Sophos X-Ops detected a multi-stage attack chain. The initial phishing email from service@mail-service.info contained a link to http://relaydata.xyz/panel/index.html. This redirected to https://node-proxy.site/gate.php on portalsync.io. A secondary email from account@credential-check.site pointed to https://mailmail.org/panel/index.html which delivered DarkSide. The final payload callback was https://edgestorage.site/login resolving to 10.23.26.14 via nodesecure.top.


Check Point Research detected a multi-stage attack chain. The initial phishing email from ceo@secure-verify.net contained a link to https://syncportal.top/secure/token. This redirected to https://data-backup.online/download/update.exe on cloudcloud.online. A secondary email from info@urgent-notice.online pointed to http://nodebackup.info/login which delivered WarmCookie. The final payload callback was hxxps://authbackup.tech/secure/token resolving to 192.201.61.51 via gateway-static.dev.


ESET Research detected a multi-stage attack chain. The initial phishing email from hr@urgent-notice.online contained a link to https://mailstatic.tech/collect. This redirected to hxxps://securesecure.cc/admin/config on relayrelay.info. A secondary email from report@phishing-domain.com pointed to hxxps://data-login.info/collect which delivered SmokeLoader. The final payload callback was hxxps://relayapi.net/api/v2/auth resolving to 155.79.224.26 via portal-cdn.live.


Microsoft MSRC detected a multi-stage attack chain. The initial phishing email from ceo@account-update.xyz contained a link to https://cachesync.online/collect. This redirected to hxxp://backup-proxy.site/assets/js/payload.js on edge-backup.xyz. A secondary email from info@credential-check.site pointed to hxxps://apiportal.top/assets/js/payload.js which delivered IcedID. The final payload callback was https://relayportal.info/panel/index.html resolving to 192.14.164.50 via static-gateway.top.


Sophos X-Ops detected a multi-stage attack chain. The initial phishing email from account@login-portal.tech contained a link to http://updatemail.tech/portal/verify. This redirected to https://login-edge.link/secure/token on proxy-node.xyz. A secondary email from it@document-share.link pointed to https://edgerelay.site/secure/token which delivered SmokeLoader. The final payload callback was hxxps://secure-gateway.io/wp-content/uploads/doc.php resolving to 28.87.120.196 via cloudauth.link.


CrowdStrike detected a multi-stage attack chain. The initial phishing email from billing@secure-verify.net contained a link to https://cloud-secure.link/assets/js/payload.js. This redirected to https://secure-backup.tech/gate.php on node-gateway.xyz. A secondary email from updates@mail-service.info pointed to http://auth-portal.org/portal/verify which delivered Raccoon Stealer. The final payload callback was https://storage-auth.dev/collect resolving to 10.38.22.247 via proxy-cdn.org.


FireEye detected a multi-stage attack chain. The initial phishing email from info@mail-service.info contained a link to https://portaldata.live/portal/verify. This redirected to http://cloud-sync.top/login on cdnsecure.tech. A secondary email from helpdesk@auth-check.org pointed to https://portal-cloud.xyz/callback which delivered Raccoon Stealer. The final payload callback was hxxp://apiportal.top/collect resolving to 172.66.101.172 via auth-mail.club.


Cisco Talos detected a multi-stage attack chain. The initial phishing email from report@phishing-domain.com contained a link to https://cdnsync.club/panel/index.html. This redirected to hxxp://secureportal.com/assets/js/payload.js on datacdn.link. A secondary email from admin@mail-service.info pointed to http://storage-backup.top/download/update.exe which delivered REvil. The final payload callback was https://sync-cdn.dev/assets/js/payload.js resolving to 168.69.242.94 via apiauth.xyz.


Proofpoint detected a multi-stage attack chain. The initial phishing email from support@auth-check.org contained a link to hxxps://cdnnode.online/secure/token. This redirected to https://edgedata.xyz/secure/token on backupnode.link. A secondary email from it@credential-check.site pointed to https://portaldata.io/collect which delivered BlackCat. The final payload callback was https://node-login.io/wp-content/uploads/doc.php resolving to 10.1.235.160 via cacheedge.com.


Mandiant detected a multi-stage attack chain. The initial phishing email from noreply@account-update.xyz contained a link to https://updatecache.top/login. This redirected to https://syncrelay.dev/login on storageedge.dev. A secondary email from billing@account-update.xyz pointed to https://relay-storage.com/callback which delivered TrickBot. The final payload callback was hxxps://mailstorage.io/admin/config resolving to 47.21.129.62 via cacheproxy.live.


Microsoft MSRC detected a multi-stage attack chain. The initial phishing email from contact@secure-verify.net contained a link to hxxps://dataapi.cc/login. This redirected to hxxps://cacheproxy.live/assets/js/payload.js on authlogin.live. A secondary email from hr@phishing-domain.com pointed to hxxps://portal-data.tech/admin/config which delivered BlackCat. The final payload callback was hxxps://backup-login.live/download/update.exe resolving to 192.147.168.77 via cloud-secure.io.


Europol detected a multi-stage attack chain. The initial phishing email from helpdesk@auth-check.org contained a link to https://staticlogin.org/wp-content/uploads/doc.php. This redirected to hxxp://login-data.club/assets/js/payload.js on storage-cdn.top. A secondary email from helpdesk@account-update.xyz pointed to hxxp://update-update.net/download/update.exe which delivered DarkSide. The final payload callback was hxxp://nodestatic.org/portal/verify resolving to 98.59.248.106 via cacheauth.club.


Dragos detected a multi-stage attack chain. The initial phishing email from alert@auth-check.org contained a link to http://nodesync.site/callback. This redirected to http://cdnedge.link/gate.php on data-portal.com. A secondary email from contact@credential-check.site pointed to https://cloudportal.net/login which delivered Hive. The final payload callback was hxxps://update-relay.com/callback resolving to 172.35.250.191 via proxy-cloud.dev.


Zscaler ThreatLabz detected a multi-stage attack chain. The initial phishing email from ceo@account-update.xyz contained a link to https://cache-login.info/collect. This redirected to hxxp://relayrelay.xyz/assets/js/payload.js on node-data.xyz. A secondary email from security@login-portal.tech pointed to hxxps://cloudnode.org/portal/verify which delivered Qbot. The final payload callback was hxxp://securestatic.org/download/update.exe resolving to 154.14.197.38 via cloud-node.dev.


Qualys detected a multi-stage attack chain. The initial phishing email from security@document-share.link contained a link to hxxps://cache-backup.dev/assets/js/payload.js. This redirected to hxxp://sync-backup.net/portal/verify on cache-data.dev. A secondary email from billing@login-portal.tech pointed to hxxp://securesecure.cc/portal/verify which delivered Hive. The final payload callback was hxxps://portalrelay.top/panel/index.html resolving to 72.57.180.237 via cdnsync.site.


Proofpoint detected a multi-stage attack chain. The initial phishing email from admin@credential-check.site contained a link to http://edgedata.xyz/panel/index.html. This redirected to hxxps://staticapi.club/secure/token on mail-proxy.org. A secondary email from admin@urgent-notice.online pointed to https://cdn-cache.top/secure/token which delivered AsyncRAT. The final payload callback was hxxps://mailcache.tech/panel/index.html resolving to 18.223.155.129 via secure-cloud.com.


Zscaler ThreatLabz detected a multi-stage attack chain. The initial phishing email from alert@phishing-domain.com contained a link to https://backuprelay.club/download/update.exe. This redirected to https://sync-edge.xyz/admin/config on storage-login.top. A secondary email from it@auth-check.org pointed to http://mailcdn.io/collect which delivered XLoader. The final payload callback was hxxps://login-relay.live/assets/js/payload.js resolving to 46.155.36.37 via syncauth.link.


Microsoft MSRC detected a multi-stage attack chain. The initial phishing email from info@mail-service.info contained a link to hxxps://relaygateway.dev/admin/config. This redirected to http://cdnstorage.cc/portal/verify on update-gateway.tech. A secondary email from helpdesk@mail-service.info pointed to http://cdndata.xyz/portal/verify which delivered AgentTesla. The final payload callback was hxxp://backup-storage.link/assets/js/payload.js resolving to 192.106.244.19 via datalogin.site.


Recorded Future detected a multi-stage attack chain. The initial phishing email from finance@account-update.xyz contained a link to hxxps://cloudauth.com/secure/token. This redirected to hxxps://edgedata.top/collect on edgerelay.com. A secondary email from account@identity-verify.cc pointed to hxxp://dataapi.club/download/update.exe which delivered PikaBot. The final payload callback was http://secureportal.info/portal/verify resolving to 10.238.15.118 via relayportal.info.


Recorded Future detected a multi-stage attack chain. The initial phishing email from notification@account-update.xyz contained a link to hxxp://api-cdn.net/portal/verify. This redirected to http://nodeupdate.tech/collect on relay-secure.club. A secondary email from admin@mail-service.info pointed to http://loginauth.net/portal/verify which delivered SmokeLoader. The final payload callback was hxxps://update-sync.info/login resolving to 10.212.148.15 via api-backup.dev.


FireEye detected a multi-stage attack chain. The initial phishing email from it@secure-verify.net contained a link to hxxps://api-cdn.online/admin/config. This redirected to https://cloudapi.com/secure/token on mailauth.info. A secondary email from ceo@identity-verify.cc pointed to http://cloud-api.tech/panel/index.html which delivered BlackCat. The final payload callback was hxxps://cdnportal.site/callback resolving to 192.179.61.69 via sync-node.xyz.


FBI detected a multi-stage attack chain. The initial phishing email from admin@mail-service.info contained a link to hxxp://proxycdn.top/api/v2/auth. This redirected to hxxps://dataedge.site/api/v2/auth on sync-auth.com. A secondary email from verify@account-update.xyz pointed to http://authauth.net/download/update.exe which delivered Cobalt Strike. The final payload callback was https://authsync.xyz/collect resolving to 90.110.62.218 via authgateway.tech.


INTERPOL detected a multi-stage attack chain. The initial phishing email from report@document-share.link contained a link to hxxp://proxy-api.org/login. This redirected to hxxps://loginstorage.club/panel/index.html on data-gateway.com. A secondary email from helpdesk@secure-verify.net pointed to hxxps://storagesecure.info/panel/index.html which delivered StealC. The final payload callback was hxxp://cdnstatic.site/secure/token resolving to 192.137.30.7 via update-cache.club.


Symantec detected a multi-stage attack chain. The initial phishing email from helpdesk@urgent-notice.online contained a link to hxxps://secure-static.online/collect. This redirected to http://secure-node.io/portal/verify on cdnlogin.site. A secondary email from contact@document-share.link pointed to https://storage-cache.live/collect which delivered IcedID. The final payload callback was hxxp://mail-sync.top/portal/verify resolving to 216.223.142.141 via syncsecure.online.


Google TAG detected a multi-stage attack chain. The initial phishing email from report@login-portal.tech contained a link to hxxp://cdn-storage.net/collect. This redirected to https://relay-login.live/wp-content/uploads/doc.php on updatenode.club. A secondary email from it@secure-verify.net pointed to http://gateway-proxy.online/collect which delivered DanaBot. The final payload callback was hxxps://portal-relay.online/login resolving to 10.49.181.117 via sync-cdn.io.


Cisco Talos detected a multi-stage attack chain. The initial phishing email from hr@phishing-domain.com contained a link to hxxp://edge-secure.top/callback. This redirected to hxxp://apiportal.top/login on cachegateway.link. A secondary email from helpdesk@document-share.link pointed to https://relay-login.cc/assets/js/payload.js which delivered Amadey. The final payload callback was http://login-portal.top/login resolving to 192.92.244.101 via api-update.io.


Symantec detected a multi-stage attack chain. The initial phishing email from contact@document-share.link contained a link to hxxp://updatenode.site/wp-content/uploads/doc.php. This redirected to https://cache-static.top/login on storage-cdn.top. A secondary email from security@auth-check.org pointed to http://portalportal.top/callback which delivered RedLine Stealer. The final payload callback was hxxps://storage-mail.com/admin/config resolving to 192.18.179.252 via edge-cloud.com.


CISA detected a multi-stage attack chain. The initial phishing email from confirm@login-portal.tech contained a link to hxxps://backupbackup.link/collect. This redirected to hxxp://apilogin.info/callback on apicache.net. A secondary email from contact@credential-check.site pointed to hxxps://portal-cdn.tech/assets/js/payload.js which delivered Dridex. The final payload callback was hxxps://static-cache.cc/gate.php resolving to 157.7.121.35 via backup-static.dev.


Dragos detected a multi-stage attack chain. The initial phishing email from confirm@identity-verify.cc contained a link to hxxps://synccache.live/api/v2/auth. This redirected to https://gatewayrelay.tech/login on secure-static.tech. A secondary email from support@login-portal.tech pointed to http://sync-cloud.live/secure/token which delivered Latrodectus. The final payload callback was http://auth-storage.live/secure/token resolving to 10.217.253.75 via edge-data.live.


CrowdStrike detected a multi-stage attack chain. The initial phishing email from helpdesk@account-update.xyz contained a link to https://mailportal.online/wp-content/uploads/doc.php. This redirected to https://apistorage.xyz/admin/config on update-cloud.online. A secondary email from admin@urgent-notice.online pointed to hxxp://backupcloud.cc/gate.php which delivered Vidar. The final payload callback was hxxps://node-auth.org/gate.php resolving to 10.131.49.209 via update-auth.com.


CrowdStrike detected a multi-stage attack chain. The initial phishing email from updates@account-update.xyz contained a link to http://cache-relay.tech/assets/js/payload.js. This redirected to hxxps://authportal.site/collect on apigateway.top. A secondary email from contact@secure-verify.net pointed to https://proxy-portal.info/portal/verify which delivered Raccoon Stealer. The final payload callback was https://sync-data.link/assets/js/payload.js resolving to 172.137.19.44 via login-secure.online.


Volexity detected a multi-stage attack chain. The initial phishing email from finance@urgent-notice.online contained a link to http://node-backup.live/secure/token. This redirected to hxxps://cachelogin.dev/assets/js/payload.js on static-api.io. A secondary email from updates@identity-verify.cc pointed to http://portaledge.io/portal/verify which delivered Play. The final payload callback was https://cloud-cache.online/secure/token resolving to 192.155.155.66 via secure-data.io.


Palo Alto Unit 42 detected a multi-stage attack chain. The initial phishing email from ceo@account-update.xyz contained a link to hxxps://relay-data.site/collect. This redirected to https://node-storage.online/wp-content/uploads/doc.php on update-secure.info. A secondary email from billing@mail-service.info pointed to http://staticbackup.online/wp-content/uploads/doc.php which delivered REvil. The final payload callback was https://node-cloud.top/download/update.exe resolving to 186.40.162.18 via proxy-edge.dev.


Volexity detected a multi-stage attack chain. The initial phishing email from finance@mail-service.info contained a link to hxxps://proxyportal.club/panel/index.html. This redirected to http://cdnapi.com/callback on cache-cloud.io. A secondary email from ceo@phishing-domain.com pointed to hxxp://nodestatic.online/assets/js/payload.js which delivered Hive. The final payload callback was http://loginmail.live/secure/token resolving to 192.204.99.135 via synccdn.top.


Secureworks detected a multi-stage attack chain. The initial phishing email from support@mail-service.info contained a link to hxxps://portalportal.cc/panel/index.html. This redirected to http://sync-backup.cc/login on update-proxy.com. A secondary email from account@credential-check.site pointed to https://static-portal.link/wp-content/uploads/doc.php which delivered BatLoader. The final payload callback was hxxps://edge-data.live/secure/token resolving to 6.38.183.16 via staticauth.cc.


Dragos detected a multi-stage attack chain. The initial phishing email from noreply@phishing-domain.com contained a link to https://data-sync.link/api/v2/auth. This redirected to https://static-node.org/secure/token on updaterelay.link. A secondary email from billing@document-share.link pointed to hxxp://apinode.xyz/gate.php which delivered BatLoader. The final payload callback was https://backup-proxy.link/download/update.exe resolving to 212.30.28.114 via datanode.live.


Check Point Research detected a multi-stage attack chain. The initial phishing email from report@auth-check.org contained a link to hxxps://relaystorage.tech/login. This redirected to http://cloudstorage.online/assets/js/payload.js on syncapi.tech. A secondary email from contact@identity-verify.cc pointed to http://data-portal.live/wp-content/uploads/doc.php which delivered SmokeLoader. The final payload callback was hxxp://portal-api.info/portal/verify resolving to 192.140.80.246 via gateway-data.org.


CISA detected a multi-stage attack chain. The initial phishing email from notification@account-update.xyz contained a link to https://gateway-backup.io/api/v2/auth. This redirected to http://nodesecure.club/admin/config on apistatic.site. A secondary email from ceo@identity-verify.cc pointed to hxxps://proxyproxy.xyz/callback which delivered BlackCat. The final payload callback was hxxps://sync-portal.com/gate.php resolving to 192.168.218.213 via updatecdn.com.


Sophos X-Ops detected a multi-stage attack chain. The initial phishing email from helpdesk@identity-verify.cc contained a link to http://edge-proxy.online/callback. This redirected to hxxp://syncupdate.org/portal/verify on gateway-mail.link. A secondary email from verify@auth-check.org pointed to hxxps://authbackup.tech/wp-content/uploads/doc.php which delivered SmokeLoader. The final payload callback was hxxp://syncupdate.link/panel/index.html resolving to 46.232.189.195 via storagesecure.cc.


Qualys detected a multi-stage attack chain. The initial phishing email from billing@document-share.link contained a link to https://updatedata.link/collect. This redirected to https://static-relay.tech/secure/token on syncproxy.live. A secondary email from admin@secure-verify.net pointed to hxxp://portal-backup.top/download/update.exe which delivered SystemBC. The final payload callback was hxxps://cache-sync.online/secure/token resolving to 99.84.228.16 via mailnode.dev.


Zscaler ThreatLabz detected a multi-stage attack chain. The initial phishing email from contact@urgent-notice.online contained a link to hxxp://node-edge.tech/panel/index.html. This redirected to hxxp://apimail.link/portal/verify on cdnlogin.cc. A secondary email from account@identity-verify.cc pointed to http://dataupdate.org/assets/js/payload.js which delivered SmokeLoader. The final payload callback was https://edge-storage.info/download/update.exe resolving to 192.231.205.52 via edgeupdate.info.


Dragos detected a multi-stage attack chain. The initial phishing email from admin@login-portal.tech contained a link to http://proxy-secure.info/gate.php. This redirected to http://auth-mail.online/wp-content/uploads/doc.php on proxyapi.xyz. A secondary email from info@document-share.link pointed to http://edgeapi.tech/api/v2/auth which delivered Conti. The final payload callback was http://secureapi.club/wp-content/uploads/doc.php resolving to 172.217.212.222 via cloudapi.info.


Cisco Talos detected a multi-stage attack chain. The initial phishing email from notification@auth-check.org contained a link to http://backup-portal.cc/gate.php. This redirected to hxxp://secureapi.io/download/update.exe on relay-auth.site. A secondary email from updates@document-share.link pointed to hxxp://relaycache.top/download/update.exe which delivered DarkSide. The final payload callback was http://proxyportal.top/gate.php resolving to 172.233.189.178 via apisync.io.


Check Point Research detected a multi-stage attack chain. The initial phishing email from updates@secure-verify.net contained a link to hxxps://loginstatic.io/login. This redirected to http://backup-api.xyz/wp-content/uploads/doc.php on secure-api.io. A secondary email from report@phishing-domain.com pointed to https://storagesync.org/gate.php which delivered Amadey. The final payload callback was https://api-mail.dev/panel/index.html resolving to 211.13.222.117 via cache-storage.net.


Zscaler ThreatLabz detected a multi-stage attack chain. The initial phishing email from ceo@mail-service.info contained a link to hxxps://staticcloud.live/wp-content/uploads/doc.php. This redirected to hxxp://portal-backup.tech/panel/index.html on data-secure.live. A secondary email from service@credential-check.site pointed to https://cloud-portal.dev/download/update.exe which delivered Lumma Stealer. The final payload callback was hxxp://storageupdate.live/secure/token resolving to 197.35.149.149 via cdn-auth.org.


Symantec detected a multi-stage attack chain. The initial phishing email from helpdesk@identity-verify.cc contained a link to hxxps://cacherelay.online/wp-content/uploads/doc.php. This redirected to http://proxy-update.tech/panel/index.html on cloudportal.live. A secondary email from account@identity-verify.cc pointed to hxxp://mail-edge.xyz/login which delivered AsyncRAT. The final payload callback was https://sync-cloud.tech/secure/token resolving to 172.153.159.185 via staticnode.io.


Volexity detected a multi-stage attack chain. The initial phishing email from ceo@phishing-domain.com contained a link to hxxp://update-portal.dev/download/update.exe. This redirected to hxxp://relaycloud.cc/admin/config on static-secure.info. A secondary email from contact@document-share.link pointed to hxxp://portal-update.info/collect which delivered Lumma Stealer. The final payload callback was hxxp://loginstatic.cc/api/v2/auth resolving to 139.86.30.148 via synccloud.top.


Recorded Future detected a multi-stage attack chain. The initial phishing email from helpdesk@phishing-domain.com contained a link to hxxps://node-proxy.org/api/v2/auth. This redirected to hxxp://update-cloud.io/assets/js/payload.js on gatewayapi.site. A secondary email from finance@phishing-domain.com pointed to hxxps://cache-static.dev/api/v2/auth which delivered TrickBot. The final payload callback was https://updatemail.cc/portal/verify resolving to 172.138.215.134 via portal-node.com.


Microsoft MSRC detected a multi-stage attack chain. The initial phishing email from info@login-portal.tech contained a link to hxxp://auth-sync.xyz/callback. This redirected to hxxp://mail-proxy.info/download/update.exe on staticauth.cc. A secondary email from service@mail-service.info pointed to https://auth-auth.dev/portal/verify which delivered DanaBot. The final payload callback was hxxps://staticstatic.org/admin/config resolving to 172.213.162.245 via staticcdn.cc.


Cisco Talos detected a multi-stage attack chain. The initial phishing email from noreply@phishing-domain.com contained a link to hxxp://mail-cache.info/callback. This redirected to hxxps://cache-update.dev/callback on mailcloud.top. A secondary email from admin@document-share.link pointed to hxxp://auth-api.tech/assets/js/payload.js which delivered NjRAT. The final payload callback was https://updatestatic.site/wp-content/uploads/doc.php resolving to 9.59.190.51 via staticproxy.xyz.


Check Point Research detected a multi-stage attack chain. The initial phishing email from info@document-share.link contained a link to https://mail-data.org/callback. This redirected to hxxps://backup-edge.io/portal/verify on secure-backup.com. A secondary email from billing@auth-check.org pointed to https://cdnsync.site/panel/index.html which delivered BatLoader. The final payload callback was http://storagemail.net/collect resolving to 192.50.0.61 via relaybackup.net.


Cisco Talos detected a multi-stage attack chain. The initial phishing email from billing@document-share.link contained a link to http://portal-portal.online/admin/config. This redirected to hxxps://static-mail.org/panel/index.html on storage-edge.live. A secondary email from confirm@phishing-domain.com pointed to hxxps://nodeportal.io/portal/verify which delivered Amadey. The final payload callback was hxxps://static-sync.org/login resolving to 172.12.109.116 via proxynode.link.


Volexity detected a multi-stage attack chain. The initial phishing email from service@secure-verify.net contained a link to http://login-cdn.tech/collect. This redirected to hxxps://nodemail.xyz/gate.php on storage-cdn.club. A secondary email from verify@phishing-domain.com pointed to hxxps://noderelay.io/wp-content/uploads/doc.php which delivered Ryuk. The final payload callback was hxxps://updatecache.tech/portal/verify resolving to 10.141.183.78 via edge-auth.xyz.


Palo Alto Unit 42 detected a multi-stage attack chain. The initial phishing email from noreply@secure-verify.net contained a link to hxxps://cloud-sync.io/login. This redirected to https://storagesecure.tech/wp-content/uploads/doc.php on cdnapi.dev. A secondary email from ceo@account-update.xyz pointed to https://loginstorage.live/callback which delivered Conti. The final payload callback was hxxp://sync-sync.net/admin/config resolving to 28.254.220.29 via static-cloud.top.


Google TAG detected a multi-stage attack chain. The initial phishing email from contact@credential-check.site contained a link to https://nodedata.org/assets/js/payload.js. This redirected to https://static-portal.club/download/update.exe on api-secure.club. A secondary email from notification@identity-verify.cc pointed to http://apilogin.net/callback which delivered BumbleBee. The final payload callback was hxxps://nodeapi.dev/login resolving to 95.199.237.232 via data-update.net.


Recorded Future detected a multi-stage attack chain. The initial phishing email from info@identity-verify.cc contained a link to https://edge-cloud.site/api/v2/auth. This redirected to http://databackup.info/download/update.exe on updatestatic.link. A secondary email from confirm@login-portal.tech pointed to http://node-update.club/portal/verify which delivered DarkSide. The final payload callback was hxxps://storage-cloud.io/secure/token resolving to 40.169.228.126 via securenode.top.


Huntress detected a multi-stage attack chain. The initial phishing email from ceo@account-update.xyz contained a link to http://node-proxy.org/portal/verify. This redirected to hxxps://cdn-mail.cc/secure/token on mailsecure.cc. A secondary email from noreply@secure-verify.net pointed to hxxps://cachenode.club/secure/token which delivered SmokeLoader. The final payload callback was https://storageapi.io/collect resolving to 51.65.156.37 via syncdata.top.


Kaspersky GReAT detected a multi-stage attack chain. The initial phishing email from it@identity-verify.cc contained a link to hxxps://securecache.io/admin/config. This redirected to hxxps://update-login.cc/admin/config on proxynode.link. A secondary email from noreply@auth-check.org pointed to hxxps://secureportal.tech/admin/config which delivered BlackCat. The final payload callback was https://sync-login.com/admin/config resolving to 10.111.30.227 via data-auth.info.


Zscaler ThreatLabz detected a multi-stage attack chain. The initial phishing email from finance@document-share.link contained a link to hxxps://data-update.com/api/v2/auth. This redirected to https://api-backup.site/portal/verify on login-proxy.online. A secondary email from updates@identity-verify.cc pointed to http://api-backup.xyz/admin/config which delivered Vidar. The final payload callback was https://nodeupdate.live/secure/token resolving to 157.230.94.90 via login-gateway.com.


Tenable detected a multi-stage attack chain. The initial phishing email from ceo@phishing-domain.com contained a link to hxxp://backupapi.net/secure/token. This redirected to https://relay-gateway.link/collect on cdn-relay.net. A secondary email from it@account-update.xyz pointed to http://relaysecure.club/assets/js/payload.js which delivered Amadey. The final payload callback was http://cloudcloud.cc/panel/index.html resolving to 10.48.33.37 via static-backup.online.


Europol detected a multi-stage attack chain. The initial phishing email from notification@auth-check.org contained a link to https://backup-login.org/collect. This redirected to hxxps://data-login.xyz/portal/verify on cdnproxy.net. A secondary email from info@secure-verify.net pointed to hxxps://cloud-auth.site/callback which delivered BumbleBee. The final payload callback was https://staticproxy.info/callback resolving to 172.252.232.33 via static-node.link.


NSA detected a multi-stage attack chain. The initial phishing email from confirm@credential-check.site contained a link to https://cloud-proxy.net/admin/config. This redirected to hxxp://nodeportal.com/callback on cachecloud.online. A secondary email from it@phishing-domain.com pointed to hxxp://logincloud.site/assets/js/payload.js which delivered Qbot. The final payload callback was https://storagenode.io/assets/js/payload.js resolving to 172.235.33.18 via sync-relay.top.


Dragos detected a multi-stage attack chain. The initial phishing email from security@credential-check.site contained a link to hxxps://backupsync.com/download/update.exe. This redirected to https://syncnode.cc/download/update.exe on relayauth.net. A secondary email from updates@login-portal.tech pointed to hxxp://backupdata.online/callback which delivered Lumma Stealer. The final payload callback was https://gatewaycdn.info/panel/index.html resolving to 211.228.237.74 via gateway-api.io.


CrowdStrike detected a multi-stage attack chain. The initial phishing email from support@credential-check.site contained a link to hxxp://nodebackup.tech/gate.php. This redirected to hxxps://data-auth.top/secure/token on staticrelay.top. A secondary email from updates@phishing-domain.com pointed to https://proxystorage.live/api/v2/auth which delivered Royal. The final payload callback was https://storage-sync.top/secure/token resolving to 162.191.172.248 via relay-static.link.


Huntress detected a multi-stage attack chain. The initial phishing email from confirm@auth-check.org contained a link to hxxps://api-proxy.xyz/portal/verify. This redirected to https://login-proxy.org/collect on securestorage.live. A secondary email from contact@auth-check.org pointed to https://auth-secure.cc/callback which delivered LockBit. The final payload callback was https://loginsync.com/secure/token resolving to 192.206.157.234 via proxy-proxy.info.


Europol detected a multi-stage attack chain. The initial phishing email from support@document-share.link contained a link to hxxp://cloudrelay.info/panel/index.html. This redirected to hxxp://login-update.org/login on cdn-auth.club. A secondary email from contact@credential-check.site pointed to https://apiupdate.site/collect which delivered QakBot. The final payload callback was http://cdnrelay.org/secure/token resolving to 172.87.191.9 via noderelay.site.


Trend Micro detected a multi-stage attack chain. The initial phishing email from alert@phishing-domain.com contained a link to https://secure-auth.club/callback. This redirected to hxxps://secure-cdn.tech/callback on logincloud.site. A secondary email from support@account-update.xyz pointed to http://cdnportal.dev/admin/config which delivered Cobalt Strike. The final payload callback was https://storage-edge.io/portal/verify resolving to 192.192.251.104 via cachesync.net.


Google TAG detected a multi-stage attack chain. The initial phishing email from support@credential-check.site contained a link to hxxp://gateway-login.xyz/api/v2/auth. This redirected to hxxps://authrelay.tech/collect on api-sync.top. A secondary email from support@mail-service.info pointed to hxxp://proxycache.link/collect which delivered REvil. The final payload callback was http://updatestorage.io/secure/token resolving to 10.23.233.118 via sync-secure.org.


Mandiant detected a multi-stage attack chain. The initial phishing email from billing@urgent-notice.online contained a link to https://edge-relay.info/panel/index.html. This redirected to https://portal-proxy.dev/download/update.exe on api-cloud.com. A secondary email from helpdesk@auth-check.org pointed to http://cdnapi.online/assets/js/payload.js which delivered NjRAT. The final payload callback was hxxps://noderelay.xyz/api/v2/auth resolving to 10.107.238.127 via securecache.org.


INTERPOL detected a multi-stage attack chain. The initial phishing email from verify@phishing-domain.com contained a link to hxxps://backupnode.link/callback. This redirected to http://secure-sync.info/panel/index.html on loginrelay.cc. A secondary email from noreply@secure-verify.net pointed to hxxps://gatewaycdn.info/assets/js/payload.js which delivered Raccoon Stealer. The final payload callback was https://gateway-auth.site/secure/token resolving to 172.195.39.190 via cloud-cache.cc.


CrowdStrike detected a multi-stage attack chain. The initial phishing email from security@login-portal.tech contained a link to http://backup-proxy.top/api/v2/auth. This redirected to http://login-static.live/admin/config on relaycdn.tech. A secondary email from updates@account-update.xyz pointed to hxxps://syncbackup.net/portal/verify which delivered Vidar. The final payload callback was hxxps://proxy-relay.live/download/update.exe resolving to 102.137.166.252 via cloud-storage.site.


Microsoft MSRC detected a multi-stage attack chain. The initial phishing email from notification@secure-verify.net contained a link to hxxps://edgemail.live/api/v2/auth. This redirected to http://portal-storage.link/assets/js/payload.js on authsecure.tech. A secondary email from service@document-share.link pointed to http://secure-secure.top/gate.php which delivered StealC. The final payload callback was http://auth-api.live/panel/index.html resolving to 36.74.66.226 via relay-secure.link.


Google TAG detected a multi-stage attack chain. The initial phishing email from account@login-portal.tech contained a link to hxxps://dataedge.info/panel/index.html. This redirected to http://storageproxy.dev/api/v2/auth on updateproxy.cc. A secondary email from billing@credential-check.site pointed to http://portalmail.top/download/update.exe which delivered DanaBot. The final payload callback was hxxp://sync-mail.live/callback resolving to 172.57.180.214 via data-backup.com.


Trend Micro detected a multi-stage attack chain. The initial phishing email from support@login-portal.tech contained a link to http://gatewaynode.site/admin/config. This redirected to https://edge-update.online/callback on updatesync.online. A secondary email from helpdesk@credential-check.site pointed to hxxps://datacdn.com/download/update.exe which delivered Amadey. The final payload callback was hxxp://proxy-mail.com/assets/js/payload.js resolving to 172.72.57.56 via static-login.io.


CrowdStrike detected a multi-stage attack chain. The initial phishing email from report@auth-check.org contained a link to hxxp://secureproxy.live/collect. This redirected to https://login-gateway.club/collect on login-backup.com. A secondary email from report@urgent-notice.online pointed to http://syncsecure.online/assets/js/payload.js which delivered BatLoader. The final payload callback was hxxp://static-data.club/callback resolving to 192.213.38.171 via securenode.net.


Proofpoint detected a multi-stage attack chain. The initial phishing email from noreply@secure-verify.net contained a link to hxxps://static-edge.io/portal/verify. This redirected to http://static-cloud.xyz/assets/js/payload.js on proxydata.link. A secondary email from ceo@auth-check.org pointed to https://relay-login.info/secure/token which delivered Ryuk. The final payload callback was https://secure-proxy.tech/download/update.exe resolving to 10.163.25.199 via proxy-secure.org.


Cisco Talos detected a multi-stage attack chain. The initial phishing email from noreply@document-share.link contained a link to http://secure-cache.dev/portal/verify. This redirected to http://authapi.club/secure/token on cache-gateway.site. A secondary email from service@identity-verify.cc pointed to http://gateway-update.io/download/update.exe which delivered Dridex. The final payload callback was hxxps://cachestorage.dev/wp-content/uploads/doc.php resolving to 123.33.47.132 via storage-relay.tech.


Kaspersky GReAT detected a multi-stage attack chain. The initial phishing email from contact@document-share.link contained a link to hxxp://update-relay.org/assets/js/payload.js. This redirected to https://cache-api.io/callback on gatewaymail.tech. A secondary email from updates@identity-verify.cc pointed to http://mailcdn.link/wp-content/uploads/doc.php which delivered Raccoon Stealer. The final payload callback was hxxps://cachenode.tech/callback resolving to 192.94.70.51 via static-portal.live.


Recorded Future detected a multi-stage attack chain. The initial phishing email from noreply@secure-verify.net contained a link to https://cachecache.link/admin/config. This redirected to hxxps://backup-data.online/assets/js/payload.js on relayproxy.link. A secondary email from security@mail-service.info pointed to https://cloudsync.org/collect which delivered BatLoader. The final payload callback was hxxp://gateway-login.site/api/v2/auth resolving to 192.55.245.50 via synclogin.org.


Artifact Analysis for ShadowPad campaign:
Stage 1 dropper at C:\Windows\Temp\helper.sh - SHA1: 272c1b843d42e539f6af76eda593374382c3d589
Stage 2 loader at /usr/local/bin/sam.hive - SHA1: 4b41b04068834d1f736cfa20a0e979ed4f6168ff
Final payload at /tmp/taskhost.exe - SHA1: f12b7f9289afc5413a1ab5765c58e13b75519a12
Exfiltration module - SHA1: e5d32333d56c7c5a1358a29ef01a7676aa96bd71
All stages communicated with 10.90.187.139. Hashcat signatures detected in Stage 2.


Artifact Analysis for Ryuk campaign:
Stage 1 dropper at C:\Windows\Temp\loader.exe - SHA256: 3e4b4e871c332f852f679b8a2aac07fad976230f18ca3cdf9b8c314d53cd2674
Stage 2 loader at /tmp/helper.sh - SHA1: 745e9c0d27c0f5ea9ed39665df87e879b3846777
Final payload at C:\Users\admin\Downloads\beacon.dll - SHA1: 821b4432c61940a5a1c749ba569cca79bacc61e9
Exfiltration module - MD5: fd068f387d77bd4582b4e903fddcfe05
All stages communicated with 81.106.165.23. Mimikatz signatures detected in Stage 2.


Artifact Analysis for StealC campaign:
Stage 1 dropper at /tmp/agent.py - SHA256: 4ea669fb144df7473a408069ea867cc7c1718b1bfe26238c124e41170d9b87a7
Stage 2 loader at /var/tmp/chrome_helper.exe - MD5: c09ff5a36af50f9dce849ceeae5d1038
Final payload at C:\Windows\Tasks\chrome_helper.exe - SHA1: 4a63695b55720cb782cdb44b09c2dadafbe3a74a
Exfiltration module - MD5: df8d3f26abfb9ab5f6f14160108bfd7e
All stages communicated with 172.117.100.195. PowerView signatures detected in Stage 2.


Artifact Analysis for REvil campaign:
Stage 1 dropper at C:\ProgramData\csrss.exe - MD5: 501b52d42f7e469c628c50d392e5d0ca
Stage 2 loader at /usr/local/bin/runtime.dll - MD5: 43c043dbddfaa045ce7451865ed3659d
Final payload at /var/tmp/loader.exe - MD5: 3b6ad6390a47d951f441d2b4025b530b
Exfiltration module - SHA1: 605c41fcfc943c32094c5a727a66d1e43f593960
All stages communicated with 28.248.210.140. Hashcat signatures detected in Stage 2.


Artifact Analysis for Lumma Stealer campaign:
Stage 1 dropper at C:\Windows\System32\update.dll - SHA1: 8bbb74922c4ac80bb9548a9ca50a0cf07773f406
Stage 2 loader at C:\Users\admin\Desktop\dropper.ps1 - SHA256: 19549578513cec2aef4c23c919224015c87e850eab68f36d646b1f7a69bd56c1
Final payload at C:\Windows\System32\shell.php - SHA1: 1aef6245b355faa7477201663bf9fae816bdc935
Exfiltration module - SHA1: 4cab829dd8d16c3f9e61f4599232857f479198c8
All stages communicated with 88.21.88.238. Mythic signatures detected in Stage 2.


Artifact Analysis for BatLoader campaign:
Stage 1 dropper at C:\Users\Public\Documents\dropper.ps1 - SHA1: 241950aedc9dd4bd71af0af08bff44092836ff84
Stage 2 loader at C:\Program Files\Common Files\shell.php - MD5: ee004920e8e9996ae72a66bedffabcd6
Final payload at C:\Users\Public\Documents\shell.php - MD5: 648e9f0529fa90be928c3e94b02959bd
Exfiltration module - MD5: 8744a009f7948abd4c3bd6a47f164621
All stages communicated with 191.90.189.242. Impacket signatures detected in Stage 2.


Artifact Analysis for Ryuk campaign:
Stage 1 dropper at C:\Users\Public\Documents\agent.py - MD5: 2f3c1066ad9a07b70e011f90f0f0e47a
Stage 2 loader at /opt/app/bin/helper.sh - SHA1: 946ecc612283d0f3975ffc9d8ecdc00418ca8015
Final payload at C:\Program Files\Common Files\winlogon.exe - SHA1: a49470535c33d622dbec2347bb30fba35d41669e
Exfiltration module - SHA256: e9c00aa817b82ee85effeab488ce7d240b7308462ede24d9b49ee1a85bba1eb5
All stages communicated with 192.222.56.202. SharpHound signatures detected in Stage 2.


Artifact Analysis for Emotet campaign:
Stage 1 dropper at /home/user/.config/lsass.dmp - SHA256: 666beef6d9e182a1d1c7b879fc56cd42d051ad874471ce11f48d28c039da9c0e
Stage 2 loader at C:\ProgramData\ntds.dit - MD5: d5b376ff10c217969633ce129769ef0e
Final payload at C:\Users\Public\Documents\ntds.dit - MD5: fe78fbb537bb40134a3cce4bd7f0c956
Exfiltration module - SHA1: cc439d14fe07333bde59ffff44e8c5536eaea54f
All stages communicated with 62.115.231.175. Hashcat signatures detected in Stage 2.


Artifact Analysis for SmokeLoader campaign:
Stage 1 dropper at /var/tmp/lsass.dmp - SHA256: dd110048ef9419163dc69e9dc432d275f0b926c8ea7988ca75db5891bfa0ae0a
Stage 2 loader at /dev/shm/chrome_helper.exe - MD5: 1d17fc0bddb5ac8b8c8c53795e3a01a6
Final payload at C:\Windows\System32\beacon.dll - SHA1: 99623582c761b5e04daf5360e988b0e439d76447
Exfiltration module - SHA1: 5d05abac4c723bf07e842ee6988fe6ed9397d354
All stages communicated with 172.191.122.206. PowerShell Empire signatures detected in Stage 2.


Artifact Analysis for StealC campaign:
Stage 1 dropper at /home/user/.config/svchost.exe - SHA256: f644804e1e60c32e51753cf2cfa7b1059a6b28bd405590f2e65403adc42580fd
Stage 2 loader at C:\Users\admin\Desktop\implant.so - SHA256: 4ecedfae86bb0a46f37f1f7c16c7014e765959d7f22092afc2334f87bc7366b8
Final payload at C:\Windows\Tasks\payload.bin - SHA256: 1a664bc85dc06b214abc90a0997c93614a1a555b725564bfca97ccb4ff667779
Exfiltration module - MD5: da0899795eb7b25c7ccd91482608b933
All stages communicated with 37.26.139.23. Sliver signatures detected in Stage 2.


Artifact Analysis for PlugX campaign:
Stage 1 dropper at /tmp/chrome_helper.exe - SHA1: bd9d7a7a023daf746f8d8ccaa73c3d1745465262
Stage 2 loader at C:\Users\Public\Documents\lsass.dmp - MD5: 42f2591e90e344a6e679591b9c93dc15
Final payload at C:\Windows\Tasks\dropper.ps1 - SHA256: fc7b058f1f894eef7d63102b5ae90cee1392668e5499644f357878e6f546c97d
Exfiltration module - SHA1: f03a1d06db7b999dd9bd9cbc7badf8d6b8d12092
All stages communicated with 177.132.251.247. Hashcat signatures detected in Stage 2.


Artifact Analysis for NjRAT campaign:
Stage 1 dropper at C:\Windows\System32\csrss.exe - MD5: 1fec74d50de58bdaa03b28a52d7b29b3
Stage 2 loader at /etc/cron.d/helper.sh - SHA256: 0a94b8cce0388d2ba2832a83b87e5e694628c8d1d2c7e888cb31d64203d59abb
Final payload at C:\Users\Public\Documents\sam.hive - SHA256: e880b0d1e76974085e371144c48e8030f93198e391eea4cb6265e0664a0690bf
Exfiltration module - SHA1: b3a25cf49a4e4549f624c6671e3edc3eb6eda6ef
All stages communicated with 172.200.52.112. Hashcat signatures detected in Stage 2.


Artifact Analysis for Raccoon Stealer campaign:
Stage 1 dropper at /usr/local/bin/update.dll - SHA256: 17db5279b4a743ca3329249ca51ff781b4c431cd99315ceb658244eafd81d99e
Stage 2 loader at /var/tmp/implant.so - MD5: e22d329db3c4b612314db72e9de4b37e
Final payload at C:\Windows\Tasks\payload.bin - SHA1: f18e6118efac43cfa7fd3476b4d0e5367af10849
Exfiltration module - SHA256: 23807456de6f7fa6220c0f0ac155c3545c775e332318f125bdc2e41e04407f7e
All stages communicated with 73.176.225.108. PowerShell Empire signatures detected in Stage 2.


Artifact Analysis for Meduza Stealer campaign:
Stage 1 dropper at /home/user/.config/chrome_helper.exe - SHA1: 5d34bbbd6b1f6467554a41388b3b2a7797716f96
Stage 2 loader at /usr/local/bin/payload.bin - SHA1: 8cb87f022d27f2f8603143c5d4a44c47fda70dc5
Final payload at /etc/cron.d/update.dll - SHA256: 622586a1e42103851378c2b0c7b985cb88f0db80f4a7b8646087898aa07a28f6
Exfiltration module - SHA1: 422af7f79137d5857ee02d0d1a41c274b6a711c5
All stages communicated with 51.209.28.56. Chisel signatures detected in Stage 2.


Artifact Analysis for LockBit campaign:
Stage 1 dropper at C:\Users\admin\Downloads\loader.exe - SHA1: b752d0e06981d57894538524c075b6a307d2bb98
Stage 2 loader at C:\Users\admin\Downloads\runtime.dll - MD5: d249d09e3bff46ed55f184db2e9d833e
Final payload at C:\Users\Public\Documents\runtime.dll - SHA1: b149c519a368780d5d408a66a4de1727c8f5897f
Exfiltration module - MD5: 74be058a36fa89b5dadd522a09c97e85
All stages communicated with 125.110.158.52. ADFind signatures detected in Stage 2.


Artifact Analysis for FormBook campaign:
Stage 1 dropper at /etc/cron.d/implant.so - MD5: b9c2686f83914ab92da6ccff2228766e
Stage 2 loader at C:\Users\Public\Documents\implant.so - SHA1: 1fca76898877faeab8ef4aec4396c97d9d1201cb
Final payload at C:\Windows\Tasks\sam.hive - SHA1: cd7dfb73500706e2c848d00a0702043eb20a63ee
Exfiltration module - SHA1: 6e525d8c0eb8044d3210e34de1c29590c9bc4b2e
All stages communicated with 132.200.75.37. PsExec signatures detected in Stage 2.


Artifact Analysis for Vidar campaign:
Stage 1 dropper at /usr/local/bin/helper.sh - MD5: 07f736a1593ac1ad8eb9c3ce52fb15de
Stage 2 loader at /dev/shm/ntds.dit - SHA1: c3cddbb88cd35ac6f32ca267d773962a262bc475
Final payload at /tmp/ntds.dit - SHA1: 0a9336c606e9a3158a2bd171c55682923ea825ba
Exfiltration module - SHA1: 0a82c2bda4cb8dba6d94974fb7370f24e5412951
All stages communicated with 25.39.236.208. Rubeus signatures detected in Stage 2.


Artifact Analysis for SystemBC campaign:
Stage 1 dropper at /opt/app/bin/implant.so - SHA256: 4c8fd61872c2862d64277d4510888e60ad10bf761eb9bcaad2846dc6cb04a5c5
Stage 2 loader at /opt/app/bin/csrss.exe - MD5: 3c8b5d862509979e929c30f916a1247e
Final payload at /tmp/implant.so - MD5: 752b9e94ea3eee372c583ef5b940c35b
Exfiltration module - SHA256: 9729b4329dfe7ee02ea75932b534c9d8fd5bf1185bb5f9de34a2b70ff59e9859
All stages communicated with 207.24.217.171. Merlin signatures detected in Stage 2.


Artifact Analysis for QakBot campaign:
Stage 1 dropper at C:\Windows\System32\implant.so - SHA1: f0448a8c14a431e5151a2ace44a1d8c8941f106d
Stage 2 loader at /usr/local/bin/dropper.ps1 - SHA1: ef123a867a02fd32adb962792e6edf672efa2497
Final payload at C:\Program Files\Common Files\helper.sh - SHA1: 53e68a8c6eb41ef8a90107dcce55d3e5d6bec2a5
Exfiltration module - MD5: 0fdbf1ed925aaf75a35815d7a3a060df
All stages communicated with 181.77.170.84. ADFind signatures detected in Stage 2.


Artifact Analysis for Dridex campaign:
Stage 1 dropper at C:\Windows\Tasks\shell.php - SHA1: ba4a697129fe0a157e80462ed3bd2916fd333014
Stage 2 loader at /tmp/implant.so - SHA1: 67f93cd86492d0b5f5dc4287b06703f010e7fb66
Final payload at /home/user/.config/helper.sh - MD5: 6b36d9ab6a185c99cb7fbacd3f75f406
Exfiltration module - SHA256: a8a886bf32d7f7476559d79d9cb660c10c9d08977fa2d59ee92d7fd4394568d2
All stages communicated with 172.81.36.92. Burp Suite signatures detected in Stage 2.


Artifact Analysis for Latrodectus campaign:
Stage 1 dropper at C:\Users\admin\Desktop\sam.hive - MD5: c5541733709ef2df6e6fed4ccfde18da
Stage 2 loader at C:\Users\admin\Desktop\payload.bin - MD5: 5913d38534c58ea1afe36f951c688d58
Final payload at /home/user/.config/payload.bin - SHA1: a61dda965395a88b4404bc984e842bc0544e8ce2
Exfiltration module - SHA256: eeebefb06e47e58bd6df32bb8759b17b8cd7dda6c8c9e7f7fa2ca1c0840a2973
All stages communicated with 67.16.158.6. Chisel signatures detected in Stage 2.


Artifact Analysis for ShadowPad campaign:
Stage 1 dropper at /dev/shm/sam.hive - MD5: 884ca3356a527fb2fa1eb0e6e6be2762
Stage 2 loader at C:\Windows\Temp\runtime.dll - SHA256: 65564bea2ac080c8721f175a4d10054d08e9d5512f3338d310a9b5295c5cf225
Final payload at /etc/cron.d/backdoor.elf - SHA1: ca44f8038e546ce2608513c72fd95e6b525c8147
Exfiltration module - SHA1: 8b5adf9ff370d0d952f2e75fafbf47812317378a
All stages communicated with 209.118.25.247. Sliver signatures detected in Stage 2.


Artifact Analysis for AgentTesla campaign:
Stage 1 dropper at /dev/shm/winlogon.exe - MD5: a4b121f3b8cf053d265109dc5636a78d
Stage 2 loader at C:\ProgramData\svchost.exe - SHA1: ee4a34e575e4d9aadb3a24692cc5fab8ee057cb8
Final payload at C:\Windows\Temp\lsass.dmp - MD5: 6fb923ca07edf4385756e54bcdd5f870
Exfiltration module - SHA1: 788ae2fb1d60ef9a39531b35335b895c0515807c
All stages communicated with 192.144.11.125. Seatbelt signatures detected in Stage 2.


Artifact Analysis for Qbot campaign:
Stage 1 dropper at C:\Users\Public\Documents\csrss.exe - SHA256: 77289f13c9feb06f40792f3245b5d8f5188d264eb7a65c616473d4f4308c1df9
Stage 2 loader at C:\Users\admin\AppData\Local\Temp\backdoor.elf - SHA256: 5c03dfd0628aa5f48aa5fee1c09d93e765da96a27b6e7d0848696679cb635da7
Final payload at C:\Users\Public\Documents\chrome_helper.exe - MD5: b1e428d4b2db8baaf9e016c7155edae3
Exfiltration module - MD5: b437c5c828d8540289bc021546b2474f
All stages communicated with 192.77.71.14. BloodHound signatures detected in Stage 2.


Artifact Analysis for AgentTesla campaign:
Stage 1 dropper at /tmp/implant.so - SHA1: 63003d9ce6c2659944e5c4b91949d4ff1c8d819e
Stage 2 loader at C:\Windows\Temp\svchost.exe - SHA256: 24e1e25faa27a77018ab33668640f88d320e1c74a66a671349d7bc0e5bf628b1
Final payload at C:\Users\admin\Downloads\shell.php - MD5: 0c8c269bbe812eb666b6636b23719126
Exfiltration module - SHA256: bbb29f766be1866ea88fdab89ec02d6a288fa6353ed489923a9f300b859e70c0
All stages communicated with 192.47.155.113. BloodHound signatures detected in Stage 2.


Artifact Analysis for Amadey campaign:
Stage 1 dropper at C:\Users\admin\AppData\Local\Temp\csrss.exe - MD5: 1cf4586d3b17db7d689b88566bec53be
Stage 2 loader at /etc/cron.d/winlogon.exe - SHA1: f1b8e36ff716aacc7abb74781d6da61887e30059
Final payload at C:\Windows\System32\helper.sh - MD5: 48a44aa6a2673b6f6cdaf5f2643c2670
Exfiltration module - SHA256: 4db01633d044213f192fc19799b0b82927aa4fdd0c93117d32de69b668c114df
All stages communicated with 192.14.129.157. LaZagne signatures detected in Stage 2.


Artifact Analysis for BlackCat campaign:
Stage 1 dropper at /home/user/.config/winlogon.exe - MD5: ad2253dd51db543d594e713e75cedeee
Stage 2 loader at C:\Users\admin\Desktop\dropper.ps1 - MD5: 7ed5841f11f87eed42aaf9f108a3ac3b
Final payload at /home/user/.config/agent.py - MD5: 06f949d97f49cf09adccd55b5df69fa4
Exfiltration module - SHA1: d02e72587a62f6b7bccc22985ae5833cb917ddea
All stages communicated with 60.100.107.211. Covenant signatures detected in Stage 2.


Artifact Analysis for Gootloader campaign:
Stage 1 dropper at /home/user/.config/ntds.dit - SHA256: eb04273bb24b8b6f3a7cad6c3f1b6be66c4b120eaf11f6a2b19f2fc78e1c09c2
Stage 2 loader at /opt/app/bin/chrome_helper.exe - SHA1: 47044f5fbfa47a02d2b519907948086fdee0c8ad
Final payload at C:\Users\admin\AppData\Local\Temp\runtime.dll - SHA1: 78d87995bcbe3dc0b4878cabcde7dee9f7fc9773
Exfiltration module - SHA1: 30241c274b04dbf8e895ba42dfb799c0b4033895
All stages communicated with 10.70.150.23. Certutil signatures detected in Stage 2.


Artifact Analysis for RedLine Stealer campaign:
Stage 1 dropper at C:\Users\admin\AppData\Local\Temp\lsass.dmp - SHA256: 29441fac67f23ef63db5cb9fca03065622c6e1abb61914ba2819fdd6e9d32c3e
Stage 2 loader at /usr/local/bin/backdoor.elf - SHA256: 173ad87fcfe5cc7fe02caf47ac495b57d3694a2d7a44c77498226b9eabb3f0d8
Final payload at C:\Users\admin\AppData\Local\Temp\runtime.dll - SHA256: 75c4f216ecbf68c7be3f08a83580150038dd55104694241ad7f67ff6b49a4dba
Exfiltration module - MD5: 02993c2548c5bafe781977e0073bda38
All stages communicated with 172.60.248.175. Sharphound signatures detected in Stage 2.


Artifact Analysis for Latrodectus campaign:
Stage 1 dropper at /tmp/agent.py - MD5: 4095e2193c4521d09b05e8b60d1d779d
Stage 2 loader at /var/tmp/update.dll - SHA1: 8b8fb6d27c8ba372c3b345762612c32c0deb7613
Final payload at C:\Windows\Tasks\taskhost.exe - SHA1: 2e9c8670abda459583f7abfd1038d61f1711aa5b
Exfiltration module - SHA256: 39d2239e3a9de21eb3275a76e625f7d2f1417fe1c7eb9979d1cd61be2e28053d
All stages communicated with 10.81.47.206. LinPEAS signatures detected in Stage 2.


Artifact Analysis for Raccoon Stealer campaign:
Stage 1 dropper at /tmp/shell.php - MD5: 6810d117f26a0e06ab15cd907e92f29b
Stage 2 loader at C:\Users\admin\Downloads\helper.sh - SHA1: a481a934c600bf7e95fbc6a1d4336fe03a6da4fc
Final payload at C:\ProgramData\loader.exe - SHA256: a7b61940ecb64720bb7c3d786d5f589a429a5792dcd6ef3cb171392161e11587
Exfiltration module - MD5: ee6b0481fbd5374be860c7f5598ed0e4
All stages communicated with 192.43.13.140. Brute Ratel signatures detected in Stage 2.


Artifact Analysis for PlugX campaign:
Stage 1 dropper at /var/tmp/lsass.dmp - SHA256: 493e23b09eda2d014d0270603464352c7f65e3efca2a79d821c24913708ef46f
Stage 2 loader at /dev/shm/svchost.exe - SHA256: 5c6c5597ac07668747d2f0fec19dc15e64555eff07bee99496522fc3aaff8d7a
Final payload at C:\Windows\System32\csrss.exe - SHA256: 6b458fc681b2cbe36d04cb12b9f01ed546c2dc41cc028ef3249fd94399589ec4
Exfiltration module - SHA1: 497a7d649f9271293f0b354b2277c0a814a5d71c
All stages communicated with 62.183.216.80. ADFind signatures detected in Stage 2.


Artifact Analysis for Vidar campaign:
Stage 1 dropper at /tmp/csrss.exe - MD5: 2914e439c22d9e6a46f0a424d09258f6
Stage 2 loader at /home/user/.config/sam.hive - SHA1: 70d43b0cffc16534c3af3e2b0eda3b165a98afbe
Final payload at C:\Users\admin\Downloads\loader.exe - SHA256: d6e18226d460d2adf10d8c2310fd7a9ea4c37c0d5090e3ea4a5833186989a378
Exfiltration module - SHA256: 5fd43635ebed7a265f45cf9313aeb1e69210db242ccf85d2c68895e23ccd93be
All stages communicated with 42.156.8.170. PsExec signatures detected in Stage 2.


Artifact Analysis for Amadey campaign:
Stage 1 dropper at /usr/local/bin/implant.so - SHA256: de057d68246f523c1ff3e66d44d618af9492c810ae4181b5f26881c8f0799a0d
Stage 2 loader at C:\Windows\System32\update.dll - SHA256: 2a42deb924c0be162cc2397500e482d0a2157c6ab98d13ff81684dfa8dc28670
Final payload at /var/tmp/chrome_helper.exe - SHA1: 38f6aaf8e40ffc00f3379c73b95104b281faf48b
Exfiltration module - SHA1: 68c02776f593fc98b823d43a065e9fe30a1a8d44
All stages communicated with 160.38.133.83. Sharphound signatures detected in Stage 2.


Artifact Analysis for Raccoon Stealer campaign:
Stage 1 dropper at C:\Windows\Temp\runtime.dll - SHA256: 348b6282a569fe2cb03baad99aa588440b9160fefce5e614587a3230f16b6e96
Stage 2 loader at /etc/cron.d/beacon.dll - SHA1: cee609a11b2fc5234161d06b375713e3ba40f31e
Final payload at C:\Windows\System32\loader.exe - SHA256: e39c2e8a74bde4f26ef02b189b6a9c18eaaa537b525f7e20f5aa55238c3ddc12
Exfiltration module - SHA1: 0b494327a72c3b2474a078cf7e32a0d3ef3c6354
All stages communicated with 192.174.120.148. ADFind signatures detected in Stage 2.


Artifact Analysis for Raccoon Stealer campaign:
Stage 1 dropper at /dev/shm/helper.sh - SHA1: 9f543ccbf240d4a4985c4fcc62225cde7b1efa23
Stage 2 loader at /var/tmp/runtime.dll - SHA256: c6ce6b39d8a2ce20bab2476fd6bbd1c3c49be1eb67037ded12f61d73bbae6768
Final payload at C:\Users\admin\Downloads\sam.hive - SHA256: 512a7dbe6ebd97461f218f33cac7b869ff4dfc91524f355b10bed63f9d433911
Exfiltration module - MD5: 3c6ed6a5c6d6ff15a0dceaa422acb733
All stages communicated with 172.26.91.178. Hashcat signatures detected in Stage 2.


Artifact Analysis for DarkSide campaign:
Stage 1 dropper at C:\Users\admin\Downloads\helper.sh - MD5: ea1b5f3afbad94ab343ba9eaa0be235a
Stage 2 loader at /etc/cron.d/dropper.ps1 - SHA1: eaf10105057a10d9bcea0bfc26a1ef3ed2b4ea78
Final payload at /etc/cron.d/winlogon.exe - MD5: 4be786c4dc2cc636ff77d9a670aa8a9e
Exfiltration module - MD5: bc8146ba403fd8a74e0cf77927a62354
All stages communicated with 10.57.186.174. Mimikatz signatures detected in Stage 2.


Artifact Analysis for QakBot campaign:
Stage 1 dropper at /home/user/.config/beacon.dll - MD5: 6daa627c2fdb6c723244bef0e878187c
Stage 2 loader at C:\Windows\System32\svchost.exe - MD5: 4bf89171efa86969272b2700a121a3be
Final payload at C:\Windows\Tasks\backdoor.elf - MD5: 50e89edbd76c34954c9cb7bdc76b09c9
Exfiltration module - SHA1: b35455fb6907ba4f69d044a07c0d190528c97d02
All stages communicated with 192.238.7.250. Chisel signatures detected in Stage 2.


Artifact Analysis for AgentTesla campaign:
Stage 1 dropper at C:\Users\Public\Documents\sam.hive - SHA256: 95bde637f970990e30466499fe4e5efaf6d207d3e51ede1553c8f9de94a14590
Stage 2 loader at C:\Windows\Tasks\winlogon.exe - SHA1: 715e1b17851f8999d6b54ac73d455d81e2f83059
Final payload at C:\Users\admin\AppData\Local\Temp\payload.bin - SHA256: 9ed0bc055f087ced9f1b1f3a616989dbf0e9f3606280588f7325a2ffb3f297ba
Exfiltration module - SHA256: 8d3e7325b5bdf39997cfc3dd2332c84b7a0f435a4f284cea3d961f6b4c784ff5
All stages communicated with 192.123.38.7. Seatbelt signatures detected in Stage 2.


Artifact Analysis for BatLoader campaign:
Stage 1 dropper at /usr/local/bin/taskhost.exe - SHA256: 32722c795f43d3e18e722591f1b92e259e5c68acd02d72097f2098d93423996d
Stage 2 loader at C:\Users\admin\AppData\Local\Temp\helper.sh - SHA256: 7f6d7087ebec2ea8e78687d4a6a2ce8cd84a3adf3198a1d0bb1344c00169b35d
Final payload at /dev/shm/payload.bin - SHA256: 1eb33e12994d8253bea165d216a236b0d80b27d2a8bd964edebc09c160cb04a0
Exfiltration module - SHA1: 26300ee4dbcd28ba74ccda3a219d64d23fe1bbe8
All stages communicated with 10.76.232.45. Seatbelt signatures detected in Stage 2.


Artifact Analysis for QakBot campaign:
Stage 1 dropper at /etc/cron.d/taskhost.exe - SHA1: e49b5584c9a39e44afa1841fda6c741eaed9de87
Stage 2 loader at C:\Windows\System32\ntds.dit - MD5: 1ac3af41120d8f2cef5b64cb7a44a764
Final payload at /tmp/sam.hive - MD5: 259cf8e670d054f2096361eac7f73984
Exfiltration module - MD5: ebf402b23bb74e3da2257acc31c4276f
All stages communicated with 172.218.108.54. Sharphound signatures detected in Stage 2.


Artifact Analysis for WarmCookie campaign:
Stage 1 dropper at /etc/cron.d/taskhost.exe - SHA1: c2019561ae7f50d89173b77cb6d5ee77bc59bebe
Stage 2 loader at C:\Windows\Tasks\lsass.dmp - SHA256: fbac811db09b7808999ba194b461ce075145ddc6668e640af0fcc461253c89ec
Final payload at C:\Program Files\Common Files\ntds.dit - SHA256: 29a71b79596400c2d5191ac5495636a60d35f58ac7cbbed658df24c902b029ff
Exfiltration module - SHA256: cdf2046ed28eb38c8a8bde7570e146e6441b7291f5e49c3281a292697a86f308
All stages communicated with 10.84.250.74. ADFind signatures detected in Stage 2.


Artifact Analysis for DarkSide campaign:
Stage 1 dropper at /tmp/agent.py - MD5: f0f77ea05d2a1f62324f3887124b3da2
Stage 2 loader at /etc/cron.d/shell.php - SHA256: bc652e95557574acb820d000c13f163fe2d31e3f599f29dcc88035ac59e06df3
Final payload at /etc/cron.d/dropper.ps1 - SHA256: cad0ed1f0267d5090a29b1d1a8e4a0bbdd64618c5165113038fe2bfc893d5a12
Exfiltration module - SHA256: 301d396ee37111ccad8d5b5c79ef76603c403e17bd29a0737828ac04af75386c
All stages communicated with 102.179.203.41. Sharphound signatures detected in Stage 2.


Artifact Analysis for IcedID campaign:
Stage 1 dropper at /opt/app/bin/implant.so - SHA256: 56fe03a871d3cb0e31654b4f5f6542602eeeba4f424cfa551a5cfefd6d5daca9
Stage 2 loader at C:\Users\admin\AppData\Local\Temp\shell.php - SHA1: 82f012690c907bb94428e4bc1749c13800eac800
Final payload at /home/user/.config/agent.py - SHA256: 60e8b685d487fcdce89a0ae7d657a6b82993c54a30e324140f96869425c67238
Exfiltration module - SHA1: 72168ffff3422c1bbe9853062e78df236f0527a0
All stages communicated with 128.186.106.195. Seatbelt signatures detected in Stage 2.


Artifact Analysis for XLoader campaign:
Stage 1 dropper at C:\Users\admin\Downloads\csrss.exe - MD5: 99e34945c47e2732c84b3a678592e0c2
Stage 2 loader at C:\Program Files\Common Files\agent.py - MD5: 1a26a4c01d068f9c344f0a2b0695bd84
Final payload at /etc/cron.d/dropper.ps1 - SHA256: bc7df102d437f968546f0deccad330c7e8ab4a04d89270a1fd44ac9352aad64e
Exfiltration module - MD5: 3286cb3382ee7ca41acd514b249cc814
All stages communicated with 128.223.213.150. Merlin signatures detected in Stage 2.


Artifact Analysis for FormBook campaign:
Stage 1 dropper at /dev/shm/beacon.dll - MD5: b6d2017e8d9377ac886aa3084f540079
Stage 2 loader at C:\Windows\Temp\winlogon.exe - SHA1: 8ec5cb8f537604e44c018e5e44a1cea66cd24343
Final payload at C:\Users\Public\Documents\dropper.ps1 - MD5: f35c4aa8df349f978cf493102305dd18
Exfiltration module - SHA1: 2b1708dbba5d0c9d1557a0e24deef7b654f54108
All stages communicated with 213.26.202.119. Havoc signatures detected in Stage 2.


Artifact Analysis for Emotet campaign:
Stage 1 dropper at /usr/local/bin/winlogon.exe - SHA1: c617f5b66b8cb27f811c87cd8cb6d7cf14d49c1d
Stage 2 loader at C:\ProgramData\taskhost.exe - SHA1: 36fb2b9f8743d6ab9a4c7a96f5c7007c04bae23d
Final payload at /etc/cron.d/shell.php - SHA1: 5c88785e18698adad9f6544de0c8ae80342fccdd
Exfiltration module - MD5: d3b984434da5a85c7d4fe72b130a7802
All stages communicated with 172.211.233.1. Hashcat signatures detected in Stage 2.


Artifact Analysis for WarmCookie campaign:
Stage 1 dropper at C:\Users\admin\Desktop\implant.so - MD5: 7c3e542708b6d48c04704591862c8a33
Stage 2 loader at /dev/shm/implant.so - SHA256: aed800f7ed075cd08b9e43acf068c924492fe1bfd60195e7a7e01fc7b5c2ffb2
Final payload at /etc/cron.d/update.dll - MD5: c5225fc5dc3cf6ae4dba0157013f0920
Exfiltration module - MD5: 396bede1e1c13c1c1763962f1e74784d
All stages communicated with 177.203.208.215. BloodHound signatures detected in Stage 2.


Artifact Analysis for Gootloader campaign:
Stage 1 dropper at /var/tmp/loader.exe - SHA256: 0a05928a49b4a37219ddd89de71269ec113beed92be59803be9b5f08fcaccd47
Stage 2 loader at C:\Users\admin\Downloads\loader.exe - SHA1: 72f3968e91bcc323136dd30d85ae887382c487e2
Final payload at /etc/cron.d/update.dll - SHA1: 346f216583a1460bb97ebeee0e67f852d9770a45
Exfiltration module - MD5: f6c75c26890bae32e785b3c16b1dda08
All stages communicated with 37.237.169.1. Metasploit signatures detected in Stage 2.


Artifact Analysis for Play campaign:
Stage 1 dropper at C:\Users\admin\Downloads\config.dat - SHA1: dd3d854fc6ca8553e344852cb5694710df520fb6
Stage 2 loader at /opt/app/bin/config.dat - SHA1: b73737f7608c4415b2b6da80e7015b46998b3e12
Final payload at C:\Users\Public\Documents\config.dat - SHA256: e92b239aaa6c105a8157dda645582869bdbdc00a40f6c8f29d0e084f6fbc306b
Exfiltration module - SHA256: 8a8dbc517b02e2ccaca761929a8cee3db48bfff85cd01b560e9838c761d6eedf
All stages communicated with 10.144.135.180. Certutil signatures detected in Stage 2.


Artifact Analysis for Lumma Stealer campaign:
Stage 1 dropper at /var/tmp/winlogon.exe - MD5: f6545f35d7f122f8470cff90a919612d
Stage 2 loader at C:\Users\Public\Documents\agent.py - SHA256: 11a21d72c98ca12e4b932b508e023227e894651d901a1c1cd395aa2aada4c81e
Final payload at C:\Windows\Tasks\backdoor.elf - MD5: 7fd5727090e186166cd46a3cbd7137d0
Exfiltration module - MD5: 89b158be09a8c233264dceebb828a976
All stages communicated with 162.46.161.172. Havoc signatures detected in Stage 2.


Artifact Analysis for RemcosRAT campaign:
Stage 1 dropper at /opt/app/bin/backdoor.elf - SHA256: 5e0baaa874c2fd76ca5ede95db7a7920b52b247563eb9b2a77c29a7f010b2d95
Stage 2 loader at /etc/cron.d/dropper.ps1 - SHA256: 0f06fde8b1fd7e7d92da73b6c17288a489cd6593cba2426c85dfea843f31b60b
Final payload at /var/tmp/dropper.ps1 - SHA1: 7936d7f9c2e8f059826b20d41cac45eab600f666
Exfiltration module - SHA1: a50751c6149f58c73ca30509e261470bef39a268
All stages communicated with 172.150.34.111. PsExec signatures detected in Stage 2.


Artifact Analysis for Dridex campaign:
Stage 1 dropper at /opt/app/bin/payload.bin - SHA1: 93d89d0ef31c69e501036864ea06319979fe47a3
Stage 2 loader at C:\Windows\System32\dropper.ps1 - MD5: 6e18e28f8d48549d158068298a4e55c1
Final payload at /dev/shm/winlogon.exe - SHA256: 37e1bd86b72b7af020ad5bd14e4ba4d95c499180b22db316318417b8fa32f960
Exfiltration module - MD5: cb7fb5a1a8ce59879f87724224aa763c
All stages communicated with 192.22.33.141. CrackMapExec signatures detected in Stage 2.


Artifact Analysis for StealC campaign:
Stage 1 dropper at C:\Windows\Tasks\helper.sh - SHA256: 9e06da8b0b7d7656ffa2d5520a827a9f8cde48a50185db3ffd6294d252375d17
Stage 2 loader at C:\ProgramData\taskhost.exe - MD5: 05802df647088a26be34c0c7e439adc0
Final payload at C:\ProgramData\agent.py - SHA1: 62b45bb44158ac6973c19d777c4d1906cd9884ca
Exfiltration module - MD5: bcc3c902ee9ae1c9ad587be8e089f070
All stages communicated with 10.216.13.145. Sliver signatures detected in Stage 2.


Artifact Analysis for Raccoon Stealer campaign:
Stage 1 dropper at C:\Users\admin\AppData\Local\Temp\winlogon.exe - SHA1: f54242483ecf0d90cb58984f1ff274d0f8ca0e28
Stage 2 loader at C:\Windows\Temp\agent.py - SHA1: a7677024098a7ca7ffd46bf9c165b3d18e9c4ca2
Final payload at /opt/app/bin/implant.so - SHA1: 6ef4a70b38bc1d9d91df27f9370765a88387fb82
Exfiltration module - SHA256: d274e670c20b6b81f77b79ecf385c9891b9e38b67a03bc1a83f7726d3733a761
All stages communicated with 192.231.137.16. Sharphound signatures detected in Stage 2.


Artifact Analysis for StealC campaign:
Stage 1 dropper at /dev/shm/csrss.exe - SHA256: 6f99f018f08b70b995ddfa85f9a66be0c1f53010e8049744afaecb2d701b13aa
Stage 2 loader at /tmp/backdoor.elf - SHA1: 1a23b098137f62d394c9f440a957bc856ed186c0
Final payload at /home/user/.config/csrss.exe - MD5: c42c6d4e8636f75bf93f68f2d4200cda
Exfiltration module - SHA1: 3f1cacfd09fd2d2eee7fc8662935b1ca99dd5ecd
All stages communicated with 44.45.8.184. LinPEAS signatures detected in Stage 2.


Artifact Analysis for SystemBC campaign:
Stage 1 dropper at /home/user/.config/chrome_helper.exe - MD5: b7f8fe6f24a5a3d0b6b7bfa4ac9ce81c
Stage 2 loader at C:\Users\admin\Downloads\dropper.ps1 - SHA256: 217ac5359b7ddcfaf49ee2014f349b2cce60842d0eab4e9ac8643261bb5d6870
Final payload at C:\Program Files\Common Files\winlogon.exe - SHA256: 7d173bb4084afbdc792ea4b67ece84c817368b4332d80d5d6a4f1eefa7730444
Exfiltration module - SHA1: 757524de9f379427e5399b11a63ce71a4466516f
All stages communicated with 172.226.89.84. BITSAdmin signatures detected in Stage 2.


Artifact Analysis for Royal campaign:
Stage 1 dropper at /home/user/.config/taskhost.exe - MD5: d37fe1bcca86b095ecb6b36a75e1733c
Stage 2 loader at /opt/app/bin/taskhost.exe - SHA256: d9a145c3b79fbe0b26eb833087e5e5da6bb63442eb601b04cdc9086a9507a82b
Final payload at C:\Users\admin\AppData\Local\Temp\shell.php - SHA1: a37ed3de0616f563e8e923015eef667cfa415467
Exfiltration module - MD5: 26a8bc215dc0619cebb4d98c0f3dc449
All stages communicated with 214.229.238.252. Brute Ratel signatures detected in Stage 2.


Artifact Analysis for Royal campaign:
Stage 1 dropper at C:\Windows\Temp\lsass.dmp - SHA256: 5e9917b349d683815bc88903bbb8cb6952a174112398de139646ae605903330c
Stage 2 loader at C:\ProgramData\ntds.dit - MD5: a912a5bd876c7df60be5d49a71405469
Final payload at /usr/local/bin/taskhost.exe - SHA1: 598d83992262e8963cc6f411a344e9f590969a44
Exfiltration module - MD5: d2c1bc4ca0b66b66d0af8be99d5c093f
All stages communicated with 209.51.87.210. Seatbelt signatures detected in Stage 2.


Artifact Analysis for REvil campaign:
Stage 1 dropper at C:\Users\admin\Desktop\implant.so - SHA1: 33828197a5f18a6b876a7719fcb12b089e57966c
Stage 2 loader at /opt/app/bin/csrss.exe - MD5: 1154f9f6df106a9e720f5d14305dcd5a
Final payload at /etc/cron.d/dropper.ps1 - SHA1: d0ee5a7d60db379f8993a022400d4b62c024148b
Exfiltration module - SHA256: 3d025f17b8af2726faf39d39cef1185dc232156c096215e0da2e8af5823c0546
All stages communicated with 189.31.209.150. PowerShell Empire signatures detected in Stage 2.


Artifact Analysis for TrickBot campaign:
Stage 1 dropper at C:\Users\Public\Documents\csrss.exe - SHA1: 0be602b7ace287256732021f987efb76ab89afef
Stage 2 loader at C:\Users\admin\Desktop\shell.php - SHA256: e88ee190f4ec91746a92fa2fee9572aae5e95c247d017a82ff0a5e9d56359b86
Final payload at /usr/local/bin/implant.so - SHA256: 7575767ae1c0bf5386daedfd74a3806dbf491e390db36e366642c1eff658691e
Exfiltration module - MD5: 9db2df171b01dc40e7cf4b36bfc29029
All stages communicated with 192.91.254.109. Sliver signatures detected in Stage 2.


Artifact Analysis for SmokeLoader campaign:
Stage 1 dropper at /var/tmp/csrss.exe - SHA256: af4a7b6fafd1f922f19201a0894a7e4997dcc2688875ef7fe9f422e1f4a62738
Stage 2 loader at C:\ProgramData\payload.bin - SHA256: dd5e9a9129f94304e116edc5e39e77db4f002affab48f6ad57e337cab1de7a14
Final payload at C:\Windows\Temp\implant.so - SHA256: 7b8a33c4b482e140d952e89870e31451d7e1ca70bf38d3c88d12ccbebe8ad757
Exfiltration module - SHA256: d434772eb248ade072461ae23777c72b0739450f7362e01dda9ac9f7439b70a5
All stages communicated with 150.56.171.244. Chisel signatures detected in Stage 2.


Artifact Analysis for Amadey campaign:
Stage 1 dropper at /usr/local/bin/runtime.dll - MD5: 5accbf6e241cdb2e8427a7afef730fc1
Stage 2 loader at /etc/cron.d/ntds.dit - SHA256: 51c0a4886999a2bcf0cc017844b996cdb666eb3d69a54709f566ef60160ed6af
Final payload at /tmp/runtime.dll - SHA1: d9845ac72966f6cfc937cb89388af51c2712c944
Exfiltration module - MD5: d148c2d45a862c3a6dabee5048770a9c
All stages communicated with 152.43.124.188. Chisel signatures detected in Stage 2.


Artifact Analysis for Conti campaign:
Stage 1 dropper at /dev/shm/svchost.exe - SHA1: b88e0dd1ec5361b5ae981436038808fdbef0c7a8
Stage 2 loader at C:\Users\Public\Documents\dropper.ps1 - SHA1: d97b0cc3843949b26b23c7d52c4cbf4f34ff8993
Final payload at C:\ProgramData\chrome_helper.exe - MD5: c3d76aca6e3dda8f68b0d61c73addb78
Exfiltration module - SHA1: 58892a9cab8ed81e14f1d522e752ff069a45f151
All stages communicated with 10.242.166.225. LinPEAS signatures detected in Stage 2.


Artifact Analysis for PlugX campaign:
Stage 1 dropper at C:\Users\Public\Documents\backdoor.elf - SHA1: b278543148358963a4de3d8e7c151b0dbfa30aad
Stage 2 loader at /var/tmp/config.dat - SHA256: dfb1b04b8a545efc84fd575365ebe194ee59b59cc8c5003bf8b9fdb3bc1f7887
Final payload at /usr/local/bin/chrome_helper.exe - SHA256: 925e335f6d3dbfbbedead4750177e3ebc57413b81b0358f2e56cca8ef387dded
Exfiltration module - SHA256: af304d186ee6bca6516ae9810c56b3e53ab68595f0ac4e9405ac818dd708bade
All stages communicated with 195.50.74.126. Mimikatz signatures detected in Stage 2.


Artifact Analysis for IcedID campaign:
Stage 1 dropper at /var/tmp/helper.sh - SHA1: ed2cf532bdc138c9609384b19e66f277e05f1845
Stage 2 loader at /dev/shm/implant.so - MD5: aa4e58c5de00993658a1117ed9c18584
Final payload at C:\Users\admin\AppData\Local\Temp\loader.exe - SHA1: e8771022c0699c22a89ff65aac462fd34f72f596
Exfiltration module - MD5: 65e9d87306848c943a56c44abd00645e
All stages communicated with 10.25.72.47. SharpHound signatures detected in Stage 2.


Artifact Analysis for Latrodectus campaign:
Stage 1 dropper at /home/user/.config/helper.sh - SHA256: fcfb26d520354676c22e4d3952337ba654d7c7b0d3c7e4174e449236d3b7b1c3
Stage 2 loader at /opt/app/bin/taskhost.exe - MD5: 203306efc80a92520634bfaa05803c84
Final payload at /dev/shm/loader.exe - MD5: 970265e9ff1654b782a45d152032e2da
Exfiltration module - SHA1: de4cdc283e24258a76c88ff929813b9ef27fb1f1
All stages communicated with 66.180.243.29. Metasploit signatures detected in Stage 2.


Artifact Analysis for Gootloader campaign:
Stage 1 dropper at /opt/app/bin/implant.so - SHA256: 2b83998e725c06241bc4f6728a67c5f877584e19bdae0dfec4809d20ba41c235
Stage 2 loader at C:\Windows\Temp\svchost.exe - MD5: 6b34e45a57c6cae335e65c0df28eaa96
Final payload at C:\Users\admin\Downloads\loader.exe - SHA256: 0a0ff3171997875d2898b344e02fcb698bbca13f4a4986514e65125d6bce5d91
Exfiltration module - SHA1: c5b80e66e103b36a57144e0ccddb929a4f93f7e2
All stages communicated with 172.49.255.12. Rubeus signatures detected in Stage 2.


Artifact Analysis for Royal campaign:
Stage 1 dropper at /var/tmp/taskhost.exe - SHA1: f8e95e214e3679b5d836b6292ed4f7e3cb9acc91
Stage 2 loader at /var/tmp/beacon.dll - SHA256: 7c812af944df48ca140539c161c7859d9e6133dae2cb848605149fe4122ce059
Final payload at /dev/shm/backdoor.elf - SHA1: 6d846d93d899729fe7bbac0619454d9e46234e20
Exfiltration module - SHA1: 63ca06c5b1e4acfdd0266369c4ce0d22318bfff4
All stages communicated with 10.30.174.190. Nmap signatures detected in Stage 2.


Artifact Analysis for AgentTesla campaign:
Stage 1 dropper at /opt/app/bin/chrome_helper.exe - SHA1: 049dde5df1eb121eaf6138aa1b6f205165bd52bd
Stage 2 loader at /dev/shm/helper.sh - MD5: c0bfe0bd58818bb7d5ee5046c03b7823
Final payload at /var/tmp/helper.sh - SHA1: be03e8366b34d1571bc75d90204aefc766c4b1b2
Exfiltration module - SHA256: 86e245ea637eb30903da074310e1eadd756d21385a37335d93e7cded8a1edc8c
All stages communicated with 10.209.83.195. LaZagne signatures detected in Stage 2.


Artifact Analysis for RedLine Stealer campaign:
Stage 1 dropper at /opt/app/bin/payload.bin - SHA256: 767ffd8a2714241ea98a3a0e20ac3aff5751a570f6255caf4252fbb18d08943d
Stage 2 loader at /dev/shm/implant.so - SHA256: 15bca80cd19dd140c8e72e8b6e7ea5a50ce01706f3a332c7bba0a8c21060668c
Final payload at C:\Program Files\Common Files\dropper.ps1 - SHA256: b65fa9bfe173296f2d8276b43d2c710581dd76debeee8f9ddf0c9b44baf43628
Exfiltration module - SHA1: fa0bce7fed6f936f2baaf3ca89e2b9ca1d0fbd6e
All stages communicated with 45.41.47.99. Burp Suite signatures detected in Stage 2.


Artifact Analysis for BlackCat campaign:
Stage 1 dropper at C:\Program Files\Common Files\config.dat - MD5: 17e9f56ae0f01a50f8c26ab97cfdb254
Stage 2 loader at C:\Users\admin\AppData\Local\Temp\loader.exe - SHA256: 7766c93f15a7093d9d5dd7887e80cc46436cd55ac29d9024dbc454a4f4f34400
Final payload at C:\Windows\System32\taskhost.exe - SHA1: 06a023d22fcef9d62b0b45fa7eac2644f71a8ea9
Exfiltration module - SHA256: 804805c96da52d1f40b9bacdd30563ee7276f105f0b931d4a29d4518dfe378ac
All stages communicated with 172.193.221.73. Nmap signatures detected in Stage 2.


Artifact Analysis for BumbleBee campaign:
Stage 1 dropper at /tmp/lsass.dmp - SHA1: 620b36f14e9d9a001084d7969d78c63080b51c34
Stage 2 loader at C:\Windows\System32\shell.php - SHA1: 0b95540e8a705e44f6732fd1e098e6e2a68dd0dd
Final payload at C:\Windows\System32\taskhost.exe - SHA1: 275aa648bed4a47a073dbd3094e06a2c372045ad
Exfiltration module - MD5: 2f55e7e50b37cefdb035a2e5ad9d9787
All stages communicated with 12.51.53.62. Mythic signatures detected in Stage 2.


Artifact Analysis for Gootloader campaign:
Stage 1 dropper at /opt/app/bin/svchost.exe - MD5: 9837a11027f52230a8fde1ff46fbb3b5
Stage 2 loader at C:\Windows\System32\shell.php - MD5: 61420328e7056b3ab9e30e18f63b3cd8
Final payload at C:\ProgramData\loader.exe - SHA1: 7b947bf3dd95bba37ac1129f5492266e928032e0
Exfiltration module - MD5: de6e4e40c77a96aaca9948eeec994fd3
All stages communicated with 92.139.142.189. LaZagne signatures detected in Stage 2.


Artifact Analysis for SmokeLoader campaign:
Stage 1 dropper at /home/user/.config/sam.hive - SHA1: 9214709cfce0ca16583170fa1f57cfa500767357
Stage 2 loader at C:\Windows\System32\update.dll - MD5: 5a2f8b4df2e979dc1de2e0253f6ece3f
Final payload at /home/user/.config/beacon.dll - SHA256: 52e2f546e476f83f940339fc046c776be5ae44302a42cf3dd88a240674e30eca
Exfiltration module - MD5: ad3d89c8991e732e1bb62b37b0ca9806
All stages communicated with 33.55.229.215. GhostPack signatures detected in Stage 2.


Artifact Analysis for Ryuk campaign:
Stage 1 dropper at /usr/local/bin/shell.php - MD5: 35b83c721ce9b8ec63ee708c8db4259b
Stage 2 loader at C:\Windows\Temp\backdoor.elf - MD5: 308e847e76d95136e7f77da572e8a822
Final payload at C:\Users\admin\Desktop\winlogon.exe - SHA256: 0b5b036058db0d4f0bf640f33c398de5a20b9cdd055c819e0c7cc972f6c5ba67
Exfiltration module - SHA1: 24a4fe14db31ae6e1a49d3d700faa09673b0f93d
All stages communicated with 78.132.156.108. Havoc signatures detected in Stage 2.


Artifact Analysis for BatLoader campaign:
Stage 1 dropper at C:\ProgramData\agent.py - SHA1: f8989b56cc480be9ae80b2fa721e3be19fc95aa4
Stage 2 loader at /opt/app/bin/config.dat - MD5: 53eecbd9df190056a69c90861f6f1112
Final payload at /opt/app/bin/payload.bin - MD5: ccb0dd1d4b6b2bf6c52e923b70514a4f
Exfiltration module - MD5: 0eeffd30add4ff0ce1eba5ce0ce31a3e
All stages communicated with 77.194.162.222. Seatbelt signatures detected in Stage 2.


Artifact Analysis for Gootloader campaign:
Stage 1 dropper at C:\Windows\Temp\backdoor.elf - SHA256: c8681ef6dec549bdaee3fa06b8950419507529ed032ad06082553aed550c08af
Stage 2 loader at /var/tmp/chrome_helper.exe - SHA1: ea0fdba952f559f0ff3dfff4f6fd4f9311bfa1fd
Final payload at /dev/shm/dropper.ps1 - SHA1: 35aec5b1c69bf2a59ea7982f14c40fed313e1e48
Exfiltration module - SHA256: 7247041adadb50a0bd5e0d05f734bdc4e2e816ccbb4701a046b0dc92a3273b96
All stages communicated with 10.50.114.199. CrackMapExec signatures detected in Stage 2.


Artifact Analysis for Royal campaign:
Stage 1 dropper at /dev/shm/winlogon.exe - MD5: 044bd431ea8e7afd6fb8d8d4fb7085b4
Stage 2 loader at /usr/local/bin/loader.exe - SHA1: 7c3cce49d758619b8e05a053713c5f3954d5a393
Final payload at /var/tmp/implant.so - SHA1: 507860f7aa59b4bcb03f053b3bd74e02e6599155
Exfiltration module - SHA1: 5fd8043623225118dddf98e0abc5ba2b6aff3438
All stages communicated with 124.67.225.189. PowerShell Empire signatures detected in Stage 2.


Artifact Analysis for Royal campaign:
Stage 1 dropper at C:\Users\admin\Downloads\backdoor.elf - SHA256: e922b64d2d3d59e459edab60119c23e657fb99742f868d178a517c261a71a129
Stage 2 loader at C:\Users\Public\Documents\config.dat - MD5: c876898d6af88cd7d48c3048f01ab6ad
Final payload at /opt/app/bin/svchost.exe - MD5: 329ea69a32e112827912b477a0dd77e0
Exfiltration module - SHA256: b165e9278845df9d891bfecc5b5534b3d8a72811cde6594dc7e406bab40a8dd5
All stages communicated with 172.50.95.74. Havoc signatures detected in Stage 2.


Artifact Analysis for StealC campaign:
Stage 1 dropper at C:\Windows\Tasks\payload.bin - MD5: 0c7c14a5a6c4fa603c4a8f1b24db09c2
Stage 2 loader at C:\Users\admin\AppData\Local\Temp\sam.hive - SHA256: 0c44c651b481b3f2094a0e066ea6f274fa99be82235a944aa247f8d86927fe49
Final payload at /home/user/.config/chrome_helper.exe - SHA256: 988f361295b6c849bf478e26cd64f752b9a1a4fd7d8fe249bd8228e2145768bd
Exfiltration module - SHA256: 138418c77d26a48d6b3da213e52b9119e096659c22d4db8707c543135bf01b24
All stages communicated with 56.244.25.242. PowerShell Empire signatures detected in Stage 2.


Artifact Analysis for RedLine Stealer campaign:
Stage 1 dropper at C:\Users\admin\Downloads\helper.sh - SHA1: afbf4afad2e0896a7a492e61c56d5297f2c63845
Stage 2 loader at /dev/shm/sam.hive - SHA256: e84a3b7ceea13a82300c89cba3314bea18626113e959556ab27b5b64a287255b
Final payload at /tmp/helper.sh - MD5: 31ca3b8e0d1dd4218c4bdde7b6a65c8a
Exfiltration module - SHA256: 838b706f2a80971e26961eef2a91eefa4d90434c49f2a8c970f70809b552ae93
All stages communicated with 10.174.96.248. Rubeus signatures detected in Stage 2.


Artifact Analysis for StealC campaign:
Stage 1 dropper at C:\Users\admin\Downloads\ntds.dit - SHA1: dd6808993c5c589f57a878f242e4525f93705d98
Stage 2 loader at /var/tmp/config.dat - MD5: a4b2192dfdce0207a01ff7433ab99424
Final payload at C:\ProgramData\loader.exe - MD5: 400c4608aa1abfa7cd3a44d46bfb4d23
Exfiltration module - MD5: 13c0df09d121beb4784e0c67b79284bc
All stages communicated with 26.31.177.196. Nmap signatures detected in Stage 2.


Artifact Analysis for Latrodectus campaign:
Stage 1 dropper at C:\ProgramData\loader.exe - SHA1: 25db062c1e7b9c28c8bcb8ec225f0803aa957d10
Stage 2 loader at C:\Users\Public\Documents\taskhost.exe - SHA1: 40881c94c725d45fc443989b84b0c3cc0c65494f
Final payload at /usr/local/bin/config.dat - SHA1: b9fa96dd2163f841673480b704208ccdef1b49bd
Exfiltration module - SHA1: 31d70025f98071398781e3638835e829a8fc2096
All stages communicated with 210.120.146.35. Metasploit signatures detected in Stage 2.


Artifact Analysis for Hive campaign:
Stage 1 dropper at /tmp/runtime.dll - SHA1: 76c56c312f132da6c6d2088ef01ec47e83a57522
Stage 2 loader at /opt/app/bin/winlogon.exe - SHA256: 8f0ab0ed11e325b5b0486fca111adedd555e81d7424922c9a17d3ce3440adc3f
Final payload at /tmp/agent.py - MD5: 99f0ee29aff2c870a2de8be368460362
Exfiltration module - MD5: d1380bd108ca829f9dbb0e751e4e7832
All stages communicated with 145.232.50.197. SharpHound signatures detected in Stage 2.


Artifact Analysis for Gootloader campaign:
Stage 1 dropper at C:\Windows\Temp\backdoor.elf - SHA1: b036e4dfa947c7efd71baa9cdb299e21d40dec09
Stage 2 loader at C:\Users\admin\AppData\Local\Temp\shell.php - MD5: 5c964309d6994bf1706549281f9a4ac6
Final payload at /tmp/config.dat - SHA256: cc01d845df0a969eca9b2adec2c57f2eaa72aaa00f29e5c61f8e630357b2984b
Exfiltration module - SHA1: 4ceeb8ffcdbc2a2a486f6ea63185bf845bfe1325
All stages communicated with 199.100.16.222. CrackMapExec signatures detected in Stage 2.


Artifact Analysis for BlackCat campaign:
Stage 1 dropper at C:\Windows\Tasks\helper.sh - SHA256: 640a97f94a3ac1e0811517f9f39a4a12ae08219a956019a463e072ab2e26838f
Stage 2 loader at C:\Users\Public\Documents\lsass.dmp - SHA1: 587f425dcf610f037b556aafd402842a7712c79d
Final payload at /tmp/helper.sh - SHA1: e77ef94cf33dea9f8d97c062da655c970346b606
Exfiltration module - SHA256: 1c13f53bc228670d512451a477167e756f7a3109b010fc97f20317e954756bb7
All stages communicated with 10.254.87.79. Burp Suite signatures detected in Stage 2.


Artifact Analysis for RedLine Stealer campaign:
Stage 1 dropper at C:\Windows\Temp\beacon.dll - MD5: 6ec35a241998edbf93b4f18a72c51d17
Stage 2 loader at C:\Users\Public\Documents\payload.bin - MD5: a24bb5e83fc2c43a1adf388aae6a78f9
Final payload at C:\ProgramData\config.dat - SHA1: 9103179775827a21f6140add595dda10102f025e
Exfiltration module - SHA256: 0233acfd7efef6e7a997c9a15a4f8eac56edd66f6e11a6ed23361b23e090d4fe
All stages communicated with 154.39.25.38. PowerShell Empire signatures detected in Stage 2.


Artifact Analysis for RedLine Stealer campaign:
Stage 1 dropper at C:\Users\admin\Downloads\beacon.dll - MD5: 57c3a9d14f88f5ebc0148887e45e0cd2
Stage 2 loader at C:\Users\admin\Downloads\backdoor.elf - SHA256: 6f3b379ec10f1181a5186e2d1020ab2795296972585d52bfbceffd8c7b2eea8b
Final payload at /home/user/.config/implant.so - SHA1: 4f35ecad44a2dbcc59af30eabc86dee0e75ddd01
Exfiltration module - SHA1: c3cd86ed8fa844153f3e32bb7048dca316dcf2a1
All stages communicated with 172.196.39.92. Rubeus signatures detected in Stage 2.


Artifact Analysis for XLoader campaign:
Stage 1 dropper at C:\ProgramData\shell.php - SHA256: 42452d1853982f86d90650d494b29426bf329f74fde9c167e8698da2d9f01d72
Stage 2 loader at C:\Windows\Tasks\beacon.dll - SHA1: c554bbb6dcb6e78e278419e9951a8b0536baed1c
Final payload at /etc/cron.d/taskhost.exe - SHA256: 1abd3090cf962f3dd7f271a5e47ad17fc030de2cff3116bdede55d8336bf9a10
Exfiltration module - SHA256: b0e2acbd1aa5ef721652310b46b5f398fa9f97179fe5b33d05645d1166e0aa06
All stages communicated with 219.28.54.226. Ligolo signatures detected in Stage 2.


Artifact Analysis for Raccoon Stealer campaign:
Stage 1 dropper at /usr/local/bin/agent.py - SHA1: 6b467b4ae11d5ef7ed08278f952190e7a0744926
Stage 2 loader at C:\Windows\Temp\payload.bin - SHA256: a0f3d7ea67347badc27a07b3773ba60afda1edbd760485153603adce1624026d
Final payload at C:\Windows\Tasks\sam.hive - SHA256: a0189a2036d50d39cae32fedf07141f966dfabbe126d8c58d662942a2013d5ce
Exfiltration module - MD5: 7f649dab1c29194f08e683642b0a2b35
All stages communicated with 192.64.113.25. BloodHound signatures detected in Stage 2.


Artifact Analysis for Raccoon Stealer campaign:
Stage 1 dropper at /etc/cron.d/chrome_helper.exe - MD5: 16d72cc367a8e8387905b511ded54a54
Stage 2 loader at C:\Windows\Temp\update.dll - SHA256: 48e061b2704b8f717cd35a51d2ee65b0bac76fcd3cd25bbccab8d8821b01163d
Final payload at C:\Windows\Temp\runtime.dll - MD5: 735773488a601104cb92bc998550a222
Exfiltration module - MD5: d538e82d3229f7126c8cece075e55916
All stages communicated with 193.178.241.221. Havoc signatures detected in Stage 2.


Artifact Analysis for SystemBC campaign:
Stage 1 dropper at /var/tmp/dropper.ps1 - MD5: 9ada78a708b4eda87feddaa43692c853
Stage 2 loader at /usr/local/bin/sam.hive - SHA256: 5c26d440cdc8f8a295fa3b216f4953402dc0fcaf3a6e8d6da14961da80d9af5b
Final payload at C:\ProgramData\dropper.ps1 - SHA1: 410a858bc0b3cb3f702a0c0511868cf595d72119
Exfiltration module - MD5: 4119e4afd96476a952541afd2d06a479
All stages communicated with 129.38.198.59. GhostPack signatures detected in Stage 2.


Artifact Analysis for Amadey campaign:
Stage 1 dropper at C:\ProgramData\dropper.ps1 - SHA256: 278c3087646f7f5538c85de2133fa4543e99cc61a4bd6ae10afe9139b1678f56
Stage 2 loader at C:\Users\admin\Downloads\runtime.dll - SHA256: c7689602ac7bf2fb695108b95d7ff7da0e24c5a8c63040530a0ac0ec627372d3
Final payload at C:\Program Files\Common Files\runtime.dll - SHA256: 143ff7982c599d27247cf1982f17097aa5babade2c02b4e2d0a5eb158168e0ee
Exfiltration module - SHA256: fe72ce0eb5a653a546ea123f63278ab27cd240a813219ef6926a30e5731ea1b8
All stages communicated with 212.57.47.36. CrackMapExec signatures detected in Stage 2.


Artifact Analysis for Play campaign:
Stage 1 dropper at /tmp/chrome_helper.exe - SHA1: 0a1414cbf2239b8895ec3653601918735a56e926
Stage 2 loader at C:\Users\admin\AppData\Local\Temp\payload.bin - SHA1: d32768fa20784f0fb1df27e63de9e00b6d0ec437
Final payload at C:\Users\admin\Desktop\payload.bin - SHA1: b155f6526835416e130e2680cc97a15603c7d04b
Exfiltration module - SHA256: 9b3f7966855474c01d0e5105e53bd7fcd500cecd817a1f24b1751fc4dca84b41
All stages communicated with 172.18.196.201. Brute Ratel signatures detected in Stage 2.


Artifact Analysis for Gootloader campaign:
Stage 1 dropper at C:\Users\admin\Downloads\csrss.exe - MD5: 6b8d6e70f6a2283fc7bcb17bfca371d8
Stage 2 loader at C:\Users\admin\Downloads\payload.bin - SHA1: 9881716b7d79f524c60379231d01b0a4ed5512f5
Final payload at C:\Users\admin\Downloads\winlogon.exe - MD5: 689a8649ed097c1fb10f6f1fbab07817
Exfiltration module - SHA1: 2ebec8343f49a76a00e10bdc7efbe4275a02009e
All stages communicated with 87.142.253.97. Havoc signatures detected in Stage 2.


Artifact Analysis for Raccoon Stealer campaign:
Stage 1 dropper at C:\ProgramData\agent.py - SHA256: f828e46eb81da2ea53d9b8bcf0d9398d49f02773b77f44734e268fe17f98c806
Stage 2 loader at /etc/cron.d/csrss.exe - SHA256: 54aac501a17f4c7332b9ef144ecc72e6c71e1930bed9416d112004abde99be84
Final payload at C:\Users\admin\AppData\Local\Temp\runtime.dll - MD5: 871567a6e031f380b213c228ffa60956
Exfiltration module - SHA1: 3d14b63672f606f0d956ad9bb2d18677fddae77a
All stages communicated with 172.144.81.214. Hashcat signatures detected in Stage 2.


Artifact Analysis for FormBook campaign:
Stage 1 dropper at C:\Program Files\Common Files\ntds.dit - SHA256: 8f069676fa4eea6856dad09ee2f3325d7193d707b283879c9e9c8a8ec3b06bea
Stage 2 loader at C:\Windows\Tasks\lsass.dmp - MD5: 50958d154cab1e2c13b8a657234227a8
Final payload at C:\Windows\System32\config.dat - SHA256: fe2f57354fe041d1a2b3c3399338634a82521eb32adb3a6fc94ccca2fab0c753
Exfiltration module - MD5: 6e6913527d7e4334d2fd296de7e3eb15
All stages communicated with 100.37.252.78. Merlin signatures detected in Stage 2.


Artifact Analysis for REvil campaign:
Stage 1 dropper at /usr/local/bin/csrss.exe - SHA1: 9bce4339d067491a841f0135ba3d92d8250e9b72
Stage 2 loader at /opt/app/bin/config.dat - MD5: 6a0dafdf27f441fcc01e1cfe704e3dbb
Final payload at C:\Windows\System32\agent.py - SHA1: 8b28d53e519702764d3c5843ad8d893338060757
Exfiltration module - SHA256: cad05140806a618a26008c1aaa36fe0f91eef11e1944b06fee65f75c7e610182
All stages communicated with 172.218.133.249. WinPEAS signatures detected in Stage 2.


Artifact Analysis for Amadey campaign:
Stage 1 dropper at C:\Windows\Tasks\dropper.ps1 - SHA256: 3649bba27289d010dcee3af212ca259e8293f1f410255e4948051013899b1fe6
Stage 2 loader at C:\Users\admin\AppData\Local\Temp\lsass.dmp - MD5: 6094ba8f81897afc9b2d438e0b6775fd
Final payload at /usr/local/bin/helper.sh - MD5: 530666eb12579f21057a902649a74985
Exfiltration module - SHA1: f3651936c44203ad97f202251c6771eac9e4cf14
All stages communicated with 11.96.148.218. Impacket signatures detected in Stage 2.


Artifact Analysis for Raccoon Stealer campaign:
Stage 1 dropper at C:\ProgramData\taskhost.exe - SHA1: ca7ec44d095c278af6a7e0b7477646b11e9615c1
Stage 2 loader at C:\Program Files\Common Files\update.dll - SHA1: 31fbfbb95f62a932f33026643c437dfd749707c8
Final payload at C:\Users\Public\Documents\csrss.exe - MD5: 38ff55b0a92b142e09a2625a1e16ec2b
Exfiltration module - SHA256: 3e40493656bbbde19c267eae64df54a2c754c835945f7ac23d224bb1c7f163c7
All stages communicated with 61.189.94.238. Havoc signatures detected in Stage 2.


Artifact Analysis for AgentTesla campaign:
Stage 1 dropper at /opt/app/bin/backdoor.elf - SHA256: 9070e50954849e1156e922de89df186c2f895b3d77ab5e6dc4ae16be65b9b49a
Stage 2 loader at C:\Users\admin\Downloads\backdoor.elf - SHA256: d53bbac182d2253eb94a5cb3e4aed42e03e555d6bddcc19ac5c0947d204dc2f9
Final payload at C:\Windows\Temp\chrome_helper.exe - SHA1: 6c7444a18c0dabc5fff540e4e16c0293b36de56d
Exfiltration module - SHA1: e4cbac248c4e11bccd800221c4276b7bba3d79aa
All stages communicated with 55.238.31.181. Mimikatz signatures detected in Stage 2.


Artifact Analysis for SmokeLoader campaign:
Stage 1 dropper at /var/tmp/winlogon.exe - SHA1: 4f6db7165f884312d44973e0072d5050fcbaf505
Stage 2 loader at /etc/cron.d/csrss.exe - MD5: fd7112457f6e909882ace31e6ec985c6
Final payload at /var/tmp/ntds.dit - SHA1: 80d42894a6606617525e69417293083428c479d2
Exfiltration module - SHA256: 9e1564490f28811b107cba26529800f7f9efa31dcfb79f09355441532ba396d4
All stages communicated with 163.229.191.196. Hashcat signatures detected in Stage 2.


Artifact Analysis for Lumma Stealer campaign:
Stage 1 dropper at /dev/shm/backdoor.elf - SHA1: fa79baa348f5fb335baa0b34c993360b58d60c90
Stage 2 loader at C:\Windows\System32\csrss.exe - MD5: 9c78d6e702c42094807bb8b086ce48b1
Final payload at /home/user/.config/config.dat - SHA1: fb3ef401dc6d5194281271f734e42c45273dc989
Exfiltration module - SHA1: 916ebd7a4311f06767066527fcf9ea42190a36f3
All stages communicated with 192.155.109.99. Sharphound signatures detected in Stage 2.


Artifact Analysis for RemcosRAT campaign:
Stage 1 dropper at C:\Users\admin\Desktop\loader.exe - SHA1: d813f2091cf13106e87326861d69bdeb700c4113
Stage 2 loader at /usr/local/bin/shell.php - SHA256: 02819c5743c9722f0b9ea890257278dcc65f3e98990ce5c5e4b3a28233f86417
Final payload at /dev/shm/loader.exe - MD5: fe8a4dc57f6b3399faf6d941445103ae
Exfiltration module - MD5: 65db24bfae2f1e50105784811a7c8b0b
All stages communicated with 134.220.246.238. BloodHound signatures detected in Stage 2.


Artifact Analysis for PikaBot campaign:
Stage 1 dropper at C:\Users\Public\Documents\winlogon.exe - SHA256: 8edc463e72afddca73051c344d7aafeffb6c26bd56aa911a47852508ba214157
Stage 2 loader at C:\Windows\Temp\dropper.ps1 - MD5: a63ebebea0f42b4313b4e0fd94662b0d
Final payload at C:\Users\admin\Desktop\sam.hive - SHA256: 2f4770a2f9bbbef360a31a0cb94cb52f635ad4cdedb06b390ab90b74fb4acb07
Exfiltration module - SHA256: 125d3f689d0ee9617b6cb9e60fe53a87973892fbe5e92e94994990b32fd8b875
All stages communicated with 96.55.55.217. PowerView signatures detected in Stage 2.


Artifact Analysis for NjRAT campaign:
Stage 1 dropper at /home/user/.config/ntds.dit - SHA1: b80a263fd9f037095230343136aac7e19bb3fb12
Stage 2 loader at /dev/shm/chrome_helper.exe - SHA256: c8c2e1f6b992adc4ea862c7e52875a84fbbf966eec02d5a62ae9b057bd3025de
Final payload at C:\Windows\System32\sam.hive - SHA1: e9d5ed616fc3ae5658a23fb99b7c183cd116b80f
Exfiltration module - SHA256: ab7aae150f0c0a60a8944b87f0259bccd705464809b241715c9bbb2319276baa
All stages communicated with 172.54.10.225. Rubeus signatures detected in Stage 2.


Artifact Analysis for Latrodectus campaign:
Stage 1 dropper at /etc/cron.d/implant.so - SHA256: accc7052c902d2b2636309be15d3d4d65bffd2583e1456d80074bea4275ffe18
Stage 2 loader at C:\Users\admin\Desktop\runtime.dll - SHA1: 40ead3e906eb0e2d3667075fce34060da216fc36
Final payload at /opt/app/bin/chrome_helper.exe - SHA256: 9d42da2cf1008f90ad71e252067f2f239638d30efe596392c79306fc20401037
Exfiltration module - SHA1: a4ff088fcaf108d69fa820b8bad648710ffd7e85
All stages communicated with 90.231.28.94. Havoc signatures detected in Stage 2.


Artifact Analysis for Gootloader campaign:
Stage 1 dropper at /var/tmp/lsass.dmp - SHA256: a6a404e3771fd33d7830cb47b7455502802b681bbd45021791f5ea6f937c54b4
Stage 2 loader at C:\ProgramData\helper.sh - SHA256: 533cc53d308ed07bf7cd542aa464f36d7ec9c385c642090a3fc25591e692278e
Final payload at C:\Windows\Temp\chrome_helper.exe - SHA256: af96a03902d3eb56d9b0a349c414bdcfe24dc4b9b83df0e5a9b9d85ff41a1ba6
Exfiltration module - SHA1: 77022c34bdbe34e159aa3bf97fcd1495c6c3cbb8
All stages communicated with 71.55.246.41. Burp Suite signatures detected in Stage 2.


Artifact Analysis for PikaBot campaign:
Stage 1 dropper at C:\ProgramData\update.dll - SHA1: 66cc1f8eb7f9eb32df1c007691d84b197c1b8850
Stage 2 loader at /tmp/ntds.dit - SHA1: 9dd53075a431a60689ef393ed6cf3b7c6e203173
Final payload at /dev/shm/winlogon.exe - SHA1: ae71dbc6de84be0f98da3fe87d3ef39f0bb16a82
Exfiltration module - MD5: 500a28b53203292393c2f601ae1d3fbd
All stages communicated with 146.113.78.182. Mimikatz signatures detected in Stage 2.


Artifact Analysis for Hive campaign:
Stage 1 dropper at /usr/local/bin/update.dll - SHA1: 368feb0c3e00f0552bc6652f78ec7f44aac2619f
Stage 2 loader at C:\ProgramData\chrome_helper.exe - SHA1: 4a9d57fd49d24413f34505a67b3f9d98b22703bf
Final payload at C:\Windows\Tasks\chrome_helper.exe - SHA1: 8a96d01808177b09353af34d6180bba0e6bed61d
Exfiltration module - SHA1: 90ac8b0187692b6ce2a557a26fab8e5404f73be6
All stages communicated with 10.248.14.159. Mythic signatures detected in Stage 2.


Artifact Analysis for Play campaign:
Stage 1 dropper at C:\Program Files\Common Files\sam.hive - MD5: 1d0087910ab4b56ca2d3e24a09f7b532
Stage 2 loader at C:\Users\admin\AppData\Local\Temp\dropper.ps1 - SHA256: eab66ef3e0cd77e3e0b0a38095cdb801c136f572bcceb220e47d6343a799f905
Final payload at C:\Windows\Tasks\beacon.dll - SHA1: 34492fdffe0eb2d094fb0a5730ae914b376e4e48
Exfiltration module - MD5: bfedff0d880824b021827ae5e3e2f447
All stages communicated with 192.54.213.206. PowerShell Empire signatures detected in Stage 2.


Artifact Analysis for Cobalt Strike campaign:
Stage 1 dropper at C:\Users\admin\Downloads\beacon.dll - SHA1: 5eae7f7fa70041459a5ab944e359b4f1d532126b
Stage 2 loader at /home/user/.config/ntds.dit - SHA256: 0c22ee447d954557ee4040d80c7016cf04fc11251dc5cfdb48536965ee781b9d
Final payload at C:\Users\admin\AppData\Local\Temp\chrome_helper.exe - MD5: bb8d8a764e58be68664ad022526d6349
Exfiltration module - MD5: 62e5bc435cba6edf9d66a562923f16cc
All stages communicated with 164.226.240.75. Mimikatz signatures detected in Stage 2.


Artifact Analysis for RedLine Stealer campaign:
Stage 1 dropper at C:\Windows\Tasks\update.dll - SHA256: 5e7fe7ef9a01c4c2987bfef5e8e067988f18d966baa0a26edcf3b90b5df2b6aa
Stage 2 loader at C:\ProgramData\loader.exe - SHA256: f89423ae1722d36d8bec508ce1a44418578f4f841ea211435b606d7cc37b2b27
Final payload at /tmp/payload.bin - SHA1: 9222c2e74c59f1777dd292643a8a8be72f833dfa
Exfiltration module - SHA1: 498a8d5586553346c7cd3611fcae83c7dc25ba7a
All stages communicated with 98.36.4.97. Sharphound signatures detected in Stage 2.


Artifact Analysis for TrickBot campaign:
Stage 1 dropper at /var/tmp/sam.hive - SHA256: 969df54751ae076bed12eee82eb2133ca9770e99d82f6d87f8a7f241b2bbde38
Stage 2 loader at C:\Users\admin\AppData\Local\Temp\svchost.exe - SHA256: d69f6aede50f208f953fa214d1215f105436a531ebcd1461663f3caca7aed8ca
Final payload at /dev/shm/update.dll - SHA1: fcd72033da0a4386a5d057ad332feffe3dad3ee7
Exfiltration module - MD5: 9303b0a2c5455bb5441b6ee3c1b2ee78
All stages communicated with 10.71.67.186. Metasploit signatures detected in Stage 2.


Artifact Analysis for Conti campaign:
Stage 1 dropper at /tmp/implant.so - SHA256: 5c605c2b3dfbb9036119cfb4ae7452eb975712f61b45f839ec2153d7011b0397
Stage 2 loader at C:\Users\admin\AppData\Local\Temp\winlogon.exe - SHA256: 1590230d0dce6bb691bbec1ebe1a0a5d0cc74ccbeb7a5ebb9884bb9d41bd3fca
Final payload at C:\Users\Public\Documents\update.dll - SHA1: d8527fccd9f976e4e393fbb75bd2f3c48e73b9be
Exfiltration module - MD5: ed54456de2cab7d14bf3ba309772e007
All stages communicated with 192.34.193.145. Merlin signatures detected in Stage 2.


Artifact Analysis for PikaBot campaign:
Stage 1 dropper at C:\Users\Public\Documents\svchost.exe - SHA256: ca8f13f631b3f1f228274d188c299c6df957580c7bb17b7a051c9a49eb4dda05
Stage 2 loader at C:\Users\admin\Desktop\sam.hive - MD5: 1ed7fb9545e840e69e067413fa90514f
Final payload at C:\Program Files\Common Files\implant.so - SHA1: 498a2234a7526768417990aeca3f34185a9ada2e
Exfiltration module - SHA1: c4eee474df8877653c85924fec48c78e12d403af
All stages communicated with 216.33.20.215. Mythic signatures detected in Stage 2.


Artifact Analysis for LockBit campaign:
Stage 1 dropper at C:\ProgramData\chrome_helper.exe - SHA256: 4b470fb6baf78ea21eb9df9fd471012356651922573981ab648bc6e665648d37
Stage 2 loader at C:\Program Files\Common Files\helper.sh - MD5: b4ac4aa6462340e3c6fd4d04a336da2e
Final payload at C:\Users\admin\Downloads\dropper.ps1 - SHA1: 60b666c2373e7b0962c721ba025575037d0d8434
Exfiltration module - MD5: 9e0b7c9dd95280119273c4f9f61178c3
All stages communicated with 172.57.195.66. LinPEAS signatures detected in Stage 2.


Artifact Analysis for IcedID campaign:
Stage 1 dropper at C:\Users\admin\Desktop\taskhost.exe - SHA256: 0b26bd4ade5a2dff0fce635964c24619088043cc338035d4507bb52fafa3f45e
Stage 2 loader at C:\Program Files\Common Files\sam.hive - SHA1: a0277a419c3506a4dd88b7d481fef7ff69152729
Final payload at C:\Windows\System32\taskhost.exe - MD5: a61c92ff7dd78aaab21969665a45a64e
Exfiltration module - SHA1: 150f436789e7d1e87c4448baf3016fd0428f9d1d
All stages communicated with 6.79.167.65. Mythic signatures detected in Stage 2.


Artifact Analysis for PikaBot campaign:
Stage 1 dropper at /opt/app/bin/update.dll - MD5: f5ddbe6ab76e374d4b31c31c5364ba90
Stage 2 loader at C:\Users\admin\Downloads\backdoor.elf - SHA1: d4ceda6da974bd6b57dbe0d309fc7dcccc18592a
Final payload at C:\Users\admin\Downloads\chrome_helper.exe - MD5: 6c99a1bb936744fef825e6c2dac3b855
Exfiltration module - MD5: e9925a4e70eba82a8d9ce48f235cd096
All stages communicated with 172.134.25.85. PowerView signatures detected in Stage 2.


Artifact Analysis for BlackCat campaign:
Stage 1 dropper at /opt/app/bin/svchost.exe - SHA1: 8498928683e518848806498c06fd5f219ffa8f29
Stage 2 loader at C:\Users\admin\Downloads\agent.py - MD5: f777fb8697e4f3b539f80a75c6f3ec77
Final payload at C:\Windows\System32\backdoor.elf - MD5: 65cd672c78f04296256846274558684b
Exfiltration module - SHA1: 1f075a3e3de862d313f97963563cf8a5997d98d2
All stages communicated with 10.191.91.59. Sliver signatures detected in Stage 2.