512e2b625559a47ba73fec


Shortcut (LNK) file, md5: b20cb8caf27d4508f6d1a51a92df49a3 sha256: 81038a217237afd16d80da7fc9219cbd145f9698bb512e2b625559a47ba73fec


Shortcut (LNK) file, md5: b20cb8caf27d4508f6d1a51a92df49a3 sha1: 868570ac0ff9ea4e281b2ef4176619aabf6bf59b


sha1: e03e89d6f3defa8a0d670910f3164b899ece35a5 sha256: d777bcb6fba73faf96cb422383404c3b81a8afa5aebbc8ed70076081de7daa0c


md5: 8a71e3c45d8fa81d90ab56681de8e57c sha256: d777bcb6fba73faf96cb422383404c3b81a8afa5aebbc8ed70076081de7daa0c


md5: 8a71e3c45d8fa81d90ab56681de8e57c sha1: e03e89d6f3defa8a0d670910f3164b899ece35a5


1.hta, sha1: 9618a1d588746ba571be3cfef7d864ffd840d020 sha256: 37f20f232aa86316901baccbb44af1668b1d868c1ca9aba8fcb36584352b3e0f


1.hta, md5: 80ac09458e5e5fbd8e500ef0f7313bd2 sha256: 37f20f232aa86316901baccbb44af1668b1d868c1ca9aba8fcb36584352b3e0f


1.hta, md5: 80ac09458e5e5fbd8e500ef0f7313bd2 sha1: 9618a1d588746ba571be3cfef7d864ffd840d020


MSFTEDIT.dll (Action RAT), sha1: 47451a404a8acec6b5cee7e0c5cbc1bb19f1fa59 sha256: 93fb036e65c0683af5ffb98e2b61e30499dec068a4e15bf3bec8066d3e246852


MSFTEDIT.dll (Action RAT), md5: 614896fea882b17b193b41d4e3e593ac sha256: 93fb036e65c0683af5ffb98e2b61e30499dec068a4e15bf3bec8066d3e246852


MSFTEDIT.dll (Action RAT), md5: 614896fea882b17b193b41d4e3e593ac sha1: 47451a404a8acec6b5cee7e0c5cbc1bb19f1fa59


PreBotHta.dll (stage 1), sha1: 36d244241c9ed6cb526d706ab49c2324037fa48c sha256: 902e087711ab8e612bd7cea9864bbadbe20a3500ba57f26f6eeb0b5b20b803ec


PreBotHta.dll (stage 1), md5: 5fc7a9d515067008095a439837881713 sha256: 902e087711ab8e612bd7cea9864bbadbe20a3500ba57f26f6eeb0b5b20b803ec


PreBotHta.dll (stage 1), md5: 5fc7a9d515067008095a439837881713 sha1: 36d244241c9ed6cb526d706ab49c2324037fa48c


PreBotHta.dll (Reverse RAT 2.0), sha1: d23489bf492839dd9095a332c59a450cb840f401 sha256: 4a81bb3f9f9fe8a10002c043210ff537c2fd4a879a694d0f18468c70eaf65cfe


PreBotHta.dll (Reverse RAT 2.0), md5: 565cac3dffde44fa487014e69b13140a sha256: 4a81bb3f9f9fe8a10002c043210ff537c2fd4a879a694d0f18468c70eaf65cfe


PreBotHta.dll (Reverse RAT 2.0), md5: 565cac3dffde44fa487014e69b13140a sha1: d23489bf492839dd9095a332c59a450cb840f401


Malicious sites


Malicious


SideCopy C&C


Action RAT C&C


Payload


ReverseRAT C&C


Date Seen


02/26/2024 2/26/2024


02/27/2024 2/27/2024


used for DNS tunneling


associated with this activity


data.bin shellcode


winsys.odt GotoMeeting executable


g2m.dll sideloaded shellcode runner


MLD.pdf decoy


myrecentfiles.lnk


Teen Girl Leak Porn 10.js


Download


Download URL2


run.bat


RunBatchFile.lnk


Unpacked Remcos RAT DLL


2023 Tax Documents.zip


MY TAX ORGANIZER.zip


2024-04-15T00:00:00Z / 2049-04-09T00:00:00Z


2024-04-19T00:00:00Z / 2049-04-13T00:00:00Z


2024-03-20T00:00:00Z / 2049-04-09T00:00:00Z


Typo-squatted found via DNSTwist


Typo-squatted


Malicious zip archive likely compromised


C2 address


Dropped by the threat actor post compromise, filename: DellAPC.exe


Dropped by the threat actor post compromise, sha256: 8b1946e3e88cff3bee6b8a2ef761513fb82a1c81f97a27f959c08d08e4c75324


Dropped by the threat actor post compromise


Dropped by the threat actor post compromise, filename: DellCTSWin.exe


Dropped by the threat actor post compromise, sha256: 2ee435033d0e2027598fc6b35d8d6cbca32380eb4c059ba0806b9cfb1b4275cc


Dropped by the threat actor post compromise, filename: DellPPem.exe


Dropped by the threat actor post compromise, sha256: 4b618892c9a397b2b831917264aaf0511ac1b7e4d5e56f177217902daab74a36


Dropped by the threat actor post compromise, filename: DellPRT.exe


Dropped by the threat actor post compromise, sha256: 725aa783a0cd17df603fbe6b11b5a41c9fbfd6fc9e4f2e468c328999e5716faa


Dropped by the threat actor post compromise, filename: KeePassDR.exe


Dropped by the threat actor post compromise, sha256: c9042a7ed34847fee538c213300374c70c76436ee506273b35282c86a11d9e6a


Dropped by the threat actor post compromise, filename: NVDisplay.Contain64.exe


Dropped by the threat actor post compromise, sha256: 35161a508dfaf8e04bb6de6bc793a3840a05f2c04bbbbf8c2237abebe8e670aa


Dropped by the threat actor post compromise, filename: NVDisplay.Container64.exe


Dropped by the threat actor post compromise, sha256: 8bc39017b1ea59386f74d7c7822063b3b00315dd317f55ddc6634bde897c45c1


Dropped by the threat actor post compromise, filename: NVDisplay.exe


Dropped by the threat actor post compromise, sha256: bbdf350c6ae2438bf14fc6dc82bb54030abf9da0c948c485e297330e08850575


Dropped by the threat actor post compromise, filename: OktaServiceAgent.exe


Dropped by the threat actor post compromise, sha256: 28e5ee69447cea77eee2942c04009735a199771ba64f6bce4965d674515d7322


Dropped by the threat actor post compromise, sha256: f36e9dec2e7c574c07f3c01bbbb2e8a6294e85863f4d6552cccb71d9b73688ad


Dropped by the threat actor post compromise, filename: PDMVault.exe


Dropped by the threat actor post compromise, sha256: 242b2c948181f8c2543163c961775393220d128ecb38a82fa62b80893f209cab


Dropped by the threat actor post compromise, sha256: 9be715df88024582eeabdb0a621477e04e2cf5f57895fa6420334609138463b9


Dropped by the threat actor post compromise, filename: PDMVaultConf.exe


Dropped by the threat actor post compromise, sha256: 8b0d04f65a6a5a3c8fb111e72a1a176b7415903664bc37f0a9015b85d3fc0aa7


Dropped by the threat actor post compromise, filename: PDMVaultL.exe


Dropped by the threat actor post compromise, sha256: 169ef0e828c3cd35128b0e8d8ca91fbf54120d9a2facf9eb8b57ea88542bc427


Dropped by the threat actor post compromise


Dropped by the threat actor post compromise, filename: PDMVaultSec.exe


Dropped by the threat actor post compromise, sha256: 61214a7b14d6ffb4d27e53e507374aabcbea21b4dc574936b39bec951220e7ea


Dropped by the threat actor post compromise, filename: PDMVaultSecs.exe


Dropped by the threat actor post compromise, sha256: 51af3d778b5a408b725fcf11d762b0f141a9c1404a8097675668f64e10d44d64


Dropped by the threat actor post compromise, filename: PDMVaultTest.exe


Dropped by the threat actor post compromise, sha256: 96ea33a5f305015fdd84bea48a9e266c0516379ae33321a1db16bc6fabad5679


Dropped by the threat actor post compromise, filename: ServerController.exe


Dropped by the threat actor post compromise, sha256: 02330e168d4478a4cd2006dd3a856979f125fd30f5ed24ee70a41e03e4c0d2f8


Dropped by the threat actor post compromise, filename: SgrmBroker.exe


Dropped by the threat actor post compromise, sha256: 8834ec9b0778a08750156632b8e74b9b31134675a95332d1d38f982510c79acb


Dropped by the threat actor post compromise, filename: VMImportHost.exe


Dropped by the threat actor post compromise, sha256: c8a982e2be4324800f69141b5be814701bcc4167b39b3e47ed8908623a13eb10


Dropped by the threat actor post compromise, filename: VMImportHost2.exe


Dropped by the threat actor post compromise, sha256: 47ec3a1ece8b30e66afd6bb510835bb072bbccc8ea19a557c59ccdf46fe83032


Dropped by the threat actor post compromise, filename: VMImportHost3.exe


Dropped by the threat actor post compromise, sha256: 9bd3c7eff51c5746c21cef536971cc65d25e3646533631344728e8061a0624cb


Dropped by the threat actor post compromise, filename: VMSAdmin.exe


Dropped by the threat actor post compromise, sha256: f89720497b810afc9666f212e8f03787d72598573b41bc943cd59ce1c620a861


Dropped by the threat actor post compromise, filename: VMSAdminUtil.exe


Dropped by the threat actor post compromise, sha256: ca05485a1ec408e2f429e2e377cc5af2bee37587a2eb91dc86e8e48211ffc49e


Dropped by the threat actor post compromise, filename: VMSAdminUtilityUp.exe


Dropped by the threat actor post compromise, sha256: 972ca168f7a8cddd77157e7163b196d1267fe2b338b93dabacc4a681e3d46b57


Dropped by the threat actor post compromise, filename: VMSBackupConfig.exe


Dropped by the threat actor post compromise, sha256: 1576f71ac41c4fc93c8717338fbc2ba48374894345c33bdf831b16d0d06df23d


Dropped by the threat actor post compromise, filename: VMSBackupUpdate.exe


Dropped by the threat actor post compromise, sha256: a5dfc9c326b1303cc1323c286ecd9751684fb1cd509527e2f959fb79e5a792c2


Dropped by the threat actor post compromise, filename: dp_agent.exe


Dropped by the threat actor post compromise, sha256: 13b2e749eb1e45ce999427a12bb78cbebc87c415685315c77cdfb7f64cb9aab0


Dropped by the threat actor post compromise, filename: local.exe


Dropped by the threat actor post compromise, sha256: bd4abc70de30e036a188fc9df7b499a19a0b49d5baefc99844dfdec6e70faf75


Dropped by the threat actor post compromise, filename: lr_agent.exe


Dropped by the threat actor post compromise, sha256: d95f6dec32b4ebed2c45ecc05215e76bf2f520f86ad6b5c5da1326083ba72e89


Dropped by the threat actor post compromise, filename: ntfrss.exe


Dropped by the threat actor post compromise, sha256: f36089675a652d7447f45c604e062c2a58771ec54778f6e06b2332d1f60b1999


Dropped by the threat actor post compromise, filename: op_agent.exe


Dropped by the threat actor post compromise, sha256: 17e0005fd046e524c1681304493f0c51695ba3f24362a61b58bd2968aa1bd01a


Notable naming scheme


Dropped by the threat actor post compromise, filename: pr_agent.exe


Dropped by the threat actor post compromise, sha256: d27f9c0d761e5e1de1a741569e743d6747734d3cdaf964a9e8ca01ce662fac90


Malicious DLL sideloaded by setup.exe. Compiled 2024-03-05. Original name: python311_WinSCP.dll, filename: python311.dll


Malicious DLL sideloaded by setup.exe. Compiled 2024-03-05. Original name: python311_WinSCP.dll, sha256: cd7d59105b0d0b947923dd9ed371b9cfc2c2aa98f29b2afbdcd3392ad26bde94


Malicious DLL sideloaded by setup.exe. Compiled 2024-04-03. Original name: python311_WinSCP.dll, filename: python311.dll


Malicious DLL sideloaded by setup.exe. Compiled 2024-04-03. Original name: python311_WinSCP.dll, sha256: 02d8e4e5f74d38c8e1c9ad893e0cec1cc19aa08a43ecc87ac043fa825382a583


Malicious DLL sideloaded by setup.exe. Compiled 2024-04-10. Original name: python311_Putty.dll, filename: python311.dll


Malicious DLL sideloaded by setup.exe. Compiled 2024-04-10. Original name: python311_Putty.dll, sha256: 500574522dbcde5e6c89803c3dca7f857f73e0868fd7f8d2f437f3cc31ce9e8d


Ransomware, named after the impacted domain, filename: redacted-.exe


Ransomware, named after the impacted domain, sha256: a1cb8761dd8e624d6872960e1443c85664e9fbf24d3e208c3584df49bbdb2d9c


Ransom note


Exfil tool dropped by the threat actor, filename: resticORIG.exe


Exfil tool dropped by the threat actor, sha256: 33f6acd3dfeda1aadf0227271937c1e5479c2dba24b4dca5f3deccc83e6a2f04


Dropped by the threat actor post compromise, filename: rr__agent.exe


Dropped by the threat actor post compromise, sha256: d94ed93042d240e4eaac8b1b397abe60c6c50a5ff11e62180a85be8aa0b0cc4a


AV/EDR killer, used to facilitate the execution of ransomware, filename: truesight.sys


AV/EDR killer, used to facilitate the execution of ransomware, sha256: bfc2ef3b404294fe2fa05a8b71c7f786b58519175b7202a69fe30f45e607ff1c


Dropped by the threat actor post compromise, filename: veeam.backups.shell.exe


Dropped by the threat actor post compromise, sha256: 7d53122d6b7cff81e1c5fcdb3523ccef1dbd46c93020a0de65bc475760faff7d


Dropped by the threat actor post compromise, filename: vmtools.exe


Dropped by the threat actor post compromise, sha256: ed501e49b9418fcfaf56a2eff7adcf85a648bdee2c42bb09db8c11f024667bfa


Dropped by the threat actor post compromise, filename: vmtoolsda.exe


Dropped by the threat actor post compromise, sha256: 12afbec79948007e87fdf9e311736160797f245857a45c040966e8e029ca97b3


Dropped by the threat actor post compromise, filename: vmtoolsdr.exe


Dropped by the threat actor post compromise, sha256: 989a8e6a01aa20e298b1ffae83b50cef3e08f6b64a8f022288dc8d5729301674


Dropped by the threat actor post compromise, filename: vmtoolsds.exe


Dropped by the threat actor post compromise, sha256: 0aa248300a9f6c498f5305ae3cb871e9ec78ae62e6d51c05c4d6dd069622f442


Dropped by the threat actor post compromise, filename: vmtoolsdt.exe


Dropped by the threat actor post compromise, sha256: df0213e4b784a7e7e3b4c799862db6ea60e34d8e22eb5e72a980a8c2e9b36177


Dropped by the threat actor post compromise, filename: DellPP.exe


Dropped by the threat actor post compromise, sha256: 51d898de0c300cae7a57c806d652809d19beb3e52422a7d8e4cb1539a1e2485d


Dropped by threat actor post compromise, filename: DellPP2.exe


Dropped by threat actor post compromise, sha256: 8827b6fa639afe037bb2c3f092ccb12d49b642ce5cec496706651ebcb23d5b9e


Encrypted Sliver beacon, filename: data.aes


Encrypted Sliver beacon, sha256: f18367d88f19c555f19e3a40b17de66d4a6f761684a5ef4cdd3d9931a6655490


filename: data.aes


sha256: c33975aa4ab4cdf015422608962bd04c893f27bd270cf3f30958981541cdfead


Encrypted Sliver beacon, sha256: 868cd4974e1f3ac7ef843da8040536cb04f96a2c5779265a69df58e87dc03029


Sliver beacon loader, filename: systemd.py


Sliver beacon loader, sha256: 69583c4a9bf96e0edafcf1ac4362c51d6ff71bba0f568625ae65a1e378f15c65


Sliver beacon loader, sha256: 03d18441c04f12270aab3e55f68284dcd84721d1e56b32f8d8b732a52a654d2d


Sliver beacon loader, sha256: cf82366e319b6736a7ee94cca827790e9fdedface98601f0499abee61f613d5d


FoFA


Censys


Indicator Type Indicators Domain Domain SHA256 SHA256 SHA256 SHA256


Indicator Type Indicators SHA256 SHA256 SHA256 SHA256


Indicator Type Indicators Domain Domain


Payload Delivery / 2023-2024


Payload Delivery / 2024-04-29


sha1: fdb92fac37232790839163a3cae5f37372db7235 sha256: 0112e3b20872760dda5f658f6b546c85f126e803e27f0577b294f335ffa5a298


md5: 1bf171b1f388691c3985df6fb6c3f0d1 sha256: 0112e3b20872760dda5f658f6b546c85f126e803e27f0577b294f335ffa5a298


md5: 1bf171b1f388691c3985df6fb6c3f0d1 sha1: fdb92fac37232790839163a3cae5f37372db7235


sha1: 25ce6c74a6f39289717522cad5eacdf5b9f4bae8 sha256: 882019d1024778e13841db975d5e60aaae1482fcf86ba669e819a68ce980d7d3


md5: bc95f228b11fa3b4e91c30d98f9f3bff sha256: 882019d1024778e13841db975d5e60aaae1482fcf86ba669e819a68ce980d7d3


md5: bc95f228b11fa3b4e91c30d98f9f3bff sha1: 25ce6c74a6f39289717522cad5eacdf5b9f4bae8


Batch script and remote access tool


C2 server contained within batch scripts


AnyDesk server used by the threat actor


Primary NetSupport RAT gateway


Secondary NetSupport RAT gateway


C2 address used to connect via AnyDesk


Cobalt Strike C2


Payload containing SSH config used by the threat actor, filename: s.zip


Payload containing SSH config used by the threat actor, sha256: c18e7709866f8b1a271a54407973152be1036ad3b57423101d7c3da98664d108


Private RSA key that is downloaded to impacted assets, filename: id_rsa


Private RSA key that is downloaded to impacted assets, sha256: 59f1c5fe47c1733b84360a72e419a07315fbae895dd23c1e32f1392e67313859


Private RSA key that is downloaded to impacted assets, filename: id_rsa_client


Private RSA key that is downloaded to impacted assets, sha256: 2ec12f4ee375087c921be72f3bd87e6e12a2394e8e747998676754c9e3e9798e


Authorized key downloaded to impacted assets by the threat actor, filename: authorized_keys


Authorized key downloaded to impacted assets by the threat actor, sha256: 35456f84bc88854f16e316290104d71a1f350e84b479eebd6fbb2f77d36bca8a


Renamed copy of the legitimate OpenSSH for Windows utility, filename: RuntimeBroker.exe


Renamed copy of the legitimate OpenSSH for Windows utility, sha256: 6f31cf7a11189c683d8455180b4ee6a60781d2e3f3aadf3ecc86f578d480cfa9


Payload that contains a batch script and the legitimate ScreenConnect setup executable, filename: a.zip


Payload that contains a batch script and the legitimate ScreenConnect setup executable, sha256: a47718693dc12f061692212a354afba8ca61590d8c25511c50cfecf73534c750


Contains a credential harvesting batch script, filename: a3.zip


Contains a credential harvesting batch script, sha256: 76f959205d0a0c40f3200e174db6bb030a1fde39b0a190b6188d9c10a0ca07c8


Trinity Ransomware, sha1: 4c58d2d624d9bdf6b14a6f8563788785074947a7 sha256: 36696ba25bdc8df0612b638430a70e5ff6c5f9e75517ad401727be03b26d8ec4


Trinity Ransomware, md5: 949c438e4ed541877dce02b38bf593ad sha256: 36696ba25bdc8df0612b638430a70e5ff6c5f9e75517ad401727be03b26d8ec4


Trinity Ransomware, md5: 949c438e4ed541877dce02b38bf593ad sha1: 4c58d2d624d9bdf6b14a6f8563788785074947a7


linked with threat actors exploiting CVE-2024-1708 and CVE-2024-17091


URI linked with threat actors exploiting CVE-2024-1708 and CVE-2024-17091 / URI


Filehash linked with threat actors exploiting CVE-2024-1708 and CVE-2024-17091


sharing = "TLP:WHITE"


bat


exe


sys


exe, filename: smbexec.exe


sha256: 5d2f77971ffe4bab08904e58c8d0c5ba2eefefa414599ebac72092e833f86537


filename: amd64.exe


sha256: 7539bd88d9bb42d280673b573fc0f5783f32db559c564b95ae33d720d9034f5a


certificate used to sign POORTRY


Meterpreter Backdoor


IIS module malware (x64)


IIS module malware (x86)


C&C address of the Meterpreter backdoor


Illegal online gambling link-related


HTML


filename: WSF


sha256: ec6805562419e16de9609e2a210464d58801c8b8be964f876cf062e4ab52681a


filename: ty.zip


sha256: daee41645adcf22576def12cb42576a07ed5f181a71d3f241c2c14271aad308b


filename: basta.js


sha256: 909ec84dfa3f2a00431a20d4b8a241f2959cac2ea402692fd46f4b7dbf247e90


filename: node.bat


sha256: 569e33818e6af315b5f290442f9e27dc6c56a25259d9c9866b2ffb4176d07103


filename: app.js


sha256: 7d8a4aa184eb350f4be8706afb0d7527fca40c4667ab0491217b9e1e9d0f9c81


filename: t.bat


sha256: e2d30095e7825589c3ebd198f31e4c24e213d9f43fc3bb1ab2cf06b70c6eac1d


filename: t.ps1


sha256: a0c40aa214cb28caaf1a2f5db136bb079780f05cba50e84bbaeed101f0de7fb3


exe


dll


SocGholish C2


Payloads, filename: Update.js


Payloads, md5: 44a0b845b30dcdc26c8017a6714c46e9


FIN7 C2s


DiceLoader C2


NetSupport


filename: csvde.exe


md5: b6f12d39edbfe3b33952be4329064b35


filename: Adobe_017301.zip


md5: e7b1fb0ef5dd20f4522945b902803f10


filename: svchostc.exe


md5: 0740803404a58d9c1c1f4bd9edaf4186


filename: svchostc.py


md5: 782621d1062a8fc7d626ceb68af314e5


Files: / DiceLoader


C2 Server


Discord Webhooks


LummaStealer C2


MNS NH Contact.apk


Posted out off.apk


Command Control


network communications with


Malicious (defanged)


Remcos RAT (walkingrpc.bat)


Remote screen control malware (launcher.exe)


Mallox ransomware (360.exe)


Remote screen control malware past case


C&C Servers / Remcos RAT


C&C Servers / Remote screen control malware


C&C Servers / Mallox ransomware


C&C Servers / Remote screen control malware past case


Download / Remcos RAT


BirdyClient


Bluelight


Graphon


Graphite


Graphican


SiestaGraph


Filename where IzYqBW5pa is the unique ID for this specific variant


File size: 15,086


File size: 15,086 / Filename


File size: 86,708


size: 86,708


File size: 6,197


Azadliq / Azerbaijan


Business Insider / U.S


The Economist / UK


Foreign Affairs / U.S


Israel Hayom / Israel


Jerusalem Post / Israel


Khaleej Times / UAE


Maariv / Israel


The Media Line / U.S


Times Of Israel / Israel


Vanity Fair / U.S


The Washington Post / U.S


Ynet / Israel


Google/Microsoft


Generic


Microsoft


Bitly / Israel


Bitly / U.S


Mailer Daemon


Aspen Institute / U.S


Mccain Institute / U.S


The Washington Institute / U.S


YouTransfer


SHA-256, filename: Av.exe


SHA-256, sha256: 36eb4290aa11a950e60d12ab18a8e139d25464355ce761f98891e1ea94f39445


SHA-256, filename: kaz.exe


SHA-256, sha256: fc39cca5d71b1a9ed3c71cca6f1b86cfe03466624ad78cdb57580dba90847851


– Type – Description / Unusual Login Source


– Type – Description / Possible C2 Endpoint


Phishing Link


Spotify-music-converter.dmg


DumpMediaSpotifyMusicConverter


TuneSoloAppleMusicConverter


TuneFunAppleMusicConverter


FoneDogToolkitForAndroid


Zloader sample


Zloader C2


Reporter


Downloader


C2 Redirectors


used to launch attacks


IcedID


Cobalt Strike


sha1: 5066e67f22bc342971b8958113696e6c838f6c58 sha256: f6e5dbff14ef272ce07743887a16decbee2607f512ff2a9045415c8e0c05dbb4 filename: Document_Scan_468.js


md5: 0d8a41ec847391807acbd55cbd69338b sha256: f6e5dbff14ef272ce07743887a16decbee2607f512ff2a9045415c8e0c05dbb4 filename: Document_Scan_468.js


md5: 0d8a41ec847391807acbd55cbd69338b sha1: 5066e67f22bc342971b8958113696e6c838f6c58 filename: Document_Scan_468.js


md5: 0d8a41ec847391807acbd55cbd69338b sha1: 5066e67f22bc342971b8958113696e6c838f6c58 sha256: f6e5dbff14ef272ce07743887a16decbee2607f512ff2a9045415c8e0c05dbb4


sha1: ca10c09416a16416e510406a323bb97b0b0703ef sha256: 332afc80371187881ef9a6f80e5c244b44af746b20342b8722f7b56b61604953 filename: license.dat


md5: bff696bb76ea1db900c694a9b57a954b sha256: 332afc80371187881ef9a6f80e5c244b44af746b20342b8722f7b56b61604953 filename: license.dat


md5: bff696bb76ea1db900c694a9b57a954b sha1: ca10c09416a16416e510406a323bb97b0b0703ef filename: license.dat


md5: bff696bb76ea1db900c694a9b57a954b sha1: ca10c09416a16416e510406a323bb97b0b0703ef sha256: 332afc80371187881ef9a6f80e5c244b44af746b20342b8722f7b56b61604953


sha1: 34c9702c66faadb4ce90980315b666be8ce35a13 sha256: 9da84133ed36960523e3c332189eca71ca42d847e2e79b78d182da8da4546830 filename: Riadnc1.dll


md5: a144aa7a0b98de3974c547e3a09f4fb2 sha256: 9da84133ed36960523e3c332189eca71ca42d847e2e79b78d182da8da4546830 filename: Riadnc1.dll


md5: a144aa7a0b98de3974c547e3a09f4fb2 sha1: 34c9702c66faadb4ce90980315b666be8ce35a13 filename: Riadnc1.dll


md5: a144aa7a0b98de3974c547e3a09f4fb2 sha1: 34c9702c66faadb4ce90980315b666be8ce35a13 sha256: 9da84133ed36960523e3c332189eca71ca42d847e2e79b78d182da8da4546830


sha1: 4e0222fd381d878650c9ebeb1bcbbfdfc34cabc5 sha256: 839cf7905dc3337bebe7f8ba127961e6cd40c52ec3a1e09084c9c1ccd202418e filename: magni.w


md5: 7e9ef45d19332c22f1f3a316035dcb1b sha256: 839cf7905dc3337bebe7f8ba127961e6cd40c52ec3a1e09084c9c1ccd202418e filename: magni.w


md5: 7e9ef45d19332c22f1f3a316035dcb1b sha1: 4e0222fd381d878650c9ebeb1bcbbfdfc34cabc5 filename: magni.w


md5: 7e9ef45d19332c22f1f3a316035dcb1b sha1: 4e0222fd381d878650c9ebeb1bcbbfdfc34cabc5 sha256: 839cf7905dc3337bebe7f8ba127961e6cd40c52ec3a1e09084c9c1ccd202418e


sha1: 38cd9f715584463b4fdecfbac421d24077e90243 sha256: 65edf9bc2c15ef125ff58ac597125b040c487640860d84eea93b9ef6b5bb8ca6 filename: magni.w.bat


md5: b3495023a3a664850e1e5e174c4b1b08 sha256: 65edf9bc2c15ef125ff58ac597125b040c487640860d84eea93b9ef6b5bb8ca6 filename: magni.w.bat


md5: b3495023a3a664850e1e5e174c4b1b08 sha1: 38cd9f715584463b4fdecfbac421d24077e90243 filename: magni.w.bat


md5: b3495023a3a664850e1e5e174c4b1b08 sha1: 38cd9f715584463b4fdecfbac421d24077e90243 sha256: 65edf9bc2c15ef125ff58ac597125b040c487640860d84eea93b9ef6b5bb8ca6


C2: / D3F@ck Loader


C2: / Raccoon Stealer


filename: 125.exe


Payloads: / D3F@ck Loader, md5: 44b14057ff868e25ad444fac098d89f0


Payloads, filename: 85.zip


Payloads, md5: 87cb408a03daa827f9cc10698ba69a90


Payloads: / NET Dropper, filename: 125.exe


md5: a56f2d534631400ef294d321f8dbdfea


Payloads, filename: Rufus_Setupx64.exe


Payloads, md5: 5cf2e80ac2a7f7fa24f74966d3ec904f


Payloads, filename: CalendlySetupLastVersion.exe


Payloads, md5: 815b3c88950fd572bb4bfef96d2ca23d


Payloads: / Raccoon Stealer


1 Open indexing directory


2 Mining Pool address


6 Anonmy.cmd


7 project88.cmd


8 Stage 3 AMSI bypass.exe – 1


9 Stage 3 AMSI bypass.exe – 2


10 Stage 3 AMSI bypass.exe – 3


11 Stage 3 dropper.exe – 1


12 Stage 3 dropper.exe – 2


13 Stage 3 dropper.exe – 3


14 Stage 4 LoadPE.dll – 1


16 Stage 4 LoadPE.dll – 3


17 Stage 4 dropper.exe – 1


19 Stage 4 dropper.exe – 3


20 WniRing0.sys


21 Stage 5 XMRrig.exe – 1


22 Stage 5 XMRrig.exe – 2


23 Stage 5 XMRrig.exe – 3


Network.zip


Network.exe


escapi.dll


Phishing


10 / Exfiltration site


11 / Exfiltration site


12 / Exfiltration site


13 / Exfiltration site


C2 server


hosting site


Oyster/CleanUpLoader C2 server


Cobalt Strike


IcedID


Javascript downloaders


Latrodectus


MSI installers


pikabot


Qakbot


Qbot


Brute Ratel C2 server


Cobalt Strike C2 server


Latrodectus C2 server


MSI download path


filename: loader


sha1: afd03337d1500d6af9bc447bd900df26786ea4a4


core implant, filename: C40F0D27


core implant, sha1: fd49866245721acc6e7431ec61b066696b72a1e1


Plugin ID: 18000, filename: soundrecord


Plugin ID: 18000, sha1: 0563225dcc2767357748d9f1f6ac2db9825d3cf9


Plugin ID: 14000, filename: browser


Plugin ID: 14000, sha1: 476c726b58409a8e3e6cf8fb6bb7d46596917e24


Plugin ID: 19000, filename: cameramodule


Plugin ID: 19000, sha1: 33c39728a0393d4271f27cc1d85cf3c1610be333


Plugin ID: 15000, filename: FileManage


Plugin ID: 15000, sha1: 9a00f6ca0d9140316f9ae03f79c7511cec32849f


Plugin ID: 31000, filename: keychain


Plugin ID: 31000, sha1: 8f390335b571297a9eb605576745876666ee7f6a


Plugin ID: 33000, filename: LanDevices


Plugin ID: 33000, sha1: 7aceb8db03b8b8c7899982b5befcaf455a86fe0b


Plugin ID: 16000, filename: softlist


Plugin ID: 16000, sha1: c65817a55b003462d48189875f18fa8bdb57b402


Plugin ID: 34000, filename: ScreenRecorder


Plugin ID: 34000, sha1: e9ba5d2dd449678628834cf5a11cffe042a4f6d6


Plugin ID: 20000, filename: ShellCommand


Plugin ID: 20000, sha1: 30e33f1188ca4cffc997260c9929738594e7488c


Plugin ID: 17000, filename: wifi


Plugin ID: 17000, sha1: 8e7e8d896ed61bea7a49271e2e6ffc982942e5c7


Brokewell Android Banking Trojan, sha1: 8ae5196842dee3ba85dfc6a5e8d4e9aa40caa5e0 sha256: 99f263fa87f13c7e6829dff73cc9c018d5f8165a5a7af3af8bc5ca6d52762ea9


Brokewell Android Banking Trojan, md5: de1ab49d5ce82fd4f250579cf16df28a sha256: 99f263fa87f13c7e6829dff73cc9c018d5f8165a5a7af3af8bc5ca6d52762ea9


Brokewell Android Banking Trojan, md5: de1ab49d5ce82fd4f250579cf16df28a sha1: 8ae5196842dee3ba85dfc6a5e8d4e9aa40caa5e0


Phishing site and Download


C&C server


Brokewell Android Banking Trojan, sha1: 3d88ba457dc75e29381213a38ebcf0ebfa59a406 sha256: 2ac038c44f1be53a1b652cafa4eba23af29831c7ebb75aaa00743b11c33665ea


Brokewell Android Banking Trojan, md5: 0360fb17d1e7a9d9bf3197508323c156 sha256: 2ac038c44f1be53a1b652cafa4eba23af29831c7ebb75aaa00743b11c33665ea


Brokewell Android Banking Trojan, md5: 0360fb17d1e7a9d9bf3197508323c156 sha1: 3d88ba457dc75e29381213a38ebcf0ebfa59a406


Brokewell Android Banking Trojan, sha1: f5e24d031edf0ec9c67d98c9294d5904dae34394 sha256: 00d35cf5af2431179b24002b3a4c7fb115380ebda496d78849bf3d10055d8a88


Brokewell Android Banking Trojan, md5: 8932768daaa490e27c7049ba772c8713 sha256: 00d35cf5af2431179b24002b3a4c7fb115380ebda496d78849bf3d10055d8a88


Brokewell Android Banking Trojan, md5: 8932768daaa490e27c7049ba772c8713 sha1: f5e24d031edf0ec9c67d98c9294d5904dae34394


Brokewell Android Banking Trojan, sha1: 4a870447d1ade26822f4ad03e21b9fdc3b3a658e sha256: 5ebb9e5cfe091ee8e00aa67c50a4aff2da90ce9eb6aa2b703a6e0bb3364359ce


Brokewell Android Banking Trojan, md5: a3dcd9c20ab80f0ebf20dc2f447e9388 sha256: 5ebb9e5cfe091ee8e00aa67c50a4aff2da90ce9eb6aa2b703a6e0bb3364359ce


Brokewell Android Banking Trojan, md5: a3dcd9c20ab80f0ebf20dc2f447e9388 sha1: 4a870447d1ade26822f4ad03e21b9fdc3b3a658e


GοοgΙe Chrοme / jcwAz.EpLIq.vcAZiUGZpK


ID Austria / zRFxj.ieubP.lWZzwlluca


Download next stage payload “p.zi”


filename: sports_platform_app-main.zip


sha256: 45c991529a421104f2edf03d92e01d95774bf54325f9107dd4139505912a0c1e


filename: imageDetails.js


sha256: 33617f0ac01a0f7fa5f64bd8edef737f678c44e677e4a2fb23c6b8a3bcd39fa2


filename: npl


sha256: f9ca12321fb91157cce8513e935810d1c2005ab0739322b474f0cb4af2605d16


filename: pay


sha256: 977a9024962102b02128d391c0543c63328d3f26701eca1a5d282af4d493dc2e


vpn.sessings (cobalt strike loader DLL)


KageNoHitobito and DoNex/DarkRace Ransomware File


Infrastructure / Sinkholed by Sekoia


Sharpil RAT


Related Sharp Stealer (sharp_build.exe)


DefragmentSrv.exe


justice.exe


wayzgoose[%n].dll


DragonForce Ransomware, sha1: e164bbaf848fa5d46fa42f62402a1c55330ef562 sha256: 1250ba6f25fd60077f698a2617c15f89d58c1867339bfd9ee8ab19ce9943304b


DragonForce Ransomware, md5: d54bae930b038950c2947f5397c13f84 sha256: 1250ba6f25fd60077f698a2617c15f89d58c1867339bfd9ee8ab19ce9943304b


DragonForce Ransomware, md5: d54bae930b038950c2947f5397c13f84 sha1: e164bbaf848fa5d46fa42f62402a1c55330ef562


Hosting payload over HTTP


Mozilla/5.0 (Windows NT; Windows NT 10.0; en-US) WindowsPowerShell/5.1.17763.2183

User agent -PowerShell user agent


-Ransom note


TeamViewer.exe [IOC Info]


BetterShaders Setup 1.0.3.exe [IOC Info]


Software.exe [IOC Info]


filename: jfhdsjfh34frjkfs23432.hta


md5: 6cdc79655e9866e31f6c901d0a05401d


filename: flutter.hta


md5: dbf196ccb2fe4b6fb01f93a603056e55


filename: plugins.hta


md5: 37b10e4ac08534ec36a59be0009a63b4


filename: bjihfsdfhdjsh234234.hta


md5: d907284734ea5bf3bd277e118b6c51f0


md5: 2a47ea398397730681f121f13efd796f


md5: 6ab0466858eb6d71d830e7b2e86dab03


filename: 4358437iufgdshvjy5843765.hta


md5: ecc65e6074464706bb2463cb74f576f7


filename: min-js.hta


md5: da529e7b6056a055e3bbbace20740ee9


filename: nodejsmin.hta


md5: cadafc6a91fc4bba33230baed9a8a338


filename: hta.dll


md5: 1e5285ee087c0d73c76fd5b0b7bc787c


md5: f74c59fd5b835bf7630fbf885d6a21aa


md5: 3cc6602a1f8a65b5c5e855df711edeb0


filename: SummitOfBion.dll


md5: 990bfd8bf27be13cca9fa1fa07a28350


md5: 29fa44d559b4661218669aa958851a59


md5: 26bde2d6a60bfc6ae472c0e9c8d976e2


md5: eceb986d166526499f8f37fd3efd44db


md5: 2a680cf1e54f1a1f585496e14d34c7e9


filename: issas.exe


md5: 76ca50a71e014aa2d089fed1251bf6cd


filename: quick.exe


md5: 71b285c8903bb38d16d97c1042cbeb92


filename: cove.exe


md5: 9684bf8955b348540446df6b78813cdb


filename: salso.exe


md5: 48e1e695258a23742cd27586e262c55a


md5: 4ba7ca56d1a6082f0303f2041b0c1a45


filename: FI_Ejec1.exe


md5: 6cda3b5940a2a97c5e71efcd1dd1d2ca


filename: Grant_of_Risk_and_HardShip_Allowances_Mar_24.pdf


md5: 30796f8fb6a8ddc4432414be84b8a489


md5: 8740d186877598297e714fdf3ab507e9


filename: msdr.dll


md5: abeaa649bd3d8b9e04a3678b86d13b6b


filename: braveservice.dll


md5: b3a5e819e3cf9834a6b33c606fc50289


filename: salso.dll


md5: 312923e0baf9796a846e5aad0a4d0fb6


md5: 1d7fc8a9241de652e481776e99aa3d46


md5: 760ff1f0496e78d37c77b2dc38bcbbe4


filename: FI_Ejec13234.dll


md5: fa5a94f04e684d30ebdc4bf829d9c604


filename: All details.xlam


md5: f436aa95838a92b560f4cd1e1c321fe7


filename: Imp message from dgms.xlam


md5: afb24ec01881b91c220fec8bb2f53291


filename: oleObject1.bin


md5: 7bb8f92770816f488f3a8f6fe25e71a7


filename: oleObject2.bin


md5: 303b75553c5df52af087b5b084d50f98


filename: mulhiar tarsnib.exe


md5: 898df40a8f2a6702c0be059f513fab9d


md5: e3cf6985446cdeb2c523d2bc5f3b4a32


filename: ShareX.exe


md5: bb5b569b38affb12dfe2ea6d5925e501


filename: Analytics Based Card.exe


md5: 7cdc81a0f5c5b2d341de040a92fdd23a


filename: vdhrh madtvin.exe


keylogger, md5: 81b436873f678569c46918862576c3e0


filename: Mailbird.exe


md5: e291fffbcb4b873b76566d5345094567


filename: All details.xlam.xlsx


md5: 9d337c728c92bdb227055e4757952338


filename: Imp message from dgms.xlam.xlsx


md5: d7b909f611e8f9f454786f9c257f26eb


Ports 9149, 15597, 18518, 26791, 28329


Ports 909, 67, 65, 121


Ports 8888, 9009, 33678


filename: out_czlrh.js


sha256: db265ea1732935f61e8d0f7a20a8adc54e20af71b3cf4a737714cd3377c838f6


filename: out_bdrts.js


sha256: fad25892e5179a346cdbdbba1e40f53bd6366806d32b57fa4d7946ebe9ae8621


filename: Letter_c89_00c568610-93e92634a4425-2643w5.js


sha256: f8fc9b40b946b742d6044f291914439727e1a7f53ea87562446f682b26cce65a


filename: Letter_p64_18t678677-53r17785m9284-51810.js


sha256: e8979741f0355a47dae575ead8c829df47f282b4533ec1be4d63086515f9c449


filename: Letter_h85_79o750478-05f74851h3126-2101c9.js


sha256: 08e82f1c0a033ab295b4d342c53970e4528e20933c614bda3bbc5d57bab20651


filename: Letter_e97_58z949277-25h33503u6712-8630h9.js


sha256: 4f52b4a2a781f366ed534d8c4b2fafef48a7848c4c20b4229b98747ca8ab06d3


filename: Letter_n95_52a858194-29r719420963-6497k0.js


sha256: 68e1caf530366b1890993185157c01161b3d625063d75a41c88d2d1bb8edfe02


filename: Letter_n54_61h288642-67072023a7462-0068w3.js


sha256: 6d7a94b7551f15732e193a07357375b98b463f0dce6b1fed871a42fcbdde9f48


filename: Letter_w54_49a010638-34d3814907559-826708.js


sha256: 2b026343214c3d2c10fdfa9b04b7694e57ee8d3605fbf9a2e127fe6fa9a58309


filename: Letter_a51_80q687203-83q18993e4985-2463m8.js


sha256: 96212917b7b0dc881332db7ece0bacfe21d9ac713af1abe078f6d3e74baacd01


filename: Letter_k40_07w820587-40d85841n3311-9847w6.js


sha256: ba3fa920708db856737a66f70e2c7e86bba73c73836f7f30c2ce42cd70d0c5bd


filename: Letter_w45_72u406742-64b48323u0125-6834a8.js


sha256: 7dbebb7c76511fc063b5ace0a9359b655f66a55a494200b8fd11905c78b5fb90


filename: Letter_c41_84a683017-72b44707a1598-464809.js


sha256: 6e892aa13cbd4b71a1c476207abddb1ef830be04999809b4ef569488a37e47e0


filename: Letter_d94_87w030300-54q44583y8818-2571b1.js


sha256: 7dff08656413a737483ecee2a50e412338ebfee3d36a1a5c04e74b25949b2306


filename: Letter_n42_88u446059-37f35802c4925-3726c4.js


sha256: 75db4709428310c76656bf76f5de267ab490e43284312b374baf7582108300a9


filename: Letter_q50_63b944998-11n0283407179-6803z4.js


sha256: c172abd808cc6216b309bc307fe69b821c7eaed35f874fd4684ab33b4291f95a


filename: Letter_u79_20w517865-65u0451500340-7186n6.js


sha256: 5fb093a9348fcf4a81befda978c948796a8319fcabe7899c2cf5ba1419ec9d35


filename: Doc_k33_80c092144-18b83503a0451-2328f3.js


sha256: 9fc48724cb9f70f774f7ed9e809e49979bd089dfd641896d8d5e3026f049b0af


filename: Doc_d43_77n194090-93d18260r9745-8376n8.js


sha256: c122596e25a4dad1d46d4ab983f4ef15bfa7b65582b7c311f404036766498105


filename: Doc_i93_65b929565-14q83944h2246-4336m9.js


sha256: e8e76b851fc78d87fe58ad7d29bc6356a8965236d1b96c5f572334dd695d5de9


filename: Doc_f98_58y658432-41b75184w6866-3921d1.js


sha256: 791c28d4201e8b9ea5162fbee3908feb34793b1c51f5aaedc43916e86068248d


filename: Doc_q80_66b246938-8806024o9126-5008b9.js


sha256: caf8295570e8a8244c7099a8eabfd1bd55ea50f026b4461e9f0f5425d54703e8


filename: Doc_m42_81h118103-88o62135w8623-1999q9.js


sha256: 092962bc268390debf17cd148d03147cdf919e442e61c92de01eac3bdb34b1c1


filename: Doc_q35_64r067638-76a88713i3606-7493z7.js


sha256: 24cb279eebcd49e1327905ab2bd19b9b2e09efa3e0a5e1875f3989c398a5da81


filename: Letter_a53_97o318845-76f99823h9630-6740o2.js


sha256: 8f7a90b540f38712c9c1a5359c6333bbe1091102d6f621b22321e08352c84cfc


filename: Letter_e79_76r514120-22p50913h4206-6851k8.js


sha256: 0737fa0b403fab17331c9835497a4f3b2955543e2fac85009dcc66df41a015f8


filename: Letter_h21_36b948317-03a99748y3026-8660b8.js


sha256: 2118c5b95d5d57492b2e8b8c0403e23b21acc4ff50282f8b6007ba89adfaa992


filename: Letter_d19_97q517001-52z26072a2831-7463c5.js


sha256: a557f891f4d50e458d745c7eaf7d0be3eceea36f0398097e977cd3f6ec463875


filename: Letter_t47_39u197519-27b72941k6563-0250a2.js


sha256: 4d9274cfe7a2bd9a125352271d1634708e1f9b1d70b056d1c1950cb98b8f91ff


filename: Letter_z27_59o257127-14z25707d6443-0555c6.js


sha256: 3584ca9c1e7e0a38e47f59bb16c21203a60833d0f826294d535a98e7ca76d9c1


filename: Letter_b42_17m561933-22h44391r3880-8554u2.js


sha256: 63283e012f067a3ffb27ed4fe6803f740c80f6f65213fe5507f0cd1ee0019b96


filename: Letter_t48_42a243569-81n19660f9965-6999u0.js


sha256: 828ef3e4ca064891836913015c48ac9807ecd43b32f6e7e4bff29b9fd2e218c9


filename: Letter_o40_58g357086-56q83656a4371-9752z1.js


sha256: 780b970dad15835d138546be9b615fc1b4124c1060a8efd91b9c52f9c3160d5b


filename: msedgeview.msi


sha256: 232f8f8dc9e5b9723c43c78cb942cc810ef56e305e4bd650110a484334f568a8


filename: 950b84.msi


sha256: f5bf914415faf7587958bbdc3312536fd9abea647f1541d44d2e757f0e683650


filename: 6838aa.msi


sha256: 08075e8a6dcc6a5fca089348edbd5fc07b2b0b26a26a46e0dd401121fdaa88d3


filename: 4178fc.msi


sha256: ff5e40fc794e56fd78feb6eb6b30794970f7cdb4a767c4095e2d20a90bb0efe8


filename: slack.msi


sha256: b9dbe9649c761b0eee38419ac39dcd7e90486ee34cd0eb56adde6b2f645f2960


filename: qual.msi


sha256: ee1e5b80a1d3d47c7703ea2b6b64ee96283ab3628ee4fa1fef6d35d1d9051e9f


filename: avp.msi


sha256: dcae57ec4b69236146f744c143c42cc8bdac9da6e991904e6dbf67ec1179286a


filename: msedge.dll


sha256: 7018c43ee38190eae122797869865fd808817f31d766575b43b118ae176c0c68


filename: Update_c7e5e126.dll


sha256: fc21a125287c3539e11408587bcaa6f3b54784d9d458facbc54994f05d7ef1b0


filename: Update_2ffaca76.dll


sha256: 65da6d9f781ff5fc2865b8850cfa64993b36f00151387fdce25859781c1eb711


filename: Update_8d74674.dll


sha256: 805b59e48af90504024f70124d850870a69b822b8e34d1ee551353c42a338bf7


filename: Update_17a3b1e7.dll


sha256: 7206eafc475f246e7c9c258afdaaa64b5193c1c7427d927be417e53dec890078


filename: mbae-api-na.dll


sha256: 9856b816a9d14d3b7db32f30b07624e4bcda7f1e265a7bb7a3e3476bfd54a759


sha256: 0ede3cbe821e4f083fc119274f069c77e64a6a7e8a2c16530317b826a0939979


sha256: 17ddc339b14845bc9d67c5c3cd9a0e617387cc0569131ff3641035d82043effa


sha256: 18d60c9c807da021bc2c31e3ba7ec2737865a8c96060134caa3cf033e43e26fe


sha256: ae610eb8f8622653b9be9692a7d2a680b0c2154022704ca58af0eaeed0066d03


sha256: 7f97adff1d298ccf1f3c7991fcb01008dda22722ebbc11af48fcbf2adb58afb4


filename: forcedelctl.dll


sha256: 3bca1dcaef4430272b9029c9a4bc8be0d45ecff66e8de8679ed30d8afab00f6f


UpdateSetup.UpdateSetup_1.3.36.292_x86 (popupwrapper.exe)


64-bit exe downloaded


shellcode downloaded


C:\Program Files\eScan\VERSION.DLL


Scheduled task


C:\Program Files\Microsoft SQL Server\SpellChecking\MsSpellChecking.DLL


C:\Program Files\Microsoft SQL Server\SpellChecking\MsSpellCheckingHost.DLL


Shellcode


Certificate


Key


C&C


elimp


OpenSans


sha256: 31dfba1b102bbf4092b25e63aae0f27386c480c10191c96c04295cb284f20878


sha1: 529763ac53562be3c1bb2c42bcab51e3ad8f8a56


sha256: 8e96d15864ec0cc6d3976d87e9e76e6eeccc23c551b22dcfacb60232773ec049


sha256: b0f94d84888dffacbc10bd7f9983b2d681b55d7e932c2d952d47ee606058df54


sha1: 31070c2ea30e6b4e1c270df94be1036ae7f8616b


sha256: f656a418fca7c4275f2441840faaeb70947e4f39d3826d6d2e50a3e7b8120e4e


WAExp


cuthead


TomBerBil


FRP client


SSH server


Server from SoftEther VPN


of GooseEgg binary DefragmentSrv.exe


of GooseEgg binary justice.exe


of wayzgoose[%n].dll – where %n is a random number


Atera Agent


Atera Agent, filename: Tejasnetworks.com.webinar.msi


Atera Agent, sha256: 14c270cf53a50867e42120250abca863675d37abf39d60689e58288a9e870144


Atera Agent, filename: Polaristek.msi


Atera Agent, sha256: 638c7a4f833dc95dbab5f0a81ef03b7d83704e30b5cdc630702475cc9fff86a2


Atera Agent karel.com.tr.telekomünikasyonWebsemineri.msi, filename: comviva.com.webinar.msi


Atera Agent karel.com.tr.telekomünikasyonWebsemineri.msi, sha256: dd2675e2f6835f8a8a0e65e9dbc763ca9229b55af7d212da38b949051ae296a5


Atera Agent, filename: setup.aleh.aleh.msi


Atera Agent, sha256: 165a80f6856487b3b4f41225ac60eed99c3d603f5a35febab8235757a273d1fd


Atera Agent (1).msi, filename: setup.aleh.aleh


Atera Agent (1).msi, sha256: d22fd0cdd6ace24e117d7330e9996a2809c2c2cb280b12f9ea43c484d2bfcfd4


Atera Agent, filename: BLUMENTAL.WEBINAR.msi


Atera Agent, sha256: f9c1a117de8519060a3bf189e72277e895345b8fece73fc0d750946c7f288367


Atera Agent, filename: IronSword.msi


Atera Agent, sha256: 2722e289767ae391e3c3773b8640a8b9f6eb24c6a9d6e541f29c8765f7a8944b


Atera Agent מילגה.msi


Atera Agent תוכנת תיירות.msi


Atera Agent Leonardo Hotels-tourism, filename: software.msi


Atera Agent Leonardo Hotels-tourism, sha256: c2f95299d8aa912e1b753f3f0780a00ea6e8b5dab0245d77fcf3b6499677c328


Atera Agent, filename: Salary.msi


Atera Agent, sha256: e89f48a7351c01cbf2f8e31c65a67f76a5ead689bb11e9d4918090a165d4425f


Atera Agent virtual-library.msi


Atera Agent


Atera Agent, filename: digitalform.msi


Atera Agent, sha256: 09e09503962a2a8022859e72b86ad8c69dcbf79839b71897c0bf8a4c4b9f4dd6


Atera Agent תכנית מועצת מחוז גולן.msi


Malicious Zip archive


Malicious Zip archive, filename: Tejasnetworks.com.webinar.zip


Malicious Zip archive, sha256: 85103955e35a1355ce68a92eaedd8f9376de1927d95bf12657b348dea6a8077b


Malicious Zip archive, filename: comviva.com.webinar.zip


Malicious Zip archive, sha256: bab601635aafeae5fbfe1c1f7204de17b189b345efd91c46001f6d83efbb3c5a


Malicious Zip archive Leonardo Hotels-tourism, filename: software.zip


Malicious Zip archive Leonardo Hotels-tourism, sha256: 7daab239271e088f04cae95627cc0066f48a1b178a1ff60b1140aa729126e928


Malicious Zip archive, filename: Salary.zip


Malicious Zip archive, sha256: cc4cc20b558096855c5d492f7a79b160a809355798be2b824525c98964450492


Malicious Zip archive תכנית מועצת מחוז


Malicious Zip archive, filename: digitalform.zip


Malicious Zip archive, sha256: f17f6866f4748e6e762752062acdf983d3b083371db83503686b91512b9bcae3


Malicious Zip archive, filename: Polaristek.zip


Malicious Zip archive, sha256: 7e6a5e32596b99f45ea9099a14507a82c10a460c56585499d7cd640f2625567f


Atera Agent Distribution


Atera Agent


Atera Agent, filename: Tejasnetworks.com.webinar.msi


Atera Agent, sha256: 14c270cf53a50867e42120250abca863675d37abf39d60689e58288a9e870144


Atera Agent, filename: Polaristek.msi


Atera Agent, sha256: 638c7a4f833dc95dbab5f0a81ef03b7d83704e30b5cdc630702475cc9fff86a2


Atera Agent karel.com.tr.telekomünikasyonWebsemineri.msi, filename: comviva.com.webinar.msi


Atera Agent karel.com.tr.telekomünikasyonWebsemineri.msi, sha256: dd2675e2f6835f8a8a0e65e9dbc763ca9229b55af7d212da38b949051ae296a5


Atera Agent, filename: setup_aleh_aleh.msi


Atera Agent, sha256: 165a80f6856487b3b4f41225ac60eed99c3d603f5a35febab8235757a273d1fd


Atera Agent setup_aleh_aleh (1).msi


Atera Agent, filename: BLUMENTAL.WEBINAR.msi


Atera Agent, sha256: f9c1a117de8519060a3bf189e72277e895345b8fece73fc0d750946c7f288367