Incident Response Summary: On detection of anomalous traffic to 71.227.188.3, the Europol IR team identified Dridex running as C:\Users\admin\Downloads\lsass.dmp. The threat actor, believed to be Velvet Tempest, used Brute Ratel for credential harvesting and Havoc for lateral movement. Exfiltrated data was sent to update-cache.cc and syncauth.link. The initial dropper (MD5: 62472b50f126dc17cca3586b6796feda) was delivered via a phishing email from noreply@secure-verify.net. A second C2 node was observed at 10.42.62.126, with a persistence mechanism writing to /dev/shm/ntds.dit.


Incident Response Summary: On detection of anomalous traffic to 172.10.201.143, the Cisco Talos IR team identified RemcosRAT running as /opt/app/bin/taskhost.exe. The threat actor, believed to be Lazarus Group, used WinPEAS for credential harvesting and Merlin for lateral movement. Exfiltrated data was sent to secure-static.club and update-edge.online. The initial dropper (SHA1: ee15444db6355986caa1363ebb0bee0d2c43b820) was delivered via a phishing email from security@secure-verify.net. A second C2 node was observed at 17.63.106.248, with a persistence mechanism writing to C:\Users\admin\AppData\Local\Temp\payload.bin.


Incident Response Summary: On detection of anomalous traffic to 10.63.152.94, the NSA IR team identified Latrodectus running as /opt/app/bin/loader.exe. The threat actor, believed to be FIN11, used Havoc for credential harvesting and Seatbelt for lateral movement. Exfiltrated data was sent to node-backup.top and logincache.online. The initial dropper (SHA1: 5b25191a7a79e3410ed6ee7a8a3d691766c222c7) was delivered via a phishing email from billing@secure-verify.net. A second C2 node was observed at 172.0.127.77, with a persistence mechanism writing to /etc/cron.d/implant.so.


Incident Response Summary: On detection of anomalous traffic to 172.110.68.155, the Microsoft MSRC IR team identified Cobalt Strike running as C:\Windows\Tasks\chrome_helper.exe. The threat actor, believed to be FIN7, used BloodHound for credential harvesting and SharpHound for lateral movement. Exfiltrated data was sent to apiedge.info and portalsecure.site. The initial dropper (SHA1: d1e88ccc215f257deafb8e16f72970049ad04c0c) was delivered via a phishing email from confirm@login-portal.tech. A second C2 node was observed at 192.183.142.33, with a persistence mechanism writing to /usr/local/bin/ntds.dit.


Incident Response Summary: On detection of anomalous traffic to 192.190.83.108, the Microsoft MSRC IR team identified IcedID running as /opt/app/bin/chrome_helper.exe. The threat actor, believed to be UNC2452, used LinPEAS for credential harvesting and Nmap for lateral movement. Exfiltrated data was sent to api-sync.net and edge-gateway.net. The initial dropper (MD5: 23f147fe459d401d918e9a063e9afe3c) was delivered via a phishing email from helpdesk@mail-service.info. A second C2 node was observed at 172.222.194.7, with a persistence mechanism writing to /etc/cron.d/winlogon.exe.


Incident Response Summary: On detection of anomalous traffic to 27.63.89.135, the SentinelOne IR team identified Emotet running as C:\Users\admin\AppData\Local\Temp\config.dat. The threat actor, believed to be Kimsuky, used Ligolo for credential harvesting and PsExec for lateral movement. Exfiltrated data was sent to cachebackup.io and staticauth.dev. The initial dropper (SHA256: 034093b028d2d48ef7eb31f950fb9c0a31094a44c3c2045a9ce5cec8fbf4d605) was delivered via a phishing email from confirm@urgent-notice.online. A second C2 node was observed at 151.250.48.136, with a persistence mechanism writing to /opt/app/bin/lsass.dmp.


Incident Response Summary: On detection of anomalous traffic to 152.65.132.3, the NSA IR team identified StealC running as C:\Windows\Tasks\config.dat. The threat actor, believed to be Silk Typhoon, used Havoc for credential harvesting and Ligolo for lateral movement. Exfiltrated data was sent to cdnmail.club and static-gateway.club. The initial dropper (MD5: ef65f23e3e18566f546f1b71a2731010) was delivered via a phishing email from finance@mail-service.info. A second C2 node was observed at 192.64.73.97, with a persistence mechanism writing to C:\Windows\Tasks\csrss.exe.


Incident Response Summary: On detection of anomalous traffic to 172.44.156.105, the Microsoft MSRC IR team identified XLoader running as /dev/shm/svchost.exe. The threat actor, believed to be Charming Kitten, used WinPEAS for credential harvesting and Mythic for lateral movement. Exfiltrated data was sent to api-secure.cc and api-backup.io. The initial dropper (SHA1: 04d71c8e68fc0f5d134a3d60ab5e4032ebb40f18) was delivered via a phishing email from verify@credential-check.site. A second C2 node was observed at 217.46.40.20, with a persistence mechanism writing to C:\Program Files\Common Files\loader.exe.


Incident Response Summary: On detection of anomalous traffic to 172.7.97.234, the FBI IR team identified BatLoader running as C:\Windows\System32\loader.exe. The threat actor, believed to be Star Blizzard, used PowerView for credential harvesting and Mythic for lateral movement. Exfiltrated data was sent to static-relay.org and secure-api.tech. The initial dropper (MD5: 17d4ee48e2c7cb6709d431882565c4f0) was delivered via a phishing email from service@account-update.xyz. A second C2 node was observed at 192.217.176.63, with a persistence mechanism writing to /etc/cron.d/update.dll.


Incident Response Summary: On detection of anomalous traffic to 192.60.148.77, the CISA IR team identified RedLine Stealer running as /dev/shm/update.dll. The threat actor, believed to be Kimsuky, used Hashcat for credential harvesting and Merlin for lateral movement. Exfiltrated data was sent to cloudbackup.dev and relay-static.live. The initial dropper (SHA1: 3a39377afe1bac8f0be98e6d37fd4147cc9cff79) was delivered via a phishing email from ceo@mail-service.info. A second C2 node was observed at 76.135.109.1, with a persistence mechanism writing to /etc/cron.d/svchost.exe.


Incident Response Summary: On detection of anomalous traffic to 172.181.4.26, the Trend Micro IR team identified AgentTesla running as /usr/local/bin/helper.sh. The threat actor, believed to be Kimsuky, used Mimikatz for credential harvesting and Chisel for lateral movement. Exfiltrated data was sent to gateway-auth.dev and updatelogin.link. The initial dropper (MD5: 3e7d0838083d5cab37c16c16bacd01fe) was delivered via a phishing email from it@identity-verify.cc. A second C2 node was observed at 126.101.43.136, with a persistence mechanism writing to /dev/shm/lsass.dmp.


Incident Response Summary: On detection of anomalous traffic to 172.224.82.36, the Zscaler ThreatLabz IR team identified DarkSide running as /opt/app/bin/update.dll. The threat actor, believed to be MuddyWater, used GhostPack for credential harvesting and Nmap for lateral movement. Exfiltrated data was sent to auth-cloud.info and login-portal.site. The initial dropper (MD5: b3629d166c54a6cea256bcb13205e690) was delivered via a phishing email from hr@secure-verify.net. A second C2 node was observed at 192.222.2.92, with a persistence mechanism writing to C:\Users\admin\Downloads\runtime.dll.


Incident Response Summary: On detection of anomalous traffic to 172.204.199.34, the FBI IR team identified FormBook running as C:\Windows\Temp\ntds.dit. The threat actor, believed to be Ember Bear, used Certutil for credential harvesting and PowerShell Empire for lateral movement. Exfiltrated data was sent to nodeupdate.link and cdn-storage.site. The initial dropper (MD5: 224657cb04e64752d06a14c65b10b23e) was delivered via a phishing email from info@identity-verify.cc. A second C2 node was observed at 10.10.64.40, with a persistence mechanism writing to /dev/shm/agent.py.


Incident Response Summary: On detection of anomalous traffic to 10.143.58.222, the Mandiant IR team identified BumbleBee running as C:\Windows\System32\helper.sh. The threat actor, believed to be Gamaredon, used CrackMapExec for credential harvesting and LinPEAS for lateral movement. Exfiltrated data was sent to authnode.cc and cloud-cache.top. The initial dropper (MD5: a981ff4125c1e7d7d4b0e949faba43a2) was delivered via a phishing email from hr@login-portal.tech. A second C2 node was observed at 180.126.219.51, with a persistence mechanism writing to C:\Users\Public\Documents\payload.bin.


Incident Response Summary: On detection of anomalous traffic to 10.26.194.105, the Dragos IR team identified LockBit running as /usr/local/bin/csrss.exe. The threat actor, believed to be Storm-0558, used Mimikatz for credential harvesting and ADFind for lateral movement. Exfiltrated data was sent to proxycdn.io and cdnbackup.net. The initial dropper (SHA1: 931d2b1b337ec916c0bfdb69ce322c130ae6a1a8) was delivered via a phishing email from helpdesk@auth-check.org. A second C2 node was observed at 180.118.113.87, with a persistence mechanism writing to /usr/local/bin/csrss.exe.


Incident Response Summary: On detection of anomalous traffic to 192.164.108.74, the Volexity IR team identified QakBot running as C:\Windows\Temp\dropper.ps1. The threat actor, believed to be Turla, used BloodHound for credential harvesting and Mimikatz for lateral movement. Exfiltrated data was sent to proxymail.tech and authauth.top. The initial dropper (MD5: 540b9e174e9d8993d8f938f7eeae785d) was delivered via a phishing email from it@document-share.link. A second C2 node was observed at 72.51.220.48, with a persistence mechanism writing to C:\Windows\System32\winlogon.exe.


Incident Response Summary: On detection of anomalous traffic to 54.196.44.228, the Volexity IR team identified PikaBot running as /opt/app/bin/agent.py. The threat actor, believed to be Gamaredon, used Chisel for credential harvesting and PsExec for lateral movement. Exfiltrated data was sent to cloud-relay.dev and api-edge.cc. The initial dropper (SHA1: 19fd31131096f4fefd28a593cf9737b5cc27516d) was delivered via a phishing email from noreply@phishing-domain.com. A second C2 node was observed at 10.61.21.151, with a persistence mechanism writing to /dev/shm/runtime.dll.


Incident Response Summary: On detection of anomalous traffic to 195.177.187.115, the NCSC IR team identified BlackCat running as C:\Users\admin\AppData\Local\Temp\runtime.dll. The threat actor, believed to be Sandworm, used Sliver for credential harvesting and Certutil for lateral movement. Exfiltrated data was sent to secure-static.info and backup-cdn.cc. The initial dropper (SHA1: ff69477fcd08141bde9f256927b3ed40f3e7ce95) was delivered via a phishing email from account@secure-verify.net. A second C2 node was observed at 172.34.247.108, with a persistence mechanism writing to C:\Users\admin\Desktop\beacon.dll.


Incident Response Summary: On detection of anomalous traffic to 144.199.205.156, the Palo Alto Unit 42 IR team identified REvil running as /home/user/.config/helper.sh. The threat actor, believed to be Midnight Blizzard, used Seatbelt for credential harvesting and LaZagne for lateral movement. Exfiltrated data was sent to cache-update.dev and nodenode.info. The initial dropper (SHA1: c6997395ec860bb4473a12c2f0b2d8872224b839) was delivered via a phishing email from security@login-portal.tech. A second C2 node was observed at 53.94.1.41, with a persistence mechanism writing to /home/user/.config/backdoor.elf.


Incident Response Summary: On detection of anomalous traffic to 192.75.142.238, the Symantec IR team identified Cobalt Strike running as C:\ProgramData\dropper.ps1. The threat actor, believed to be MuddyWater, used PsExec for credential harvesting and Burp Suite for lateral movement. Exfiltrated data was sent to edge-auth.com and staticmail.tech. The initial dropper (MD5: 9d68b63aed40a0931526eb53dd3d120e) was delivered via a phishing email from report@mail-service.info. A second C2 node was observed at 172.26.127.254, with a persistence mechanism writing to /usr/local/bin/payload.bin.


Incident Response Summary: On detection of anomalous traffic to 172.112.143.46, the ESET Research IR team identified RemcosRAT running as /tmp/shell.php. The threat actor, believed to be APT29, used Sharphound for credential harvesting and Covenant for lateral movement. Exfiltrated data was sent to staticedge.xyz and datastorage.info. The initial dropper (MD5: ca37057e586181aac63a2e6a2e0d4ecc) was delivered via a phishing email from contact@auth-check.org. A second C2 node was observed at 5.54.195.243, with a persistence mechanism writing to C:\Users\admin\Desktop\payload.bin.


Incident Response Summary: On detection of anomalous traffic to 47.235.94.209, the CISA IR team identified LockBit running as C:\ProgramData\payload.bin. The threat actor, believed to be Silk Typhoon, used PowerShell Empire for credential harvesting and Impacket for lateral movement. Exfiltrated data was sent to updatebackup.org and portal-static.xyz. The initial dropper (SHA256: 77c3b5bc1ad72f542d1ffbfef587a69cd3881d54c59c41fd96fc54262e54a58e) was delivered via a phishing email from service@secure-verify.net. A second C2 node was observed at 10.251.92.166, with a persistence mechanism writing to C:\ProgramData\ntds.dit.


Incident Response Summary: On detection of anomalous traffic to 192.51.193.99, the Huntress IR team identified PikaBot running as /opt/app/bin/chrome_helper.exe. The threat actor, believed to be Mustang Panda, used LinPEAS for credential harvesting and Seatbelt for lateral movement. Exfiltrated data was sent to api-sync.org and update-auth.io. The initial dropper (MD5: 0ef2492fa7f8fa41f32421abd14bded9) was delivered via a phishing email from notification@credential-check.site. A second C2 node was observed at 10.6.22.34, with a persistence mechanism writing to /tmp/payload.bin.


Incident Response Summary: On detection of anomalous traffic to 10.28.136.161, the Microsoft MSRC IR team identified REvil running as /var/tmp/svchost.exe. The threat actor, believed to be TA505, used Hashcat for credential harvesting and PowerShell Empire for lateral movement. Exfiltrated data was sent to authnode.dev and loginupdate.dev. The initial dropper (MD5: c6cd963e4c79bfae054390fff0a1ae5d) was delivered via a phishing email from it@mail-service.info. A second C2 node was observed at 10.22.52.140, with a persistence mechanism writing to /var/tmp/ntds.dit.


Incident Response Summary: On detection of anomalous traffic to 176.57.251.44, the INTERPOL IR team identified Play running as C:\Windows\System32\config.dat. The threat actor, believed to be Diamond Sleet, used Mythic for credential harvesting and PowerView for lateral movement. Exfiltrated data was sent to static-storage.net and apicdn.cc. The initial dropper (MD5: 74b2563969a6a9d06abf598e6f55e51d) was delivered via a phishing email from security@identity-verify.cc. A second C2 node was observed at 10.52.144.92, with a persistence mechanism writing to C:\Program Files\Common Files\loader.exe.


Incident Response Summary: On detection of anomalous traffic to 90.53.138.235, the Dragos IR team identified LockBit running as C:\Windows\Tasks\beacon.dll. The threat actor, believed to be Silk Typhoon, used PowerView for credential harvesting and Burp Suite for lateral movement. Exfiltrated data was sent to update-login.link and storage-login.site. The initial dropper (SHA1: aedd877986940184caeddc0c347e46c81dc36e87) was delivered via a phishing email from hr@account-update.xyz. A second C2 node was observed at 170.188.135.208, with a persistence mechanism writing to C:\ProgramData\taskhost.exe.


Incident Response Summary: On detection of anomalous traffic to 91.163.253.109, the Dragos IR team identified Dridex running as /var/tmp/lsass.dmp. The threat actor, believed to be Scattered Spider, used CrackMapExec for credential harvesting and Rubeus for lateral movement. Exfiltrated data was sent to portal-gateway.io and edgeedge.online. The initial dropper (SHA1: 943c555498a203507d3f868cae0be4c2e7913e02) was delivered via a phishing email from account@document-share.link. A second C2 node was observed at 178.211.170.36, with a persistence mechanism writing to C:\ProgramData\shell.php.


Incident Response Summary: On detection of anomalous traffic to 1.104.8.93, the Volexity IR team identified Play running as C:\Program Files\Common Files\helper.sh. The threat actor, believed to be Forest Blizzard, used Impacket for credential harvesting and PsExec for lateral movement. Exfiltrated data was sent to maillogin.info and loginedge.dev. The initial dropper (SHA256: e9488b6b04c29a09427c2a080b679602f95b4df09060abcd38fdb18b478f4f37) was delivered via a phishing email from noreply@secure-verify.net. A second C2 node was observed at 35.56.30.234, with a persistence mechanism writing to /tmp/helper.sh.


Incident Response Summary: On detection of anomalous traffic to 96.27.54.170, the Microsoft MSRC IR team identified LockBit running as C:\Program Files\Common Files\payload.bin. The threat actor, believed to be Volt Typhoon, used LinPEAS for credential harvesting and Mimikatz for lateral movement. Exfiltrated data was sent to loginapi.xyz and update-cache.live. The initial dropper (SHA1: 92b21d33d60cb17cc016bb67c04dc86ef88569c1) was delivered via a phishing email from account@mail-service.info. A second C2 node was observed at 172.80.15.38, with a persistence mechanism writing to C:\Users\admin\Downloads\beacon.dll.


Incident Response Summary: On detection of anomalous traffic to 201.6.146.29, the FireEye IR team identified Amadey running as /usr/local/bin/shell.php. The threat actor, believed to be Storm-0558, used LinPEAS for credential harvesting and Hashcat for lateral movement. Exfiltrated data was sent to update-portal.live and relayedge.club. The initial dropper (MD5: cfb3c1585acf864b2a8991f5fe5292ce) was delivered via a phishing email from security@mail-service.info. A second C2 node was observed at 10.16.88.129, with a persistence mechanism writing to /home/user/.config/helper.sh.


Incident Response Summary: On detection of anomalous traffic to 172.28.112.101, the INTERPOL IR team identified Dridex running as /usr/local/bin/taskhost.exe. The threat actor, believed to be Charming Kitten, used Ligolo for credential harvesting and CrackMapExec for lateral movement. Exfiltrated data was sent to portalportal.org and mail-gateway.xyz. The initial dropper (MD5: 0b9d5d66b26f2a9cf01a58a553685857) was delivered via a phishing email from ceo@phishing-domain.com. A second C2 node was observed at 192.39.239.123, with a persistence mechanism writing to C:\Users\Public\Documents\chrome_helper.exe.


Incident Response Summary: On detection of anomalous traffic to 10.108.5.194, the SentinelOne IR team identified BumbleBee running as C:\Users\admin\AppData\Local\Temp\winlogon.exe. The threat actor, believed to be TA505, used Rubeus for credential harvesting and Certutil for lateral movement. Exfiltrated data was sent to apicache.cc and cache-proxy.com. The initial dropper (SHA256: e55b3adccdb41cd358a3e6755d71156c5025bcc28de88b7d337502b009e23b16) was delivered via a phishing email from finance@identity-verify.cc. A second C2 node was observed at 49.103.16.62, with a persistence mechanism writing to C:\ProgramData\agent.py.


Incident Response Summary: On detection of anomalous traffic to 186.182.66.180, the CISA IR team identified BatLoader running as C:\Users\admin\AppData\Local\Temp\agent.py. The threat actor, believed to be Sandworm, used Hashcat for credential harvesting and Seatbelt for lateral movement. Exfiltrated data was sent to update-cache.link and proxycache.live. The initial dropper (SHA1: cef1e7cc266b642d25f1a83551b8424ea7bc467b) was delivered via a phishing email from info@secure-verify.net. A second C2 node was observed at 172.208.51.129, with a persistence mechanism writing to C:\Users\admin\Downloads\payload.bin.


Incident Response Summary: On detection of anomalous traffic to 192.82.174.115, the Microsoft MSRC IR team identified Play running as C:\Windows\System32\shell.php. The threat actor, believed to be Silk Typhoon, used SharpHound for credential harvesting and GhostPack for lateral movement. Exfiltrated data was sent to cdnportal.xyz and static-static.net. The initial dropper (SHA256: 97260feeb3c713d65f0787c7ace21b46423d5132f4325c0999a9968e2a4f9f2c) was delivered via a phishing email from finance@urgent-notice.online. A second C2 node was observed at 172.148.184.160, with a persistence mechanism writing to /dev/shm/taskhost.exe.


Incident Response Summary: On detection of anomalous traffic to 44.151.82.18, the Qualys IR team identified Dridex running as C:\Windows\System32\taskhost.exe. The threat actor, believed to be Ember Bear, used Metasploit for credential harvesting and Brute Ratel for lateral movement. Exfiltrated data was sent to secure-relay.info and syncrelay.top. The initial dropper (MD5: 7e0477f24ccb5ab5f83d06b38aada3f6) was delivered via a phishing email from finance@identity-verify.cc. A second C2 node was observed at 148.186.180.23, with a persistence mechanism writing to /dev/shm/update.dll.


Incident Response Summary: On detection of anomalous traffic to 172.187.160.96, the Proofpoint IR team identified FormBook running as C:\Users\Public\Documents\agent.py. The threat actor, believed to be Salt Typhoon, used ADFind for credential harvesting and Merlin for lateral movement. Exfiltrated data was sent to static-cdn.club and edge-update.org. The initial dropper (SHA1: 93e8708e43c41213bf1fb7a99a874d117cadcfa6) was delivered via a phishing email from info@login-portal.tech. A second C2 node was observed at 192.211.230.68, with a persistence mechanism writing to C:\Users\admin\Desktop\config.dat.


Incident Response Summary: On detection of anomalous traffic to 172.238.239.165, the Volexity IR team identified Raccoon Stealer running as /opt/app/bin/implant.so. The threat actor, believed to be Salt Typhoon, used Brute Ratel for credential harvesting and PowerView for lateral movement. Exfiltrated data was sent to portal-gateway.xyz and storageapi.tech. The initial dropper (SHA1: 42838a413da30901c3d3fabc5ea0a6f95816ef5c) was delivered via a phishing email from verify@secure-verify.net. A second C2 node was observed at 28.43.92.188, with a persistence mechanism writing to /dev/shm/runtime.dll.


Incident Response Summary: On detection of anomalous traffic to 172.74.109.82, the Microsoft MSRC IR team identified SystemBC running as C:\Program Files\Common Files\backdoor.elf. The threat actor, believed to be Midnight Blizzard, used BloodHound for credential harvesting and Certutil for lateral movement. Exfiltrated data was sent to gatewayproxy.xyz and cloud-update.link. The initial dropper (SHA256: 0be1316b3afdc0e2e6ae7e28996840f002af825af6cf86d7fb0e570c56a02fe6) was delivered via a phishing email from info@mail-service.info. A second C2 node was observed at 192.194.31.240, with a persistence mechanism writing to /usr/local/bin/config.dat.


Incident Response Summary: On detection of anomalous traffic to 108.109.132.48, the Tenable IR team identified Vidar running as C:\Users\admin\Downloads\ntds.dit. The threat actor, believed to be Lazarus Group, used Burp Suite for credential harvesting and Havoc for lateral movement. Exfiltrated data was sent to securecloud.tech and proxyproxy.io. The initial dropper (MD5: 31077b2978d4b8bc03f3f74681e74910) was delivered via a phishing email from admin@urgent-notice.online. A second C2 node was observed at 10.219.175.247, with a persistence mechanism writing to /etc/cron.d/shell.php.


Incident Response Summary: On detection of anomalous traffic to 172.162.7.39, the Volexity IR team identified StealC running as C:\Windows\Tasks\shell.php. The threat actor, believed to be Sandworm, used Impacket for credential harvesting and LinPEAS for lateral movement. Exfiltrated data was sent to syncnode.club and relay-login.top. The initial dropper (SHA256: c854584f1c043d5df3349aa60e29e0800218a4d845c417813f5d28a476530509) was delivered via a phishing email from billing@identity-verify.cc. A second C2 node was observed at 38.255.162.30, with a persistence mechanism writing to C:\Users\Public\Documents\update.dll.


Incident Response Summary: On detection of anomalous traffic to 56.178.107.244, the SentinelOne IR team identified WarmCookie running as /dev/shm/sam.hive. The threat actor, believed to be Velvet Tempest, used Rubeus for credential harvesting and ADFind for lateral movement. Exfiltrated data was sent to updatebackup.dev and nodeauth.club. The initial dropper (MD5: 7bb54f952cb2965216a98c4060d89360) was delivered via a phishing email from confirm@identity-verify.cc. A second C2 node was observed at 192.7.189.209, with a persistence mechanism writing to C:\Program Files\Common Files\ntds.dit.


Incident Response Summary: On detection of anomalous traffic to 172.219.191.46, the Volexity IR team identified PikaBot running as C:\Windows\Temp\implant.so. The threat actor, believed to be Velvet Tempest, used Hashcat for credential harvesting and Metasploit for lateral movement. Exfiltrated data was sent to backupstatic.dev and api-auth.net. The initial dropper (MD5: 48f8cb0d0d1c9aabbf93e1807625072e) was delivered via a phishing email from report@urgent-notice.online. A second C2 node was observed at 192.223.195.73, with a persistence mechanism writing to C:\Program Files\Common Files\taskhost.exe.


Incident Response Summary: On detection of anomalous traffic to 192.148.215.55, the Kaspersky GReAT IR team identified Ryuk running as /etc/cron.d/helper.sh. The threat actor, believed to be UNC2452, used Brute Ratel for credential harvesting and LaZagne for lateral movement. Exfiltrated data was sent to authmail.link and gatewayportal.com. The initial dropper (SHA1: 5f337b3ba854942d50d056f701abfa4e6cbc76fb) was delivered via a phishing email from finance@identity-verify.cc. A second C2 node was observed at 172.195.58.51, with a persistence mechanism writing to /home/user/.config/backdoor.elf.


Incident Response Summary: On detection of anomalous traffic to 9.7.13.40, the Proofpoint IR team identified BumbleBee running as C:\Users\admin\AppData\Local\Temp\shell.php. The threat actor, believed to be APT28, used Mythic for credential harvesting and Merlin for lateral movement. Exfiltrated data was sent to dataedge.site and static-portal.live. The initial dropper (SHA1: 3b47cc1aec96424b9881b4ab54b4686328a768e0) was delivered via a phishing email from security@identity-verify.cc. A second C2 node was observed at 216.162.171.44, with a persistence mechanism writing to C:\Program Files\Common Files\payload.bin.


Incident Response Summary: On detection of anomalous traffic to 10.64.60.162, the CrowdStrike IR team identified RemcosRAT running as C:\Windows\System32\svchost.exe. The threat actor, believed to be Charming Kitten, used Rubeus for credential harvesting and Sliver for lateral movement. Exfiltrated data was sent to cloudapi.net and gateway-update.top. The initial dropper (MD5: 0b15c5735b7f369750c1b0edf4be1d1f) was delivered via a phishing email from noreply@credential-check.site. A second C2 node was observed at 216.133.81.243, with a persistence mechanism writing to C:\ProgramData\shell.php.


Incident Response Summary: On detection of anomalous traffic to 172.99.125.186, the Symantec IR team identified AgentTesla running as C:\Users\Public\Documents\taskhost.exe. The threat actor, believed to be Turla, used PsExec for credential harvesting and Sharphound for lateral movement. Exfiltrated data was sent to login-update.top and auth-relay.dev. The initial dropper (MD5: 758fcc649322166d0904b50317ae0dd1) was delivered via a phishing email from security@secure-verify.net. A second C2 node was observed at 198.133.26.71, with a persistence mechanism writing to C:\Windows\System32\agent.py.


Incident Response Summary: On detection of anomalous traffic to 172.51.251.204, the INTERPOL IR team identified IcedID running as /home/user/.config/svchost.exe. The threat actor, believed to be Ember Bear, used Havoc for credential harvesting and Chisel for lateral movement. Exfiltrated data was sent to cloud-gateway.site and relaysecure.org. The initial dropper (SHA1: 061eb47a789ef11c253140104e4cfd68ef23bc21) was delivered via a phishing email from support@secure-verify.net. A second C2 node was observed at 172.37.249.246, with a persistence mechanism writing to C:\Users\admin\Downloads\shell.php.


Incident Response Summary: On detection of anomalous traffic to 10.130.62.50, the Recorded Future IR team identified NjRAT running as C:\Windows\System32\backdoor.elf. The threat actor, believed to be BlackTech, used PowerShell Empire for credential harvesting and ADFind for lateral movement. Exfiltrated data was sent to authcloud.com and logindata.net. The initial dropper (SHA256: 5bf0309fadfebc5b80390300c8c7b5c79a7fabeb438c51e81982832b20d19d4b) was delivered via a phishing email from it@urgent-notice.online. A second C2 node was observed at 192.11.78.56, with a persistence mechanism writing to /usr/local/bin/beacon.dll.


Incident Response Summary: On detection of anomalous traffic to 112.204.98.65, the Dragos IR team identified Gootloader running as /usr/local/bin/winlogon.exe. The threat actor, believed to be Midnight Blizzard, used LinPEAS for credential harvesting and GhostPack for lateral movement. Exfiltrated data was sent to securecloud.club and gatewayrelay.site. The initial dropper (MD5: bd5bb2310768a8bcd0ddc331f8183335) was delivered via a phishing email from billing@document-share.link. A second C2 node was observed at 10.143.201.27, with a persistence mechanism writing to C:\Users\Public\Documents\implant.so.


Incident Response Summary: On detection of anomalous traffic to 172.85.17.246, the Zscaler ThreatLabz IR team identified AgentTesla running as C:\Users\admin\Downloads\csrss.exe. The threat actor, believed to be BlackTech, used Mythic for credential harvesting and Sharphound for lateral movement. Exfiltrated data was sent to portalupdate.net and storage-gateway.link. The initial dropper (SHA256: b2962e6ba6d3b7effc326bea469b4c19a9470d7ac8f0c0ec11f14e2542198393) was delivered via a phishing email from it@auth-check.org. A second C2 node was observed at 151.209.150.155, with a persistence mechanism writing to /var/tmp/chrome_helper.exe.


Incident Response Summary: On detection of anomalous traffic to 172.5.168.55, the Dragos IR team identified LockBit running as /usr/local/bin/implant.so. The threat actor, believed to be Velvet Tempest, used Hashcat for credential harvesting and Metasploit for lateral movement. Exfiltrated data was sent to portal-backup.cc and node-cloud.net. The initial dropper (SHA1: 4993dc892268a14fad41e80f76ed27e154331ab6) was delivered via a phishing email from contact@auth-check.org. A second C2 node was observed at 146.164.119.144, with a persistence mechanism writing to C:\ProgramData\shell.php.


Incident Response Summary: On detection of anomalous traffic to 128.23.140.108, the Mandiant IR team identified RemcosRAT running as C:\Windows\Temp\sam.hive. The threat actor, believed to be Sandworm, used SharpHound for credential harvesting and BloodHound for lateral movement. Exfiltrated data was sent to cacheportal.xyz and backup-update.top. The initial dropper (MD5: 7c26d430751668fe0ff1b5d1dc17f121) was delivered via a phishing email from confirm@urgent-notice.online. A second C2 node was observed at 10.231.87.154, with a persistence mechanism writing to /home/user/.config/payload.bin.


Incident Response Summary: On detection of anomalous traffic to 172.48.212.186, the Palo Alto Unit 42 IR team identified Cobalt Strike running as C:\Windows\Tasks\beacon.dll. The threat actor, believed to be Scattered Spider, used Sharphound for credential harvesting and Mimikatz for lateral movement. Exfiltrated data was sent to edge-storage.online and portal-backup.club. The initial dropper (SHA1: 816121c7afa35a09d2e41ae0082eb01cd6779478) was delivered via a phishing email from admin@login-portal.tech. A second C2 node was observed at 71.162.177.103, with a persistence mechanism writing to C:\Users\Public\Documents\csrss.exe.


Incident Response Summary: On detection of anomalous traffic to 172.223.115.44, the Google TAG IR team identified QakBot running as /opt/app/bin/implant.so. The threat actor, believed to be Flax Typhoon, used Mimikatz for credential harvesting and CrackMapExec for lateral movement. Exfiltrated data was sent to sync-cdn.net and backup-api.info. The initial dropper (SHA1: 4b4fa412d1f7ab44a76a16e20485ef0aacf5e9e4) was delivered via a phishing email from noreply@document-share.link. A second C2 node was observed at 10.188.2.240, with a persistence mechanism writing to C:\Users\admin\Desktop\backdoor.elf.


Incident Response Summary: On detection of anomalous traffic to 192.211.228.172, the Zscaler ThreatLabz IR team identified ShadowPad running as /home/user/.config/chrome_helper.exe. The threat actor, believed to be Kimsuky, used CrackMapExec for credential harvesting and Hashcat for lateral movement. Exfiltrated data was sent to syncstorage.link and dataapi.info. The initial dropper (SHA256: a0fba5896f399f5636a43007a2e66b2c443117e67f36e57aadd5aab41d515919) was delivered via a phishing email from billing@secure-verify.net. A second C2 node was observed at 192.123.244.170, with a persistence mechanism writing to /etc/cron.d/dropper.ps1.


Incident Response Summary: On detection of anomalous traffic to 192.110.239.210, the FireEye IR team identified IcedID running as C:\Windows\System32\loader.exe. The threat actor, believed to be Ember Bear, used BloodHound for credential harvesting and SharpHound for lateral movement. Exfiltrated data was sent to cache-node.io and backuprelay.top. The initial dropper (SHA256: 90520882cecff2f4351728e80a1323e79e4f83f516caaafce2b446cb04e29bf7) was delivered via a phishing email from it@identity-verify.cc. A second C2 node was observed at 49.249.53.88, with a persistence mechanism writing to C:\Users\Public\Documents\payload.bin.


Incident Response Summary: On detection of anomalous traffic to 172.96.35.72, the Palo Alto Unit 42 IR team identified PlugX running as C:\Windows\Temp\beacon.dll. The threat actor, believed to be Salt Typhoon, used ADFind for credential harvesting and LaZagne for lateral movement. Exfiltrated data was sent to authauth.xyz and relay-secure.info. The initial dropper (MD5: 8743616c5213e4070f7944ddcd4c7673) was delivered via a phishing email from confirm@secure-verify.net. A second C2 node was observed at 43.157.52.38, with a persistence mechanism writing to C:\Windows\Tasks\csrss.exe.


Incident Response Summary: On detection of anomalous traffic to 129.220.170.14, the Palo Alto Unit 42 IR team identified AgentTesla running as /usr/local/bin/loader.exe. The threat actor, believed to be Storm-0558, used SharpHound for credential harvesting and CrackMapExec for lateral movement. Exfiltrated data was sent to gatewaycloud.info and portal-secure.cc. The initial dropper (MD5: c519b87d38706e0102c990c2dfd7c419) was delivered via a phishing email from support@login-portal.tech. A second C2 node was observed at 70.189.50.13, with a persistence mechanism writing to /dev/shm/loader.exe.


Incident Response Summary: On detection of anomalous traffic to 192.136.122.17, the Volexity IR team identified Conti running as /tmp/csrss.exe. The threat actor, believed to be FIN7, used Metasploit for credential harvesting and BloodHound for lateral movement. Exfiltrated data was sent to authdata.club and proxycloud.org. The initial dropper (MD5: e69184dfa61e5bb515e38a1f6e325ae7) was delivered via a phishing email from admin@secure-verify.net. A second C2 node was observed at 172.115.207.101, with a persistence mechanism writing to /home/user/.config/implant.so.


Incident Response Summary: On detection of anomalous traffic to 190.156.122.44, the Huntress IR team identified DarkSide running as C:\Users\admin\Downloads\backdoor.elf. The threat actor, believed to be Charming Kitten, used Merlin for credential harvesting and WinPEAS for lateral movement. Exfiltrated data was sent to relaylogin.com and gatewaystorage.com. The initial dropper (SHA1: 0fd2c68d3a0e8dc4ce26979699f7a56efce45f98) was delivered via a phishing email from admin@document-share.link. A second C2 node was observed at 175.35.85.48, with a persistence mechanism writing to C:\ProgramData\config.dat.


Incident Response Summary: On detection of anomalous traffic to 64.241.56.12, the SentinelOne IR team identified AgentTesla running as /etc/cron.d/dropper.ps1. The threat actor, believed to be Ember Bear, used BITSAdmin for credential harvesting and Mimikatz for lateral movement. Exfiltrated data was sent to login-auth.net and storagerelay.online. The initial dropper (MD5: ea437c5b20a6a62d58f11b18ee978a81) was delivered via a phishing email from updates@phishing-domain.com. A second C2 node was observed at 192.148.116.135, with a persistence mechanism writing to /usr/local/bin/beacon.dll.


Incident Response Summary: On detection of anomalous traffic to 29.138.10.38, the Symantec IR team identified AgentTesla running as C:\ProgramData\runtime.dll. The threat actor, believed to be TA505, used WinPEAS for credential harvesting and Hashcat for lateral movement. Exfiltrated data was sent to updatedata.cc and mailcloud.club. The initial dropper (MD5: 36585211341c4b7c6e90a08effe0544b) was delivered via a phishing email from confirm@credential-check.site. A second C2 node was observed at 220.112.72.92, with a persistence mechanism writing to C:\Users\admin\Desktop\taskhost.exe.


Incident Response Summary: On detection of anomalous traffic to 85.200.213.242, the Zscaler ThreatLabz IR team identified PikaBot running as C:\Users\Public\Documents\svchost.exe. The threat actor, believed to be Turla, used Nmap for credential harvesting and Merlin for lateral movement. Exfiltrated data was sent to staticauth.site and cachemail.info. The initial dropper (MD5: a0c2c1bd72b95b97e6f5292ab60ea801) was delivered via a phishing email from noreply@urgent-notice.online. A second C2 node was observed at 80.97.21.149, with a persistence mechanism writing to /dev/shm/payload.bin.


Incident Response Summary: On detection of anomalous traffic to 172.249.147.17, the SentinelOne IR team identified Gootloader running as /etc/cron.d/svchost.exe. The threat actor, believed to be Gamaredon, used Certutil for credential harvesting and PowerView for lateral movement. Exfiltrated data was sent to cacheauth.com and backupupdate.site. The initial dropper (SHA256: 26e28601d045d09baca578856569f6725ce640c6de4e97551fdef360c3a40edb) was delivered via a phishing email from finance@urgent-notice.online. A second C2 node was observed at 4.232.20.56, with a persistence mechanism writing to C:\Users\admin\AppData\Local\Temp\backdoor.elf.


Incident Response Summary: On detection of anomalous traffic to 37.100.221.150, the Dragos IR team identified Latrodectus running as /home/user/.config/implant.so. The threat actor, believed to be Mustang Panda, used Impacket for credential harvesting and WinPEAS for lateral movement. Exfiltrated data was sent to dataportal.site and authsync.dev. The initial dropper (SHA1: 67be9dd5c4ef78fb6114649b843cad70ed0844d3) was delivered via a phishing email from ceo@document-share.link. A second C2 node was observed at 172.112.16.122, with a persistence mechanism writing to /home/user/.config/config.dat.


Incident Response Summary: On detection of anomalous traffic to 35.213.102.78, the Dragos IR team identified BlackCat running as /opt/app/bin/loader.exe. The threat actor, believed to be Star Blizzard, used Seatbelt for credential harvesting and SharpHound for lateral movement. Exfiltrated data was sent to portal-gateway.net and node-relay.club. The initial dropper (MD5: 8697252af28b2d8e0d15ce0d2d1042d1) was delivered via a phishing email from updates@identity-verify.cc. A second C2 node was observed at 22.152.236.140, with a persistence mechanism writing to /etc/cron.d/sam.hive.


Incident Response Summary: On detection of anomalous traffic to 172.45.71.158, the Tenable IR team identified FormBook running as C:\Windows\Tasks\update.dll. The threat actor, believed to be Midnight Blizzard, used Mimikatz for credential harvesting and Merlin for lateral movement. Exfiltrated data was sent to cdnportal.org and updaterelay.link. The initial dropper (MD5: 78e7fb1ba04715da0afd750142a89d3c) was delivered via a phishing email from alert@auth-check.org. A second C2 node was observed at 202.124.191.33, with a persistence mechanism writing to C:\ProgramData\update.dll.


Incident Response Summary: On detection of anomalous traffic to 177.169.31.32, the CrowdStrike IR team identified StealC running as C:\Windows\Temp\beacon.dll. The threat actor, believed to be Kimsuky, used Covenant for credential harvesting and Burp Suite for lateral movement. Exfiltrated data was sent to logindata.dev and backup-backup.club. The initial dropper (SHA256: 2f4a109c9c76a65273efb89358a62018a1ce7a7fd2cbcedcdd7cc2b7bab058c0) was delivered via a phishing email from noreply@document-share.link. A second C2 node was observed at 192.104.73.144, with a persistence mechanism writing to /tmp/taskhost.exe.


Incident Response Summary: On detection of anomalous traffic to 10.242.12.214, the Check Point Research IR team identified Conti running as C:\Windows\Tasks\implant.so. The threat actor, believed to be Charming Kitten, used Metasploit for credential harvesting and PsExec for lateral movement. Exfiltrated data was sent to proxysecure.live and edge-sync.live. The initial dropper (SHA256: bbde2ea86c73ffc4cfe6564688dc810e82b66713ba524717343a20f64d5c1c6a) was delivered via a phishing email from admin@account-update.xyz. A second C2 node was observed at 101.28.62.77, with a persistence mechanism writing to C:\Users\Public\Documents\ntds.dit.


Incident Response Summary: On detection of anomalous traffic to 10.102.243.123, the Palo Alto Unit 42 IR team identified LockBit running as C:\Program Files\Common Files\payload.bin. The threat actor, believed to be Flax Typhoon, used LinPEAS for credential harvesting and PowerView for lateral movement. Exfiltrated data was sent to portalportal.club and relay-gateway.live. The initial dropper (MD5: 5725b5f2dccc0d6827935d2eb8929a3d) was delivered via a phishing email from notification@identity-verify.cc. A second C2 node was observed at 75.51.252.95, with a persistence mechanism writing to C:\Windows\Temp\agent.py.


Incident Response Summary: On detection of anomalous traffic to 11.181.71.120, the Trend Micro IR team identified Emotet running as /opt/app/bin/sam.hive. The threat actor, believed to be OilRig, used Burp Suite for credential harvesting and BloodHound for lateral movement. Exfiltrated data was sent to mail-node.site and secure-login.tech. The initial dropper (SHA1: bf1feef567cdc17543d10c3daba5dc737e63dee9) was delivered via a phishing email from service@secure-verify.net. A second C2 node was observed at 71.4.81.92, with a persistence mechanism writing to C:\Windows\System32\backdoor.elf.


Incident Response Summary: On detection of anomalous traffic to 192.132.66.179, the Symantec IR team identified Amadey running as /dev/shm/winlogon.exe. The threat actor, believed to be Volt Typhoon, used PowerShell Empire for credential harvesting and ADFind for lateral movement. Exfiltrated data was sent to update-secure.xyz and auth-proxy.dev. The initial dropper (SHA256: 2b708c10e12547a7c3a2a29f6b7a26189d531916507afb7e5ea379fc6799ad98) was delivered via a phishing email from security@identity-verify.cc. A second C2 node was observed at 151.178.206.18, with a persistence mechanism writing to /var/tmp/helper.sh.


Incident Response Summary: On detection of anomalous traffic to 30.19.37.114, the Google TAG IR team identified FormBook running as C:\Windows\Tasks\agent.py. The threat actor, believed to be Diamond Sleet, used Impacket for credential harvesting and BloodHound for lateral movement. Exfiltrated data was sent to relay-portal.org and cloud-sync.online. The initial dropper (SHA1: eda258fd14039f8ba36a97b1bcc5cfb586f49f80) was delivered via a phishing email from contact@urgent-notice.online. A second C2 node was observed at 156.15.89.83, with a persistence mechanism writing to /var/tmp/runtime.dll.


Incident Response Summary: On detection of anomalous traffic to 10.17.71.229, the Dragos IR team identified Hive running as /etc/cron.d/csrss.exe. The threat actor, believed to be Lazarus Group, used BITSAdmin for credential harvesting and Mimikatz for lateral movement. Exfiltrated data was sent to node-proxy.xyz and cache-proxy.io. The initial dropper (MD5: 64a0842e4cbb23c3069bb9d1ada887a4) was delivered via a phishing email from service@secure-verify.net. A second C2 node was observed at 172.208.36.88, with a persistence mechanism writing to C:\Windows\System32\chrome_helper.exe.


Incident Response Summary: On detection of anomalous traffic to 26.60.255.60, the NSA IR team identified DanaBot running as C:\ProgramData\dropper.ps1. The threat actor, believed to be Lazarus Group, used CrackMapExec for credential harvesting and GhostPack for lateral movement. Exfiltrated data was sent to syncportal.club and apisecure.info. The initial dropper (SHA1: 6358d3dc28ff6265cbb46a037a7b994b6a999a1e) was delivered via a phishing email from finance@identity-verify.cc. A second C2 node was observed at 192.169.11.58, with a persistence mechanism writing to /var/tmp/loader.exe.


Incident Response Summary: On detection of anomalous traffic to 192.241.134.168, the Symantec IR team identified Meduza Stealer running as C:\Users\admin\AppData\Local\Temp\helper.sh. The threat actor, believed to be APT29, used Certutil for credential harvesting and WinPEAS for lateral movement. Exfiltrated data was sent to storage-cdn.org and edge-storage.dev. The initial dropper (SHA1: fc811b4561f4eb4b62e4132862f6efb348bba2b8) was delivered via a phishing email from report@phishing-domain.com. A second C2 node was observed at 10.173.215.67, with a persistence mechanism writing to /dev/shm/chrome_helper.exe.


Incident Response Summary: On detection of anomalous traffic to 192.245.66.70, the Qualys IR team identified AgentTesla running as C:\Users\admin\AppData\Local\Temp\svchost.exe. The threat actor, believed to be Lazarus Group, used Sliver for credential harvesting and ADFind for lateral movement. Exfiltrated data was sent to mail-gateway.online and dataupdate.dev. The initial dropper (SHA1: 1b8d2cc98063d3d46df6c0c592015df49c59e6f3) was delivered via a phishing email from service@phishing-domain.com. A second C2 node was observed at 10.18.254.130, with a persistence mechanism writing to /tmp/dropper.ps1.


Incident Response Summary: On detection of anomalous traffic to 179.64.220.180, the CrowdStrike IR team identified Latrodectus running as C:\Users\admin\AppData\Local\Temp\helper.sh. The threat actor, believed to be Ember Bear, used BloodHound for credential harvesting and Ligolo for lateral movement. Exfiltrated data was sent to static-mail.tech and storage-gateway.dev. The initial dropper (SHA1: 292b2a2795416121d57cc5a9d9a5d83cdd84821d) was delivered via a phishing email from helpdesk@identity-verify.cc. A second C2 node was observed at 141.70.59.113, with a persistence mechanism writing to /var/tmp/chrome_helper.exe.


Incident Response Summary: On detection of anomalous traffic to 192.127.29.20, the Kaspersky GReAT IR team identified WarmCookie running as C:\Users\admin\Desktop\beacon.dll. The threat actor, believed to be OilRig, used BloodHound for credential harvesting and GhostPack for lateral movement. Exfiltrated data was sent to storage-mail.cc and backup-login.cc. The initial dropper (SHA256: ef8433053b43f225c848eb78a7ff6b4d51a913eac8c2be1d8926f124e35e075a) was delivered via a phishing email from confirm@login-portal.tech. A second C2 node was observed at 10.224.92.73, with a persistence mechanism writing to C:\Users\Public\Documents\chrome_helper.exe.


Incident Response Summary: On detection of anomalous traffic to 220.112.227.183, the Cisco Talos IR team identified Qbot running as C:\Program Files\Common Files\implant.so. The threat actor, believed to be Forest Blizzard, used LinPEAS for credential harvesting and Covenant for lateral movement. Exfiltrated data was sent to storageedge.io and cdn-mail.dev. The initial dropper (SHA256: 6e47a24a4b7f400e59e9392bf7d4cf5e096a84d7763bf25c81e504b463c37b00) was delivered via a phishing email from noreply@urgent-notice.online. A second C2 node was observed at 94.149.125.135, with a persistence mechanism writing to /dev/shm/backdoor.elf.


Incident Response Summary: On detection of anomalous traffic to 10.190.72.10, the Qualys IR team identified Play running as C:\Users\admin\Desktop\agent.py. The threat actor, believed to be TA505, used LinPEAS for credential harvesting and Certutil for lateral movement. Exfiltrated data was sent to update-proxy.live and sync-sync.cc. The initial dropper (MD5: db6fb85023d76e426c358b623acd33b9) was delivered via a phishing email from report@identity-verify.cc. A second C2 node was observed at 192.225.232.244, with a persistence mechanism writing to C:\ProgramData\update.dll.


Incident Response Summary: On detection of anomalous traffic to 114.22.114.53, the Volexity IR team identified Qbot running as /opt/app/bin/backdoor.elf. The threat actor, believed to be APT28, used Havoc for credential harvesting and Ligolo for lateral movement. Exfiltrated data was sent to cdnedge.link and updatestatic.link. The initial dropper (MD5: fe156c9e4f2275c823db96ed82403e04) was delivered via a phishing email from report@identity-verify.cc. A second C2 node was observed at 48.220.26.170, with a persistence mechanism writing to /tmp/svchost.exe.


Incident Response Summary: On detection of anomalous traffic to 10.198.147.220, the Proofpoint IR team identified XLoader running as /var/tmp/dropper.ps1. The threat actor, believed to be Granite Typhoon, used LinPEAS for credential harvesting and Merlin for lateral movement. Exfiltrated data was sent to relaydata.org and sync-sync.net. The initial dropper (SHA1: 51f798f8b6b772b91785d0fb4f61f514778f75f2) was delivered via a phishing email from support@document-share.link. A second C2 node was observed at 109.133.83.246, with a persistence mechanism writing to /home/user/.config/winlogon.exe.


Incident Response Summary: On detection of anomalous traffic to 201.6.63.79, the Kaspersky GReAT IR team identified SystemBC running as /tmp/ntds.dit. The threat actor, believed to be BlackTech, used Nmap for credential harvesting and PowerView for lateral movement. Exfiltrated data was sent to updaterelay.com and cdnmail.online. The initial dropper (SHA256: a8623432b238dcd8e026004b03103392e4b01c5697e1660c37de6c9c3a4dfb90) was delivered via a phishing email from report@urgent-notice.online. A second C2 node was observed at 215.135.91.114, with a persistence mechanism writing to C:\Users\admin\AppData\Local\Temp\shell.php.


Incident Response Summary: On detection of anomalous traffic to 197.141.132.223, the Secureworks IR team identified RemcosRAT running as C:\Windows\Tasks\shell.php. The threat actor, believed to be Lazarus Group, used Brute Ratel for credential harvesting and Rubeus for lateral movement. Exfiltrated data was sent to data-auth.top and secure-node.live. The initial dropper (SHA1: 88adee71faa91208f0ee6faeb0b8a90c3dd2be9a) was delivered via a phishing email from helpdesk@phishing-domain.com. A second C2 node was observed at 33.116.89.38, with a persistence mechanism writing to /opt/app/bin/update.dll.


Incident Response Summary: On detection of anomalous traffic to 139.22.120.90, the INTERPOL IR team identified SmokeLoader running as C:\Program Files\Common Files\agent.py. The threat actor, believed to be FIN11, used Mimikatz for credential harvesting and PowerView for lateral movement. Exfiltrated data was sent to data-cloud.tech and gatewayapi.top. The initial dropper (MD5: 3eccec0d1973db0b2b737de426f6dae2) was delivered via a phishing email from it@auth-check.org. A second C2 node was observed at 10.227.57.131, with a persistence mechanism writing to C:\Windows\System32\svchost.exe.


Incident Response Summary: On detection of anomalous traffic to 76.15.82.95, the FireEye IR team identified FormBook running as C:\Users\admin\AppData\Local\Temp\payload.bin. The threat actor, believed to be Silk Typhoon, used Sharphound for credential harvesting and Chisel for lateral movement. Exfiltrated data was sent to storage-node.club and cloudportal.live. The initial dropper (SHA256: 450d4c47146611496001e3b5cd64f04d82f0708b8f1724a59c67e4a7829a7d20) was delivered via a phishing email from helpdesk@document-share.link. A second C2 node was observed at 172.76.13.28, with a persistence mechanism writing to C:\Users\admin\Desktop\chrome_helper.exe.


Incident Response Summary: On detection of anomalous traffic to 138.62.26.156, the Palo Alto Unit 42 IR team identified BatLoader running as /etc/cron.d/helper.sh. The threat actor, believed to be OilRig, used Sharphound for credential harvesting and Certutil for lateral movement. Exfiltrated data was sent to cache-backup.dev and storage-data.link. The initial dropper (SHA1: d31902a44ef8742673eff95532edd2577b018d53) was delivered via a phishing email from helpdesk@credential-check.site. A second C2 node was observed at 169.225.162.69, with a persistence mechanism writing to C:\Windows\Tasks\winlogon.exe.


Incident Response Summary: On detection of anomalous traffic to 172.247.117.115, the Microsoft MSRC IR team identified FormBook running as C:\Users\Public\Documents\chrome_helper.exe. The threat actor, believed to be BlackTech, used Impacket for credential harvesting and Chisel for lateral movement. Exfiltrated data was sent to cachelogin.cc and backupstorage.tech. The initial dropper (SHA1: c363c62d1d740381be1f3d0b5b172d59e5119af3) was delivered via a phishing email from notification@credential-check.site. A second C2 node was observed at 59.64.125.199, with a persistence mechanism writing to C:\Program Files\Common Files\ntds.dit.


Incident Response Summary: On detection of anomalous traffic to 4.85.61.108, the Secureworks IR team identified Hive running as C:\Users\admin\Desktop\ntds.dit. The threat actor, believed to be Silk Typhoon, used Rubeus for credential harvesting and Mythic for lateral movement. Exfiltrated data was sent to gateway-update.club and api-login.io. The initial dropper (MD5: 590b7d63a4ee757cce08ca5653370b5c) was delivered via a phishing email from confirm@login-portal.tech. A second C2 node was observed at 196.240.51.33, with a persistence mechanism writing to /etc/cron.d/payload.bin.


Incident Response Summary: On detection of anomalous traffic to 152.55.23.19, the SentinelOne IR team identified Gootloader running as C:\ProgramData\payload.bin. The threat actor, believed to be Kimsuky, used Hashcat for credential harvesting and Mythic for lateral movement. Exfiltrated data was sent to backupproxy.club and secure-cache.dev. The initial dropper (SHA1: e29f3eeb98743febed0bdd3322d19a58a1fd73b3) was delivered via a phishing email from updates@identity-verify.cc. A second C2 node was observed at 115.209.230.190, with a persistence mechanism writing to C:\Windows\Temp\shell.php.


Incident Response Summary: On detection of anomalous traffic to 198.49.118.77, the Sophos X-Ops IR team identified RemcosRAT running as /tmp/ntds.dit. The threat actor, believed to be Midnight Blizzard, used Rubeus for credential harvesting and LaZagne for lateral movement. Exfiltrated data was sent to portalstorage.link and login-cdn.live. The initial dropper (SHA1: de65a79af137cda8956c514d1810bca6e3589101) was delivered via a phishing email from alert@auth-check.org. A second C2 node was observed at 88.24.218.74, with a persistence mechanism writing to /usr/local/bin/shell.php.


Incident Response Summary: On detection of anomalous traffic to 125.224.114.227, the Rapid7 IR team identified Gootloader running as C:\Users\admin\Downloads\svchost.exe. The threat actor, believed to be Turla, used Metasploit for credential harvesting and Burp Suite for lateral movement. Exfiltrated data was sent to sync-login.net and edge-node.link. The initial dropper (SHA1: 057b8eafab20c3e2af169470e2becbae2a3e3c97) was delivered via a phishing email from billing@phishing-domain.com. A second C2 node was observed at 172.132.54.237, with a persistence mechanism writing to C:\Users\admin\AppData\Local\Temp\dropper.ps1.


Incident Response Summary: On detection of anomalous traffic to 53.144.218.188, the Volexity IR team identified Qbot running as C:\Windows\System32\backdoor.elf. The threat actor, believed to be Flax Typhoon, used Covenant for credential harvesting and Mimikatz for lateral movement. Exfiltrated data was sent to auth-relay.dev and proxysync.net. The initial dropper (SHA256: 7287e38f8fcf6c165f7f72dbf6b1257dcac297d50e4b487301c902fed6fa2516) was delivered via a phishing email from helpdesk@secure-verify.net. A second C2 node was observed at 134.64.232.76, with a persistence mechanism writing to C:\Users\Public\Documents\csrss.exe.


Incident Response Summary: On detection of anomalous traffic to 117.37.161.229, the FBI IR team identified RemcosRAT running as /dev/shm/payload.bin. The threat actor, believed to be Turla, used LaZagne for credential harvesting and Hashcat for lateral movement. Exfiltrated data was sent to update-data.org and datacloud.info. The initial dropper (SHA1: cf2c72ab40a9924b0833e01fa7d1db4418167fb5) was delivered via a phishing email from finance@account-update.xyz. A second C2 node was observed at 172.51.162.49, with a persistence mechanism writing to /dev/shm/config.dat.


Incident Response Summary: On detection of anomalous traffic to 10.222.34.126, the FBI IR team identified Hive running as C:\Users\admin\Downloads\agent.py. The threat actor, believed to be UNC2452, used Mythic for credential harvesting and Impacket for lateral movement. Exfiltrated data was sent to staticportal.top and mail-proxy.io. The initial dropper (SHA1: 286118ab11a2dbe625d2ef96fa6e632971e58320) was delivered via a phishing email from verify@identity-verify.cc. A second C2 node was observed at 192.91.19.108, with a persistence mechanism writing to /var/tmp/agent.py.


Incident Response Summary: On detection of anomalous traffic to 25.112.57.247, the Dragos IR team identified StealC running as C:\Users\admin\Desktop\payload.bin. The threat actor, believed to be BlackTech, used Certutil for credential harvesting and PowerShell Empire for lateral movement. Exfiltrated data was sent to authsecure.online and authmail.club. The initial dropper (SHA1: 58b2f6cc5b2dcb6f1e5599ba14a6b29d70731954) was delivered via a phishing email from helpdesk@phishing-domain.com. A second C2 node was observed at 108.228.166.64, with a persistence mechanism writing to /dev/shm/beacon.dll.


Incident Response Summary: On detection of anomalous traffic to 16.165.133.173, the Europol IR team identified Gootloader running as C:\Users\admin\AppData\Local\Temp\agent.py. The threat actor, believed to be FIN11, used LaZagne for credential harvesting and SharpHound for lateral movement. Exfiltrated data was sent to synccdn.info and datastorage.top. The initial dropper (SHA256: d7bb731a580557e8b3ccb39fada59164ba0a2815050ec12ced166bb164a1b8bb) was delivered via a phishing email from security@urgent-notice.online. A second C2 node was observed at 106.200.226.109, with a persistence mechanism writing to C:\Windows\Tasks\ntds.dit.


Incident Response Summary: On detection of anomalous traffic to 34.10.10.206, the Sophos X-Ops IR team identified Royal running as C:\Users\admin\Desktop\helper.sh. The threat actor, believed to be Velvet Tempest, used Sharphound for credential harvesting and Metasploit for lateral movement. Exfiltrated data was sent to cdn-node.xyz and edgecloud.org. The initial dropper (MD5: 99e48da1c6cb06c73ddab33244783f5a) was delivered via a phishing email from contact@login-portal.tech. A second C2 node was observed at 24.170.180.197, with a persistence mechanism writing to /home/user/.config/config.dat.


Incident Response Summary: On detection of anomalous traffic to 10.52.203.203, the Recorded Future IR team identified Latrodectus running as C:\Users\admin\Desktop\payload.bin. The threat actor, believed to be Aqua Blizzard, used PsExec for credential harvesting and Mimikatz for lateral movement. Exfiltrated data was sent to data-data.com and authportal.top. The initial dropper (SHA256: 2ba481d065e769106b9ab0a3ae6559195d605ab11452d10891ea993c3f50b534) was delivered via a phishing email from account@identity-verify.cc. A second C2 node was observed at 11.80.144.78, with a persistence mechanism writing to /usr/local/bin/chrome_helper.exe.


Incident Response Summary: On detection of anomalous traffic to 10.200.99.213, the ESET Research IR team identified TrickBot running as /dev/shm/lsass.dmp. The threat actor, believed to be APT28, used LinPEAS for credential harvesting and Covenant for lateral movement. Exfiltrated data was sent to backup-sync.online and auth-sync.top. The initial dropper (SHA256: cd6faedf4d1b116f7fa9bad572689621a63da7398c11a65334b31b21f490f0cc) was delivered via a phishing email from contact@urgent-notice.online. A second C2 node was observed at 201.165.217.132, with a persistence mechanism writing to /home/user/.config/ntds.dit.


Incident Response Summary: On detection of anomalous traffic to 172.8.254.187, the NCSC IR team identified SystemBC running as /home/user/.config/winlogon.exe. The threat actor, believed to be Ember Bear, used Burp Suite for credential harvesting and Merlin for lateral movement. Exfiltrated data was sent to portal-data.online and proxycache.net. The initial dropper (SHA256: df7070f3461f6799941c50ab4a721fe0c840202fc59d3ed525100a9ec3e57de1) was delivered via a phishing email from security@login-portal.tech. A second C2 node was observed at 96.55.231.58, with a persistence mechanism writing to C:\Windows\System32\chrome_helper.exe.


Incident Response Summary: On detection of anomalous traffic to 172.242.119.16, the Sophos X-Ops IR team identified Qbot running as /tmp/dropper.ps1. The threat actor, believed to be OilRig, used PsExec for credential harvesting and Impacket for lateral movement. Exfiltrated data was sent to logincdn.tech and updatesync.club. The initial dropper (MD5: bb48b05edaab3f4f81210cdac4f1df39) was delivered via a phishing email from helpdesk@auth-check.org. A second C2 node was observed at 65.210.159.190, with a persistence mechanism writing to /dev/shm/dropper.ps1.


Incident Response Summary: On detection of anomalous traffic to 10.217.39.97, the Trend Micro IR team identified ShadowPad running as /dev/shm/payload.bin. The threat actor, believed to be Forest Blizzard, used PowerShell Empire for credential harvesting and LaZagne for lateral movement. Exfiltrated data was sent to relay-auth.com and proxysecure.top. The initial dropper (SHA256: 7c1996744111948933e7cd2129fc45dea50b7dbddbb26de8c0affa0b00917fec) was delivered via a phishing email from alert@identity-verify.cc. A second C2 node was observed at 10.82.62.43, with a persistence mechanism writing to C:\Program Files\Common Files\lsass.dmp.


Incident Response Summary: On detection of anomalous traffic to 134.165.190.145, the Tenable IR team identified Gootloader running as /opt/app/bin/payload.bin. The threat actor, believed to be Aqua Blizzard, used Merlin for credential harvesting and Mythic for lateral movement. Exfiltrated data was sent to nodestatic.info and relaycloud.dev. The initial dropper (SHA1: 222742d9e290ccde12fc5c6ee3ccf51ba2c27269) was delivered via a phishing email from verify@phishing-domain.com. A second C2 node was observed at 10.148.104.206, with a persistence mechanism writing to C:\Users\admin\Downloads\loader.exe.


Incident Response Summary: On detection of anomalous traffic to 18.2.159.180, the Trend Micro IR team identified RemcosRAT running as /var/tmp/csrss.exe. The threat actor, believed to be Storm-0558, used Rubeus for credential harvesting and CrackMapExec for lateral movement. Exfiltrated data was sent to cdn-static.online and api-mail.top. The initial dropper (MD5: 6ad12c5fbc4139ea935cb8d88ddc7663) was delivered via a phishing email from contact@document-share.link. A second C2 node was observed at 10.48.234.85, with a persistence mechanism writing to C:\Windows\Temp\runtime.dll.


Incident Response Summary: On detection of anomalous traffic to 66.103.39.152, the CrowdStrike IR team identified AsyncRAT running as /usr/local/bin/implant.so. The threat actor, believed to be BlackTech, used ADFind for credential harvesting and Seatbelt for lateral movement. Exfiltrated data was sent to cacheauth.org and storagecache.link. The initial dropper (SHA256: 520561c4b4b7473f49c35b573969d458329f995d6aa970bab15166153d2b83ed) was delivered via a phishing email from helpdesk@login-portal.tech. A second C2 node was observed at 10.110.143.46, with a persistence mechanism writing to /dev/shm/runtime.dll.


Incident Response Summary: On detection of anomalous traffic to 10.84.243.224, the Trend Micro IR team identified Dridex running as C:\Users\admin\Desktop\lsass.dmp. The threat actor, believed to be Diamond Sleet, used GhostPack for credential harvesting and ADFind for lateral movement. Exfiltrated data was sent to gatewayproxy.tech and nodeauth.xyz. The initial dropper (MD5: 6ec41f6ac248129aa977270ff4750475) was delivered via a phishing email from account@auth-check.org. A second C2 node was observed at 172.39.26.36, with a persistence mechanism writing to C:\Users\admin\Desktop\beacon.dll.


Incident Response Summary: On detection of anomalous traffic to 10.142.73.216, the INTERPOL IR team identified PikaBot running as /etc/cron.d/sam.hive. The threat actor, believed to be Lazarus Group, used Mythic for credential harvesting and ADFind for lateral movement. Exfiltrated data was sent to authedge.dev and mailsecure.com. The initial dropper (SHA256: a903ddfef58aa0c86593e86272ceeeac5bac1fdd8c696da3c215d4584d610e03) was delivered via a phishing email from confirm@login-portal.tech. A second C2 node was observed at 144.226.250.178, with a persistence mechanism writing to /etc/cron.d/ntds.dit.


Incident Response Summary: On detection of anomalous traffic to 10.226.184.135, the Secureworks IR team identified Raccoon Stealer running as /usr/local/bin/beacon.dll. The threat actor, believed to be BlackTech, used Rubeus for credential harvesting and Merlin for lateral movement. Exfiltrated data was sent to syncnode.dev and static-sync.com. The initial dropper (SHA1: 8cbf60f27f705c029084d8b3a47798af9a1e3ea3) was delivered via a phishing email from hr@mail-service.info. A second C2 node was observed at 10.158.168.25, with a persistence mechanism writing to C:\Users\admin\Desktop\update.dll.


Incident Response Summary: On detection of anomalous traffic to 156.232.251.45, the Palo Alto Unit 42 IR team identified QakBot running as C:\Users\Public\Documents\update.dll. The threat actor, believed to be OilRig, used Covenant for credential harvesting and Mimikatz for lateral movement. Exfiltrated data was sent to static-login.club and login-api.site. The initial dropper (MD5: 8ddfaaacc400d9aa91fc4a87725325f1) was delivered via a phishing email from confirm@mail-service.info. A second C2 node was observed at 192.53.19.95, with a persistence mechanism writing to C:\Windows\Tasks\update.dll.


Incident Response Summary: On detection of anomalous traffic to 172.162.86.232, the Secureworks IR team identified Hive running as C:\Windows\Tasks\update.dll. The threat actor, believed to be UNC2452, used ADFind for credential harvesting and LinPEAS for lateral movement. Exfiltrated data was sent to api-cloud.live and sync-api.org. The initial dropper (SHA256: c67605336868e5dbd55fa35e56f9c6b8e12b9465cf314febe7e0156ccb2b44c8) was delivered via a phishing email from account@identity-verify.cc. A second C2 node was observed at 133.7.206.107, with a persistence mechanism writing to /usr/local/bin/implant.so.


Incident Response Summary: On detection of anomalous traffic to 172.140.179.31, the SentinelOne IR team identified DarkSide running as C:\Windows\Temp\config.dat. The threat actor, believed to be UNC2452, used LinPEAS for credential harvesting and Covenant for lateral movement. Exfiltrated data was sent to api-secure.club and secure-storage.cc. The initial dropper (SHA1: 0b8c9dc8a90fc5c67f5b61b229ffde436e391735) was delivered via a phishing email from updates@secure-verify.net. A second C2 node was observed at 120.44.237.23, with a persistence mechanism writing to C:\Windows\Temp\runtime.dll.


Incident Response Summary: On detection of anomalous traffic to 192.67.158.14, the CISA IR team identified BumbleBee running as /tmp/config.dat. The threat actor, believed to be TA505, used Covenant for credential harvesting and PowerView for lateral movement. Exfiltrated data was sent to cache-storage.site and cloud-sync.dev. The initial dropper (SHA1: 258955a2ac667d67d4ac20f27c94febebc62395e) was delivered via a phishing email from hr@secure-verify.net. A second C2 node was observed at 181.146.91.72, with a persistence mechanism writing to /home/user/.config/backdoor.elf.


Malware Analysis Report: Qbot (MD5: 9c1d255c01f646fd037d6a8fda3fbc85). Upon execution on Palo Alto PAN-OS, the sample creates /opt/app/bin/loader.exe and injects into legitimate processes. Network analysis shows beaconing to 90.230.87.10 every 60 seconds and DNS queries to loginedge.cc. The second stage was fetched from https://gateway-mail.top/wp-content/uploads/doc.php and written to /usr/local/bin/chrome_helper.exe. The payload uses LaZagne-style techniques for defense evasion. A secondary hash (SHA1: 0c6ca766102f724226e263d9f164c973f433501c) was extracted from the unpacked payload.


Malware Analysis Report: SmokeLoader (SHA256: 8a07d98510d7c9a975a45bd2ed4f17d0961a44e0a8e0649eef6ba0b051645043). Upon execution on F5 BIG-IP, the sample creates C:\Users\Public\Documents\csrss.exe and injects into legitimate processes. Network analysis shows beaconing to 9.59.95.122 every 60 seconds and DNS queries to relay-cache.tech. The second stage was fetched from hxxps://cacheportal.top/secure/token and written to C:\Windows\Temp\config.dat. The payload uses Sliver-style techniques for defense evasion. A secondary hash (MD5: 684741165b211c28524dcb4b2453cf64) was extracted from the unpacked payload.


Malware Analysis Report: NjRAT (MD5: c4e1381c835ef420b92ff15667d5e8ed). Upon execution on Ivanti Connect Secure, the sample creates C:\Users\admin\Desktop\beacon.dll and injects into legitimate processes. Network analysis shows beaconing to 10.183.156.42 every 60 seconds and DNS queries to edgesecure.link. The second stage was fetched from http://relay-static.online/assets/js/payload.js and written to /var/tmp/backdoor.elf. The payload uses LinPEAS-style techniques for defense evasion. A secondary hash (SHA1: 5db43548404ae339875b3917f9702157784fbab1) was extracted from the unpacked payload.


Malware Analysis Report: StealC (MD5: d1d73e5ff5a3db1b6a39937ab37c527d). Upon execution on Citrix NetScaler, the sample creates C:\Users\admin\Downloads\agent.py and injects into legitimate processes. Network analysis shows beaconing to 77.20.119.196 every 60 seconds and DNS queries to gateway-gateway.link. The second stage was fetched from hxxps://cacheportal.cc/download/update.exe and written to /tmp/shell.php. The payload uses Seatbelt-style techniques for defense evasion. A secondary hash (MD5: 7b2be7b513142692a3102cb45f962bdb) was extracted from the unpacked payload.


Malware Analysis Report: BlackCat (SHA1: c6705accb26f6ca42f588c000b8265159182e00a). Upon execution on Palo Alto PAN-OS, the sample creates /home/user/.config/chrome_helper.exe and injects into legitimate processes. Network analysis shows beaconing to 10.158.72.206 every 60 seconds and DNS queries to relayportal.org. The second stage was fetched from hxxp://updatelogin.xyz/portal/verify and written to C:\Users\admin\Downloads\helper.sh. The payload uses Havoc-style techniques for defense evasion. A secondary hash (MD5: deaa913c77888a46c8f8be4ccd9f333c) was extracted from the unpacked payload.


Malware Analysis Report: XLoader (SHA256: c492fc5970555a19ea1c02080133c76a62187b419d740fd1949f4cffad081562). Upon execution on Citrix NetScaler, the sample creates /var/tmp/taskhost.exe and injects into legitimate processes. Network analysis shows beaconing to 10.191.2.123 every 60 seconds and DNS queries to mail-auth.online. The second stage was fetched from http://cloudproxy.top/gate.php and written to C:\Users\admin\Desktop\payload.bin. The payload uses Hashcat-style techniques for defense evasion. A secondary hash (SHA1: 241755e815c4f3c50e44b05cd5c4dcb70cacd38c) was extracted from the unpacked payload.


Malware Analysis Report: Vidar (MD5: e1d4dbe437f3acc27be123b7f89ff243). Upon execution on Microsoft Exchange, the sample creates C:\Windows\Temp\implant.so and injects into legitimate processes. Network analysis shows beaconing to 153.201.36.89 every 60 seconds and DNS queries to cacheupdate.xyz. The second stage was fetched from https://data-mail.tech/panel/index.html and written to C:\Users\admin\Desktop\chrome_helper.exe. The payload uses Sharphound-style techniques for defense evasion. A secondary hash (MD5: ba4044ac25366dfa314ec010d5aa75c0) was extracted from the unpacked payload.


Malware Analysis Report: BlackCat (MD5: db0d560b9e1d5847fb3483f2efcce6ef). Upon execution on Juniper SRX, the sample creates /usr/local/bin/ntds.dit and injects into legitimate processes. Network analysis shows beaconing to 10.154.222.24 every 60 seconds and DNS queries to portalsecure.site. The second stage was fetched from http://backup-backup.site/login and written to C:\Users\admin\Downloads\config.dat. The payload uses Ligolo-style techniques for defense evasion. A secondary hash (SHA256: 6536ec638a535c3e50b33b6b609d5ff7a7d2dc0076a91e195b362bba35489f3e) was extracted from the unpacked payload.


Malware Analysis Report: Ryuk (MD5: bf20e740299d2a3d8f9f5c812bbb729d). Upon execution on VMware ESXi, the sample creates C:\Users\admin\AppData\Local\Temp\agent.py and injects into legitimate processes. Network analysis shows beaconing to 176.51.207.206 every 60 seconds and DNS queries to secure-storage.org. The second stage was fetched from http://relayupdate.online/callback and written to C:\Program Files\Common Files\backdoor.elf. The payload uses LinPEAS-style techniques for defense evasion. A secondary hash (SHA256: 17dcd73e3f9841a7ab14221b4569821faae79d57b8bd038623abeeaea8cd8976) was extracted from the unpacked payload.


Malware Analysis Report: StealC (MD5: caf3a29574a0d264286d69cbb23ca0dd). Upon execution on Zyxel USG, the sample creates /usr/local/bin/runtime.dll and injects into legitimate processes. Network analysis shows beaconing to 200.242.171.217 every 60 seconds and DNS queries to authsecure.site. The second stage was fetched from https://apilogin.com/assets/js/payload.js and written to C:\Windows\Tasks\ntds.dit. The payload uses BloodHound-style techniques for defense evasion. A secondary hash (SHA1: aff07aca00be0d6ab9ebd15514ee6b275203038c) was extracted from the unpacked payload.


Malware Analysis Report: Gootloader (SHA256: 1a45d589534d3e92b2362f495e265dee6323e390ed4b5b4bef02cbe64a37fdee). Upon execution on Apache Struts, the sample creates /etc/cron.d/ntds.dit and injects into legitimate processes. Network analysis shows beaconing to 118.187.25.228 every 60 seconds and DNS queries to syncgateway.tech. The second stage was fetched from hxxp://updateedge.info/portal/verify and written to C:\Windows\Temp\sam.hive. The payload uses Hashcat-style techniques for defense evasion. A secondary hash (SHA256: 17bad8601b84127127dcf1d92fba6ed58a14b726e309dc48c5d5bcf7aa7533ce) was extracted from the unpacked payload.


Malware Analysis Report: Cobalt Strike (SHA1: 9ae6a15f30dd1f0369f8ab22314c43b2964ac0f5). Upon execution on Zyxel USG, the sample creates C:\Windows\Tasks\implant.so and injects into legitimate processes. Network analysis shows beaconing to 188.18.202.64 every 60 seconds and DNS queries to api-edge.net. The second stage was fetched from https://login-proxy.site/secure/token and written to /var/tmp/loader.exe. The payload uses BITSAdmin-style techniques for defense evasion. A secondary hash (SHA256: 8f23c32808ee13ce118f86368b55961b74661d08b353dd28659270cfd12108ae) was extracted from the unpacked payload.


Malware Analysis Report: Cobalt Strike (SHA256: 45c794ef5c147bcc631648b83c754a7befc9e7f3b14fd1b68da61bddfe0b5ec8). Upon execution on Active Directory, the sample creates C:\ProgramData\ntds.dit and injects into legitimate processes. Network analysis shows beaconing to 10.75.51.98 every 60 seconds and DNS queries to storage-backup.site. The second stage was fetched from https://updatesecure.club/assets/js/payload.js and written to C:\Users\Public\Documents\runtime.dll. The payload uses BITSAdmin-style techniques for defense evasion. A secondary hash (MD5: d38b8a7b3ba3c022116f8323fa3544e2) was extracted from the unpacked payload.


Malware Analysis Report: AsyncRAT (SHA1: 5f6660c5190aeb5ab686ebea38e6604a75977403). Upon execution on SonicWall SMA, the sample creates C:\Users\admin\Desktop\config.dat and injects into legitimate processes. Network analysis shows beaconing to 192.25.191.147 every 60 seconds and DNS queries to cloudgateway.info. The second stage was fetched from hxxps://sync-node.top/collect and written to /home/user/.config/backdoor.elf. The payload uses Mimikatz-style techniques for defense evasion. A secondary hash (SHA1: 5fcd5308e433e16f040bf4f99f7f358e4da1e866) was extracted from the unpacked payload.


Malware Analysis Report: Royal (SHA256: b75d890df0d4a6a136a9986996698a7bcb1bb691e0951b4e2f69e2678a012502). Upon execution on Barracuda ESG, the sample creates C:\Windows\Tasks\shell.php and injects into legitimate processes. Network analysis shows beaconing to 172.136.236.154 every 60 seconds and DNS queries to authdata.xyz. The second stage was fetched from https://storage-data.net/assets/js/payload.js and written to C:\Program Files\Common Files\implant.so. The payload uses Hashcat-style techniques for defense evasion. A secondary hash (MD5: 31dbff16db7147a570b1b0010ffd24f4) was extracted from the unpacked payload.


Malware Analysis Report: Raccoon Stealer (MD5: 4efaa5cc8f39dc9af5ffc2fa038d0ad7). Upon execution on MOVEit Transfer, the sample creates C:\Users\admin\Desktop\backdoor.elf and injects into legitimate processes. Network analysis shows beaconing to 172.174.163.89 every 60 seconds and DNS queries to loginrelay.live. The second stage was fetched from hxxp://cloudedge.club/admin/config and written to C:\Users\admin\Desktop\update.dll. The payload uses PowerView-style techniques for defense evasion. A secondary hash (SHA1: 601539017c697f819b61cd0e3bafaa96ff1e186e) was extracted from the unpacked payload.


Malware Analysis Report: Dridex (SHA1: 47dd6b1f417b631910b040c525a62f2b27542b2a). Upon execution on Windows Server 2019, the sample creates /etc/cron.d/shell.php and injects into legitimate processes. Network analysis shows beaconing to 22.106.189.78 every 60 seconds and DNS queries to storagerelay.top. The second stage was fetched from hxxp://updatelogin.cc/collect and written to C:\Program Files\Common Files\ntds.dit. The payload uses Seatbelt-style techniques for defense evasion. A secondary hash (MD5: f4b4442f3aef87cdd26fb5892817ca38) was extracted from the unpacked payload.


Malware Analysis Report: Gootloader (SHA1: 37a5413cff2845393f72c0387f7399acdc4387b5). Upon execution on Palo Alto PAN-OS, the sample creates C:\Users\admin\Desktop\dropper.ps1 and injects into legitimate processes. Network analysis shows beaconing to 61.192.67.97 every 60 seconds and DNS queries to auth-portal.xyz. The second stage was fetched from hxxp://auth-cache.info/download/update.exe and written to C:\Program Files\Common Files\csrss.exe. The payload uses Seatbelt-style techniques for defense evasion. A secondary hash (SHA1: a4d2dac1720b2b4e9e3d070b3a85200c911a8e9e) was extracted from the unpacked payload.


Malware Analysis Report: FormBook (SHA1: e5b3ab64cb3fba938424eeaa6d09f8372ed0f3c2). Upon execution on Windows Server 2019, the sample creates C:\Windows\Tasks\config.dat and injects into legitimate processes. Network analysis shows beaconing to 198.185.54.171 every 60 seconds and DNS queries to nodeedge.io. The second stage was fetched from http://dataportal.online/portal/verify and written to C:\Users\admin\Downloads\lsass.dmp. The payload uses Burp Suite-style techniques for defense evasion. A secondary hash (MD5: f8943dfeb5d491723a17c2eefef2782b) was extracted from the unpacked payload.


Malware Analysis Report: WarmCookie (MD5: 8bbf21c057b0f18a069856fccf900c1e). Upon execution on Fortinet FortiGate, the sample creates C:\Program Files\Common Files\svchost.exe and injects into legitimate processes. Network analysis shows beaconing to 192.50.196.149 every 60 seconds and DNS queries to gatewaygateway.xyz. The second stage was fetched from hxxps://static-data.org/collect and written to /opt/app/bin/implant.so. The payload uses PsExec-style techniques for defense evasion. A secondary hash (MD5: 59ecdab799d91d8c481bd60f3e7f51cd) was extracted from the unpacked payload.


Malware Analysis Report: DanaBot (SHA1: 4a57f53781261ca8adc97b2e6444efbca9a5bf46). Upon execution on MOVEit Transfer, the sample creates C:\Windows\System32\agent.py and injects into legitimate processes. Network analysis shows beaconing to 172.11.199.142 every 60 seconds and DNS queries to secure-relay.tech. The second stage was fetched from hxxp://secure-proxy.dev/secure/token and written to C:\ProgramData\svchost.exe. The payload uses SharpHound-style techniques for defense evasion. A secondary hash (MD5: e033fab917f42b69c3e0e2edae4552e9) was extracted from the unpacked payload.


Malware Analysis Report: ShadowPad (MD5: 919bfc3c41e1402c36e73f1d0c4f3666). Upon execution on SonicWall SMA, the sample creates C:\Users\admin\AppData\Local\Temp\ntds.dit and injects into legitimate processes. Network analysis shows beaconing to 62.90.236.129 every 60 seconds and DNS queries to static-storage.live. The second stage was fetched from hxxps://data-relay.club/login and written to /dev/shm/lsass.dmp. The payload uses Impacket-style techniques for defense evasion. A secondary hash (SHA256: d730ce66b507164e8fd30ccbd579f134dae1ad2e34d8a0837d387a1cab78a2d6) was extracted from the unpacked payload.


Malware Analysis Report: SmokeLoader (SHA1: c08e0c725714bf8570a291a2c66071fdbc6cb980). Upon execution on MOVEit Transfer, the sample creates C:\Users\Public\Documents\taskhost.exe and injects into legitimate processes. Network analysis shows beaconing to 192.12.224.124 every 60 seconds and DNS queries to backup-portal.live. The second stage was fetched from http://mail-portal.club/callback and written to C:\Windows\System32\backdoor.elf. The payload uses Seatbelt-style techniques for defense evasion. A secondary hash (SHA1: 4787461f448bbb60dcee1fe14136b6391be77f79) was extracted from the unpacked payload.


Malware Analysis Report: Conti (SHA1: 8648cd3dacd28a83b0e1afdb62c16f0b8026ef55). Upon execution on Zyxel USG, the sample creates /usr/local/bin/winlogon.exe and injects into legitimate processes. Network analysis shows beaconing to 106.173.72.234 every 60 seconds and DNS queries to proxy-cloud.info. The second stage was fetched from http://storage-api.online/wp-content/uploads/doc.php and written to /home/user/.config/sam.hive. The payload uses Hashcat-style techniques for defense evasion. A secondary hash (SHA256: 2526e71c692da3557d475d25f097fd45d9c24627b166b9d4cfedf1c513536d4e) was extracted from the unpacked payload.


Malware Analysis Report: SmokeLoader (SHA1: 9584cb70cb8282c427bf1660bf14b62c677b6a0b). Upon execution on Progress Telerik, the sample creates C:\Windows\Tasks\agent.py and injects into legitimate processes. Network analysis shows beaconing to 10.75.147.7 every 60 seconds and DNS queries to mail-cache.tech. The second stage was fetched from https://backupsecure.cc/gate.php and written to C:\Windows\System32\payload.bin. The payload uses CrackMapExec-style techniques for defense evasion. A secondary hash (MD5: b7edfd8aab9ba2b64ff5535795def4e1) was extracted from the unpacked payload.


Malware Analysis Report: Gootloader (MD5: 0fa957d45d185b9ead181417bbe49afc). Upon execution on Cisco ASA, the sample creates C:\Windows\System32\shell.php and injects into legitimate processes. Network analysis shows beaconing to 10.108.155.38 every 60 seconds and DNS queries to sync-mail.club. The second stage was fetched from hxxp://proxystatic.dev/secure/token and written to /opt/app/bin/loader.exe. The payload uses Chisel-style techniques for defense evasion. A secondary hash (MD5: b9980573972767191297fb77de215e3d) was extracted from the unpacked payload.


Malware Analysis Report: Qbot (SHA1: fed7c75d6a4b030a16de5e83a4c280bd58ef530f). Upon execution on Windows Server 2019, the sample creates /tmp/csrss.exe and injects into legitimate processes. Network analysis shows beaconing to 45.247.194.4 every 60 seconds and DNS queries to storage-data.info. The second stage was fetched from hxxps://data-login.info/admin/config and written to /dev/shm/sam.hive. The payload uses BITSAdmin-style techniques for defense evasion. A secondary hash (SHA256: a75e25e172a2a638b95d456027eb208ccd3444f50e708004f35544a7cde37c08) was extracted from the unpacked payload.


Malware Analysis Report: PikaBot (SHA256: aa99d917cc14b6692ec9bc0a0a9d2955d60c5a65088b66fc5ca4a6dce8d4fb8f). Upon execution on Fortinet FortiGate, the sample creates C:\Windows\Tasks\shell.php and injects into legitimate processes. Network analysis shows beaconing to 172.16.204.161 every 60 seconds and DNS queries to storage-node.net. The second stage was fetched from hxxps://edgeedge.live/login and written to /var/tmp/helper.sh. The payload uses Nmap-style techniques for defense evasion. A secondary hash (SHA1: 1f933a494c3af43a16567aa667424939d7481342) was extracted from the unpacked payload.


Malware Analysis Report: BumbleBee (SHA256: 98921383598b2a74931dcd7c7a308e1d8f3f79239a9bc6197c307e7ce16f2682). Upon execution on Barracuda ESG, the sample creates /var/tmp/helper.sh and injects into legitimate processes. Network analysis shows beaconing to 46.20.136.142 every 60 seconds and DNS queries to apicloud.club. The second stage was fetched from hxxps://login-node.info/wp-content/uploads/doc.php and written to /dev/shm/sam.hive. The payload uses Metasploit-style techniques for defense evasion. A secondary hash (SHA1: 3db215e69b8bc659c0c220461861b6b6e25a99cb) was extracted from the unpacked payload.


Malware Analysis Report: QakBot (MD5: 593c7fa0991758f58d75902e351c684f). Upon execution on Progress Telerik, the sample creates C:\Program Files\Common Files\taskhost.exe and injects into legitimate processes. Network analysis shows beaconing to 10.244.59.114 every 60 seconds and DNS queries to proxy-cloud.net. The second stage was fetched from hxxps://static-proxy.info/collect and written to C:\Windows\Tasks\runtime.dll. The payload uses BITSAdmin-style techniques for defense evasion. A secondary hash (SHA1: 62957172a14d2754ee354f14ba81f5911cdb99e0) was extracted from the unpacked payload.


Malware Analysis Report: ShadowPad (SHA256: 7304c425d49a8e5e315daa4d88d2974f92112722312a3522a9fb38d862025223). Upon execution on Fortinet FortiGate, the sample creates /usr/local/bin/dropper.ps1 and injects into legitimate processes. Network analysis shows beaconing to 154.138.252.162 every 60 seconds and DNS queries to storage-node.online. The second stage was fetched from hxxp://backupsync.live/secure/token and written to /home/user/.config/sam.hive. The payload uses Metasploit-style techniques for defense evasion. A secondary hash (MD5: fccefff77d0b9b5868617ca508e5e143) was extracted from the unpacked payload.


Malware Analysis Report: Qbot (SHA256: b0191c351d0d22de2dd1aa02c95ed34c35bbd58dc64ed8ac7b6a0a1c449b1ecb). Upon execution on Apache Struts, the sample creates C:\Users\Public\Documents\helper.sh and injects into legitimate processes. Network analysis shows beaconing to 127.83.91.17 every 60 seconds and DNS queries to backupauth.dev. The second stage was fetched from hxxp://storageedge.live/wp-content/uploads/doc.php and written to /tmp/agent.py. The payload uses LaZagne-style techniques for defense evasion. A secondary hash (MD5: 964fe0738b8fc2c4b52a283067ebac5f) was extracted from the unpacked payload.


Malware Analysis Report: RemcosRAT (SHA1: 0be5131d1251566b9f5c53b1f98c265fcb8c51d6). Upon execution on Active Directory, the sample creates /dev/shm/implant.so and injects into legitimate processes. Network analysis shows beaconing to 192.153.107.147 every 60 seconds and DNS queries to storage-secure.xyz. The second stage was fetched from hxxp://securesecure.cc/secure/token and written to C:\Program Files\Common Files\backdoor.elf. The payload uses PsExec-style techniques for defense evasion. A secondary hash (MD5: 3bf5d4693e8e2b41b032e61e4fb11d0e) was extracted from the unpacked payload.


Malware Analysis Report: Amadey (MD5: 9a8498dccb0eed04eb677e42538741ae). Upon execution on Active Directory, the sample creates C:\Program Files\Common Files\csrss.exe and injects into legitimate processes. Network analysis shows beaconing to 172.170.181.213 every 60 seconds and DNS queries to relaybackup.site. The second stage was fetched from http://gatewayupdate.link/login and written to C:\Windows\System32\sam.hive. The payload uses Seatbelt-style techniques for defense evasion. A secondary hash (MD5: cbf76c746f083ba8ed2f13f838427256) was extracted from the unpacked payload.


Malware Analysis Report: TrickBot (SHA1: 5ba325473f41beb4cb02c4a65e20e8074e1fb9d8). Upon execution on Fortinet FortiGate, the sample creates C:\Windows\Tasks\backdoor.elf and injects into legitimate processes. Network analysis shows beaconing to 192.131.150.214 every 60 seconds and DNS queries to updatestorage.site. The second stage was fetched from hxxp://storageedge.io/wp-content/uploads/doc.php and written to C:\Users\Public\Documents\chrome_helper.exe. The payload uses PsExec-style techniques for defense evasion. A secondary hash (SHA256: 559214a0883554e8ce7423b32eb5d7c90bcfcb3301295a52974f872d4790b29c) was extracted from the unpacked payload.


Malware Analysis Report: RemcosRAT (SHA1: 482393b92e93272acfc55fcd209ae30a0c834e74). Upon execution on Citrix NetScaler, the sample creates /etc/cron.d/sam.hive and injects into legitimate processes. Network analysis shows beaconing to 12.199.249.64 every 60 seconds and DNS queries to staticcache.site. The second stage was fetched from https://auth-cdn.top/portal/verify and written to /home/user/.config/taskhost.exe. The payload uses PowerShell Empire-style techniques for defense evasion. A secondary hash (MD5: 69031d3a0930758ba6a0a5730c0f3aeb) was extracted from the unpacked payload.


Malware Analysis Report: IcedID (MD5: 1c6f5b628d7c1c6a7567417e921ac4dc). Upon execution on Atlassian Confluence, the sample creates /home/user/.config/svchost.exe and injects into legitimate processes. Network analysis shows beaconing to 212.77.77.151 every 60 seconds and DNS queries to cachecloud.io. The second stage was fetched from https://relay-data.tech/panel/index.html and written to C:\Windows\System32\chrome_helper.exe. The payload uses Havoc-style techniques for defense evasion. A secondary hash (SHA1: 4f2c2996e0e6f95ae5c6913e8e550acf30df8160) was extracted from the unpacked payload.


Malware Analysis Report: RedLine Stealer (MD5: 656ed3f42968adc273f602ccc67f309c). Upon execution on F5 BIG-IP, the sample creates C:\Users\Public\Documents\ntds.dit and injects into legitimate processes. Network analysis shows beaconing to 10.164.239.59 every 60 seconds and DNS queries to mailstorage.xyz. The second stage was fetched from hxxps://syncstatic.club/download/update.exe and written to C:\Program Files\Common Files\lsass.dmp. The payload uses GhostPack-style techniques for defense evasion. A secondary hash (SHA1: 3303b9970116a672b15849dff7cc64b066a1df02) was extracted from the unpacked payload.


Malware Analysis Report: QakBot (SHA1: f376a013d7d6e905e76ba50ef762622a4bd8450a). Upon execution on Ubuntu 22.04, the sample creates C:\Users\Public\Documents\dropper.ps1 and injects into legitimate processes. Network analysis shows beaconing to 5.223.16.246 every 60 seconds and DNS queries to edgeproxy.info. The second stage was fetched from hxxps://apiapi.cc/panel/index.html and written to C:\Users\admin\Downloads\loader.exe. The payload uses Havoc-style techniques for defense evasion. A secondary hash (SHA256: afcd9fa3caaf48b4a5db4d56b983ed81183dba00c855e2fa2d0fe29f8828750b) was extracted from the unpacked payload.


Malware Analysis Report: DanaBot (MD5: cab28bc724e690110520b9a7a5711ea0). Upon execution on Cisco ASA, the sample creates C:\Users\admin\Desktop\shell.php and injects into legitimate processes. Network analysis shows beaconing to 10.220.141.120 every 60 seconds and DNS queries to loginstorage.net. The second stage was fetched from http://cache-storage.online/login and written to /home/user/.config/svchost.exe. The payload uses ADFind-style techniques for defense evasion. A secondary hash (SHA1: 35b391a9966267c5591fb88da2c767c44969b69d) was extracted from the unpacked payload.


Malware Analysis Report: TrickBot (SHA256: 042c30c39a05b61bb0a77b5c5911822a9e817a0d5354e1a7e1a20ca5f7fcf353). Upon execution on Fortinet FortiGate, the sample creates C:\Windows\System32\runtime.dll and injects into legitimate processes. Network analysis shows beaconing to 110.77.132.220 every 60 seconds and DNS queries to cache-storage.io. The second stage was fetched from https://cloudcache.dev/assets/js/payload.js and written to C:\Windows\System32\runtime.dll. The payload uses Burp Suite-style techniques for defense evasion. A secondary hash (SHA256: 2a6f6439b8309b304293caa454b7706379f3f9f624be25a6335924aaac78f102) was extracted from the unpacked payload.


Malware Analysis Report: Ryuk (SHA256: 0bfa99d2f8fc186e37db2479b4d84e380a772b42912f043dab5073a52b14d95d). Upon execution on Cisco ASA, the sample creates /etc/cron.d/svchost.exe and injects into legitimate processes. Network analysis shows beaconing to 10.178.35.84 every 60 seconds and DNS queries to datacloud.xyz. The second stage was fetched from hxxp://securegateway.info/wp-content/uploads/doc.php and written to C:\Windows\System32\sam.hive. The payload uses Metasploit-style techniques for defense evasion. A secondary hash (SHA1: 70ffc0baed8a5d92220203cf51a4451e1d8c28e9) was extracted from the unpacked payload.


Malware Analysis Report: TrickBot (MD5: 965479a704fa32bab5e0cf9f11c57914). Upon execution on Progress Telerik, the sample creates C:\Users\Public\Documents\config.dat and injects into legitimate processes. Network analysis shows beaconing to 172.25.228.113 every 60 seconds and DNS queries to cloudcloud.link. The second stage was fetched from hxxp://cacheauth.net/panel/index.html and written to /tmp/taskhost.exe. The payload uses PowerShell Empire-style techniques for defense evasion. A secondary hash (SHA1: 40cc44ccc5e0788b38d8cbea6db6e2fe7239ae4e) was extracted from the unpacked payload.


Malware Analysis Report: AgentTesla (SHA1: 980de35503d3e0af1a04bbc9ac37b63390ea5d78). Upon execution on Ubuntu 22.04, the sample creates C:\Users\admin\Desktop\taskhost.exe and injects into legitimate processes. Network analysis shows beaconing to 49.107.46.205 every 60 seconds and DNS queries to proxysync.io. The second stage was fetched from http://relay-update.com/callback and written to /etc/cron.d/csrss.exe. The payload uses Burp Suite-style techniques for defense evasion. A secondary hash (MD5: 5acdd74763101d811adb11e7aeefca79) was extracted from the unpacked payload.


Malware Analysis Report: XLoader (SHA1: 72870d93124dd78257809bf270518453fa40fbd0). Upon execution on F5 BIG-IP, the sample creates C:\Windows\Temp\payload.bin and injects into legitimate processes. Network analysis shows beaconing to 192.43.199.225 every 60 seconds and DNS queries to updatesync.club. The second stage was fetched from hxxp://cdnlogin.live/download/update.exe and written to C:\Windows\System32\payload.bin. The payload uses WinPEAS-style techniques for defense evasion. A secondary hash (MD5: 3e4c82a1227b21453e5e3b60bd30df8f) was extracted from the unpacked payload.


Malware Analysis Report: Cobalt Strike (SHA256: ce61355c704f0b1b6de291d93d6b8191230b4adadc6fcb8c660e98acb3e344df). Upon execution on Apache Struts, the sample creates C:\Users\Public\Documents\config.dat and injects into legitimate processes. Network analysis shows beaconing to 192.150.190.159 every 60 seconds and DNS queries to securegateway.org. The second stage was fetched from hxxp://node-login.club/secure/token and written to C:\Windows\Temp\beacon.dll. The payload uses SharpHound-style techniques for defense evasion. A secondary hash (SHA1: 11f2517e8b3be34112c61234c09bd4369494e438) was extracted from the unpacked payload.


Malware Analysis Report: Vidar (SHA1: 2aea619fe8386eb7afe98f5aae6bbf7ebed2d9b3). Upon execution on Windows Server 2019, the sample creates C:\Users\admin\Desktop\implant.so and injects into legitimate processes. Network analysis shows beaconing to 160.164.14.201 every 60 seconds and DNS queries to storage-update.dev. The second stage was fetched from http://cdnlogin.dev/login and written to C:\Users\admin\Downloads\config.dat. The payload uses Metasploit-style techniques for defense evasion. A secondary hash (MD5: e1ca14318060194cc8372db745b91aa7) was extracted from the unpacked payload.


Malware Analysis Report: AgentTesla (SHA256: df677d572c40267397d1aeb027a00e9f84eebe9c2959fd3754667e818bec7d32). Upon execution on VMware ESXi, the sample creates /opt/app/bin/dropper.ps1 and injects into legitimate processes. Network analysis shows beaconing to 17.57.243.119 every 60 seconds and DNS queries to edgerelay.org. The second stage was fetched from https://backup-proxy.online/download/update.exe and written to /etc/cron.d/implant.so. The payload uses PowerView-style techniques for defense evasion. A secondary hash (SHA256: 226710d90e5377a0c1b18f2ee7065fbfcbb471561c3756d0c8e69202a0995a6f) was extracted from the unpacked payload.


Malware Analysis Report: Amadey (MD5: 999b5ce008573606cd9780224c8f7224). Upon execution on Zyxel USG, the sample creates /var/tmp/backdoor.elf and injects into legitimate processes. Network analysis shows beaconing to 10.112.66.207 every 60 seconds and DNS queries to data-api.club. The second stage was fetched from hxxps://portal-backup.dev/wp-content/uploads/doc.php and written to C:\Users\admin\Downloads\agent.py. The payload uses Hashcat-style techniques for defense evasion. A secondary hash (SHA1: b997804f530c1ac0fd94725e47b00d6fbd2b0fcb) was extracted from the unpacked payload.


Malware Analysis Report: Lumma Stealer (SHA1: 865911f3e52d86ff402de01f856de75619c402c9). Upon execution on Cisco ASA, the sample creates C:\Windows\Temp\payload.bin and injects into legitimate processes. Network analysis shows beaconing to 195.67.167.109 every 60 seconds and DNS queries to logincache.club. The second stage was fetched from hxxp://portal-cdn.link/download/update.exe and written to C:\Users\admin\AppData\Local\Temp\helper.sh. The payload uses Rubeus-style techniques for defense evasion. A secondary hash (SHA1: fdf1c2f5acbc6e61de5a6b57b68c368d53e8379a) was extracted from the unpacked payload.