Forensic Investigation Notes: Analysis of the compromised host revealed GhostPack artifacts at /home/user/.config/sam.hive. Memory dump analysis confirmed execution of Chisel. Registry modifications pointed to persistence via C:\Users\admin\AppData\Local\Temp\loader.exe. Network forensics identified connections to 203.24.197.117 and cloud-auth.info. Email headers traced the initial vector to service@mail-service.info. File /etc/cron.d/ntds.dit (SHA256: ef76741aa4beea4ec9d32c7ddeecd56c638ed5fd2708442328cef4de39e6ba67) was identified as the initial dropper. A staging URL hxxp://proxylogin.link/gate.php resolved to 172.234.108.18. Secondary artifact hash: SHA1: 6124b066ecbc1a51d0f7d8cb064d4196f0b7b015.


Forensic Investigation Notes: Analysis of the compromised host revealed ADFind artifacts at /opt/app/bin/beacon.dll. Memory dump analysis confirmed execution of Burp Suite. Registry modifications pointed to persistence via /usr/local/bin/update.dll. Network forensics identified connections to 172.135.132.159 and data-portal.club. Email headers traced the initial vector to info@account-update.xyz. File C:\Windows\Tasks\backdoor.elf (SHA256: 4e283a44e8dfd0fd92ee54eabaac3e6eba7e186e054617d2662b1379314d5bbf) was identified as the initial dropper. A staging URL http://backupapi.com/login resolved to 1.117.126.156. Secondary artifact hash: SHA256: c2a9622fe351cfa7bbb2464c8d70c160aef2eca3638abebebb5a09ddad4678ce.


Forensic Investigation Notes: Analysis of the compromised host revealed GhostPack artifacts at /var/tmp/config.dat. Memory dump analysis confirmed execution of Metasploit. Registry modifications pointed to persistence via C:\Program Files\Common Files\sam.hive. Network forensics identified connections to 172.250.203.62 and storagebackup.site. Email headers traced the initial vector to security@auth-check.org. File /etc/cron.d/helper.sh (SHA256: dd505695fa7f4e99641212b9972547afab943c4a7fbab018d88e82954acfa8b9) was identified as the initial dropper. A staging URL https://portal-cdn.site/login resolved to 192.18.41.7. Secondary artifact hash: SHA1: 0d42c75081ef62141355253253159559da2aa96f.


Forensic Investigation Notes: Analysis of the compromised host revealed Mythic artifacts at C:\Users\admin\AppData\Local\Temp\backdoor.elf. Memory dump analysis confirmed execution of Brute Ratel. Registry modifications pointed to persistence via C:\Windows\Tasks\agent.py. Network forensics identified connections to 199.139.129.133 and update-cdn.dev. Email headers traced the initial vector to updates@phishing-domain.com. File C:\Users\admin\Desktop\sam.hive (SHA1: a2057b5b7495095dec5f47d4a7e086ac6ce11c35) was identified as the initial dropper. A staging URL hxxp://relay-proxy.link/admin/config resolved to 172.6.126.104. Secondary artifact hash: MD5: 6d2fb6b799c14869160d59f5fba5bdab.


Forensic Investigation Notes: Analysis of the compromised host revealed Burp Suite artifacts at /dev/shm/winlogon.exe. Memory dump analysis confirmed execution of Impacket. Registry modifications pointed to persistence via /home/user/.config/implant.so. Network forensics identified connections to 10.37.226.28 and secure-api.info. Email headers traced the initial vector to it@auth-check.org. File /tmp/runtime.dll (SHA256: 1c83abb833a14fd32fc6b74d71f539304467548ba8f98edd431e852c009a44f8) was identified as the initial dropper. A staging URL hxxp://relaysync.xyz/wp-content/uploads/doc.php resolved to 214.26.18.72. Secondary artifact hash: MD5: 9fdc464bd8979fe0dcf0e032b677256e.


Forensic Investigation Notes: Analysis of the compromised host revealed GhostPack artifacts at /home/user/.config/shell.php. Memory dump analysis confirmed execution of BITSAdmin. Registry modifications pointed to persistence via C:\Program Files\Common Files\winlogon.exe. Network forensics identified connections to 172.13.108.187 and backup-static.club. Email headers traced the initial vector to notification@account-update.xyz. File /etc/cron.d/config.dat (SHA256: 5c1c3348575deb6dd697c07a44a8225b7bd5bfe3baa461ddf0b193e7c7832b54) was identified as the initial dropper. A staging URL http://portalmail.xyz/assets/js/payload.js resolved to 172.124.0.225. Secondary artifact hash: SHA1: 2e51ee56525d79e1fa6563fd975cae5e7b46110d.


Forensic Investigation Notes: Analysis of the compromised host revealed Hashcat artifacts at C:\Users\Public\Documents\implant.so. Memory dump analysis confirmed execution of PowerView. Registry modifications pointed to persistence via /dev/shm/sam.hive. Network forensics identified connections to 196.218.79.70 and nodeportal.live. Email headers traced the initial vector to helpdesk@document-share.link. File /var/tmp/taskhost.exe (MD5: c6515cb220045fcce617de02f8fe2101) was identified as the initial dropper. A staging URL http://proxy-portal.io/admin/config resolved to 184.77.100.203. Secondary artifact hash: SHA256: d39e3adb7100acd0703fe52a6097a1c21474858b1506a591f9aca812610b6e2d.


Forensic Investigation Notes: Analysis of the compromised host revealed Hashcat artifacts at C:\ProgramData\backdoor.elf. Memory dump analysis confirmed execution of Brute Ratel. Registry modifications pointed to persistence via C:\ProgramData\helper.sh. Network forensics identified connections to 156.199.225.240 and proxy-data.live. Email headers traced the initial vector to report@account-update.xyz. File /usr/local/bin/shell.php (SHA256: ec26ceba3abee3469b38a8b0a71df845ec07e78f0f8c6021bef5a80bd495c676) was identified as the initial dropper. A staging URL https://auth-portal.org/login resolved to 172.3.187.94. Secondary artifact hash: SHA256: 882b90bbef9386158031451a11e1a24f1c8647c08bc3089d6173ca7fbdf2a99a.


Forensic Investigation Notes: Analysis of the compromised host revealed PsExec artifacts at C:\Users\admin\Desktop\shell.php. Memory dump analysis confirmed execution of Nmap. Registry modifications pointed to persistence via /tmp/csrss.exe. Network forensics identified connections to 192.229.7.27 and data-static.club. Email headers traced the initial vector to noreply@credential-check.site. File /usr/local/bin/lsass.dmp (MD5: b88251e006c6349b74bfefd9bdeadd52) was identified as the initial dropper. A staging URL hxxp://edge-portal.site/secure/token resolved to 170.167.184.125. Secondary artifact hash: MD5: d59477304a0aa779f692d49cb1c1a8f1.


Forensic Investigation Notes: Analysis of the compromised host revealed Impacket artifacts at /opt/app/bin/payload.bin. Memory dump analysis confirmed execution of Havoc. Registry modifications pointed to persistence via C:\Users\admin\AppData\Local\Temp\winlogon.exe. Network forensics identified connections to 10.24.41.201 and gatewayapi.site. Email headers traced the initial vector to notification@credential-check.site. File C:\Windows\Temp\implant.so (SHA256: cedbac21ccc21b0e37fed177a5db1b4f31da4fe08de9c4dc2015491822f56c27) was identified as the initial dropper. A staging URL https://edge-sync.link/assets/js/payload.js resolved to 192.28.42.210. Secondary artifact hash: MD5: 942c30b21fdfc3b6ceeee69ffcd36dff.


Forensic Investigation Notes: Analysis of the compromised host revealed BloodHound artifacts at C:\ProgramData\payload.bin. Memory dump analysis confirmed execution of Nmap. Registry modifications pointed to persistence via C:\ProgramData\helper.sh. Network forensics identified connections to 192.98.155.171 and cloud-cloud.net. Email headers traced the initial vector to hr@urgent-notice.online. File C:\Windows\Temp\update.dll (SHA1: 5168782bbb16b009c3fd7854b20f68751df9aebd) was identified as the initial dropper. A staging URL hxxp://proxy-relay.top/admin/config resolved to 214.26.207.123. Secondary artifact hash: SHA1: 5d06dee3ceeeafa8eca8a2d668865476b821ca17.


Forensic Investigation Notes: Analysis of the compromised host revealed Impacket artifacts at C:\Program Files\Common Files\csrss.exe. Memory dump analysis confirmed execution of Sharphound. Registry modifications pointed to persistence via /opt/app/bin/ntds.dit. Network forensics identified connections to 192.69.71.6 and authproxy.site. Email headers traced the initial vector to helpdesk@phishing-domain.com. File C:\ProgramData\implant.so (SHA256: f67cbb1e615ab57a3f0f4eafc53951d1c09bf9e7ea3b874d81ad54750e86918c) was identified as the initial dropper. A staging URL hxxps://cloud-gateway.info/assets/js/payload.js resolved to 55.41.203.211. Secondary artifact hash: SHA256: a2e780266501a625cf76aaddda467bcccf5b2ab2896703914727170fef0b6967.


Forensic Investigation Notes: Analysis of the compromised host revealed Rubeus artifacts at C:\Program Files\Common Files\implant.so. Memory dump analysis confirmed execution of Hashcat. Registry modifications pointed to persistence via /var/tmp/ntds.dit. Network forensics identified connections to 172.236.222.71 and cache-data.top. Email headers traced the initial vector to noreply@urgent-notice.online. File /tmp/winlogon.exe (SHA1: a388f8001e9270bba0a6af817d760b8f0a615896) was identified as the initial dropper. A staging URL hxxps://portal-relay.dev/download/update.exe resolved to 10.75.115.201. Secondary artifact hash: SHA1: e84df837b7e0cb9aecfb187f90d1625e142ba1ee.


Forensic Investigation Notes: Analysis of the compromised host revealed PsExec artifacts at C:\Users\admin\Desktop\implant.so. Memory dump analysis confirmed execution of GhostPack. Registry modifications pointed to persistence via /var/tmp/sam.hive. Network forensics identified connections to 217.84.95.81 and nodesync.link. Email headers traced the initial vector to contact@urgent-notice.online. File /usr/local/bin/implant.so (SHA1: 974b30fcb9e91a8bee97e1ff1313a9986ab1cbae) was identified as the initial dropper. A staging URL hxxps://nodeauth.live/api/v2/auth resolved to 192.212.131.67. Secondary artifact hash: SHA1: b03e81b7ca2e4f24b8273e1f0b0b7573175e788f.


Forensic Investigation Notes: Analysis of the compromised host revealed PowerShell Empire artifacts at /home/user/.config/helper.sh. Memory dump analysis confirmed execution of Merlin. Registry modifications pointed to persistence via /var/tmp/update.dll. Network forensics identified connections to 172.255.245.22 and secureproxy.io. Email headers traced the initial vector to report@phishing-domain.com. File C:\Program Files\Common Files\backdoor.elf (SHA256: 5d606006e5846768b5ba739fcd1515c4525a033380d65006abac790c5179d1da) was identified as the initial dropper. A staging URL hxxp://mail-cache.net/login resolved to 82.178.28.198. Secondary artifact hash: SHA1: 4db3461e28013177d28b2aea5be20a2eda416168.


Forensic Investigation Notes: Analysis of the compromised host revealed Chisel artifacts at /usr/local/bin/lsass.dmp. Memory dump analysis confirmed execution of PowerView. Registry modifications pointed to persistence via /var/tmp/sam.hive. Network forensics identified connections to 102.11.110.38 and secure-static.tech. Email headers traced the initial vector to report@document-share.link. File C:\Users\admin\Downloads\taskhost.exe (MD5: 79453a7147bc47adcc84203273bc0114) was identified as the initial dropper. A staging URL http://relaydata.club/collect resolved to 172.152.37.138. Secondary artifact hash: SHA256: 2eda58c885ea72f87853e0cb2aa8ae1923988cffd920d231b38b08e3432fcba6.


Forensic Investigation Notes: Analysis of the compromised host revealed SharpHound artifacts at /tmp/implant.so. Memory dump analysis confirmed execution of WinPEAS. Registry modifications pointed to persistence via /etc/cron.d/beacon.dll. Network forensics identified connections to 172.231.137.175 and portal-relay.com. Email headers traced the initial vector to account@identity-verify.cc. File /opt/app/bin/csrss.exe (SHA256: 67617ee243a2415b145297c0393788569234334f1b9eb5e5c1fc1405f07612f4) was identified as the initial dropper. A staging URL http://mail-portal.top/callback resolved to 10.32.245.173. Secondary artifact hash: SHA1: 52864be824859bb93458376532dab6b294738981.


Forensic Investigation Notes: Analysis of the compromised host revealed Brute Ratel artifacts at C:\Users\Public\Documents\taskhost.exe. Memory dump analysis confirmed execution of PsExec. Registry modifications pointed to persistence via C:\Users\admin\Downloads\csrss.exe. Network forensics identified connections to 10.21.185.102 and edgelogin.io. Email headers traced the initial vector to security@secure-verify.net. File /home/user/.config/config.dat (SHA256: dafb592edcc9f033605628a0a7b1ef6b7c3bde2c1bce56df265119636b4db146) was identified as the initial dropper. A staging URL hxxp://proxy-node.io/api/v2/auth resolved to 10.74.85.161. Secondary artifact hash: SHA256: 2b3ebc495dc4d598d2e2625943c95fd5e80323c74d571659bd3c96f3661ce733.


Forensic Investigation Notes: Analysis of the compromised host revealed Nmap artifacts at C:\Users\admin\Downloads\sam.hive. Memory dump analysis confirmed execution of Covenant. Registry modifications pointed to persistence via /var/tmp/ntds.dit. Network forensics identified connections to 10.1.241.35 and loginedge.online. Email headers traced the initial vector to info@identity-verify.cc. File /etc/cron.d/agent.py (SHA1: a40c5251aa10ad9ded3ef1d34f7dcd407e3b9a1c) was identified as the initial dropper. A staging URL http://proxy-static.club/wp-content/uploads/doc.php resolved to 10.229.11.141. Secondary artifact hash: MD5: 5c60b38fb7565a418b37e38904108e4a.


Forensic Investigation Notes: Analysis of the compromised host revealed Rubeus artifacts at C:\Users\admin\Desktop\winlogon.exe. Memory dump analysis confirmed execution of SharpHound. Registry modifications pointed to persistence via C:\ProgramData\config.dat. Network forensics identified connections to 10.186.41.9 and login-gateway.dev. Email headers traced the initial vector to support@phishing-domain.com. File /opt/app/bin/csrss.exe (MD5: 3db205e2f4e6ec748589acc0a2742610) was identified as the initial dropper. A staging URL hxxp://gateway-update.online/download/update.exe resolved to 192.155.131.182. Secondary artifact hash: SHA256: 3ee0b2533436b8fd3abf39cc3847cc9eec0b98ef09df46d8fb6236f0885fe66e.


Forensic Investigation Notes: Analysis of the compromised host revealed Certutil artifacts at /var/tmp/winlogon.exe. Memory dump analysis confirmed execution of Mimikatz. Registry modifications pointed to persistence via C:\Users\admin\AppData\Local\Temp\payload.bin. Network forensics identified connections to 175.72.140.51 and cachelogin.live. Email headers traced the initial vector to report@secure-verify.net. File /var/tmp/svchost.exe (SHA1: 3dd2eb650f715139bbd6cd7c317028e7b2d2a5d3) was identified as the initial dropper. A staging URL http://portaldata.net/callback resolved to 85.104.58.252. Secondary artifact hash: SHA256: d74934538bb0704219358e06ef5e713fd969b78ec5c4281f41f894352eb9faab.


Forensic Investigation Notes: Analysis of the compromised host revealed Mimikatz artifacts at C:\Users\admin\Desktop\dropper.ps1. Memory dump analysis confirmed execution of PowerView. Registry modifications pointed to persistence via /dev/shm/agent.py. Network forensics identified connections to 96.142.129.17 and cacherelay.com. Email headers traced the initial vector to confirm@mail-service.info. File C:\Windows\Temp\helper.sh (SHA256: 13d365c4532896bac68852e075aa8b99d0165a1279454dbc8816723515da3a5f) was identified as the initial dropper. A staging URL hxxps://storageedge.com/secure/token resolved to 172.50.223.101. Secondary artifact hash: SHA256: dc8217c1ff77fad2583557d1499f6c685fb4ad6976693d5a287b83c41cb8a7f4.


Forensic Investigation Notes: Analysis of the compromised host revealed BITSAdmin artifacts at C:\Users\Public\Documents\beacon.dll. Memory dump analysis confirmed execution of WinPEAS. Registry modifications pointed to persistence via C:\Program Files\Common Files\agent.py. Network forensics identified connections to 192.1.66.76 and static-gateway.cc. Email headers traced the initial vector to contact@secure-verify.net. File C:\Windows\System32\shell.php (MD5: 3397dc598d5123caccdf69b34c1fbc4b) was identified as the initial dropper. A staging URL hxxp://auth-storage.live/assets/js/payload.js resolved to 10.183.3.82. Secondary artifact hash: SHA1: 6b04002aa3bbc0e67d7243e7eb33e41da0f7125b.


Forensic Investigation Notes: Analysis of the compromised host revealed Ligolo artifacts at /opt/app/bin/csrss.exe. Memory dump analysis confirmed execution of Rubeus. Registry modifications pointed to persistence via C:\Users\admin\Downloads\helper.sh. Network forensics identified connections to 172.98.233.166 and cdnbackup.online. Email headers traced the initial vector to ceo@login-portal.tech. File C:\Users\admin\Downloads\payload.bin (SHA1: 21bb4dcaf516182cad3981db9bb87cb1f7f5e166) was identified as the initial dropper. A staging URL hxxps://cdnauth.net/secure/token resolved to 163.155.120.90. Secondary artifact hash: SHA1: 13618451d5c53e92871c56707c861acb5e3a91dd.


Forensic Investigation Notes: Analysis of the compromised host revealed GhostPack artifacts at C:\Users\admin\Downloads\winlogon.exe. Memory dump analysis confirmed execution of LaZagne. Registry modifications pointed to persistence via /opt/app/bin/loader.exe. Network forensics identified connections to 172.20.113.22 and mailedge.dev. Email headers traced the initial vector to admin@document-share.link. File C:\Program Files\Common Files\config.dat (MD5: d734ff0838a33dd15ae2c8d5c6089b62) was identified as the initial dropper. A staging URL hxxps://authedge.site/portal/verify resolved to 71.9.121.6. Secondary artifact hash: MD5: 6478fccc188d34653833b2b2791778f1.


Forensic Investigation Notes: Analysis of the compromised host revealed Havoc artifacts at C:\Windows\System32\config.dat. Memory dump analysis confirmed execution of Impacket. Registry modifications pointed to persistence via /var/tmp/csrss.exe. Network forensics identified connections to 153.92.23.84 and proxystatic.cc. Email headers traced the initial vector to alert@login-portal.tech. File /opt/app/bin/agent.py (SHA1: f983743a4a9ea71efa490b7b5326ec6d25ba1b02) was identified as the initial dropper. A staging URL hxxps://cacheedge.xyz/assets/js/payload.js resolved to 145.208.226.83. Secondary artifact hash: SHA1: 2277308359c4fa577b3154bed57a5cc42abacf9f.


Forensic Investigation Notes: Analysis of the compromised host revealed Metasploit artifacts at /home/user/.config/winlogon.exe. Memory dump analysis confirmed execution of Seatbelt. Registry modifications pointed to persistence via C:\Windows\Tasks\ntds.dit. Network forensics identified connections to 10.199.0.141 and mail-secure.org. Email headers traced the initial vector to billing@login-portal.tech. File C:\Windows\System32\sam.hive (MD5: 4da8a950755f390be0291f15d4f0fc53) was identified as the initial dropper. A staging URL http://nodestatic.link/login resolved to 136.237.19.205. Secondary artifact hash: MD5: cf1ff038a57843dc01450d2eb47eb3bc.


Forensic Investigation Notes: Analysis of the compromised host revealed Seatbelt artifacts at C:\Windows\Temp\loader.exe. Memory dump analysis confirmed execution of Sharphound. Registry modifications pointed to persistence via /tmp/backdoor.elf. Network forensics identified connections to 10.116.3.176 and data-cache.cc. Email headers traced the initial vector to verify@document-share.link. File C:\Windows\Tasks\ntds.dit (SHA1: 0f7495554694f9b0007dedc62a68f9f4fd3a8a83) was identified as the initial dropper. A staging URL https://relay-auth.top/assets/js/payload.js resolved to 72.199.54.190. Secondary artifact hash: SHA1: d732bd33f9e38df6e353cd5be703754a45572be8.


Forensic Investigation Notes: Analysis of the compromised host revealed WinPEAS artifacts at C:\Users\admin\Desktop\update.dll. Memory dump analysis confirmed execution of PsExec. Registry modifications pointed to persistence via /var/tmp/runtime.dll. Network forensics identified connections to 213.74.187.188 and cache-relay.site. Email headers traced the initial vector to support@document-share.link. File /dev/shm/dropper.ps1 (SHA1: 26fd0e0fb2a1c0ef03328d88a5a76bba190b6ff3) was identified as the initial dropper. A staging URL http://update-proxy.xyz/collect resolved to 132.53.132.199. Secondary artifact hash: SHA1: 981e98302fefc773bdf76bd00793ece57e8251c5.


Forensic Investigation Notes: Analysis of the compromised host revealed Seatbelt artifacts at /home/user/.config/implant.so. Memory dump analysis confirmed execution of Merlin. Registry modifications pointed to persistence via /home/user/.config/backdoor.elf. Network forensics identified connections to 223.158.141.29 and loginportal.top. Email headers traced the initial vector to ceo@mail-service.info. File /opt/app/bin/sam.hive (SHA1: 0789f4c167013f7b2b02cd9e8dda707f2d2efb5c) was identified as the initial dropper. A staging URL https://backup-relay.live/collect resolved to 172.206.87.191. Secondary artifact hash: SHA1: 28409093cba43a118374f634550713b013644794.


Forensic Investigation Notes: Analysis of the compromised host revealed PowerView artifacts at C:\Users\Public\Documents\lsass.dmp. Memory dump analysis confirmed execution of GhostPack. Registry modifications pointed to persistence via C:\Windows\Temp\backdoor.elf. Network forensics identified connections to 192.168.27.119 and proxy-storage.site. Email headers traced the initial vector to confirm@secure-verify.net. File /var/tmp/winlogon.exe (SHA1: 408b815d248d95f797ca33e4cff1da8ecaeffa12) was identified as the initial dropper. A staging URL hxxp://proxynode.info/portal/verify resolved to 94.160.230.130. Secondary artifact hash: SHA1: b040cfc785c1bda8a0b31dce697178bad813c260.


Forensic Investigation Notes: Analysis of the compromised host revealed CrackMapExec artifacts at C:\Users\admin\AppData\Local\Temp\beacon.dll. Memory dump analysis confirmed execution of SharpHound. Registry modifications pointed to persistence via /tmp/update.dll. Network forensics identified connections to 100.48.98.81 and portal-cache.org. Email headers traced the initial vector to billing@urgent-notice.online. File C:\Windows\Tasks\taskhost.exe (SHA1: 6e82a1d8fac3a2ea0858ba706ec315f3437e5c9b) was identified as the initial dropper. A staging URL hxxp://backupupdate.xyz/callback resolved to 192.1.251.131. Secondary artifact hash: MD5: d8740c0b1698820674d7c0b76bb97f77.


Forensic Investigation Notes: Analysis of the compromised host revealed WinPEAS artifacts at /opt/app/bin/payload.bin. Memory dump analysis confirmed execution of BloodHound. Registry modifications pointed to persistence via /opt/app/bin/update.dll. Network forensics identified connections to 81.100.81.118 and loginsync.cc. Email headers traced the initial vector to billing@account-update.xyz. File C:\Users\admin\Downloads\helper.sh (SHA256: b9129fd69d142aa211d46f0c62109f5aed20b61a69583e2f8f50d0b907afba26) was identified as the initial dropper. A staging URL http://data-sync.online/api/v2/auth resolved to 172.169.60.73. Secondary artifact hash: SHA256: 0ebf46845afb8ecdb0a78d131de17dadb11f2665ecac94cb4443d790afa1ff51.


Forensic Investigation Notes: Analysis of the compromised host revealed Sliver artifacts at /home/user/.config/ntds.dit. Memory dump analysis confirmed execution of Burp Suite. Registry modifications pointed to persistence via /opt/app/bin/update.dll. Network forensics identified connections to 178.231.21.234 and syncapi.xyz. Email headers traced the initial vector to hr@auth-check.org. File /var/tmp/csrss.exe (MD5: 3ab6762e89c051bd7e4a2e00ba8e5d24) was identified as the initial dropper. A staging URL hxxp://proxyportal.net/api/v2/auth resolved to 10.20.210.30. Secondary artifact hash: MD5: 4d23d94b55d5bfe53e572301d3045ff0.


Forensic Investigation Notes: Analysis of the compromised host revealed Burp Suite artifacts at /var/tmp/implant.so. Memory dump analysis confirmed execution of Sliver. Registry modifications pointed to persistence via C:\ProgramData\payload.bin. Network forensics identified connections to 172.207.52.232 and mail-portal.info. Email headers traced the initial vector to confirm@auth-check.org. File /dev/shm/svchost.exe (MD5: ca015b60a8c303da0cbaffd30435febf) was identified as the initial dropper. A staging URL https://update-sync.tech/secure/token resolved to 10.76.121.168. Secondary artifact hash: MD5: 12027871cced67ce2649d1131311a3a3.


Forensic Investigation Notes: Analysis of the compromised host revealed SharpHound artifacts at /opt/app/bin/shell.php. Memory dump analysis confirmed execution of BITSAdmin. Registry modifications pointed to persistence via /opt/app/bin/update.dll. Network forensics identified connections to 110.3.255.128 and proxy-gateway.live. Email headers traced the initial vector to report@phishing-domain.com. File C:\Windows\System32\ntds.dit (SHA256: f64f2099b56c91015dba7f653670eafc60fa694a52c3d480bb0226e7c21914eb) was identified as the initial dropper. A staging URL hxxp://gatewaycdn.com/assets/js/payload.js resolved to 197.159.110.60. Secondary artifact hash: SHA1: 03d67898780c130d85ae4278e18dd2037c2525e2.


Forensic Investigation Notes: Analysis of the compromised host revealed Sharphound artifacts at /var/tmp/lsass.dmp. Memory dump analysis confirmed execution of Merlin. Registry modifications pointed to persistence via C:\Users\admin\Desktop\payload.bin. Network forensics identified connections to 10.31.227.96 and staticcdn.site. Email headers traced the initial vector to updates@phishing-domain.com. File C:\Program Files\Common Files\shell.php (SHA256: b7f96c25122d971a30a6da7d828ac0491c59cec9826a9f2f8092c08610872b0a) was identified as the initial dropper. A staging URL hxxps://storage-auth.org/login resolved to 174.11.205.27. Secondary artifact hash: SHA256: c66646656e6293aceb4c06e63a13d5ed9ea0d2962b25fd3fd8025a12f242ac3b.


Forensic Investigation Notes: Analysis of the compromised host revealed LinPEAS artifacts at /tmp/shell.php. Memory dump analysis confirmed execution of Sharphound. Registry modifications pointed to persistence via /tmp/backdoor.elf. Network forensics identified connections to 154.243.83.234 and data-data.cc. Email headers traced the initial vector to info@document-share.link. File /home/user/.config/implant.so (SHA256: beb0961fbbf08f707a8ec792fe0084b8c9e00dc41183220cdc08fa250511fe08) was identified as the initial dropper. A staging URL hxxp://cache-portal.link/api/v2/auth resolved to 172.93.37.142. Secondary artifact hash: MD5: 66a94f3c5243ba48e5e43000adc450ae.


Forensic Investigation Notes: Analysis of the compromised host revealed BloodHound artifacts at C:\Windows\Temp\winlogon.exe. Memory dump analysis confirmed execution of Hashcat. Registry modifications pointed to persistence via /var/tmp/svchost.exe. Network forensics identified connections to 11.28.64.227 and securerelay.link. Email headers traced the initial vector to finance@document-share.link. File /dev/shm/chrome_helper.exe (SHA256: b08e79c1a358c8d48d4ce919498771c26eef32b4fc85975eb9f56827f8f5722a) was identified as the initial dropper. A staging URL http://proxyedge.io/download/update.exe resolved to 192.119.237.114. Secondary artifact hash: SHA256: af6f774ac4a31b2683fcbbe530a60bf0c03bccbb9783d82c392e6150fa5be283.


Forensic Investigation Notes: Analysis of the compromised host revealed Hashcat artifacts at C:\Windows\System32\update.dll. Memory dump analysis confirmed execution of CrackMapExec. Registry modifications pointed to persistence via C:\Users\admin\Desktop\runtime.dll. Network forensics identified connections to 10.85.215.250 and mailnode.cc. Email headers traced the initial vector to hr@credential-check.site. File C:\Windows\System32\config.dat (SHA1: 299f3b3c423337422cb8b93f9f54990a7d3f0748) was identified as the initial dropper. A staging URL hxxps://updatecache.site/admin/config resolved to 172.132.212.181. Secondary artifact hash: SHA1: a92eda0da6735c3c93191bda0a9e475009f7802f.


Forensic Investigation Notes: Analysis of the compromised host revealed Sliver artifacts at C:\Program Files\Common Files\backdoor.elf. Memory dump analysis confirmed execution of Hashcat. Registry modifications pointed to persistence via C:\Windows\Tasks\payload.bin. Network forensics identified connections to 56.231.238.178 and updatestatic.info. Email headers traced the initial vector to verify@credential-check.site. File /usr/local/bin/winlogon.exe (SHA256: 7cd47eaa2464dfa44c5efbb5f343e041a835d7296f56de34f1197967352a0ccb) was identified as the initial dropper. A staging URL hxxp://cdngateway.net/collect resolved to 121.253.133.4. Secondary artifact hash: MD5: a54bbeaee0ab5065f49d1cae8e67e658.


Forensic Investigation Notes: Analysis of the compromised host revealed SharpHound artifacts at C:\Windows\Tasks\payload.bin. Memory dump analysis confirmed execution of Havoc. Registry modifications pointed to persistence via /home/user/.config/payload.bin. Network forensics identified connections to 192.75.205.176 and updateupdate.tech. Email headers traced the initial vector to verify@secure-verify.net. File C:\Users\admin\Desktop\loader.exe (SHA256: 66d43902925cef3c05693039a5d30dc53b251d892c9d4e55354ecb0665178cee) was identified as the initial dropper. A staging URL http://cdnstorage.site/panel/index.html resolved to 192.193.131.31. Secondary artifact hash: SHA1: 56c6896bfd571d719003472670aeffaba90a7b18.


Forensic Investigation Notes: Analysis of the compromised host revealed PowerView artifacts at C:\Windows\Temp\runtime.dll. Memory dump analysis confirmed execution of Nmap. Registry modifications pointed to persistence via C:\ProgramData\lsass.dmp. Network forensics identified connections to 163.32.73.120 and datamail.top. Email headers traced the initial vector to info@identity-verify.cc. File C:\Users\admin\Desktop\agent.py (MD5: 27530415a91fef25ca115872d73b182a) was identified as the initial dropper. A staging URL hxxps://api-cache.cc/collect resolved to 10.89.134.35. Secondary artifact hash: SHA1: f4f16c10535c0619990979d9b5e7c29410a44d3f.


Forensic Investigation Notes: Analysis of the compromised host revealed Covenant artifacts at /usr/local/bin/dropper.ps1. Memory dump analysis confirmed execution of Burp Suite. Registry modifications pointed to persistence via C:\Windows\Temp\loader.exe. Network forensics identified connections to 1.204.248.224 and authcdn.online. Email headers traced the initial vector to support@mail-service.info. File C:\Windows\Tasks\svchost.exe (SHA1: 77090bb3d031e9f40770744b5e8eda511c1b5c20) was identified as the initial dropper. A staging URL https://data-gateway.io/assets/js/payload.js resolved to 172.87.20.123. Secondary artifact hash: SHA256: 6f6351e8ddfb837f42e631bcdacc5011966738f1123b534effd234139f3f8cb1.


Forensic Investigation Notes: Analysis of the compromised host revealed Chisel artifacts at C:\Windows\Tasks\implant.so. Memory dump analysis confirmed execution of Mimikatz. Registry modifications pointed to persistence via C:\Users\admin\Desktop\sam.hive. Network forensics identified connections to 172.34.46.9 and proxy-edge.club. Email headers traced the initial vector to security@phishing-domain.com. File C:\Windows\System32\agent.py (MD5: ac7b76f2de888e32908d9d2b681495a4) was identified as the initial dropper. A staging URL https://cdnlogin.tech/collect resolved to 10.240.26.209. Secondary artifact hash: SHA256: d18deb2b2b15e02e3f4c086199d7cea5874d41993209fcf71d543c9968ed0a6f.


Forensic Investigation Notes: Analysis of the compromised host revealed ADFind artifacts at /dev/shm/config.dat. Memory dump analysis confirmed execution of Havoc. Registry modifications pointed to persistence via /var/tmp/implant.so. Network forensics identified connections to 192.240.186.232 and static-gateway.tech. Email headers traced the initial vector to updates@mail-service.info. File C:\Users\admin\Downloads\update.dll (SHA256: 8ec0f50de8338e23f1588118dfb0ac15320906f33c05fba1d2ec1c0436503220) was identified as the initial dropper. A staging URL http://securemail.org/admin/config resolved to 69.235.170.164. Secondary artifact hash: SHA256: c0ae70d62e54be47d125637c4244d155358bd8044cb9bea5b82fb48535a61b44.


Forensic Investigation Notes: Analysis of the compromised host revealed Seatbelt artifacts at /usr/local/bin/config.dat. Memory dump analysis confirmed execution of ADFind. Registry modifications pointed to persistence via C:\Users\admin\AppData\Local\Temp\agent.py. Network forensics identified connections to 200.108.225.75 and data-relay.dev. Email headers traced the initial vector to helpdesk@credential-check.site. File C:\ProgramData\lsass.dmp (MD5: 9595b07e1d9522843c026714fa478b93) was identified as the initial dropper. A staging URL http://portalcache.link/callback resolved to 192.187.47.231. Secondary artifact hash: SHA256: 699cdf257904e6fbae6ac3b6e19d536617e1fa1b16f60dd7c93b148ed5198aa3.


Forensic Investigation Notes: Analysis of the compromised host revealed LaZagne artifacts at C:\Users\Public\Documents\lsass.dmp. Memory dump analysis confirmed execution of BloodHound. Registry modifications pointed to persistence via C:\Windows\Temp\loader.exe. Network forensics identified connections to 78.23.185.134 and cachestatic.com. Email headers traced the initial vector to billing@auth-check.org. File /opt/app/bin/winlogon.exe (MD5: f362d54dd841312a2b29d73bbdb747f0) was identified as the initial dropper. A staging URL hxxps://securebackup.club/admin/config resolved to 158.200.40.71. Secondary artifact hash: SHA256: 388cdfe4dcd9a0d84c5a1a00300834105bf4aaa6505f1ecd68d075389848ff64.


Forensic Investigation Notes: Analysis of the compromised host revealed WinPEAS artifacts at /etc/cron.d/sam.hive. Memory dump analysis confirmed execution of BloodHound. Registry modifications pointed to persistence via /usr/local/bin/backdoor.elf. Network forensics identified connections to 54.93.132.96 and auth-auth.net. Email headers traced the initial vector to account@auth-check.org. File /opt/app/bin/svchost.exe (SHA1: 679a6c910ba7933155ca273dccaa53a30fc66430) was identified as the initial dropper. A staging URL http://edge-sync.site/panel/index.html resolved to 172.74.225.189. Secondary artifact hash: SHA1: 0e8e4dcd64b1df215b5c3afe8829e1237d6cda63.


Forensic Investigation Notes: Analysis of the compromised host revealed PowerView artifacts at /opt/app/bin/implant.so. Memory dump analysis confirmed execution of Havoc. Registry modifications pointed to persistence via /var/tmp/config.dat. Network forensics identified connections to 31.107.26.210 and cdn-login.org. Email headers traced the initial vector to contact@mail-service.info. File C:\ProgramData\helper.sh (MD5: 29bf7c2cc699db507cc1328e51191d88) was identified as the initial dropper. A staging URL hxxp://mail-static.online/login resolved to 186.101.140.178. Secondary artifact hash: SHA1: 0422fe108e7f404a84f408a4dd90614cb92295e3.


Forensic Investigation Notes: Analysis of the compromised host revealed Rubeus artifacts at /opt/app/bin/winlogon.exe. Memory dump analysis confirmed execution of BITSAdmin. Registry modifications pointed to persistence via /home/user/.config/dropper.ps1. Network forensics identified connections to 192.72.32.219 and portalupdate.info. Email headers traced the initial vector to helpdesk@credential-check.site. File C:\Users\admin\Downloads\shell.php (SHA1: 5e2b78f682cab0d52d50c7e8c8fdbe2177990631) was identified as the initial dropper. A staging URL https://proxy-edge.dev/admin/config resolved to 121.130.143.115. Secondary artifact hash: MD5: 248b6f59e35839343c2a2dd073fe69ee.


Forensic Investigation Notes: Analysis of the compromised host revealed Sharphound artifacts at /dev/shm/config.dat. Memory dump analysis confirmed execution of ADFind. Registry modifications pointed to persistence via C:\ProgramData\backdoor.elf. Network forensics identified connections to 87.24.138.89 and staticnode.io. Email headers traced the initial vector to updates@document-share.link. File C:\Program Files\Common Files\chrome_helper.exe (MD5: ab1b1b64272fc4560cde7c7512e2c0ad) was identified as the initial dropper. A staging URL https://proxystorage.info/secure/token resolved to 192.92.216.115. Secondary artifact hash: SHA256: 3a5de3698032c715d5f1566beba62ed450050c60ceda324f5348e617930269fa.


Forensic Investigation Notes: Analysis of the compromised host revealed BITSAdmin artifacts at /usr/local/bin/sam.hive. Memory dump analysis confirmed execution of SharpHound. Registry modifications pointed to persistence via /home/user/.config/chrome_helper.exe. Network forensics identified connections to 192.109.212.228 and storageapi.club. Email headers traced the initial vector to hr@identity-verify.cc. File /var/tmp/backdoor.elf (SHA256: dca9efba1c0479f7560007ef5a46b360bd28e4560a1f0b9e0d3941a673a47fe4) was identified as the initial dropper. A staging URL hxxps://node-static.com/download/update.exe resolved to 192.168.222.47. Secondary artifact hash: SHA256: 7e8e1c188bbfb6bbd4d8c384a1695422fb50c9c3d2915a799b4ca1c35b620dc6.


Forensic Investigation Notes: Analysis of the compromised host revealed Brute Ratel artifacts at /usr/local/bin/loader.exe. Memory dump analysis confirmed execution of Mimikatz. Registry modifications pointed to persistence via /home/user/.config/agent.py. Network forensics identified connections to 105.60.35.252 and data-cdn.link. Email headers traced the initial vector to contact@auth-check.org. File /dev/shm/implant.so (SHA256: 0e5e9d9bcd63d9d4d87a3ae4af3f60e27728aae3c479f49f9234779f6a93fad9) was identified as the initial dropper. A staging URL https://nodeupdate.live/wp-content/uploads/doc.php resolved to 105.205.69.181. Secondary artifact hash: MD5: c31d5928c73089c7bb35e241f3d7afe1.


Forensic Investigation Notes: Analysis of the compromised host revealed Brute Ratel artifacts at C:\Users\Public\Documents\lsass.dmp. Memory dump analysis confirmed execution of Havoc. Registry modifications pointed to persistence via C:\Users\admin\AppData\Local\Temp\payload.bin. Network forensics identified connections to 10.27.109.215 and securebackup.info. Email headers traced the initial vector to it@identity-verify.cc. File C:\Windows\System32\sam.hive (SHA1: f847f0475fed82c2a5d009f8a085124923436d4e) was identified as the initial dropper. A staging URL hxxps://api-auth.org/wp-content/uploads/doc.php resolved to 173.90.251.18. Secondary artifact hash: MD5: e07534afaa11fd0762aa8a8602f99fc2.


Forensic Investigation Notes: Analysis of the compromised host revealed Covenant artifacts at C:\Windows\Temp\beacon.dll. Memory dump analysis confirmed execution of Burp Suite. Registry modifications pointed to persistence via C:\Users\admin\Downloads\dropper.ps1. Network forensics identified connections to 20.163.152.89 and gatewaystorage.club. Email headers traced the initial vector to info@urgent-notice.online. File /dev/shm/dropper.ps1 (SHA256: 3e70333bda4ed225d3436e058178d17891dd3f2d3767da94da0ae29057afa9f4) was identified as the initial dropper. A staging URL hxxp://secure-edge.top/secure/token resolved to 132.205.192.60. Secondary artifact hash: MD5: 1cd7ea7cef512aa885225ce713cb8e36.


Forensic Investigation Notes: Analysis of the compromised host revealed PsExec artifacts at C:\Windows\System32\chrome_helper.exe. Memory dump analysis confirmed execution of Impacket. Registry modifications pointed to persistence via C:\Users\admin\Downloads\loader.exe. Network forensics identified connections to 214.139.199.151 and storage-login.com. Email headers traced the initial vector to helpdesk@account-update.xyz. File C:\Users\admin\Desktop\ntds.dit (SHA1: c49a06a2a408fbcd7708dff2a55eb4ed1d8fc24e) was identified as the initial dropper. A staging URL hxxp://apisecure.xyz/login resolved to 45.80.146.115. Secondary artifact hash: SHA256: e525bc87aa6336b01306ebdfba007402ecf548e3712fc6ada975dd02ecfa1af7.


Forensic Investigation Notes: Analysis of the compromised host revealed PsExec artifacts at /tmp/ntds.dit. Memory dump analysis confirmed execution of CrackMapExec. Registry modifications pointed to persistence via C:\Users\admin\Desktop\loader.exe. Network forensics identified connections to 140.199.69.110 and portalupdate.club. Email headers traced the initial vector to admin@urgent-notice.online. File C:\Program Files\Common Files\agent.py (SHA256: 8d3c7506c0e222933be9175fc3ee0360a5b0adc6db9041d7ff78930b754f44d5) was identified as the initial dropper. A staging URL https://relayedge.xyz/gate.php resolved to 48.241.73.136. Secondary artifact hash: MD5: 726f8eccc060b7b557a8c4b4d96c5430.


Forensic Investigation Notes: Analysis of the compromised host revealed WinPEAS artifacts at C:\ProgramData\svchost.exe. Memory dump analysis confirmed execution of Seatbelt. Registry modifications pointed to persistence via C:\Program Files\Common Files\config.dat. Network forensics identified connections to 209.188.245.63 and relay-proxy.top. Email headers traced the initial vector to support@phishing-domain.com. File /var/tmp/helper.sh (MD5: 3ab618f17dfcd34f26277e24018c077f) was identified as the initial dropper. A staging URL https://storagecloud.tech/assets/js/payload.js resolved to 109.88.98.245. Secondary artifact hash: SHA1: fe99fd200cbf0f6e30b74776adaa6a06666115c7.


Forensic Investigation Notes: Analysis of the compromised host revealed Burp Suite artifacts at /dev/shm/runtime.dll. Memory dump analysis confirmed execution of Merlin. Registry modifications pointed to persistence via C:\Users\admin\AppData\Local\Temp\payload.bin. Network forensics identified connections to 10.176.229.237 and storage-storage.tech. Email headers traced the initial vector to contact@urgent-notice.online. File C:\Windows\Tasks\helper.sh (SHA1: e680d2f92a72754dbbb2b8e70acb37a6051e8673) was identified as the initial dropper. A staging URL http://cache-relay.dev/admin/config resolved to 172.83.130.11. Secondary artifact hash: SHA1: 1be6db5741d6346e3f959fc3267e9cc1d2425728.


Forensic Investigation Notes: Analysis of the compromised host revealed PowerView artifacts at C:\Users\admin\AppData\Local\Temp\agent.py. Memory dump analysis confirmed execution of Merlin. Registry modifications pointed to persistence via C:\Users\Public\Documents\taskhost.exe. Network forensics identified connections to 172.215.146.103 and backup-sync.io. Email headers traced the initial vector to hr@identity-verify.cc. File C:\Program Files\Common Files\beacon.dll (SHA1: d4cfddc3707f93cd9943b40bef9a7904d87bdd54) was identified as the initial dropper. A staging URL hxxp://datacloud.org/collect resolved to 60.200.175.98. Secondary artifact hash: SHA1: 2e074bd8e65aa52f3c7e4590c7e0c7eb865cab7b.


Forensic Investigation Notes: Analysis of the compromised host revealed BloodHound artifacts at C:\ProgramData\config.dat. Memory dump analysis confirmed execution of PowerShell Empire. Registry modifications pointed to persistence via /home/user/.config/dropper.ps1. Network forensics identified connections to 8.5.216.229 and securegateway.info. Email headers traced the initial vector to contact@phishing-domain.com. File /opt/app/bin/csrss.exe (SHA1: eff91261888b8d95c221e66dec42357649bd2caa) was identified as the initial dropper. A staging URL hxxp://cloudcdn.net/assets/js/payload.js resolved to 10.134.160.150. Secondary artifact hash: MD5: d12989d79c4e76695aad34fdc95e12a9.


Forensic Investigation Notes: Analysis of the compromised host revealed Impacket artifacts at C:\Users\admin\AppData\Local\Temp\helper.sh. Memory dump analysis confirmed execution of BloodHound. Registry modifications pointed to persistence via /var/tmp/shell.php. Network forensics identified connections to 24.192.73.140 and storage-edge.link. Email headers traced the initial vector to confirm@phishing-domain.com. File C:\Windows\Temp\taskhost.exe (SHA256: ea8593fa9318412fbb64aadce0ea3fc40ffb7c8452bd3f171658c5baa1fad900) was identified as the initial dropper. A staging URL http://mail-cloud.xyz/portal/verify resolved to 10.182.217.141. Secondary artifact hash: SHA1: e09a6757b02c1755a6dd614ce32e0e90a2792b36.


Forensic Investigation Notes: Analysis of the compromised host revealed Mythic artifacts at /tmp/winlogon.exe. Memory dump analysis confirmed execution of Burp Suite. Registry modifications pointed to persistence via C:\Users\admin\Desktop\sam.hive. Network forensics identified connections to 126.84.235.19 and relaycache.top. Email headers traced the initial vector to it@credential-check.site. File C:\Windows\Temp\payload.bin (SHA1: 43fe5c7239850639a757575c290607e6b7714d37) was identified as the initial dropper. A staging URL https://cachestorage.cc/secure/token resolved to 98.187.220.169. Secondary artifact hash: SHA1: e29d84fa9e17b74a88566cf370a5da6bd206d8ef.


Forensic Investigation Notes: Analysis of the compromised host revealed WinPEAS artifacts at C:\Windows\Temp\winlogon.exe. Memory dump analysis confirmed execution of Hashcat. Registry modifications pointed to persistence via /opt/app/bin/helper.sh. Network forensics identified connections to 172.58.153.132 and static-mail.org. Email headers traced the initial vector to noreply@auth-check.org. File C:\Users\admin\Desktop\payload.bin (SHA1: 89a5f605ce14cc94a306b53aa9c27bdbb6182b18) was identified as the initial dropper. A staging URL hxxp://cdn-relay.dev/api/v2/auth resolved to 215.146.38.144. Secondary artifact hash: SHA1: f4e54ac1e3ddcf763946d08d1c33bb5ebde8a911.


Forensic Investigation Notes: Analysis of the compromised host revealed SharpHound artifacts at C:\Users\admin\Desktop\winlogon.exe. Memory dump analysis confirmed execution of Mimikatz. Registry modifications pointed to persistence via C:\Users\Public\Documents\chrome_helper.exe. Network forensics identified connections to 76.151.163.39 and staticsync.online. Email headers traced the initial vector to account@urgent-notice.online. File C:\Users\admin\Downloads\chrome_helper.exe (MD5: 8c5fcb3c3b98536cdca8afe5b2fbc8d9) was identified as the initial dropper. A staging URL https://backup-cdn.xyz/admin/config resolved to 10.20.69.122. Secondary artifact hash: MD5: 2164b84440fd0744e7f008da17a4dbd4.


Forensic Investigation Notes: Analysis of the compromised host revealed BloodHound artifacts at /var/tmp/config.dat. Memory dump analysis confirmed execution of Chisel. Registry modifications pointed to persistence via C:\ProgramData\config.dat. Network forensics identified connections to 192.102.223.60 and api-edge.dev. Email headers traced the initial vector to security@auth-check.org. File /home/user/.config/agent.py (SHA256: 0db4e25ab6261020a90b47f8866da6e56b157a6c42a5d30f250229de2874a693) was identified as the initial dropper. A staging URL hxxps://cachestorage.cc/assets/js/payload.js resolved to 165.11.128.24. Secondary artifact hash: SHA1: 9b44b0196a748264807df2046678bf9b3a23f7df.


Forensic Investigation Notes: Analysis of the compromised host revealed LaZagne artifacts at C:\Windows\Temp\agent.py. Memory dump analysis confirmed execution of WinPEAS. Registry modifications pointed to persistence via /dev/shm/implant.so. Network forensics identified connections to 10.166.154.105 and datasync.link. Email headers traced the initial vector to it@credential-check.site. File /usr/local/bin/chrome_helper.exe (SHA256: c2c067d6895af976c874f6bcfeec36f64594da1087d97a0ddd518c5e307ed1f0) was identified as the initial dropper. A staging URL http://cloud-cloud.cc/assets/js/payload.js resolved to 10.44.58.53. Secondary artifact hash: SHA1: 8ac7d9c5159cace54807c30a15eee75fa53d1864.


Forensic Investigation Notes: Analysis of the compromised host revealed PsExec artifacts at C:\Users\admin\Downloads\sam.hive. Memory dump analysis confirmed execution of BloodHound. Registry modifications pointed to persistence via C:\Program Files\Common Files\dropper.ps1. Network forensics identified connections to 172.65.59.197 and cloud-node.net. Email headers traced the initial vector to info@mail-service.info. File C:\Program Files\Common Files\chrome_helper.exe (SHA256: d44f9d5e62420726b53c9144a1cebb77a19f2e9e5cf1db3b89ad7c1a0c63a93a) was identified as the initial dropper. A staging URL hxxps://edgecdn.org/panel/index.html resolved to 10.13.84.159. Secondary artifact hash: MD5: 8b17c7815903259fcb02cf973f4bec8b.


Forensic Investigation Notes: Analysis of the compromised host revealed Brute Ratel artifacts at C:\ProgramData\shell.php. Memory dump analysis confirmed execution of CrackMapExec. Registry modifications pointed to persistence via C:\Users\admin\Desktop\ntds.dit. Network forensics identified connections to 192.55.18.132 and edgecloud.net. Email headers traced the initial vector to helpdesk@identity-verify.cc. File /home/user/.config/csrss.exe (SHA256: 70a8aad9cc92ba43f1e2cedf481e13b2cfbd0c36ff993f276a2f458f7b023f3f) was identified as the initial dropper. A staging URL hxxps://proxycdn.info/gate.php resolved to 10.111.98.83. Secondary artifact hash: SHA256: 834ad02b3fcfeb4097f1129b9d8ccdd7bf1e7a830691222acc61096110cd55e9.


Forensic Investigation Notes: Analysis of the compromised host revealed GhostPack artifacts at C:\ProgramData\svchost.exe. Memory dump analysis confirmed execution of Nmap. Registry modifications pointed to persistence via /tmp/dropper.ps1. Network forensics identified connections to 75.18.164.209 and update-data.info. Email headers traced the initial vector to notification@auth-check.org. File C:\ProgramData\implant.so (SHA256: 82057bc5a401bbae2a439d012ae3f0a03e9d57de965776cb4562038d54a6f0d5) was identified as the initial dropper. A staging URL https://updateproxy.net/panel/index.html resolved to 10.122.105.201. Secondary artifact hash: SHA1: 0dc5bbfa61527600858d4593732027980e8eb9ea.


IOC Bulletin - Amadey Campaign:
Network Indicators:
- 89.29.253.117
- 193.78.183.182
- 39.115.38.212
- cloudauth.site
- cloud-proxy.top
URLs:
- http://api-cdn.tech/login
- hxxp://cache-static.site/login
Email Senders:
- contact@identity-verify.cc
- updates@phishing-domain.com
File Indicators:
- SHA1: dd699d3c01bf1e467f4357d1ea15192a8a7c8417
- SHA1: 8456e526dd911a33c387b1e2f38013816c1a76f0
- Drop path: C:\Windows\Temp\csrss.exe


IOC Bulletin - StealC Campaign:
Network Indicators:
- 104.203.203.176
- 192.70.126.56
- 16.14.252.28
- nodeupdate.link
- cache-proxy.live
URLs:
- hxxp://edge-gateway.xyz/download/update.exe
- hxxps://backup-cloud.live/callback
Email Senders:
- ceo@urgent-notice.online
- verify@mail-service.info
File Indicators:
- SHA256: 584b4ae96367c9585e21a9e26d9ee98956160b913cfd5d17ef58e9badb71a095
- MD5: 27279a1fc740ed107ae63fa0321982c7
- Drop path: /home/user/.config/dropper.ps1


IOC Bulletin - PikaBot Campaign:
Network Indicators:
- 192.87.124.120
- 154.2.252.48
- 192.166.72.176
- edgestorage.club
- mailstorage.live
URLs:
- hxxps://cache-gateway.link/wp-content/uploads/doc.php
- hxxp://nodesecure.link/callback
Email Senders:
- verify@urgent-notice.online
- confirm@login-portal.tech
File Indicators:
- SHA256: 04c3b4a672ee8bcc2d96ccc520c4547b1f1aa8afc8ecd8cbb4cba94173557eb0
- SHA256: 42c45825d21712960b61902d4959ae1ba1df16921db01eb617996c9ce1048657
- Drop path: /dev/shm/runtime.dll


IOC Bulletin - Vidar Campaign:
Network Indicators:
- 10.123.8.9
- 178.120.210.66
- 94.159.211.108
- nodegateway.club
- syncauth.site
URLs:
- hxxp://login-cdn.site/api/v2/auth
- hxxp://storagemail.dev/collect
Email Senders:
- updates@credential-check.site
- service@phishing-domain.com
File Indicators:
- SHA256: 132f594c182fe498251350d47734e7f1536b04a8ebd65a3eccfd1e33c663a444
- MD5: fb9271d0cd918c48bc3991e0cb15e508
- Drop path: C:\Users\Public\Documents\backdoor.elf


IOC Bulletin - AgentTesla Campaign:
Network Indicators:
- 2.52.56.192
- 65.40.189.113
- 192.57.159.183
- portal-api.net
- edgeportal.net
URLs:
- http://updatecloud.dev/api/v2/auth
- http://node-static.org/assets/js/payload.js
Email Senders:
- admin@auth-check.org
- ceo@auth-check.org
File Indicators:
- SHA256: 090234806c2088615d508f24d58f19bf5d71ed0875c3c0ec1048b483dfd290e7
- MD5: bf2748f94544ff55934713b9b2859834
- Drop path: /usr/local/bin/lsass.dmp


IOC Bulletin - AgentTesla Campaign:
Network Indicators:
- 45.203.126.98
- 218.118.255.116
- 172.13.101.75
- storagesync.tech
- gatewaygateway.com
URLs:
- http://api-api.cc/admin/config
- hxxp://login-proxy.link/wp-content/uploads/doc.php
Email Senders:
- account@identity-verify.cc
- notification@credential-check.site
File Indicators:
- SHA256: 61e1ff2aeb28548fde8a079bc97f5483dd9243103ca7addb478bdf795801c94e
- SHA256: 6b95cf9e398686c1bca42fd67e6e77fb07e704bb1d0947f54381bc5b1db628d4
- Drop path: /usr/local/bin/payload.bin


IOC Bulletin - Ryuk Campaign:
Network Indicators:
- 191.106.199.205
- 192.188.28.242
- 215.230.10.251
- sync-update.link
- gateway-mail.com
URLs:
- https://cloud-gateway.link/login
- https://sync-node.top/panel/index.html
Email Senders:
- hr@login-portal.tech
- verify@credential-check.site
File Indicators:
- SHA1: 7c52d67ef2ca07007c338c6f3aafce68ce0ae408
- SHA256: 9273964c65942820d85b60fd1b2353018e0528faf9eb4a9e5a517799cc9939c4
- Drop path: C:\Users\admin\AppData\Local\Temp\svchost.exe


IOC Bulletin - FormBook Campaign:
Network Indicators:
- 172.169.171.225
- 172.92.181.66
- 157.198.219.148
- backuplogin.live
- proxy-mail.live
URLs:
- hxxps://storagesecure.io/login
- http://gateway-api.top/wp-content/uploads/doc.php
Email Senders:
- hr@mail-service.info
- updates@document-share.link
File Indicators:
- MD5: 050514a94200ee510d0c1043e79afc56
- SHA256: a24cfda30a2856a6d96393cc729a64bd20494a606e8c63d6f7328abb36a0c7c3
- Drop path: /home/user/.config/winlogon.exe


IOC Bulletin - Lumma Stealer Campaign:
Network Indicators:
- 10.160.60.209
- 183.108.116.211
- 172.142.249.184
- cdn-cdn.net
- updaterelay.io
URLs:
- hxxps://storagerelay.site/assets/js/payload.js
- https://cdn-sync.live/panel/index.html
Email Senders:
- finance@secure-verify.net
- finance@account-update.xyz
File Indicators:
- SHA256: 82772762bf4362dbf2888bc02012b312e8b866c9bb9f1e3654d27bb46a461b9b
- SHA256: dfca7200b5a630870282e9c68cf37f5b3111aed25b313255008ca7c68262cb62
- Drop path: /var/tmp/winlogon.exe


IOC Bulletin - AgentTesla Campaign:
Network Indicators:
- 192.103.109.124
- 192.241.183.221
- 169.251.63.169
- cdn-login.site
- portalsync.top
URLs:
- hxxp://authapi.tech/assets/js/payload.js
- https://node-relay.com/api/v2/auth
Email Senders:
- admin@credential-check.site
- notification@secure-verify.net
File Indicators:
- MD5: eefc702db8e948bce4d4e3014752f0d3
- SHA1: 3fb7e472b58fe46ee3ed0a995261d00d65e7628a
- Drop path: C:\Users\Public\Documents\ntds.dit


IOC Bulletin - Conti Campaign:
Network Indicators:
- 172.205.131.66
- 183.41.52.150
- 10.234.185.205
- securebackup.live
- cloudnode.dev
URLs:
- http://securedata.online/portal/verify
- http://relayupdate.com/panel/index.html
Email Senders:
- confirm@secure-verify.net
- noreply@auth-check.org
File Indicators:
- SHA1: 078a05703f2f58f55f71a8bd7575d365514ce847
- SHA1: 5464237536190a75354608cd92f87cc1a82ae2dc
- Drop path: /var/tmp/config.dat


IOC Bulletin - NjRAT Campaign:
Network Indicators:
- 10.44.15.141
- 10.207.247.147
- 192.209.207.106
- login-edge.site
- cloudedge.xyz
URLs:
- https://relayapi.site/callback
- hxxps://auth-update.live/wp-content/uploads/doc.php
Email Senders:
- verify@phishing-domain.com
- notification@phishing-domain.com
File Indicators:
- SHA1: ac0ceec111f1f91dddd16c1400630dd2c5df291c
- SHA1: 0637afd329e0590d739d162b9de909793ab5b62d
- Drop path: C:\Windows\Tasks\update.dll


IOC Bulletin - BumbleBee Campaign:
Network Indicators:
- 134.31.213.236
- 193.115.84.10
- 205.17.120.70
- staticlogin.top
- proxybackup.io
URLs:
- hxxps://static-gateway.tech/gate.php
- https://syncstorage.site/gate.php
Email Senders:
- noreply@identity-verify.cc
- verify@identity-verify.cc
File Indicators:
- MD5: 1a1db639d51c427e1dc15eb89b906986
- MD5: cd1708d3cabeb215aac702f6e4054b8e
- Drop path: /etc/cron.d/backdoor.elf


IOC Bulletin - Dridex Campaign:
Network Indicators:
- 192.52.228.151
- 128.244.179.1
- 10.157.170.196
- login-cdn.org
- secureportal.cc
URLs:
- https://login-portal.top/secure/token
- hxxp://mail-relay.xyz/login
Email Senders:
- report@phishing-domain.com
- updates@mail-service.info
File Indicators:
- SHA256: 292fcaf1a11abdc90430629e03a7fd64f0616b9981ee416f53f7e74725db5424
- SHA256: 645c1b9c7d6964ce89b3536d0be0124095f8a47a7dfafb3c15d3ef11cec9afce
- Drop path: C:\Users\admin\AppData\Local\Temp\lsass.dmp


IOC Bulletin - Play Campaign:
Network Indicators:
- 23.221.175.38
- 172.238.204.191
- 95.62.64.88
- proxy-cache.cc
- cdn-mail.live
URLs:
- hxxp://staticcloud.xyz/gate.php
- hxxp://datacloud.info/download/update.exe
Email Senders:
- confirm@auth-check.org
- service@account-update.xyz
File Indicators:
- SHA256: 9ffdb41e404dfba9e90de799d5489cb0d5df5be35761f4b881ba7f5502283ac5
- MD5: d9a1c0a8ea86fb3e0cc9a2f622a958fe
- Drop path: /var/tmp/sam.hive


IOC Bulletin - BlackCat Campaign:
Network Indicators:
- 172.90.95.87
- 10.18.119.208
- 192.241.27.2
- logincloud.info
- cloud-relay.com
URLs:
- hxxps://data-cloud.top/admin/config
- http://edge-sync.tech/admin/config
Email Senders:
- info@account-update.xyz
- it@credential-check.site
File Indicators:
- MD5: 63728b6a41839a50d8456f7323158ef6
- SHA256: f7012cdfc50e141d1e84183b4bb4cc582363745a62e1d3d5e533fa55c3abc5b2
- Drop path: C:\Windows\Temp\backdoor.elf


IOC Bulletin - ShadowPad Campaign:
Network Indicators:
- 172.51.190.193
- 172.215.197.139
- 192.197.151.95
- backupbackup.club
- auth-mail.online
URLs:
- hxxp://relay-static.top/callback
- hxxp://updatestorage.xyz/admin/config
Email Senders:
- updates@login-portal.tech
- report@identity-verify.cc
File Indicators:
- SHA1: 506ff57f73df7550d2beecae16c47d596c9d3841
- SHA1: 3ff0d885e72fa1319ac4c2e88259755216b19f56
- Drop path: /etc/cron.d/implant.so


IOC Bulletin - Royal Campaign:
Network Indicators:
- 186.67.109.163
- 10.233.239.234
- 192.108.41.178
- updatedata.org
- static-node.tech
URLs:
- hxxps://mailmail.link/admin/config
- http://login-storage.com/callback
Email Senders:
- contact@urgent-notice.online
- service@phishing-domain.com
File Indicators:
- SHA1: ab493ec8bdbe8bef1fedd8710562fbcca3edb003
- SHA1: d19074c7a6fca1e8ec76514e502438aa2a2cedb3
- Drop path: C:\Users\admin\Desktop\sam.hive


IOC Bulletin - Play Campaign:
Network Indicators:
- 127.213.241.24
- 213.219.126.37
- 186.45.0.60
- securebackup.org
- portalsecure.org
URLs:
- http://cacheportal.xyz/portal/verify
- https://cache-gateway.xyz/collect
Email Senders:
- ceo@document-share.link
- finance@phishing-domain.com
File Indicators:
- SHA256: 5b6bcfb201a5ea8dd2d4efd891748da2a3d7e577878dfe061638b0e6ea7d69d9
- MD5: 2724e3292b419b807d1c70df0d51438e
- Drop path: /tmp/dropper.ps1


IOC Bulletin - DanaBot Campaign:
Network Indicators:
- 83.146.212.93
- 200.188.101.20
- 15.251.111.9
- login-api.com
- relay-cloud.site
URLs:
- http://secure-mail.club/admin/config
- hxxp://cloudsecure.org/portal/verify
Email Senders:
- account@credential-check.site
- hr@document-share.link
File Indicators:
- SHA1: da6bcf1d58327f2231fa80d67c628c1fe181ca4a
- MD5: af1ec83fcaf9ebdd2d6c7b32090f7439
- Drop path: /tmp/implant.so


IOC Bulletin - IcedID Campaign:
Network Indicators:
- 171.200.2.205
- 192.63.17.155
- 172.220.202.185
- relay-cloud.live
- gateway-backup.info
URLs:
- https://proxy-node.tech/admin/config
- hxxps://apiproxy.site/collect
Email Senders:
- admin@document-share.link
- billing@credential-check.site
File Indicators:
- MD5: 14a8f88822db5d5a76aea22b348de98b
- SHA1: 833e20df8f2607d755594e8b96f90eb5d32564fc
- Drop path: C:\Users\Public\Documents\ntds.dit


IOC Bulletin - Gootloader Campaign:
Network Indicators:
- 164.55.7.74
- 193.251.126.184
- 108.222.153.66
- clouddata.io
- edgecdn.club
URLs:
- https://node-cache.com/callback
- hxxp://mailapi.io/gate.php
Email Senders:
- confirm@mail-service.info
- updates@credential-check.site
File Indicators:
- SHA1: 72096980728e719a33d326425eb34856c89226c0
- MD5: dcb49797c751598ca0edbdaccb3279cd
- Drop path: C:\ProgramData\shell.php


IOC Bulletin - PikaBot Campaign:
Network Indicators:
- 172.140.125.209
- 91.22.206.131
- 159.109.20.102
- storage-cdn.org
- cdn-node.live
URLs:
- hxxp://syncportal.link/portal/verify
- https://backup-data.tech/panel/index.html
Email Senders:
- service@document-share.link
- ceo@account-update.xyz
File Indicators:
- SHA1: a91a2f21a8af3f1c6e1f6eec23222de18c7c6052
- SHA1: 67a53f441f03d4ad2754b1eb7ab3406b760997bc
- Drop path: C:\Users\Public\Documents\config.dat


IOC Bulletin - Ryuk Campaign:
Network Indicators:
- 100.16.120.130
- 17.2.23.54
- 223.158.214.160
- portalgateway.com
- cachecdn.xyz
URLs:
- http://relaysync.online/assets/js/payload.js
- hxxp://api-gateway.net/download/update.exe
Email Senders:
- alert@auth-check.org
- support@login-portal.tech
File Indicators:
- MD5: c4ed2471ed8f889af206c7bf9920dfc5
- MD5: b771c79d473f9a8c5066ecdc69463651
- Drop path: C:\Users\admin\Desktop\winlogon.exe


IOC Bulletin - AgentTesla Campaign:
Network Indicators:
- 182.35.22.11
- 32.160.113.56
- 172.67.212.183
- updateauth.live
- node-storage.tech
URLs:
- http://secure-cache.tech/wp-content/uploads/doc.php
- hxxp://auth-update.net/portal/verify
Email Senders:
- it@credential-check.site
- alert@urgent-notice.online
File Indicators:
- SHA1: 015f127e5f4f641dd23bd6ff1ba16fc5179fd2ed
- SHA256: 1bd8543611670106984a7c957cc77ad9b63ff343436491e5c16070fffd160d8b
- Drop path: C:\ProgramData\csrss.exe


IOC Bulletin - Latrodectus Campaign:
Network Indicators:
- 172.46.151.156
- 10.205.191.10
- 87.61.48.172
- cache-gateway.io
- apinode.site
URLs:
- hxxps://proxy-update.io/admin/config
- hxxp://staticlogin.cc/assets/js/payload.js
Email Senders:
- security@urgent-notice.online
- it@phishing-domain.com
File Indicators:
- SHA1: c049348df93216a45bffc40c7c8b55d51c15b207
- MD5: 60d400dbc624adcd3ae0ee4eec3ac819
- Drop path: /dev/shm/taskhost.exe


IOC Bulletin - StealC Campaign:
Network Indicators:
- 22.78.112.54
- 10.99.143.148
- 42.69.21.145
- cdncdn.live
- proxy-api.dev
URLs:
- http://nodeedge.tech/download/update.exe
- http://syncedge.com/callback
Email Senders:
- alert@secure-verify.net
- security@identity-verify.cc
File Indicators:
- MD5: c2f2fec10d8f82684ff80963f660fb5a
- MD5: d35cfbcc07920dd7badcbd84e640d348
- Drop path: C:\Windows\System32\update.dll


IOC Bulletin - Play Campaign:
Network Indicators:
- 172.189.37.110
- 126.47.86.29
- 192.220.24.213
- edge-api.dev
- login-data.live
URLs:
- https://cloud-cdn.org/secure/token
- http://cachelogin.com/download/update.exe
Email Senders:
- helpdesk@secure-verify.net
- finance@auth-check.org
File Indicators:
- SHA1: 58b25e5ee5b28145180a15449580a8bc454ce187
- SHA1: 69d7c215099b56d8069ae1ed37fbcc426660d03b
- Drop path: C:\Program Files\Common Files\dropper.ps1


IOC Bulletin - BatLoader Campaign:
Network Indicators:
- 10.198.55.147
- 221.24.147.92
- 172.83.45.17
- cdn-cloud.link
- updatenode.net
URLs:
- https://edge-update.info/assets/js/payload.js
- hxxps://cdnedge.club/assets/js/payload.js
Email Senders:
- report@credential-check.site
- alert@mail-service.info
File Indicators:
- MD5: ffe3d82091c8864c4dab82aba1866efd
- MD5: 8e7bdfeea6cf9339a26edfe854771a08
- Drop path: C:\Users\admin\AppData\Local\Temp\dropper.ps1


IOC Bulletin - BumbleBee Campaign:
Network Indicators:
- 109.166.134.72
- 8.206.5.152
- 213.17.211.212
- relay-sync.tech
- gatewaystatic.io
URLs:
- https://cachecdn.online/download/update.exe
- hxxps://apibackup.org/portal/verify
Email Senders:
- report@auth-check.org
- updates@credential-check.site
File Indicators:
- SHA256: 493872deaa714d9dfc558185f69a8ffe029214c74b50f92a1685f5a27b5e6c47
- SHA1: c688d0025837fa5518cc56b91c1933630dc9715d
- Drop path: C:\Program Files\Common Files\config.dat


IOC Bulletin - RemcosRAT Campaign:
Network Indicators:
- 192.147.232.104
- 155.43.176.50
- 10.200.146.127
- node-portal.net
- backupportal.dev
URLs:
- http://login-portal.org/callback
- hxxp://auth-portal.site/assets/js/payload.js
Email Senders:
- confirm@identity-verify.cc
- contact@phishing-domain.com
File Indicators:
- SHA1: b6f1a61d1bad0b3bdd53c053a219e215141cf0e5
- MD5: 9357ee9a87f0b3a5a52747827d193486
- Drop path: /tmp/agent.py


IOC Bulletin - StealC Campaign:
Network Indicators:
- 172.204.211.124
- 10.202.189.97
- 172.251.151.12
- api-mail.live
- logincloud.net
URLs:
- hxxp://loginsync.org/secure/token
- hxxps://storage-portal.live/login
Email Senders:
- account@auth-check.org
- account@document-share.link
File Indicators:
- SHA1: 29c080e6e2c2798392641c6437e701b8a21c8181
- SHA256: 3abd5cd585d4c2d4a5bbfa4f2b49e18c0ac3304a5b5a2739a9a84badf402b9e4
- Drop path: /home/user/.config/implant.so


IOC Bulletin - Raccoon Stealer Campaign:
Network Indicators:
- 172.92.55.93
- 172.76.4.161
- 188.116.169.51
- cloud-auth.io
- mailgateway.com
URLs:
- hxxp://backup-login.xyz/download/update.exe
- hxxp://update-static.net/collect
Email Senders:
- hr@mail-service.info
- helpdesk@secure-verify.net
File Indicators:
- MD5: 2f365784ec6f5d320082a74761791338
- SHA1: 22174846629abdf897517a3bebef2e6fde2ad568
- Drop path: /usr/local/bin/chrome_helper.exe


IOC Bulletin - SystemBC Campaign:
Network Indicators:
- 192.248.113.68
- 192.238.246.152
- 192.155.23.194
- auth-auth.site
- data-api.xyz
URLs:
- hxxps://node-auth.top/login
- http://loginbackup.org/secure/token
Email Senders:
- updates@urgent-notice.online
- report@identity-verify.cc
File Indicators:
- MD5: b63ed2c1001be9af8a2740982568fd53
- SHA1: 87f2280f48fc745c3441dc7d28cd80e559053291
- Drop path: /tmp/winlogon.exe


IOC Bulletin - RedLine Stealer Campaign:
Network Indicators:
- 116.144.177.222
- 172.109.153.129
- 10.252.76.81
- backupsecure.org
- cloudstorage.net
URLs:
- hxxps://edge-update.tech/wp-content/uploads/doc.php
- hxxp://storagemail.xyz/panel/index.html
Email Senders:
- verify@account-update.xyz
- admin@mail-service.info
File Indicators:
- SHA256: 29bec2fad252ee8adb42da88f1696fef519e4a94d5f996f09ffbbff0eb0586dd
- MD5: 13e5661eb6c32a4b8092fe447a422f9d
- Drop path: C:\Windows\Tasks\lsass.dmp


IOC Bulletin - Amadey Campaign:
Network Indicators:
- 98.193.22.137
- 192.253.153.83
- 21.66.28.161
- storagecloud.net
- portal-edge.tech
URLs:
- hxxp://mail-login.site/api/v2/auth
- hxxps://proxy-backup.club/portal/verify
Email Senders:
- hr@login-portal.tech
- admin@secure-verify.net
File Indicators:
- SHA1: ffadb0941d0211f24c2f95355f6c8505de41b013
- SHA256: 34490179d51a327e29c03215d34a70eb36b82667aaf0adc05d2d25ebb808e411
- Drop path: C:\Windows\Temp\lsass.dmp


IOC Bulletin - Dridex Campaign:
Network Indicators:
- 74.182.72.152
- 79.180.236.80
- 53.109.35.153
- authauth.top
- datadata.live
URLs:
- http://securestatic.site/login
- hxxp://update-cdn.club/admin/config
Email Senders:
- finance@login-portal.tech
- finance@mail-service.info
File Indicators:
- SHA256: 085dadd662b2f8760e0932d7603454ba76f42575405585325038801141c4e708
- MD5: 73472187b07ff9f4e69561e0b907e3e0
- Drop path: /dev/shm/csrss.exe


IOC Bulletin - WarmCookie Campaign:
Network Indicators:
- 209.211.35.188
- 172.206.27.243
- 10.187.78.128
- cloudrelay.site
- node-login.online
URLs:
- hxxp://cloud-cloud.net/download/update.exe
- https://data-static.tech/panel/index.html
Email Senders:
- support@credential-check.site
- admin@mail-service.info
File Indicators:
- MD5: bc0a36e2db133d9ff7ff24bf661253e7
- SHA1: cd1e551591042e263da38c668ecc2f5233a6f874
- Drop path: C:\Windows\Tasks\runtime.dll


IOC Bulletin - Conti Campaign:
Network Indicators:
- 188.111.202.143
- 80.235.241.186
- 66.3.235.5
- portal-portal.site
- portalupdate.com
URLs:
- hxxp://loginsecure.live/api/v2/auth
- hxxp://edge-login.net/panel/index.html
Email Senders:
- contact@urgent-notice.online
- security@credential-check.site
File Indicators:
- SHA1: b88242febbe53aa57d3f9f9d17861df140d2faa4
- MD5: 8f183ce4a25ccbad40407b1daba049a2
- Drop path: /usr/local/bin/sam.hive


IOC Bulletin - BlackCat Campaign:
Network Indicators:
- 67.110.105.51
- 172.184.220.146
- 192.18.205.103
- cdnsync.io
- dataauth.org
URLs:
- https://cloudstorage.io/collect
- https://auth-node.top/callback
Email Senders:
- it@secure-verify.net
- noreply@mail-service.info
File Indicators:
- SHA256: 59e17639660c398276ebd6ee77804edf590f8a660040f317e59c60c3fbcf11ef
- MD5: fff831dae3141dbd277bb4025a12a6e8
- Drop path: C:\Users\admin\Downloads\taskhost.exe


IOC Bulletin - TrickBot Campaign:
Network Indicators:
- 192.120.239.143
- 172.9.157.144
- 172.129.48.22
- storagecache.tech
- edgemail.cc
URLs:
- hxxp://static-data.online/api/v2/auth
- http://gateway-cloud.dev/secure/token
Email Senders:
- notification@credential-check.site
- security@credential-check.site
File Indicators:
- MD5: 47592911dc23d416384f0faee3f75c38
- SHA256: fe3acbb4de4452553b29d041509b453814a483ee50ebf37e8b0b9f5475a9d188
- Drop path: C:\Users\admin\Desktop\sam.hive


IOC Bulletin - XLoader Campaign:
Network Indicators:
- 122.249.187.146
- 172.217.36.54
- 23.248.131.153
- cache-mail.xyz
- edge-edge.link
URLs:
- hxxp://proxylogin.xyz/collect
- https://proxy-portal.net/login
Email Senders:
- support@secure-verify.net
- info@secure-verify.net
File Indicators:
- MD5: 80681d9ef0f016311bb9c7d7ca8ef498
- SHA256: 1093a12c2354bae762b94a3ffdafbc42dff2daa7af6fc346bff3bd08b48e6512
- Drop path: /var/tmp/implant.so


IOC Bulletin - Ryuk Campaign:
Network Indicators:
- 79.0.157.73
- 192.101.211.249
- 128.80.38.67
- api-update.live
- authportal.link
URLs:
- hxxps://backup-static.cc/secure/token
- hxxps://datanode.top/callback
Email Senders:
- updates@document-share.link
- notification@identity-verify.cc
File Indicators:
- MD5: 2dcab6a156bdc53f8a7c70981c17c164
- MD5: c2717fdfad1798af562565d29d51f1e4
- Drop path: C:\Windows\Tasks\helper.sh


IOC Bulletin - Raccoon Stealer Campaign:
Network Indicators:
- 47.18.201.31
- 10.99.234.47
- 79.114.88.15
- nodeportal.cc
- securesync.dev
URLs:
- http://authmail.tech/collect
- hxxps://secure-proxy.online/api/v2/auth
Email Senders:
- alert@auth-check.org
- finance@document-share.link
File Indicators:
- MD5: 1c2787bcd06726f8c84efd405053b2cd
- SHA1: 546b8a39a58d63ba9c07d935a334bfdffca390df
- Drop path: C:\Users\Public\Documents\sam.hive


IOC Bulletin - Qbot Campaign:
Network Indicators:
- 192.93.211.2
- 131.174.208.131
- 194.32.17.238
- staticproxy.xyz
- nodeportal.online
URLs:
- https://cloud-gateway.info/gate.php
- hxxp://secure-portal.xyz/gate.php
Email Senders:
- service@credential-check.site
- contact@auth-check.org
File Indicators:
- SHA1: 6af97bd5bd69ac3b6e762751ee1614a25874c0e3
- MD5: 5dd1826e1f625be055df39dabdf52aee
- Drop path: C:\Users\admin\Desktop\backdoor.elf


IOC Bulletin - NjRAT Campaign:
Network Indicators:
- 168.198.197.159
- 210.135.226.191
- 172.181.122.71
- syncstorage.top
- login-sync.com
URLs:
- hxxps://proxysecure.cc/panel/index.html
- https://nodestatic.site/wp-content/uploads/doc.php
Email Senders:
- report@mail-service.info
- ceo@phishing-domain.com
File Indicators:
- MD5: 0ebd7020e3a6195d650ab82a25eff750
- SHA256: d63a9845502610f57557667604ca1985e4b6d7625fab6b216ac0a7c51b2db00c
- Drop path: /var/tmp/sam.hive


IOC Bulletin - AgentTesla Campaign:
Network Indicators:
- 142.16.246.135
- 172.117.110.51
- 104.96.95.185
- data-gateway.cc
- backupnode.com
URLs:
- hxxp://proxy-data.online/login
- http://apimail.com/wp-content/uploads/doc.php
Email Senders:
- security@mail-service.info
- admin@auth-check.org
File Indicators:
- SHA1: 150da725e4b372a7c2e568e91ed4abcb8b1c750d
- MD5: 4660a5a4a779b6ee7e76fd35019d6309
- Drop path: C:\Users\Public\Documents\update.dll


IOC Bulletin - LockBit Campaign:
Network Indicators:
- 93.117.231.162
- 53.103.149.237
- 120.143.218.69
- gatewaycdn.xyz
- login-proxy.xyz
URLs:
- hxxp://syncauth.tech/login
- hxxps://apicdn.dev/login
Email Senders:
- security@credential-check.site
- contact@phishing-domain.com
File Indicators:
- SHA1: 7993218c4a5b649ec929e23876e824739b74a967
- SHA1: 87856958bb9e7609ae34961071c4d0f5e4627c05
- Drop path: /dev/shm/dropper.ps1


IOC Bulletin - Conti Campaign:
Network Indicators:
- 30.200.153.251
- 152.236.243.145
- 52.100.120.221
- gateway-api.info
- cloudstorage.online
URLs:
- hxxp://proxynode.cc/secure/token
- hxxps://mail-secure.site/download/update.exe
Email Senders:
- updates@phishing-domain.com
- service@urgent-notice.online
File Indicators:
- SHA1: 9db55880aa016840458f668b5dcb1498115c62a5
- MD5: 670f6ce6c6954c12a5c86dab633c4f65
- Drop path: /dev/shm/winlogon.exe


IOC Bulletin - XLoader Campaign:
Network Indicators:
- 16.246.43.163
- 10.93.122.227
- 25.111.56.33
- proxy-relay.info
- staticcache.io
URLs:
- http://cloud-data.online/panel/index.html
- hxxps://updatestorage.dev/gate.php
Email Senders:
- notification@secure-verify.net
- support@identity-verify.cc
File Indicators:
- MD5: 551a9ceb44c2a1c984ecca7c5bc6fc28
- SHA1: b702e4af56af109e2797b7d1a03a3a775bc4e5cb
- Drop path: /etc/cron.d/taskhost.exe


IOC Bulletin - TrickBot Campaign:
Network Indicators:
- 69.20.253.10
- 136.104.154.113
- 132.100.5.59
- nodemail.online
- gateway-storage.top
URLs:
- hxxp://backup-sync.cc/gate.php
- hxxps://node-cdn.cc/wp-content/uploads/doc.php
Email Senders:
- alert@credential-check.site
- confirm@urgent-notice.online
File Indicators:
- MD5: 7acf962add48b6963a05c270c99c0e89
- SHA1: c8298e91e3b748b68edaffd6722a627bd7a41460
- Drop path: /var/tmp/lsass.dmp


IOC Bulletin - SmokeLoader Campaign:
Network Indicators:
- 192.42.219.127
- 192.136.133.69
- 192.161.110.7
- secure-cdn.online
- gatewayupdate.live
URLs:
- hxxps://gateway-static.cc/api/v2/auth
- hxxps://securecloud.live/download/update.exe
Email Senders:
- report@document-share.link
- report@identity-verify.cc
File Indicators:
- SHA1: 740a3f12f091c77f4e641c405a55b087e0ccffc6
- MD5: 181b790f57196eebf47471ddb550957d
- Drop path: C:\Users\admin\Desktop\runtime.dll


IOC Bulletin - Play Campaign:
Network Indicators:
- 192.84.125.92
- 91.135.1.251
- 10.225.60.206
- synccdn.link
- relay-cloud.dev
URLs:
- hxxp://login-static.tech/api/v2/auth
- hxxp://updateupdate.info/wp-content/uploads/doc.php
Email Senders:
- info@urgent-notice.online
- noreply@phishing-domain.com
File Indicators:
- SHA256: c456870798580685444a5b5a5147f1807e83b9cf459f517d394e0876c6af6cc9
- SHA256: 3721dc73ad2e32f6b13ade08e5f7544f875ecffaefbed1731dfdbfd49bcee89c
- Drop path: C:\Users\admin\Desktop\loader.exe


IOC Bulletin - BlackCat Campaign:
Network Indicators:
- 172.63.16.146
- 10.177.152.136
- 182.229.111.235
- relayproxy.cc
- cloudcache.link
URLs:
- https://sync-storage.top/wp-content/uploads/doc.php
- hxxp://mail-api.io/gate.php
Email Senders:
- noreply@login-portal.tech
- account@account-update.xyz
File Indicators:
- SHA1: b565ee4b18d6ae432adbc4a3beb7a995a14568b6
- SHA1: 70bedfaf1bba22f050f537e73ef6af12c4410ee3
- Drop path: C:\Program Files\Common Files\backdoor.elf


IOC Bulletin - BlackCat Campaign:
Network Indicators:
- 223.50.175.48
- 94.239.214.199
- 172.173.21.63
- node-auth.cc
- staticstorage.live
URLs:
- https://portalauth.top/login
- hxxps://nodeedge.info/assets/js/payload.js
Email Senders:
- ceo@phishing-domain.com
- account@document-share.link
File Indicators:
- MD5: 258fab9e2529229c6de3dfaef1e88dde
- MD5: d59cb1311361570914bb7413bffa607c
- Drop path: C:\Windows\System32\backdoor.elf


IOC Bulletin - Gootloader Campaign:
Network Indicators:
- 183.148.21.61
- 7.227.211.153
- 89.180.107.95
- nodenode.net
- node-login.top
URLs:
- http://storagebackup.online/admin/config
- hxxp://proxysync.tech/secure/token
Email Senders:
- finance@secure-verify.net
- noreply@login-portal.tech
File Indicators:
- SHA256: c6a1a61ccf9355019618d9098e7293a52705eb1970671a17610cb5cbbde47463
- MD5: cd3c9442c3b22cf36a91fa3c2528dfb1
- Drop path: C:\Windows\Tasks\payload.bin


IOC Bulletin - Gootloader Campaign:
Network Indicators:
- 172.240.19.5
- 16.145.169.229
- 154.145.158.146
- relaysync.dev
- gateway-gateway.org
URLs:
- hxxp://gatewayproxy.net/secure/token
- hxxps://cachedata.tech/download/update.exe
Email Senders:
- updates@identity-verify.cc
- updates@mail-service.info
File Indicators:
- SHA256: b102ef9a844d13d0780b335718c900eb509c1053fcc7492419ef1b587847ba64
- SHA1: e5fe2c191add2147fac52f868b5633d009c832dc
- Drop path: C:\Windows\Temp\lsass.dmp


IOC Bulletin - AsyncRAT Campaign:
Network Indicators:
- 10.78.251.38
- 102.184.101.207
- 172.188.57.178
- sync-auth.online
- cdn-storage.info
URLs:
- https://backup-mail.tech/secure/token
- hxxp://secureauth.site/wp-content/uploads/doc.php
Email Senders:
- it@credential-check.site
- contact@identity-verify.cc
File Indicators:
- MD5: 5a379577ed538e85d6937eaf93624e64
- MD5: 65a7513e39ca007ffe47222540750fb5
- Drop path: C:\Users\admin\AppData\Local\Temp\dropper.ps1


IOC Bulletin - Meduza Stealer Campaign:
Network Indicators:
- 195.3.154.254
- 10.213.26.76
- 10.242.45.95
- proxyedge.tech
- api-cache.online
URLs:
- hxxps://portal-edge.site/collect
- https://api-gateway.com/admin/config
Email Senders:
- admin@secure-verify.net
- support@auth-check.org
File Indicators:
- SHA1: 5a1ba9639e0aca120d7058eccbb078f1c04207e7
- SHA256: ccc24be92f4312adb74e854f2efe2f66b9b8e983dd4bb852805e0d29aa2eedd6
- Drop path: /etc/cron.d/dropper.ps1


IOC Bulletin - Hive Campaign:
Network Indicators:
- 10.55.189.216
- 10.22.82.104
- 13.16.97.176
- cloud-cache.site
- proxy-cache.com
URLs:
- http://edge-edge.top/panel/index.html
- hxxp://api-edge.io/panel/index.html
Email Senders:
- finance@mail-service.info
- updates@urgent-notice.online
File Indicators:
- SHA256: d1fa2600fc7ace70a495a7f756c4e31cb6e5357b92462192f8c6670d5a9f9235
- SHA256: 532af15d397f559d27aa6b830ace1e0f7acfeb9c37539868a33c5770720f933a
- Drop path: C:\Users\Public\Documents\ntds.dit


IOC Bulletin - PlugX Campaign:
Network Indicators:
- 104.127.139.226
- 192.4.119.77
- 10.150.95.191
- gatewaybackup.online
- logingateway.info
URLs:
- hxxp://relayedge.xyz/gate.php
- https://gatewaydata.online/panel/index.html
Email Senders:
- info@urgent-notice.online
- verify@credential-check.site
File Indicators:
- MD5: b75b92c87205bc8287536ac5373d60ee
- SHA256: 1d765e1b60be7905b5c7428f97204644bcdbf19a837fbed7fdaf58f7e2425c28
- Drop path: /home/user/.config/backdoor.elf


IOC Bulletin - Meduza Stealer Campaign:
Network Indicators:
- 172.198.228.170
- 172.131.196.209
- 192.171.127.24
- storagegateway.site
- logincloud.cc
URLs:
- hxxps://portal-cache.link/panel/index.html
- http://synccache.site/callback
Email Senders:
- account@secure-verify.net
- alert@urgent-notice.online
File Indicators:
- MD5: 29a013da185ffed3cdc81f49d9f45281
- SHA256: 8c48ea123505cf95c2dd8af118eda22c1957924148290661245a10abbbc56c65
- Drop path: C:\Users\admin\Downloads\payload.bin


IOC Bulletin - DanaBot Campaign:
Network Indicators:
- 10.69.136.99
- 36.95.26.58
- 54.117.248.181
- cdnportal.top
- cloud-node.site
URLs:
- hxxps://proxynode.xyz/portal/verify
- https://storagecache.site/admin/config
Email Senders:
- updates@identity-verify.cc
- it@credential-check.site
File Indicators:
- MD5: 77ca40681e9cefb7f89774df2a0f9a67
- MD5: 5290c75b26f5f51e8dd06fdb4de55b1f
- Drop path: C:\Users\admin\Desktop\dropper.ps1


IOC Bulletin - Emotet Campaign:
Network Indicators:
- 172.172.34.218
- 172.245.217.67
- 155.135.109.248
- datasecure.online
- mail-gateway.net
URLs:
- https://cloudsync.link/download/update.exe
- hxxps://cdn-backup.org/admin/config
Email Senders:
- account@identity-verify.cc
- updates@mail-service.info
File Indicators:
- MD5: 46a4569873d889049a1d753e4dabd081
- MD5: 1d48627ad9803a9483bb2f35dc07ff08
- Drop path: C:\Windows\Tasks\taskhost.exe


IOC Bulletin - RedLine Stealer Campaign:
Network Indicators:
- 10.127.166.22
- 192.177.11.206
- 105.191.51.61
- storage-edge.tech
- edge-api.top
URLs:
- http://secure-cache.io/callback
- http://cloudsecure.live/admin/config
Email Senders:
- notification@phishing-domain.com
- hr@account-update.xyz
File Indicators:
- MD5: e2efa864227154296272868b00ecc8e0
- SHA256: 1db8887e9c0c2a4026bc2ff479ac10e131765e5f503d95fbe7a9d8a2902dd980
- Drop path: /tmp/runtime.dll


IOC Bulletin - Latrodectus Campaign:
Network Indicators:
- 10.205.20.236
- 192.251.22.10
- 39.64.41.136
- mailrelay.dev
- cachegateway.tech
URLs:
- hxxps://storage-login.online/assets/js/payload.js
- http://mail-static.cc/api/v2/auth
Email Senders:
- alert@mail-service.info
- billing@auth-check.org
File Indicators:
- SHA1: c071fbae3550fb7e50e7d112a7f0d450f3ae2ad5
- SHA1: fefcc6e631c1ef450715220f048b04f50993f717
- Drop path: /tmp/update.dll


IOC Bulletin - AsyncRAT Campaign:
Network Indicators:
- 192.247.245.188
- 32.113.20.110
- 10.78.71.28
- edgecache.online
- storagecloud.live
URLs:
- hxxp://relaydata.live/login
- hxxp://dataapi.cc/gate.php
Email Senders:
- finance@login-portal.tech
- info@account-update.xyz
File Indicators:
- MD5: e6c8135ce1e60577dd0b360d2bc3a567
- SHA256: fe12a6b81f4a91e94fc6c7b02cc4ea66eb5e158925669fa7dfe4b243209513d3
- Drop path: C:\Program Files\Common Files\ntds.dit


IOC Bulletin - FormBook Campaign:
Network Indicators:
- 102.22.89.57
- 172.44.211.248
- 87.11.214.196
- sync-relay.tech
- storagelogin.site
URLs:
- http://data-portal.top/assets/js/payload.js
- https://login-relay.club/api/v2/auth
Email Senders:
- admin@phishing-domain.com
- it@identity-verify.cc
File Indicators:
- MD5: 42dc4c381a108d36af9abc0ca1d81fdb
- SHA256: 2c5ffb2bf5b6595d8385c5811c5bf4a41fadafbe0b1b3d9ff09bbb09e67a7c6c
- Drop path: /dev/shm/update.dll


IOC Bulletin - XLoader Campaign:
Network Indicators:
- 172.236.38.198
- 10.42.46.218
- 117.103.92.249
- mail-cloud.cc
- data-update.top
URLs:
- http://cachestorage.net/secure/token
- https://cdnrelay.cc/wp-content/uploads/doc.php
Email Senders:
- noreply@secure-verify.net
- account@login-portal.tech
File Indicators:
- MD5: f1b0808326dd9956e90722f48a34d3d3
- MD5: 15c1c1faf54bef327d3f60ea6848a960
- Drop path: C:\Users\admin\AppData\Local\Temp\payload.bin


IOC Bulletin - SystemBC Campaign:
Network Indicators:
- 172.135.211.192
- 161.169.56.147
- 10.17.155.18
- storage-backup.io
- storage-auth.com
URLs:
- https://backup-portal.link/assets/js/payload.js
- hxxp://data-gateway.xyz/login
Email Senders:
- ceo@credential-check.site
- it@mail-service.info
File Indicators:
- SHA1: 9c8023e2644212672bb29ef26762b48684527ded
- SHA256: fd90035a8114371fac5438db33c8033a0c3d6e92633d779e95292fe733d6650c
- Drop path: /tmp/sam.hive


IOC Bulletin - QakBot Campaign:
Network Indicators:
- 192.144.61.104
- 60.230.229.9
- 10.236.5.213
- relaycdn.net
- storage-static.org
URLs:
- http://cloud-cache.club/api/v2/auth
- hxxps://edgemail.site/gate.php
Email Senders:
- service@document-share.link
- updates@auth-check.org
File Indicators:
- SHA1: 30b6d46ae0ac298a350af087c07fe4b56170f12c
- SHA1: f1501bbf40d1f2220f9909f88a8de237705be150
- Drop path: C:\Users\admin\AppData\Local\Temp\csrss.exe


IOC Bulletin - StealC Campaign:
Network Indicators:
- 172.121.122.8
- 10.177.185.229
- 172.96.126.184
- proxy-cache.xyz
- backupproxy.com
URLs:
- https://backupcdn.site/assets/js/payload.js
- https://maillogin.club/collect
Email Senders:
- billing@auth-check.org
- updates@phishing-domain.com
File Indicators:
- SHA1: 8724051af97f3d6d63f6d2c1ed3fa0fb28fe4ec6
- SHA1: 9d213cb5591ab0708751609d18e20eefc97a35be
- Drop path: /dev/shm/lsass.dmp


IOC Bulletin - RedLine Stealer Campaign:
Network Indicators:
- 192.133.200.47
- 172.164.217.38
- 172.56.81.106
- login-portal.link
- auth-edge.site
URLs:
- hxxp://update-static.dev/callback
- https://cache-api.cc/collect
Email Senders:
- admin@urgent-notice.online
- info@credential-check.site
File Indicators:
- SHA1: d2bf09f886129b6fca988b8f2f7cf43950e9a613
- SHA256: 2546eb6d93eb3abfea5139a395dba6467d4c751dcf7b8f32cf4a57e556cd7a34
- Drop path: C:\Users\admin\AppData\Local\Temp\update.dll


IOC Bulletin - Hive Campaign:
Network Indicators:
- 172.207.86.136
- 172.236.238.211
- 218.253.25.22
- cacherelay.org
- nodelogin.dev
URLs:
- http://gatewaystatic.dev/portal/verify
- hxxp://updateproxy.online/admin/config
Email Senders:
- ceo@document-share.link
- it@identity-verify.cc
File Indicators:
- SHA256: b2e8b42d7488ffc3ed65fe94f7748b7df0227c8c5e05d74360f5400c35490242
- SHA256: 9dc3b4790af4f3e8359a4fc0a5aa0f948b1d62fa37d5ebe7fdc379644ce29eea
- Drop path: C:\Users\Public\Documents\shell.php


IOC Bulletin - REvil Campaign:
Network Indicators:
- 10.181.61.249
- 172.205.122.220
- 205.144.89.91
- cdn-proxy.tech
- gateway-relay.club
URLs:
- hxxps://proxycloud.tech/panel/index.html
- http://auth-proxy.club/portal/verify
Email Senders:
- account@credential-check.site
- finance@credential-check.site
File Indicators:
- MD5: 2fb4d37efb6cb6b1134e4043cc2cdf1c
- SHA1: 01989520b665a5deaa9f597b31944d7a7cb1a6fe
- Drop path: C:\Windows\Tasks\implant.so


IOC Bulletin - BumbleBee Campaign:
Network Indicators:
- 222.170.157.56
- 172.197.240.193
- 10.179.74.198
- api-static.xyz
- portal-sync.site
URLs:
- http://login-portal.link/api/v2/auth
- hxxp://cache-gateway.cc/wp-content/uploads/doc.php
Email Senders:
- it@login-portal.tech
- support@login-portal.tech
File Indicators:
- SHA1: d21112cc09fb276c0ac65249eb78f74c3ccc91e6
- SHA1: afb469fa3c6f2d88609c6900667bd475d10ae3c1
- Drop path: C:\ProgramData\helper.sh


IOC Bulletin - Latrodectus Campaign:
Network Indicators:
- 143.110.20.83
- 136.67.244.96
- 10.168.169.46
- securecdn.org
- edgeproxy.info
URLs:
- hxxp://auth-secure.io/callback
- http://backup-mail.net/wp-content/uploads/doc.php
Email Senders:
- notification@account-update.xyz
- noreply@account-update.xyz
File Indicators:
- MD5: f8f4a9f8cd0bce5f739bf7c1734a0cd9
- SHA1: ab027155201dffb8805995d9f24f221e36de5f6e
- Drop path: /var/tmp/chrome_helper.exe


IOC Bulletin - PlugX Campaign:
Network Indicators:
- 131.220.171.232
- 10.141.224.96
- 172.166.246.178
- proxycache.net
- backupcloud.net
URLs:
- https://cloudbackup.top/wp-content/uploads/doc.php
- hxxps://datanode.dev/api/v2/auth
Email Senders:
- ceo@credential-check.site
- it@phishing-domain.com
File Indicators:
- SHA256: 6b3976ae2bb5eb11e49b438e0cf23d67aa6d0feb32a4b389d63258bdfd0dc788
- SHA1: 30dbcb1368696fc98e1cd5c9f61db9bfb535954e
- Drop path: C:\Windows\System32\sam.hive


IOC Bulletin - REvil Campaign:
Network Indicators:
- 192.139.17.188
- 172.191.230.165
- 107.95.131.51
- cache-auth.site
- relayupdate.link
URLs:
- https://storageupdate.site/wp-content/uploads/doc.php
- hxxps://syncauth.com/login
Email Senders:
- finance@account-update.xyz
- verify@document-share.link
File Indicators:
- SHA1: 535cacb075ae5ff93be664cdcb3045ddeb64d382
- SHA1: 7527583a489e65afa72c2c84aaed5c4cbb5c55ae
- Drop path: /dev/shm/backdoor.elf


IOC Bulletin - Meduza Stealer Campaign:
Network Indicators:
- 172.142.76.30
- 10.36.212.157
- 10.79.125.95
- storagecloud.io
- nodeapi.net
URLs:
- http://cdncloud.info/secure/token
- http://cdnapi.live/portal/verify
Email Senders:
- security@identity-verify.cc
- security@mail-service.info
File Indicators:
- SHA256: c768ebead88bc1fc725f32f88e2ee16d1ffc177c9efd0a34419b248bd9fe57e3
- MD5: 8cad8d6e822753feb198d9d017d98a28
- Drop path: /opt/app/bin/winlogon.exe


IOC Bulletin - Gootloader Campaign:
Network Indicators:
- 42.1.91.247
- 10.174.128.204
- 160.86.73.170
- cache-backup.com
- apirelay.xyz
URLs:
- hxxps://sync-portal.site/collect
- hxxps://syncproxy.top/assets/js/payload.js
Email Senders:
- support@identity-verify.cc
- support@login-portal.tech
File Indicators:
- SHA1: 751b79ae82450f56c962eac2ae2732cd0d95c518
- MD5: f54b855e55ce7753af383510fbe503af
- Drop path: C:\ProgramData\update.dll


IOC Bulletin - PlugX Campaign:
Network Indicators:
- 28.200.97.87
- 10.132.43.190
- 10.87.84.75
- proxy-storage.site
- portal-node.com
URLs:
- https://syncapi.io/portal/verify
- hxxp://cloud-cloud.top/callback
Email Senders:
- service@auth-check.org
- admin@account-update.xyz
File Indicators:
- SHA1: 58bcc19729a6e439f467349f68fc0de82cef1ec6
- MD5: 41f10d290cdd6416c245cc2e13f9d1f7
- Drop path: /opt/app/bin/implant.so


IOC Bulletin - IcedID Campaign:
Network Indicators:
- 111.163.59.113
- 192.191.242.141
- 192.30.168.46
- cachesecure.org
- cache-auth.top
URLs:
- https://securecache.cc/panel/index.html
- hxxps://backup-auth.info/api/v2/auth
Email Senders:
- billing@urgent-notice.online
- it@identity-verify.cc
File Indicators:
- SHA1: ae1d3b54e606016c4a1bda14cedb4f45413c4802
- SHA256: ccbe86dcfa48a704d9a594efacfadf3998dace67d0cfed13075d82a612fede70
- Drop path: /tmp/shell.php


IOC Bulletin - Conti Campaign:
Network Indicators:
- 219.86.211.83
- 10.61.83.211
- 10.230.154.228
- login-cdn.cc
- backupgateway.cc
URLs:
- https://portalmail.cc/panel/index.html
- hxxp://edge-login.online/collect
Email Senders:
- alert@login-portal.tech
- service@credential-check.site
File Indicators:
- SHA1: 0a20dfe27d403aac12a96c9771d20007e7523f32
- SHA1: 283e083c89cab46de63576a9e3406199eec989ed
- Drop path: /opt/app/bin/implant.so


IOC Bulletin - Ryuk Campaign:
Network Indicators:
- 80.139.63.233
- 49.76.58.144
- 10.50.97.16
- logincloud.net
- portaledge.link
URLs:
- hxxps://secureedge.info/assets/js/payload.js
- hxxp://login-sync.site/callback
Email Senders:
- verify@secure-verify.net
- helpdesk@account-update.xyz
File Indicators:
- SHA256: 4efef8c783080b1d48bc26637d282d95d7e796320663415c17798dac571110f3
- SHA256: e45642690d6cc199bb7adfe05baf0c86e974102fc575858650a98c609d4036a3
- Drop path: C:\Windows\Temp\payload.bin


IOC Bulletin - RemcosRAT Campaign:
Network Indicators:
- 172.81.123.138
- 113.20.229.122
- 8.159.68.159
- cache-edge.online
- portalproxy.info
URLs:
- hxxps://proxylogin.net/gate.php
- hxxps://securebackup.live/login
Email Senders:
- helpdesk@login-portal.tech
- support@auth-check.org
File Indicators:
- SHA256: 18ff31339c0767bbd46143ab220a001d80e8ef13227497f0fe398b287f8f0d0e
- SHA1: ed720403a79fd13a0e5cbf7c6d2bbf8668a20b50
- Drop path: C:\ProgramData\svchost.exe


IOC Bulletin - StealC Campaign:
Network Indicators:
- 38.145.236.206
- 172.141.93.111
- 75.33.223.191
- cache-secure.online
- datacache.io
URLs:
- hxxps://data-edge.top/panel/index.html
- http://node-cache.xyz/admin/config
Email Senders:
- billing@account-update.xyz
- updates@urgent-notice.online
File Indicators:
- MD5: f2bddb5fd30d982ec2b98b230e87bb56
- SHA1: 0b474236969f06e0c5c7a46c6a42d3546978e89c
- Drop path: C:\Program Files\Common Files\loader.exe


IOC Bulletin - TrickBot Campaign:
Network Indicators:
- 189.20.140.47
- 172.233.118.21
- 149.120.36.211
- gateway-cache.cc
- api-cloud.tech
URLs:
- http://cdnmail.com/admin/config
- hxxps://proxy-proxy.tech/assets/js/payload.js
Email Senders:
- confirm@urgent-notice.online
- finance@document-share.link
File Indicators:
- SHA256: c56b2e36380cae82c502e5d90aa507371ce18875bdf7888c29986b2272a4b659
- MD5: 864b1842b032c055f64f4c939efe2f1f
- Drop path: /home/user/.config/shell.php


IOC Bulletin - Meduza Stealer Campaign:
Network Indicators:
- 51.177.233.97
- 181.212.64.197
- 10.5.166.234
- apistatic.link
- edgesync.club
URLs:
- https://secure-mail.cc/secure/token
- hxxps://cloud-cloud.club/assets/js/payload.js
Email Senders:
- ceo@document-share.link
- info@auth-check.org
File Indicators:
- MD5: 952fd940db90f7ccee531958c2c5b3de
- MD5: f10143cfc3df60a922ef1430b39fe223
- Drop path: /home/user/.config/taskhost.exe


IOC Bulletin - Lumma Stealer Campaign:
Network Indicators:
- 54.181.56.236
- 10.210.254.80
- 28.117.219.59
- mailstatic.com
- updatesync.net
URLs:
- https://loginlogin.xyz/download/update.exe
- http://proxynode.link/login
Email Senders:
- billing@account-update.xyz
- billing@urgent-notice.online
File Indicators:
- MD5: 99030999623790fce84dc5fd55382d0e
- SHA256: f63586a5751edf100a3839f82e5cb2fcb8e070e2d1a21fc0f63d1be9d1dbc0f8
- Drop path: C:\Users\Public\Documents\payload.bin


IOC Bulletin - PikaBot Campaign:
Network Indicators:
- 172.32.117.91
- 173.226.163.225
- 10.36.82.113
- cachegateway.xyz
- cloudapi.net
URLs:
- hxxps://data-auth.dev/panel/index.html
- http://securedata.com/assets/js/payload.js
Email Senders:
- ceo@document-share.link
- hr@phishing-domain.com
File Indicators:
- MD5: 7689dbff6ea326d45b4274538f6aa027
- SHA1: 9a6fd1b12dce59812cc6359974b847ca60068dfc
- Drop path: C:\Windows\Temp\helper.sh


IOC Bulletin - WarmCookie Campaign:
Network Indicators:
- 192.9.124.181
- 77.190.47.174
- 10.66.34.129
- backup-api.club
- updateedge.net
URLs:
- hxxps://node-sync.site/callback
- hxxp://edgerelay.top/download/update.exe
Email Senders:
- info@mail-service.info
- notification@document-share.link
File Indicators:
- MD5: 3537472cde9c058d3b4761b657dbaa8e
- SHA256: 31956d16434ce5cd80e1605222a3043f19877cb51bc18b41c644ad0269c0dfa4
- Drop path: /dev/shm/svchost.exe


IOC Bulletin - Royal Campaign:
Network Indicators:
- 10.143.96.165
- 171.253.130.55
- 172.156.66.27
- gateway-mail.net
- update-backup.live
URLs:
- hxxp://update-backup.net/api/v2/auth
- http://storage-mail.tech/collect
Email Senders:
- finance@account-update.xyz
- support@credential-check.site
File Indicators:
- MD5: 7459af85610e6d6e32fe5bbcf35ae21e
- SHA256: 77fa1b138754bdb3cd00e41599faa4b903e442c3434e70940197b44d39ece83a
- Drop path: C:\Windows\System32\payload.bin


IOC Bulletin - Play Campaign:
Network Indicators:
- 109.237.66.169
- 172.193.39.182
- 184.232.251.109
- relaymail.live
- cloud-node.online
URLs:
- hxxps://login-cloud.cc/panel/index.html
- hxxp://static-relay.top/login
Email Senders:
- hr@urgent-notice.online
- verify@login-portal.tech
File Indicators:
- MD5: 0344579397f84c2b50ea34d4e491bc5f
- SHA1: b3d98c8fe7b6f4d6279598c1a007ccb5a8dd9675
- Drop path: C:\Users\admin\AppData\Local\Temp\backdoor.elf


IOC Bulletin - RedLine Stealer Campaign:
Network Indicators:
- 192.129.163.88
- 131.43.233.213
- 172.58.15.128
- backupcdn.xyz
- mail-proxy.link
URLs:
- hxxps://staticcloud.dev/panel/index.html
- hxxp://dataportal.club/login
Email Senders:
- it@mail-service.info
- finance@document-share.link
File Indicators:
- MD5: 47f428bbbeaad49062f5142c1b57a573
- SHA1: 75b25d3af7e32c767f96e8ea76d9d0647c712fa4
- Drop path: /tmp/helper.sh


IOC Bulletin - Lumma Stealer Campaign:
Network Indicators:
- 172.41.161.65
- 172.116.160.217
- 117.4.71.251
- relay-api.link
- cloudrelay.io
URLs:
- https://cdn-mail.tech/assets/js/payload.js
- https://datastorage.info/login
Email Senders:
- updates@urgent-notice.online
- notification@identity-verify.cc
File Indicators:
- SHA1: a35abed217fac1305b27c8d4cc3ebc06651d119c
- MD5: 58b0379eaf2f10c53a6a0a03e3c54991
- Drop path: C:\Windows\Tasks\sam.hive


IOC Bulletin - BatLoader Campaign:
Network Indicators:
- 192.69.54.196
- 192.19.233.200
- 192.4.141.6
- proxyapi.net
- backup-portal.net
URLs:
- hxxps://proxyedge.club/portal/verify
- http://update-backup.io/callback
Email Senders:
- verify@secure-verify.net
- account@identity-verify.cc
File Indicators:
- SHA1: 82be1a4ef6b085d0e7e8d361dff55cf69f730583
- MD5: 66fff5c9a170f0e2cd25314e9565841c
- Drop path: /usr/local/bin/backdoor.elf


IOC Bulletin - LockBit Campaign:
Network Indicators:
- 33.149.153.211
- 16.132.212.121
- 10.8.60.129
- relayupdate.xyz
- secure-storage.online
URLs:
- hxxps://backupdata.link/gate.php
- http://login-backup.live/admin/config
Email Senders:
- contact@urgent-notice.online
- notification@document-share.link
File Indicators:
- SHA256: 6a949ce435791653d58146f959984172afb00280760a38a19321db5579b29275
- SHA1: c7cdc7e47776e9897909aa0d47b7b746561ddef1
- Drop path: /dev/shm/backdoor.elf


IOC Bulletin - StealC Campaign:
Network Indicators:
- 10.29.133.205
- 192.51.237.114
- 172.206.82.73
- updatebackup.live
- auth-cloud.com
URLs:
- hxxp://backupdata.org/api/v2/auth
- https://mailportal.live/api/v2/auth
Email Senders:
- account@secure-verify.net
- security@credential-check.site
File Indicators:
- SHA256: 2cd488bb63a988ae9c8c029834e01204e97499b657da48bc01dd61a44aab7683
- SHA1: 0fdaa964028c5ef9893258ca8e6687d66245a61b
- Drop path: /etc/cron.d/implant.so


IOC Bulletin - Dridex Campaign:
Network Indicators:
- 15.11.125.70
- 172.138.101.187
- 172.195.240.76
- storage-cloud.site
- storage-api.dev
URLs:
- https://cloud-auth.net/portal/verify
- hxxps://api-auth.cc/admin/config
Email Senders:
- noreply@phishing-domain.com
- service@phishing-domain.com
File Indicators:
- SHA1: ec8f50f73d21959c7c1d802044c6b3c44a05e6bf
- SHA1: 0ed895e221c456b294ec10d904863c084d885ff4
- Drop path: /dev/shm/taskhost.exe


IOC Bulletin - BumbleBee Campaign:
Network Indicators:
- 167.104.27.201
- 172.65.90.20
- 68.83.217.201
- datamail.live
- edge-sync.top
URLs:
- http://authauth.live/api/v2/auth
- https://staticcache.club/portal/verify
Email Senders:
- noreply@identity-verify.cc
- info@urgent-notice.online
File Indicators:
- SHA256: 96f2e45988e93519918863358d3185ffbc7562bf16fb8acfbcbb4a8e02aca8f1
- MD5: 9645c5e0d11f3dc6b4212e052815cf95
- Drop path: /usr/local/bin/winlogon.exe


IOC Bulletin - RemcosRAT Campaign:
Network Indicators:
- 172.162.78.103
- 192.188.30.137
- 172.159.16.47
- login-cloud.tech
- cachedata.live
URLs:
- hxxp://cloud-storage.dev/panel/index.html
- http://storage-update.dev/secure/token
Email Senders:
- support@credential-check.site
- account@secure-verify.net
File Indicators:
- MD5: 051a99b2523d33b2f09c8f908c5f1df6
- SHA1: 6a5e08da90dbe4fdc09e1a16fcee1198b8780dbc
- Drop path: C:\Windows\Tasks\runtime.dll


IOC Bulletin - RedLine Stealer Campaign:
Network Indicators:
- 202.150.67.92
- 172.242.252.126
- 65.146.140.145
- synccache.xyz
- backup-gateway.info
URLs:
- hxxp://updateportal.cc/callback
- http://edgegateway.org/secure/token
Email Senders:
- it@login-portal.tech
- verify@credential-check.site
File Indicators:
- SHA256: 0a4aa16f727d7fa4c357f6ed7230738c723cae0bbfb91fa895f878e768cbdf40
- SHA256: 308615cb4494e967db13a67299fe83f77b8a6dc4aa54c56b8d1d4f2d34155676
- Drop path: /var/tmp/dropper.ps1


IOC Bulletin - AgentTesla Campaign:
Network Indicators:
- 168.194.10.150
- 10.62.11.227
- 7.239.80.221
- syncmail.club
- static-gateway.com
URLs:
- hxxp://cache-static.live/download/update.exe
- hxxp://relayupdate.online/callback
Email Senders:
- noreply@auth-check.org
- alert@credential-check.site
File Indicators:
- SHA256: 6c6fecbbba8e40f6d71068ccdd6ee1871b5cb5b4615fe9c612372c9a8e9ea663
- MD5: 0c93c16d3a70c1cc806203890d0c4385
- Drop path: /home/user/.config/runtime.dll


IOC Bulletin - Conti Campaign:
Network Indicators:
- 199.29.111.34
- 16.118.152.64
- 69.79.235.143
- logindata.site
- proxy-cache.dev
URLs:
- https://syncstorage.dev/collect
- http://staticmail.live/assets/js/payload.js
Email Senders:
- account@secure-verify.net
- security@credential-check.site
File Indicators:
- MD5: 9e0067f7297246fdc5f3fbd7ebae8a96
- SHA1: fbde1d680f9c15e1a0425fa6709f14d41f3b07ae
- Drop path: /tmp/taskhost.exe


IOC Bulletin - Qbot Campaign:
Network Indicators:
- 175.73.224.187
- 192.117.67.218
- 192.143.12.42
- static-cloud.site
- proxy-portal.net
URLs:
- https://updatesync.com/assets/js/payload.js
- hxxps://storagemail.net/download/update.exe
Email Senders:
- confirm@identity-verify.cc
- helpdesk@urgent-notice.online
File Indicators:
- MD5: 5cb18d679a4bf76b5a1e7a2f30dcb15a
- MD5: 7f4f4c47383272809dca376dcf235946
- Drop path: C:\ProgramData\taskhost.exe


IOC Bulletin - TrickBot Campaign:
Network Indicators:
- 2.69.67.137
- 10.244.149.174
- 151.182.86.204
- relay-gateway.online
- syncsecure.xyz
URLs:
- hxxp://synccloud.dev/admin/config
- http://cloudlogin.club/panel/index.html
Email Senders:
- billing@document-share.link
- contact@document-share.link
File Indicators:
- SHA1: fe68e8b07c51a1e79b5992a28abeb51620eb030e
- SHA256: 26232a6d33f117767ee0d2b066b2f550ddbb28cf0097ad2ead2e778a0bfa815f
- Drop path: C:\Users\admin\Downloads\chrome_helper.exe


IOC Bulletin - AgentTesla Campaign:
Network Indicators:
- 10.6.70.98
- 172.225.84.18
- 50.128.197.245
- storagecloud.live
- apimail.dev
URLs:
- hxxp://auth-update.tech/login
- hxxp://api-edge.online/login
Email Senders:
- notification@auth-check.org
- support@credential-check.site
File Indicators:
- MD5: 55bf2caa24753bb78545a256d07f7df6
- MD5: 823c55e38fb689af79d69524ac7a97e2
- Drop path: /tmp/helper.sh


IOC Bulletin - ShadowPad Campaign:
Network Indicators:
- 218.116.53.252
- 192.243.98.228
- 22.159.174.14
- relay-mail.cc
- node-login.site
URLs:
- http://update-static.com/download/update.exe
- http://update-edge.top/api/v2/auth
Email Senders:
- security@secure-verify.net
- account@document-share.link
File Indicators:
- SHA1: deb54670cc483f3519b249a1e1e31f3c92152dc4
- SHA1: ec816554fef3b2ff7e8b8073aabaacb22c856483
- Drop path: /usr/local/bin/csrss.exe