Artifact Analysis for LockBit campaign:
Stage 1 dropper at /opt/app/bin/agent.py - SHA256: 41b1aa1216cc9eebe262cd3c5fffd5a7cddbcc80909c543a1add45e2b37c5f55
Stage 2 loader at C:\Windows\Tasks\beacon.dll - SHA1: 8e81e1776ef9a6fa9243acac388ca89691df999b
Final payload at C:\Users\Public\Documents\runtime.dll - MD5: 3dee144ef644abc0e4db8756b1217eea
Exfiltration module - SHA1: 11df3359d0d5b1cdc6e8acbf8ef38eb2797f3d3a
All stages communicated with 10.205.46.177. Mimikatz signatures detected in Stage 2.


Artifact Analysis for XLoader campaign:
Stage 1 dropper at C:\Windows\Temp\helper.sh - SHA256: 5f9b22033f5140321c54e259dfdbb3ddd4b7884286f7f6d2a70ddfb29b2786ed
Stage 2 loader at C:\Users\Public\Documents\loader.exe - SHA1: 4f014205d7184f5f0e9348086c4c40a50bbdfdfc
Final payload at C:\Program Files\Common Files\sam.hive - SHA1: f043cad98cb8c7c61f170ad3817e7362f8e5bac8
Exfiltration module - SHA256: 3afefb949260ce23fcaf6a99c94418d6610f2b386012bdc29b72d29a35cdbb8c
All stages communicated with 72.157.85.46. Covenant signatures detected in Stage 2.


Artifact Analysis for AsyncRAT campaign:
Stage 1 dropper at C:\Windows\Temp\beacon.dll - SHA1: b90b4560c9197981aa5a95c7348d5df888efd628
Stage 2 loader at /tmp/implant.so - SHA1: 1f6b4150b02a63eeff0296edd950b72f5e0ed9f9
Final payload at C:\Users\admin\AppData\Local\Temp\update.dll - MD5: 83ed60a4a50bfe7ed5f0897654afd28c
Exfiltration module - SHA1: ba7b284bac5010da8cf97d47200fb08e9d8a705b
All stages communicated with 59.16.197.107. ADFind signatures detected in Stage 2.


Artifact Analysis for Meduza Stealer campaign:
Stage 1 dropper at C:\Users\admin\Desktop\update.dll - MD5: 55174984f16dff7dc500a064de99a432
Stage 2 loader at C:\Users\admin\Downloads\implant.so - MD5: bdb2f246a2e33b2e7c0105aff7bd6d8f
Final payload at C:\Program Files\Common Files\agent.py - MD5: 71c8bca68dbd2a556691638fe6ec457a
Exfiltration module - SHA256: 85b41076f8e526bd47edf4a3a5d5c6a0642e1783d834c123ee19d1ba71be4e05
All stages communicated with 192.21.131.203. ADFind signatures detected in Stage 2.


Artifact Analysis for SmokeLoader campaign:
Stage 1 dropper at /home/user/.config/implant.so - SHA1: 9bf309e9d308e9f3b06b59b48f0e3c402ee7e972
Stage 2 loader at /opt/app/bin/backdoor.elf - MD5: 611dc0181f4f1035b6296ae029736ab3
Final payload at /opt/app/bin/loader.exe - SHA256: cf4f047d3f50369dd0916260fc50bfcc5fa6134fdeaf1875fc33bcf8ec4d1bd6
Exfiltration module - MD5: d12232c7ede33e5e65663bdd6274af5b
All stages communicated with 105.176.239.119. LinPEAS signatures detected in Stage 2.


Artifact Analysis for ShadowPad campaign:
Stage 1 dropper at C:\Windows\Tasks\taskhost.exe - SHA1: 404c11c8a5513c340c0d3fef74a40d1c4eac14ba
Stage 2 loader at /etc/cron.d/runtime.dll - SHA256: 108b8d2d16aa2245253d3c10543774ce38c370589fbc3818a6137cf7d162b825
Final payload at /usr/local/bin/config.dat - SHA256: 0ddf3dd5691f6ba2b36bedd64dac60ba8b4c2003c852bf9c4b3dcda648c0bbd3
Exfiltration module - SHA1: 4575a8e18191b195177ee4042949494b43d4a7c8
All stages communicated with 192.89.237.198. LaZagne signatures detected in Stage 2.


Artifact Analysis for Qbot campaign:
Stage 1 dropper at C:\Users\admin\Desktop\ntds.dit - SHA256: 27c6321989e67ca79508f8e56e20efdac3e390fec8a73877b7f8cb1e80ddd8e2
Stage 2 loader at /opt/app/bin/backdoor.elf - SHA256: 5a436011d333cc54a292a8f4a43497a68c776c7838aff4db8591dc200d7cb8b9
Final payload at /home/user/.config/payload.bin - SHA256: 8bb08eeb6c994f0cd3ea43ffc45a3fb76e05aea3b1c39abb690f91456fd21f8e
Exfiltration module - MD5: 88a471c230391768d7f8ba8b1790248d
All stages communicated with 197.148.219.177. Havoc signatures detected in Stage 2.


Artifact Analysis for AsyncRAT campaign:
Stage 1 dropper at C:\Users\admin\AppData\Local\Temp\runtime.dll - MD5: 4c3c69673167f03276f847009a5ce3bf
Stage 2 loader at C:\Windows\Temp\svchost.exe - MD5: ebc24af121e0690b13319f14f9ad3930
Final payload at C:\Windows\System32\taskhost.exe - SHA1: ca3265b2cbe04e531eed166debd7efe42346ed28
Exfiltration module - MD5: 07b6d974738efeb4171809efb4a1a2e3
All stages communicated with 107.167.150.92. PsExec signatures detected in Stage 2.


Artifact Analysis for Royal campaign:
Stage 1 dropper at /tmp/payload.bin - SHA256: b0cfa2721a8b6a7309101bd87646148d837b4d6d6a8de32a78889ded4d9841f1
Stage 2 loader at /var/tmp/agent.py - SHA1: 646c44f1b445e2676eb8121bee8b1240c81ddcf1
Final payload at /opt/app/bin/helper.sh - SHA1: c54686ffee846c752987e1eb34720ae0ab396eff
Exfiltration module - SHA256: f7326c08024d3709fd6f6f0bc959382c9ba86fea13d7e4e87b3f634a17e71d31
All stages communicated with 107.82.67.199. Chisel signatures detected in Stage 2.


Artifact Analysis for Play campaign:
Stage 1 dropper at /etc/cron.d/beacon.dll - SHA1: 6763316e86e659b21d74ad0aae76ba416d485030
Stage 2 loader at /etc/cron.d/agent.py - SHA1: 2b4d42ed33fe458eb4b875a7dff5e080eac8f0cc
Final payload at C:\Windows\System32\svchost.exe - SHA1: a70e746d52aba02fceede966c3648c8100ea1f9e
Exfiltration module - MD5: 9d1a2a7d45a014a4252cb1d88f173ef1
All stages communicated with 10.103.119.208. Covenant signatures detected in Stage 2.


Artifact Analysis for Emotet campaign:
Stage 1 dropper at C:\ProgramData\implant.so - SHA1: ab3dc5201f48ab58c0a05def0e3f02011da1e79c
Stage 2 loader at C:\ProgramData\csrss.exe - MD5: 907363e9f86f20c6e9ac7bafa1a3b5a1
Final payload at C:\Windows\Tasks\beacon.dll - SHA1: edd5adef8fa71768a84b78d0b28e60a4c84199ef
Exfiltration module - MD5: 98b815f5ed8c317264e1d537ea516758
All stages communicated with 23.58.40.92. Metasploit signatures detected in Stage 2.


Artifact Analysis for Meduza Stealer campaign:
Stage 1 dropper at C:\Users\admin\Desktop\payload.bin - SHA1: 93340b9f1e731f93ed5a9cb5f5152f8e364dfb95
Stage 2 loader at /tmp/chrome_helper.exe - SHA1: 37778ccf5b641ba4cfdb0ca5ee3fde52c7e46cf8
Final payload at /etc/cron.d/helper.sh - SHA256: 49347bcb845b29752879daf1f5526e2b7395e63e9caadea3544e9a4fe4125c73
Exfiltration module - SHA1: f5d7e7f6f12c13fd250ae24b48c055ae9300fc44
All stages communicated with 192.37.57.92. Nmap signatures detected in Stage 2.


Artifact Analysis for PlugX campaign:
Stage 1 dropper at /opt/app/bin/update.dll - SHA1: fa2b5e83a303db43635b96f4db41c77cf73be409
Stage 2 loader at C:\ProgramData\lsass.dmp - MD5: e49ef82a2ece08e96884cfa8769fc4b6
Final payload at /tmp/implant.so - SHA1: 2f1446ab1e68a193ff560aa3f0b350cd95d1921d
Exfiltration module - MD5: 5e03c45cbf87af540b3f78c7bb168f1f
All stages communicated with 6.188.224.210. Mythic signatures detected in Stage 2.


Artifact Analysis for TrickBot campaign:
Stage 1 dropper at /etc/cron.d/chrome_helper.exe - SHA1: b5beb5635baa396e227fd79331fd3442ad70105b
Stage 2 loader at C:\Users\admin\AppData\Local\Temp\implant.so - SHA1: 281eaefeabb72cf07ab45c7c6af14e11c6e31fd5
Final payload at C:\ProgramData\update.dll - SHA256: 0a54faf272ad58bf7b7ace7a3b8de248c3a3bfb75c715bbced6b4520a4ba0f0a
Exfiltration module - SHA256: 24df310619e615c0b8148ee3070511cdce287633d9ce73863bf64fa608d2fe7b
All stages communicated with 76.113.7.10. Sharphound signatures detected in Stage 2.


Artifact Analysis for Gootloader campaign:
Stage 1 dropper at C:\Windows\System32\svchost.exe - SHA256: 0be3b838d217897a6578b21470ae6c4635600775b6ce9fe6177dbafbfdac24b2
Stage 2 loader at C:\Users\admin\Desktop\winlogon.exe - MD5: 5e0a17218d12f86420a812dfbce8d17d
Final payload at C:\Users\admin\Desktop\shell.php - MD5: c8dbea38ec7a86b3140b5c6649dd38ee
Exfiltration module - SHA256: 48f3032b2afa80f2247dbfc4f02de0cd3851114bcceda4977c051b609a56885d
All stages communicated with 165.211.96.142. CrackMapExec signatures detected in Stage 2.


Artifact Analysis for Play campaign:
Stage 1 dropper at C:\Users\admin\Desktop\runtime.dll - SHA256: b38f5ac30bb8990a0369fb56347aef217e8126ef2bd02ab0c7487ea6a45ab633
Stage 2 loader at C:\Users\admin\Downloads\lsass.dmp - SHA1: ea97080547fe94f7485c5c8bb0bf3af92c53258a
Final payload at C:\Windows\Tasks\ntds.dit - SHA1: 4f406d18f5f1cb656d368b0e1f1398dfa01cd15c
Exfiltration module - SHA256: 0a21ea8262870079d1956ae565349c47664bb3b4ec35cdb65ae2197d7704b1c8
All stages communicated with 10.158.126.21. WinPEAS signatures detected in Stage 2.


Artifact Analysis for SystemBC campaign:
Stage 1 dropper at /var/tmp/implant.so - SHA1: 4cdae49ff61b0bed3bbb0baf5cd4af97e88e1e45
Stage 2 loader at /dev/shm/chrome_helper.exe - SHA256: e7bff95e155d4c52cc881a267942c99c4c2da45e2651edc648b86af2ff697a38
Final payload at /usr/local/bin/taskhost.exe - MD5: 721007c6ff13c76d4a79dd21c2230607
Exfiltration module - MD5: f73248c6ad72af7460580dcf4813103e
All stages communicated with 172.149.68.152. Havoc signatures detected in Stage 2.


Artifact Analysis for Hive campaign:
Stage 1 dropper at /usr/local/bin/lsass.dmp - SHA256: 1bcb0a6eed1c296651a768bb74cc64d005c762063547ff12704940f80d60384f
Stage 2 loader at C:\Users\Public\Documents\agent.py - SHA256: 665e5f2d382cea6d7f9da97bb0d4d87569a997beaee37f85e1ac143aea71c46a
Final payload at /tmp/loader.exe - MD5: fceb7b43f0db4102ab6a7afcb092763c
Exfiltration module - SHA1: 8fa3b6f7705cbdcd5780d42a8039942081baad88
All stages communicated with 172.254.153.182. Covenant signatures detected in Stage 2.


Artifact Analysis for SmokeLoader campaign:
Stage 1 dropper at /opt/app/bin/agent.py - SHA1: bc3596961e3c7d365d3e46e20a52b68e683361f9
Stage 2 loader at C:\Users\admin\AppData\Local\Temp\csrss.exe - SHA256: 839e132455cd1373f93bd1679955b0abdf6de865c08e35fcdaaa35d88ad90ae9
Final payload at /home/user/.config/beacon.dll - SHA1: d55c529b6dc988b95797fd47682c851fe2848e32
Exfiltration module - SHA1: b12f52d2d60e711afe4aca818a798910229bcb74
All stages communicated with 126.172.68.204. PsExec signatures detected in Stage 2.


Artifact Analysis for Gootloader campaign:
Stage 1 dropper at /home/user/.config/winlogon.exe - SHA1: f3d59a7e032067cfe774c2dcfe4e0371c99628f6
Stage 2 loader at C:\Windows\Tasks\shell.php - SHA1: 0ccb754d0163a9d3b147bb32c12117997c42f052
Final payload at C:\Users\admin\Downloads\config.dat - MD5: 954158127a2206e1170710f60467b2a9
Exfiltration module - SHA256: fe5fbaed4f51015f72d170a524582a1d3ed889274ae06e62d270ac82ac268df4
All stages communicated with 178.151.13.187. Hashcat signatures detected in Stage 2.


Artifact Analysis for Conti campaign:
Stage 1 dropper at C:\Windows\Temp\svchost.exe - SHA1: 7cca2341bb85488bb380ab1f58d9d61901236c09
Stage 2 loader at C:\Users\Public\Documents\agent.py - MD5: 0ef0832f8007827bb0e92b82cbfd7d4c
Final payload at C:\Users\admin\Desktop\taskhost.exe - SHA256: 560de4ce64a64fe8161221872335ada988e0e8495a580e5247591b3c6a52e839
Exfiltration module - SHA256: 59b397023dc826d4bd790929c2b6d80b609aba656724c593d579a6fb58ce65d9
All stages communicated with 115.164.143.96. Seatbelt signatures detected in Stage 2.


Artifact Analysis for BlackCat campaign:
Stage 1 dropper at C:\Users\admin\AppData\Local\Temp\csrss.exe - SHA256: a16a35403663a1262b4080e869303cc5f48c6278af283b0ebb6118822bc25c9f
Stage 2 loader at C:\Windows\Tasks\implant.so - SHA1: c61f85d8f083079b4c2d2f2188786d1c8dc6d201
Final payload at C:\Users\admin\Desktop\lsass.dmp - SHA1: 2d1f09ae91bf2bf9f10c5e61138fdea4d3a2bbcf
Exfiltration module - SHA1: 5fb3b7373a3f44942e0d0dd1b14ab29a34ce1912
All stages communicated with 153.90.110.61. LinPEAS signatures detected in Stage 2.


Artifact Analysis for StealC campaign:
Stage 1 dropper at C:\Windows\Temp\update.dll - SHA1: e9b797d94ae1178b104797db9bdd56c42eea6d4f
Stage 2 loader at C:\Windows\System32\csrss.exe - MD5: 2a8a5d728d5fb332a7fd50432fc7db4a
Final payload at /etc/cron.d/runtime.dll - SHA256: b567e13943128c3d7e0c143b81491b37ae47127ed0a89a38c7837dfce3033336
Exfiltration module - SHA1: 073c9bd061596e02a6a09534583f6fff57512939
All stages communicated with 192.189.204.178. Hashcat signatures detected in Stage 2.


Artifact Analysis for RedLine Stealer campaign:
Stage 1 dropper at /tmp/taskhost.exe - SHA256: 666b9995b6355c0b8727da604c0bf6fb505fe2e4fb0e6a5ff2b8c9e77eb48ebd
Stage 2 loader at C:\Users\admin\Downloads\csrss.exe - MD5: 09d8685246bf38b0ecadfff7aa9c1085
Final payload at C:\Users\admin\Downloads\agent.py - MD5: 478844240b8d53ad45ef53af836e004c
Exfiltration module - SHA1: 7cb6d96d5cd6621b9c2ae28c02684b0ed9f96c0c
All stages communicated with 207.16.62.57. LaZagne signatures detected in Stage 2.


Artifact Analysis for RedLine Stealer campaign:
Stage 1 dropper at C:\Windows\Tasks\csrss.exe - SHA256: 180ca30c3f8523e518e5d372e7a9cbd25dc71cb1de23d62bb03d73bb9653fb17
Stage 2 loader at C:\Users\Public\Documents\beacon.dll - SHA1: a1e96c735871a3ec2f2393f7d18bc9a2b827ddbd
Final payload at /var/tmp/runtime.dll - SHA256: 105475e8d68bd72b3077a10cf790d0e9a23b30279fb45c3124284b6b5916a667
Exfiltration module - SHA256: c3759e6e61dfe5c49f8816e6faedae49f6756efee1979eb7d3bb139ecd4d992b
All stages communicated with 172.72.150.214. Certutil signatures detected in Stage 2.


Artifact Analysis for Play campaign:
Stage 1 dropper at /opt/app/bin/chrome_helper.exe - SHA1: c84efe513c8ec15228d6afa5a20b681c823f9281
Stage 2 loader at /opt/app/bin/ntds.dit - SHA1: 0d548d270f993b66383c81b642299d8850696c7b
Final payload at /home/user/.config/agent.py - SHA256: c3ebb4eecf2ff44bf175c33687bd42a9fce23a99d5cd6904ef43597fa6b07f05
Exfiltration module - SHA256: bf9e95ae367322e03813d0996a0d979457881542f1ca66a75018d799cabcc9a9
All stages communicated with 141.243.35.118. Certutil signatures detected in Stage 2.


Artifact Analysis for WarmCookie campaign:
Stage 1 dropper at /tmp/csrss.exe - SHA256: 6f87f8c11922a7310941edda8a85d486e96066d1c2f525e2cac7ae42239726d5
Stage 2 loader at C:\ProgramData\update.dll - SHA256: 5a3d228830583c1eb8381e9cef6ffa15f0094f0fb480e0f16af304c54b5155d4
Final payload at /etc/cron.d/backdoor.elf - MD5: 889a93d0230f2675d55bb03f02cd197e
Exfiltration module - SHA1: 74dbc436d395bd3173e6021f5a2b3f376a73d107
All stages communicated with 172.221.81.185. Mythic signatures detected in Stage 2.


Artifact Analysis for LockBit campaign:
Stage 1 dropper at /usr/local/bin/runtime.dll - MD5: c47a32415b722653860ffc11a89e6675
Stage 2 loader at /tmp/taskhost.exe - SHA256: 808a9908c1b60e10f9b0b023ed17f4ea826beab1ab01ab4294d17d61cfaa6405
Final payload at C:\Program Files\Common Files\chrome_helper.exe - SHA1: be6ab38376884a37609a1587c9a513ba57b36293
Exfiltration module - MD5: df98cbfd34e5ff436b38d928b0f6fb50
All stages communicated with 192.215.243.143. Mimikatz signatures detected in Stage 2.


Artifact Analysis for Vidar campaign:
Stage 1 dropper at /dev/shm/beacon.dll - MD5: d40888ea6f08d7e535f0845be1a845e7
Stage 2 loader at /opt/app/bin/taskhost.exe - SHA256: e99339e49abe6312c43636f34542491017885d181f2748f907e600768f23c2b3
Final payload at /opt/app/bin/helper.sh - SHA1: 0d13549dcb7d87b52f38e7dbe1452806e08b5e6c
Exfiltration module - SHA1: 9eb1cac59ccc705330f998659e4ebccc436fe574
All stages communicated with 203.70.24.178. PowerView signatures detected in Stage 2.