Phishing Campaign Report: INTERPOL identified a large-scale phishing operation. Emails originated from info@login-portal.tech and service@phishing-domain.com, spoofing legitimate services. Victims were directed to https://syncstatic.dev/callback which hosted a credential harvesting page on auth-cloud.org. A secondary link http://update-edge.tech/portal/verify delivered SmokeLoader (MD5: 5fd3f109d884a45f7c0c87bb59d21f2c). The malware was saved to C:\ProgramData\shell.php and established C2 with 172.25.0.20.


Phishing Campaign Report: Kaspersky GReAT identified a large-scale phishing operation. Emails originated from alert@auth-check.org and finance@identity-verify.cc, spoofing legitimate services. Victims were directed to hxxps://proxy-mail.link/panel/index.html which hosted a credential harvesting page on apicdn.info. A secondary link hxxps://cloud-node.club/portal/verify delivered QakBot (SHA256: 1291e92e5bbba173be68a34922734af05b541ae39c6ac00fa6f54be47e0907f8). The malware was saved to C:\ProgramData\csrss.exe and established C2 with 99.174.38.176.


Phishing Campaign Report: NSA identified a large-scale phishing operation. Emails originated from billing@auth-check.org and billing@urgent-notice.online, spoofing legitimate services. Victims were directed to hxxp://sync-node.top/gate.php which hosted a credential harvesting page on static-update.net. A secondary link hxxps://relaystorage.tech/wp-content/uploads/doc.php delivered Vidar (MD5: fd02c62d70aaafe6a3a3def0a2f6fa5a). The malware was saved to C:\Users\admin\Desktop\agent.py and established C2 with 29.249.230.141.


Phishing Campaign Report: Dragos identified a large-scale phishing operation. Emails originated from hr@phishing-domain.com and info@document-share.link, spoofing legitimate services. Victims were directed to hxxps://login-relay.link/callback which hosted a credential harvesting page on nodeportal.site. A secondary link hxxps://proxy-auth.site/api/v2/auth delivered PikaBot (SHA256: 63f7fb97b8fcfd1baed37c84b6f4b6998872019e08f71e4d6fdacc5de80cd3a3). The malware was saved to C:\ProgramData\shell.php and established C2 with 212.197.224.92.


Phishing Campaign Report: Recorded Future identified a large-scale phishing operation. Emails originated from notification@urgent-notice.online and billing@login-portal.tech, spoofing legitimate services. Victims were directed to hxxps://gateway-api.online/assets/js/payload.js which hosted a credential harvesting page on sync-mail.top. A secondary link hxxp://updatestorage.io/secure/token delivered WarmCookie (SHA1: 89580e72ffddd4a0d7785cdb8e836db32862c30a). The malware was saved to /etc/cron.d/ntds.dit and established C2 with 113.76.189.64.


Phishing Campaign Report: FireEye identified a large-scale phishing operation. Emails originated from it@login-portal.tech and helpdesk@document-share.link, spoofing legitimate services. Victims were directed to http://backup-secure.site/admin/config which hosted a credential harvesting page on api-storage.io. A secondary link http://auth-relay.dev/secure/token delivered SystemBC (MD5: 63a6a9d93124b040a9ee5607e1bd6282). The malware was saved to C:\Program Files\Common Files\dropper.ps1 and established C2 with 155.106.2.209.


Phishing Campaign Report: Google TAG identified a large-scale phishing operation. Emails originated from billing@phishing-domain.com and noreply@urgent-notice.online, spoofing legitimate services. Victims were directed to http://cloudsecure.dev/download/update.exe which hosted a credential harvesting page on apimail.link. A secondary link hxxp://portalgateway.cc/portal/verify delivered QakBot (MD5: 34ddaca1ba2c98b38e4cedb4d27900c8). The malware was saved to C:\Windows\System32\loader.exe and established C2 with 77.218.54.248.


Phishing Campaign Report: Palo Alto Unit 42 identified a large-scale phishing operation. Emails originated from helpdesk@phishing-domain.com and confirm@credential-check.site, spoofing legitimate services. Victims were directed to http://update-edge.dev/download/update.exe which hosted a credential harvesting page on proxyrelay.dev. A secondary link hxxp://relay-data.io/gate.php delivered Conti (SHA1: 36d4949990d108a477cc23c751aabc6cc8f8a9af). The malware was saved to /home/user/.config/payload.bin and established C2 with 33.246.199.51.


Phishing Campaign Report: Qualys identified a large-scale phishing operation. Emails originated from admin@document-share.link and support@phishing-domain.com, spoofing legitimate services. Victims were directed to hxxps://apilogin.net/download/update.exe which hosted a credential harvesting page on cdn-mail.club. A secondary link https://logincloud.info/gate.php delivered Amadey (SHA1: 64498ff275059b14c4397d6156639c4357c8d188). The malware was saved to C:\Windows\Tasks\beacon.dll and established C2 with 192.218.61.174.


Phishing Campaign Report: Huntress identified a large-scale phishing operation. Emails originated from notification@document-share.link and verify@secure-verify.net, spoofing legitimate services. Victims were directed to https://mailstatic.site/callback which hosted a credential harvesting page on nodedata.xyz. A secondary link hxxps://relaygateway.info/collect delivered Gootloader (MD5: b530c22357846efd062c0176590d509b). The malware was saved to C:\Windows\Temp\svchost.exe and established C2 with 39.82.144.242.


Phishing Campaign Report: FBI identified a large-scale phishing operation. Emails originated from noreply@identity-verify.cc and it@login-portal.tech, spoofing legitimate services. Victims were directed to hxxp://staticcloud.club/download/update.exe which hosted a credential harvesting page on relay-update.tech. A secondary link https://cache-api.link/wp-content/uploads/doc.php delivered Gootloader (SHA1: ff609ebf43385b53f2f27e12ccda354c779cbe56). The malware was saved to /var/tmp/ntds.dit and established C2 with 10.171.252.202.


Phishing Campaign Report: Zscaler ThreatLabz identified a large-scale phishing operation. Emails originated from notification@secure-verify.net and info@auth-check.org, spoofing legitimate services. Victims were directed to http://auth-cdn.net/assets/js/payload.js which hosted a credential harvesting page on mailedge.cc. A secondary link hxxps://gateway-update.com/download/update.exe delivered Royal (MD5: 5dac42b0fe500fee8105e5676a273265). The malware was saved to C:\Windows\Tasks\winlogon.exe and established C2 with 222.104.112.82.


Phishing Campaign Report: Check Point Research identified a large-scale phishing operation. Emails originated from finance@urgent-notice.online and account@login-portal.tech, spoofing legitimate services. Victims were directed to hxxp://proxyapi.cc/api/v2/auth which hosted a credential harvesting page on datanode.dev. A secondary link hxxps://cacheportal.online/portal/verify delivered FormBook (MD5: 7e4470d9bce1a8b5ee5a1b421e3b0e53). The malware was saved to /home/user/.config/helper.sh and established C2 with 10.106.46.242.


Phishing Campaign Report: Rapid7 identified a large-scale phishing operation. Emails originated from verify@account-update.xyz and contact@identity-verify.cc, spoofing legitimate services. Victims were directed to https://loginnode.org/callback which hosted a credential harvesting page on loginbackup.com. A secondary link hxxp://synccache.dev/assets/js/payload.js delivered Cobalt Strike (SHA256: 8085a5765eb49fe20a6aac8eec924d040c6aca7b19f94aa4fee2fdfa5a0dded3). The malware was saved to C:\Windows\System32\svchost.exe and established C2 with 171.25.44.78.


Phishing Campaign Report: Qualys identified a large-scale phishing operation. Emails originated from service@phishing-domain.com and ceo@secure-verify.net, spoofing legitimate services. Victims were directed to hxxp://edge-storage.info/download/update.exe which hosted a credential harvesting page on cloud-data.tech. A secondary link hxxp://authportal.top/assets/js/payload.js delivered FormBook (SHA1: e591b59fb3f0d47818c1ba89e91c88b2f3fcf234). The malware was saved to /tmp/lsass.dmp and established C2 with 10.45.29.15.


Phishing Campaign Report: NCSC identified a large-scale phishing operation. Emails originated from support@document-share.link and support@urgent-notice.online, spoofing legitimate services. Victims were directed to hxxps://api-edge.online/assets/js/payload.js which hosted a credential harvesting page on storage-sync.net. A secondary link hxxp://backup-edge.com/panel/index.html delivered NjRAT (SHA1: 1cef83726fffe803644b953a949cc7240dce1547). The malware was saved to C:\Users\admin\Downloads\implant.so and established C2 with 192.117.25.237.


Phishing Campaign Report: Qualys identified a large-scale phishing operation. Emails originated from hr@login-portal.tech and updates@identity-verify.cc, spoofing legitimate services. Victims were directed to http://apidata.link/callback which hosted a credential harvesting page on gateway-node.net. A secondary link hxxps://edge-update.io/download/update.exe delivered AgentTesla (SHA1: c0fae2ecab350167c91048a4c590a1e162dabbc2). The malware was saved to /home/user/.config/sam.hive and established C2 with 197.234.1.224.


Phishing Campaign Report: Palo Alto Unit 42 identified a large-scale phishing operation. Emails originated from it@login-portal.tech and info@secure-verify.net, spoofing legitimate services. Victims were directed to hxxp://mail-edge.xyz/login which hosted a credential harvesting page on loginauth.io. A secondary link http://proxycloud.cc/collect delivered Lumma Stealer (SHA1: b7f7faea666f9b7b21dbbd124a8f7d5e5a9f3c8d). The malware was saved to /home/user/.config/payload.bin and established C2 with 156.119.242.105.


Phishing Campaign Report: NSA identified a large-scale phishing operation. Emails originated from it@phishing-domain.com and alert@identity-verify.cc, spoofing legitimate services. Victims were directed to hxxps://gatewayproxy.club/panel/index.html which hosted a credential harvesting page on gateway-data.site. A secondary link hxxp://proxyportal.live/admin/config delivered WarmCookie (SHA1: 023943beb3e4bb120a2e9010efe6cc9e7a66578d). The malware was saved to /etc/cron.d/svchost.exe and established C2 with 192.203.82.118.


Phishing Campaign Report: FireEye identified a large-scale phishing operation. Emails originated from service@account-update.xyz and notification@account-update.xyz, spoofing legitimate services. Victims were directed to http://gateway-gateway.site/panel/index.html which hosted a credential harvesting page on storagesecure.org. A secondary link http://cache-cloud.online/api/v2/auth delivered Latrodectus (SHA1: cf7eb8228b84d725062f8dd8bab3ecc408912fac). The malware was saved to C:\Windows\Temp\sam.hive and established C2 with 149.123.162.145.


Forensic Investigation Notes: Analysis of the compromised host revealed Impacket artifacts at C:\Users\Public\Documents\payload.bin. Memory dump analysis confirmed execution of Merlin. Registry modifications pointed to persistence via /opt/app/bin/winlogon.exe. Network forensics identified connections to 83.253.194.76 and storage-update.dev. Email headers traced the initial vector to finance@secure-verify.net. File /dev/shm/beacon.dll (MD5: 8dff4072608e18e79badf38d2113e739) was identified as the initial dropper. A staging URL http://authportal.tech/panel/index.html resolved to 192.96.189.246. Secondary artifact hash: SHA256: 93df586b497c7d58730bb70c40a1608ca7732097797e3fa3046e28cfe6fd98ae.


Forensic Investigation Notes: Analysis of the compromised host revealed Nmap artifacts at /tmp/shell.php. Memory dump analysis confirmed execution of ADFind. Registry modifications pointed to persistence via C:\ProgramData\payload.bin. Network forensics identified connections to 21.58.157.135 and update-static.org. Email headers traced the initial vector to security@urgent-notice.online. File /etc/cron.d/lsass.dmp (MD5: 8886a3dfe453a5efc1c980a32715ee65) was identified as the initial dropper. A staging URL http://edgeproxy.tech/login resolved to 11.28.184.199. Secondary artifact hash: SHA256: 6051c54e8d1cba19ab6fcb86902d14ce4690e6cf1a357ed374d4d5c066caa51d.


Forensic Investigation Notes: Analysis of the compromised host revealed PowerView artifacts at /var/tmp/svchost.exe. Memory dump analysis confirmed execution of Sharphound. Registry modifications pointed to persistence via C:\Windows\System32\shell.php. Network forensics identified connections to 172.6.32.165 and cache-update.site. Email headers traced the initial vector to report@auth-check.org. File /tmp/svchost.exe (SHA256: 6068b0e3688649aea8c3cca4864c99db8bde3de8908e1de3fdc140a1d79b27e1) was identified as the initial dropper. A staging URL hxxp://secure-secure.xyz/callback resolved to 214.18.252.71. Secondary artifact hash: SHA256: b75359ecd5b43117cce45c92381a40a71aac1e95de91752e8622d37e37de2a53.


Forensic Investigation Notes: Analysis of the compromised host revealed GhostPack artifacts at /tmp/taskhost.exe. Memory dump analysis confirmed execution of LinPEAS. Registry modifications pointed to persistence via C:\Windows\Temp\lsass.dmp. Network forensics identified connections to 10.69.133.202 and maildata.online. Email headers traced the initial vector to finance@phishing-domain.com. File C:\Users\admin\Downloads\update.dll (SHA256: a270f068d86259619469f03c062ac0dd92d3485c728bdfb587fa009ee37644fb) was identified as the initial dropper. A staging URL https://proxyapi.link/portal/verify resolved to 172.216.71.67. Secondary artifact hash: MD5: 508380f00eb43725cb7ab4ba89c1dfb9.


Forensic Investigation Notes: Analysis of the compromised host revealed Sharphound artifacts at C:\Users\admin\Desktop\implant.so. Memory dump analysis confirmed execution of Sliver. Registry modifications pointed to persistence via /etc/cron.d/ntds.dit. Network forensics identified connections to 139.252.106.93 and apisync.site. Email headers traced the initial vector to confirm@urgent-notice.online. File /dev/shm/backdoor.elf (SHA256: 75d479a2be58f83ef38848c0e221d28d859e43472515b31e57acee3d82bf0bf7) was identified as the initial dropper. A staging URL https://mailnode.xyz/panel/index.html resolved to 65.190.112.66. Secondary artifact hash: SHA1: f02a9b799e6d1eabb5f60cfe168de6752daeea4e.


Forensic Investigation Notes: Analysis of the compromised host revealed PowerShell Empire artifacts at /tmp/agent.py. Memory dump analysis confirmed execution of Mimikatz. Registry modifications pointed to persistence via /var/tmp/csrss.exe. Network forensics identified connections to 172.200.153.133 and proxymail.io. Email headers traced the initial vector to account@document-share.link. File C:\Program Files\Common Files\config.dat (MD5: d0150deab73bd97fbc6d611bc202e58e) was identified as the initial dropper. A staging URL http://datasecure.link/collect resolved to 62.78.15.221. Secondary artifact hash: MD5: bf607140b8bb36bafa54a198d8ab8e65.


Forensic Investigation Notes: Analysis of the compromised host revealed LinPEAS artifacts at /tmp/backdoor.elf. Memory dump analysis confirmed execution of Covenant. Registry modifications pointed to persistence via /home/user/.config/helper.sh. Network forensics identified connections to 172.12.156.82 and portalrelay.org. Email headers traced the initial vector to admin@phishing-domain.com. File C:\Program Files\Common Files\implant.so (SHA1: 86122be981bc302f825671bde6ef44e37d8daaf7) was identified as the initial dropper. A staging URL hxxp://cloudsync.org/collect resolved to 172.16.89.137. Secondary artifact hash: MD5: 32962f203d09618932e00aabcc76fc1d.


Forensic Investigation Notes: Analysis of the compromised host revealed PowerView artifacts at C:\Users\admin\AppData\Local\Temp\sam.hive. Memory dump analysis confirmed execution of CrackMapExec. Registry modifications pointed to persistence via C:\Windows\Tasks\helper.sh. Network forensics identified connections to 163.176.2.62 and authmail.com. Email headers traced the initial vector to admin@mail-service.info. File /dev/shm/payload.bin (SHA1: 6cf5d77a31ee288115c7b547596ca87d6f227e1b) was identified as the initial dropper. A staging URL hxxps://updatesecure.io/portal/verify resolved to 10.215.70.86. Secondary artifact hash: MD5: 0ff06103cedfb88b2c4743ad1740e274.


Forensic Investigation Notes: Analysis of the compromised host revealed Nmap artifacts at /tmp/winlogon.exe. Memory dump analysis confirmed execution of Havoc. Registry modifications pointed to persistence via /var/tmp/chrome_helper.exe. Network forensics identified connections to 10.251.169.49 and mail-cache.com. Email headers traced the initial vector to security@identity-verify.cc. File C:\Windows\System32\sam.hive (SHA1: debf7e4f98336905b5118d23d96b3e65c1aed2fa) was identified as the initial dropper. A staging URL https://securerelay.live/download/update.exe resolved to 192.51.57.37. Secondary artifact hash: MD5: 86248dac92592a9c25c1e1d013f29e1e.


Forensic Investigation Notes: Analysis of the compromised host revealed Merlin artifacts at C:\Program Files\Common Files\lsass.dmp. Memory dump analysis confirmed execution of Sharphound. Registry modifications pointed to persistence via C:\Users\admin\Downloads\csrss.exe. Network forensics identified connections to 58.98.179.90 and cdnstatic.live. Email headers traced the initial vector to info@document-share.link. File C:\Users\Public\Documents\update.dll (SHA1: b94d93a5fb42d02c93f10c8bf0c8c1a3b4262bb1) was identified as the initial dropper. A staging URL http://storage-auth.net/admin/config resolved to 88.41.132.162. Secondary artifact hash: MD5: 631f801b13c48003ca98262149cd9238.


Forensic Investigation Notes: Analysis of the compromised host revealed Covenant artifacts at /home/user/.config/csrss.exe. Memory dump analysis confirmed execution of CrackMapExec. Registry modifications pointed to persistence via /etc/cron.d/winlogon.exe. Network forensics identified connections to 35.242.95.140 and syncportal.net. Email headers traced the initial vector to info@auth-check.org. File /var/tmp/sam.hive (SHA1: 1076081d3c86a6b206b8fdd633df129e93b8446d) was identified as the initial dropper. A staging URL hxxp://mailgateway.club/callback resolved to 172.233.102.64. Secondary artifact hash: SHA256: c4ce8f71359818bf567a3623886bf75a36678f4055a693531481182d6ea4900e.


Forensic Investigation Notes: Analysis of the compromised host revealed Sliver artifacts at /usr/local/bin/taskhost.exe. Memory dump analysis confirmed execution of PsExec. Registry modifications pointed to persistence via C:\Users\admin\Downloads\ntds.dit. Network forensics identified connections to 192.226.200.41 and api-static.live. Email headers traced the initial vector to admin@login-portal.tech. File C:\Windows\Temp\loader.exe (MD5: 672fc99dd0e2128936dcc7dd4e2c6743) was identified as the initial dropper. A staging URL http://apigateway.club/login resolved to 192.30.217.147. Secondary artifact hash: SHA1: 06a905d934739f42947e20585f64dd2282c24c40.


Forensic Investigation Notes: Analysis of the compromised host revealed Havoc artifacts at /home/user/.config/winlogon.exe. Memory dump analysis confirmed execution of Merlin. Registry modifications pointed to persistence via C:\Users\admin\AppData\Local\Temp\winlogon.exe. Network forensics identified connections to 113.116.51.243 and backup-node.tech. Email headers traced the initial vector to info@mail-service.info. File C:\Windows\System32\payload.bin (SHA1: a8e8efc33eb8468d23ed3d20b890f128c179e8ed) was identified as the initial dropper. A staging URL hxxp://cdn-login.tech/callback resolved to 10.143.117.212. Secondary artifact hash: SHA1: 663254acc13c6c7e14596ef3875b4dd07c6d16d7.


Forensic Investigation Notes: Analysis of the compromised host revealed BITSAdmin artifacts at /home/user/.config/csrss.exe. Memory dump analysis confirmed execution of Mimikatz. Registry modifications pointed to persistence via C:\Users\admin\AppData\Local\Temp\payload.bin. Network forensics identified connections to 34.241.185.197 and auth-storage.info. Email headers traced the initial vector to finance@mail-service.info. File C:\Users\admin\Downloads\helper.sh (SHA256: 3b32cba1e085a0f4543bc4938f2408139d00ea09e1882c54c6006a7ac4cc8e0e) was identified as the initial dropper. A staging URL hxxp://api-node.live/admin/config resolved to 114.193.238.48. Secondary artifact hash: SHA256: 0c218a3ada1c81616585140490276368681735988cc27b7e3a8f413afd6dcb87.


Forensic Investigation Notes: Analysis of the compromised host revealed Ligolo artifacts at /home/user/.config/helper.sh. Memory dump analysis confirmed execution of Mythic. Registry modifications pointed to persistence via C:\Program Files\Common Files\implant.so. Network forensics identified connections to 192.247.247.31 and relay-static.org. Email headers traced the initial vector to ceo@secure-verify.net. File /etc/cron.d/helper.sh (SHA256: bc00a75cb4707d719398fadb1fd7602a41c8f76d56a538c2770f23bba93448b8) was identified as the initial dropper. A staging URL hxxps://cloudsecure.io/callback resolved to 172.8.208.38. Secondary artifact hash: SHA256: 9e834e48b2c2ddb6c002d2b3183ef6877e95570801d79a1ae42ab2ca2404880d.


Forensic Investigation Notes: Analysis of the compromised host revealed Seatbelt artifacts at C:\Windows\System32\implant.so. Memory dump analysis confirmed execution of Mimikatz. Registry modifications pointed to persistence via C:\ProgramData\update.dll. Network forensics identified connections to 10.126.203.146 and gatewayproxy.net. Email headers traced the initial vector to it@account-update.xyz. File /dev/shm/helper.sh (SHA1: 1fcc6ed43c2a71725e33e122ad36cbc0106159aa) was identified as the initial dropper. A staging URL https://proxyupdate.online/secure/token resolved to 172.226.111.174. Secondary artifact hash: SHA256: 66eb685f5bb0ca01e7c0a78c71f5b609cc4a308f788c398925e88831cd679d88.


Forensic Investigation Notes: Analysis of the compromised host revealed Chisel artifacts at C:\ProgramData\csrss.exe. Memory dump analysis confirmed execution of Mythic. Registry modifications pointed to persistence via /tmp/update.dll. Network forensics identified connections to 10.3.67.199 and cloud-backup.top. Email headers traced the initial vector to support@account-update.xyz. File /usr/local/bin/backdoor.elf (MD5: 07c8a765c53befd52b71c101e95dd825) was identified as the initial dropper. A staging URL http://nodeportal.online/login resolved to 191.124.253.143. Secondary artifact hash: SHA256: 92ffe7d857c20a3b8186b23a4a4150d47507f3f97662e749f6867616648e836a.


Forensic Investigation Notes: Analysis of the compromised host revealed BloodHound artifacts at /var/tmp/update.dll. Memory dump analysis confirmed execution of Impacket. Registry modifications pointed to persistence via /usr/local/bin/svchost.exe. Network forensics identified connections to 174.178.152.161 and edgenode.net. Email headers traced the initial vector to helpdesk@urgent-notice.online. File /tmp/backdoor.elf (MD5: 79d7d3fb55602d8fa529e53928a26e6a) was identified as the initial dropper. A staging URL hxxps://relay-secure.net/secure/token resolved to 192.74.122.202. Secondary artifact hash: SHA1: afac24953001f6ffa8a2beff87f277daec95b7f0.


Forensic Investigation Notes: Analysis of the compromised host revealed Certutil artifacts at C:\Users\Public\Documents\helper.sh. Memory dump analysis confirmed execution of LinPEAS. Registry modifications pointed to persistence via /var/tmp/backdoor.elf. Network forensics identified connections to 41.76.1.26 and secure-cdn.link. Email headers traced the initial vector to billing@secure-verify.net. File C:\Users\admin\Desktop\update.dll (SHA256: 43e8dcd50f74e891d97bb67aa31d7b105110fddf89e0a9e92f11ff80c9fd19b4) was identified as the initial dropper. A staging URL http://nodeauth.club/wp-content/uploads/doc.php resolved to 192.86.185.204. Secondary artifact hash: SHA1: ca9aea6ae641689061742546886bc006a93dc7a8.


Forensic Investigation Notes: Analysis of the compromised host revealed Chisel artifacts at C:\Program Files\Common Files\svchost.exe. Memory dump analysis confirmed execution of CrackMapExec. Registry modifications pointed to persistence via /var/tmp/dropper.ps1. Network forensics identified connections to 154.6.238.192 and cdn-cdn.com. Email headers traced the initial vector to info@mail-service.info. File C:\ProgramData\beacon.dll (SHA256: 78f1abc36baf1fcc18c60e40afbdc51df37d449b782dd2ac9e5ebfe0767497f2) was identified as the initial dropper. A staging URL hxxps://cdn-proxy.dev/gate.php resolved to 166.248.219.124. Secondary artifact hash: SHA1: 6a1333cc93bceea9367a959275a655f96ac9748c.


Forensic Investigation Notes: Analysis of the compromised host revealed Nmap artifacts at C:\Users\Public\Documents\ntds.dit. Memory dump analysis confirmed execution of GhostPack. Registry modifications pointed to persistence via /var/tmp/backdoor.elf. Network forensics identified connections to 27.92.110.118 and cache-api.cc. Email headers traced the initial vector to finance@auth-check.org. File /etc/cron.d/svchost.exe (SHA1: 97b6f18343f6815ffcdcbffe6e6cc8b043fce58a) was identified as the initial dropper. A staging URL http://mailgateway.cc/download/update.exe resolved to 192.190.41.196. Secondary artifact hash: SHA1: f98eb835a4cfea8b144ac9ddd2a5e064384fcb4d.


Forensic Investigation Notes: Analysis of the compromised host revealed Chisel artifacts at C:\Users\admin\Desktop\csrss.exe. Memory dump analysis confirmed execution of Ligolo. Registry modifications pointed to persistence via /opt/app/bin/lsass.dmp. Network forensics identified connections to 128.40.120.113 and gateway-data.cc. Email headers traced the initial vector to alert@account-update.xyz. File C:\Users\Public\Documents\implant.so (SHA256: 403bda1b5a63a0daa61c4dc0e67620662e09dd36ad7988bc99449fb97baf170d) was identified as the initial dropper. A staging URL hxxp://portalrelay.io/login resolved to 188.59.212.193. Secondary artifact hash: MD5: 63df7a51ded305d1a681b7aab547dfc5.


Forensic Investigation Notes: Analysis of the compromised host revealed Ligolo artifacts at /etc/cron.d/csrss.exe. Memory dump analysis confirmed execution of Mythic. Registry modifications pointed to persistence via /dev/shm/runtime.dll. Network forensics identified connections to 192.146.23.43 and backup-backup.link. Email headers traced the initial vector to service@account-update.xyz. File C:\Windows\Tasks\taskhost.exe (SHA256: 1ff87a3242603df5ce3ddba89cc5f2f31079c78864870f82fc55c1c768413c65) was identified as the initial dropper. A staging URL hxxp://gatewaycloud.club/login resolved to 10.147.194.247. Secondary artifact hash: SHA1: 24190d58ef6ef86fbaa35fd3ea497f19b60589e8.


Forensic Investigation Notes: Analysis of the compromised host revealed Mythic artifacts at /home/user/.config/taskhost.exe. Memory dump analysis confirmed execution of Merlin. Registry modifications pointed to persistence via C:\ProgramData\sam.hive. Network forensics identified connections to 192.52.191.48 and edgegateway.xyz. Email headers traced the initial vector to contact@mail-service.info. File C:\Program Files\Common Files\taskhost.exe (SHA1: 9db30425e0da60608dbfb1058edc02feef683f4f) was identified as the initial dropper. A staging URL https://updatesync.site/callback resolved to 131.116.57.154. Secondary artifact hash: MD5: 76c58d3f7effd27ed16bca1f3ea2afa1.


Forensic Investigation Notes: Analysis of the compromised host revealed Rubeus artifacts at C:\Users\admin\Desktop\shell.php. Memory dump analysis confirmed execution of LinPEAS. Registry modifications pointed to persistence via /dev/shm/svchost.exe. Network forensics identified connections to 10.14.142.139 and api-mail.cc. Email headers traced the initial vector to noreply@document-share.link. File /tmp/lsass.dmp (SHA1: 63c17df861124a09243259db7690ccdefcd5e78b) was identified as the initial dropper. A staging URL hxxps://secure-proxy.dev/callback resolved to 172.116.205.187. Secondary artifact hash: SHA1: 3ecdd1811d7a860a0768ce80e12ee475ab7eb51b.


Forensic Investigation Notes: Analysis of the compromised host revealed Mimikatz artifacts at /opt/app/bin/implant.so. Memory dump analysis confirmed execution of Impacket. Registry modifications pointed to persistence via /var/tmp/backdoor.elf. Network forensics identified connections to 191.74.48.21 and authnode.xyz. Email headers traced the initial vector to confirm@secure-verify.net. File C:\ProgramData\update.dll (MD5: a51ce9d7bfc3d1a998e514ed328dea07) was identified as the initial dropper. A staging URL hxxps://cacheportal.top/gate.php resolved to 44.65.80.72. Secondary artifact hash: SHA256: 74255276c5eeb7477976357672b8b3c4ac77008e32f6d624d0521836445f1d2d.


Forensic Investigation Notes: Analysis of the compromised host revealed Hashcat artifacts at /opt/app/bin/sam.hive. Memory dump analysis confirmed execution of Sliver. Registry modifications pointed to persistence via /usr/local/bin/shell.php. Network forensics identified connections to 160.29.161.42 and edgegateway.link. Email headers traced the initial vector to it@urgent-notice.online. File /dev/shm/agent.py (SHA1: e52e3e70f2b284a36b76249b59c647fad1fde353) was identified as the initial dropper. A staging URL hxxps://edge-static.io/login resolved to 10.251.63.29. Secondary artifact hash: SHA1: 6281e7febc12a977bc81e7f9a50c2c5d7d344868.


Forensic Investigation Notes: Analysis of the compromised host revealed ADFind artifacts at C:\Program Files\Common Files\chrome_helper.exe. Memory dump analysis confirmed execution of Burp Suite. Registry modifications pointed to persistence via /dev/shm/runtime.dll. Network forensics identified connections to 52.48.86.153 and gateway-auth.site. Email headers traced the initial vector to report@identity-verify.cc. File /opt/app/bin/ntds.dit (SHA256: 88ca2dd3ec81c86f2114fbddcb8151db2453760a558b04144503a272ca2ca17b) was identified as the initial dropper. A staging URL hxxps://proxy-edge.io/api/v2/auth resolved to 94.180.229.210. Secondary artifact hash: SHA256: 8b78809a9833591a016a08cb09f918bb93d5f70fa81eaddd81e6d2cfe50f6fa9.


Forensic Investigation Notes: Analysis of the compromised host revealed Merlin artifacts at /tmp/loader.exe. Memory dump analysis confirmed execution of Metasploit. Registry modifications pointed to persistence via C:\Users\admin\AppData\Local\Temp\lsass.dmp. Network forensics identified connections to 172.39.218.254 and datacloud.site. Email headers traced the initial vector to helpdesk@secure-verify.net. File C:\Users\admin\Downloads\update.dll (SHA256: ea5b38c145be6e88f5a14b1569e80f6a597f2f297279b70ab2f0b64eb6aa37c6) was identified as the initial dropper. A staging URL https://staticnode.tech/collect resolved to 90.96.87.30. Secondary artifact hash: SHA256: 1b813fe60298c2d99f225b8fbb2e8a5841b1376ee5daf888c0bb4384ab98a869.


Forensic Investigation Notes: Analysis of the compromised host revealed BITSAdmin artifacts at C:\Users\admin\AppData\Local\Temp\update.dll. Memory dump analysis confirmed execution of Certutil. Registry modifications pointed to persistence via /home/user/.config/implant.so. Network forensics identified connections to 192.182.151.96 and datastatic.dev. Email headers traced the initial vector to alert@account-update.xyz. File C:\Users\admin\AppData\Local\Temp\helper.sh (MD5: 06a45626e64b339570ba3cbaf07f6117) was identified as the initial dropper. A staging URL hxxp://synccloud.cc/download/update.exe resolved to 129.115.174.178. Secondary artifact hash: SHA1: bccc0f8890a6fada5b18c2107652b296c2930580.


Forensic Investigation Notes: Analysis of the compromised host revealed GhostPack artifacts at /opt/app/bin/winlogon.exe. Memory dump analysis confirmed execution of BloodHound. Registry modifications pointed to persistence via C:\Users\Public\Documents\sam.hive. Network forensics identified connections to 172.34.130.214 and secure-cloud.site. Email headers traced the initial vector to alert@urgent-notice.online. File /usr/local/bin/chrome_helper.exe (SHA1: f6dedeb7f359524b5d8994e5deefa01eddc45209) was identified as the initial dropper. A staging URL https://datacache.cc/secure/token resolved to 223.215.91.232. Secondary artifact hash: SHA1: b192a4d9866044906f1fefe6e38f6c2e6b4ebdae.


Forensic Investigation Notes: Analysis of the compromised host revealed BITSAdmin artifacts at /usr/local/bin/taskhost.exe. Memory dump analysis confirmed execution of Sliver. Registry modifications pointed to persistence via /tmp/dropper.ps1. Network forensics identified connections to 100.111.26.155 and staticcdn.top. Email headers traced the initial vector to finance@auth-check.org. File /usr/local/bin/winlogon.exe (SHA256: a886cf170956e5477466b88f4790af46132b743ad51cd307c7df153b41f1a3b7) was identified as the initial dropper. A staging URL hxxps://loginsync.dev/panel/index.html resolved to 10.240.204.134. Secondary artifact hash: SHA256: 55d2006d8aa9d05fa04a34a23a3e1932b777ad71b5b611e1a3aa264182e84a44.


Forensic Investigation Notes: Analysis of the compromised host revealed WinPEAS artifacts at C:\Users\admin\Downloads\taskhost.exe. Memory dump analysis confirmed execution of CrackMapExec. Registry modifications pointed to persistence via C:\Windows\Tasks\beacon.dll. Network forensics identified connections to 103.32.34.225 and relayupdate.online. Email headers traced the initial vector to alert@credential-check.site. File /tmp/winlogon.exe (SHA1: 2d8b99173fb7fc510e6a59bed7d173f5ad56b055) was identified as the initial dropper. A staging URL hxxp://backup-update.club/portal/verify resolved to 10.240.98.240. Secondary artifact hash: SHA256: 0fa8196b824c8a921dac46b3b1ab4e49c48a0801543617a7154f8ffe2fb1b43e.


Forensic Investigation Notes: Analysis of the compromised host revealed Sharphound artifacts at C:\Windows\System32\config.dat. Memory dump analysis confirmed execution of GhostPack. Registry modifications pointed to persistence via C:\Users\admin\Downloads\backdoor.elf. Network forensics identified connections to 10.210.125.48 and auth-edge.net. Email headers traced the initial vector to finance@mail-service.info. File C:\Users\Public\Documents\implant.so (SHA1: 212effc3dae43cd0de555adde2786da7c8973dfb) was identified as the initial dropper. A staging URL https://securebackup.link/download/update.exe resolved to 172.160.157.231. Secondary artifact hash: SHA1: 4eb75ba1d6dbed442affdb929b07e49d88a8f53f.


Forensic Investigation Notes: Analysis of the compromised host revealed ADFind artifacts at C:\Windows\Temp\config.dat. Memory dump analysis confirmed execution of GhostPack. Registry modifications pointed to persistence via /usr/local/bin/helper.sh. Network forensics identified connections to 113.210.179.180 and gatewaysync.com. Email headers traced the initial vector to notification@mail-service.info. File /etc/cron.d/svchost.exe (SHA1: 9e579c46d2dc527dea22b28dfef6ddf2861ba642) was identified as the initial dropper. A staging URL hxxp://backup-proxy.tech/collect resolved to 10.218.33.251. Secondary artifact hash: SHA1: 9ce43eb034060ab02c12b27b05638d97e58e4b03.


Forensic Investigation Notes: Analysis of the compromised host revealed SharpHound artifacts at C:\ProgramData\runtime.dll. Memory dump analysis confirmed execution of Hashcat. Registry modifications pointed to persistence via C:\Windows\Tasks\update.dll. Network forensics identified connections to 215.166.47.176 and api-update.top. Email headers traced the initial vector to service@auth-check.org. File /opt/app/bin/agent.py (SHA1: 815f61a943bd531946f3403e0c4eaa58634f2711) was identified as the initial dropper. A staging URL hxxp://securecache.cc/login resolved to 192.91.197.221. Secondary artifact hash: SHA256: 8a4349c58fe98cc4b3df4ad2fa3a1aa9a548305046f6ada349cea3ccdc9812e6.


Forensic Investigation Notes: Analysis of the compromised host revealed Covenant artifacts at C:\Users\admin\Downloads\helper.sh. Memory dump analysis confirmed execution of Certutil. Registry modifications pointed to persistence via /dev/shm/lsass.dmp. Network forensics identified connections to 154.88.85.146 and apiapi.top. Email headers traced the initial vector to billing@document-share.link. File C:\Users\admin\Desktop\ntds.dit (SHA1: 1b3e977428278619fd921184f9e7dad9050a84c8) was identified as the initial dropper. A staging URL https://static-data.link/download/update.exe resolved to 60.118.196.24. Secondary artifact hash: SHA1: 776d6f7e5834097c0f1ed789acb98af54965492f.


Forensic Investigation Notes: Analysis of the compromised host revealed LinPEAS artifacts at /usr/local/bin/payload.bin. Memory dump analysis confirmed execution of LaZagne. Registry modifications pointed to persistence via /home/user/.config/svchost.exe. Network forensics identified connections to 172.209.97.52 and proxy-mail.net. Email headers traced the initial vector to service@identity-verify.cc. File C:\Users\admin\Desktop\ntds.dit (SHA1: 25c76c99d5fa1435e6460153d4758353829662bb) was identified as the initial dropper. A staging URL https://cdnnode.site/portal/verify resolved to 173.117.121.66. Secondary artifact hash: SHA256: a79611f355238376a6b7f9c5e45ebf63a7996ad376cf2c2e9691f37ffa501783.


Forensic Investigation Notes: Analysis of the compromised host revealed Merlin artifacts at C:\Users\admin\Downloads\agent.py. Memory dump analysis confirmed execution of PowerShell Empire. Registry modifications pointed to persistence via /var/tmp/dropper.ps1. Network forensics identified connections to 88.10.230.69 and staticsync.dev. Email headers traced the initial vector to admin@login-portal.tech. File C:\Users\admin\Downloads\lsass.dmp (SHA1: ae3d16263e58bfa0a677b1ee6b210a0caf73630e) was identified as the initial dropper. A staging URL https://staticgateway.info/wp-content/uploads/doc.php resolved to 172.11.177.42. Secondary artifact hash: SHA256: 2a7cd051324007715a838d9875881e215d18022c00bd5dd9943c6c2ebe78ce01.


Forensic Investigation Notes: Analysis of the compromised host revealed Ligolo artifacts at /opt/app/bin/implant.so. Memory dump analysis confirmed execution of PowerView. Registry modifications pointed to persistence via C:\Users\Public\Documents\beacon.dll. Network forensics identified connections to 32.103.2.10 and backupstatic.top. Email headers traced the initial vector to service@urgent-notice.online. File C:\Users\admin\Desktop\winlogon.exe (SHA256: c8d1cfcb22d50aa34fd40e7c62b855957fe926c728c17877116891b69b795192) was identified as the initial dropper. A staging URL https://gatewayrelay.cc/gate.php resolved to 71.69.233.55. Secondary artifact hash: MD5: 63d2cf9b70a62ca2470dfdea68f8dff7.


Forensic Investigation Notes: Analysis of the compromised host revealed Chisel artifacts at C:\Windows\Temp\ntds.dit. Memory dump analysis confirmed execution of Sliver. Registry modifications pointed to persistence via C:\Users\Public\Documents\sam.hive. Network forensics identified connections to 172.225.42.21 and portalproxy.live. Email headers traced the initial vector to contact@auth-check.org. File C:\Windows\Temp\ntds.dit (SHA1: f23bbe759d71dc88bdcbcda2bd653942f81809f8) was identified as the initial dropper. A staging URL http://storage-api.io/login resolved to 10.133.229.27. Secondary artifact hash: SHA256: ceb9dfc1fec8c27a3674093fbabc208a418d82864bc02bbcfa3a732fbac9287c.


Forensic Investigation Notes: Analysis of the compromised host revealed Hashcat artifacts at C:\Users\Public\Documents\lsass.dmp. Memory dump analysis confirmed execution of GhostPack. Registry modifications pointed to persistence via /dev/shm/agent.py. Network forensics identified connections to 10.145.106.249 and storageupdate.top. Email headers traced the initial vector to contact@identity-verify.cc. File /usr/local/bin/shell.php (SHA1: 47719100c560f07125ddf2ae8c8c6741ef46e1fa) was identified as the initial dropper. A staging URL hxxps://proxy-storage.info/download/update.exe resolved to 157.222.167.5. Secondary artifact hash: SHA1: cb282f70f0828903a18d0e12266d0a893356e919.


Forensic Investigation Notes: Analysis of the compromised host revealed WinPEAS artifacts at /usr/local/bin/config.dat. Memory dump analysis confirmed execution of PowerShell Empire. Registry modifications pointed to persistence via C:\Program Files\Common Files\chrome_helper.exe. Network forensics identified connections to 206.228.63.77 and edge-storage.live. Email headers traced the initial vector to contact@account-update.xyz. File /dev/shm/dropper.ps1 (SHA1: ad327435f85fd18f6aecdfaed620bfa1e7665fa3) was identified as the initial dropper. A staging URL hxxps://backupnode.link/admin/config resolved to 10.169.28.251. Secondary artifact hash: SHA256: 278f25d69df821172d5ea19e58af4fd260110ea4666375b621c25e1cf0ff06a0.


Forensic Investigation Notes: Analysis of the compromised host revealed BITSAdmin artifacts at C:\Program Files\Common Files\helper.sh. Memory dump analysis confirmed execution of Ligolo. Registry modifications pointed to persistence via /home/user/.config/shell.php. Network forensics identified connections to 51.165.179.57 and login-relay.io. Email headers traced the initial vector to report@auth-check.org. File /var/tmp/ntds.dit (SHA1: 1d42e0e0a2aaa6b9237bef58d941df4453c24d30) was identified as the initial dropper. A staging URL https://static-cloud.com/admin/config resolved to 192.43.11.198. Secondary artifact hash: SHA256: b21dcb0444cccbb89d6e6e5f4f312f22a1bc0acaf3dcb47e73db93615d5e2a9c.


Forensic Investigation Notes: Analysis of the compromised host revealed Sharphound artifacts at /etc/cron.d/payload.bin. Memory dump analysis confirmed execution of ADFind. Registry modifications pointed to persistence via /dev/shm/sam.hive. Network forensics identified connections to 10.198.167.107 and backupbackup.xyz. Email headers traced the initial vector to hr@identity-verify.cc. File /etc/cron.d/loader.exe (MD5: 51ec2620632bf78d6be51f39d6ca7c78) was identified as the initial dropper. A staging URL hxxps://datadata.net/admin/config resolved to 10.99.216.56. Secondary artifact hash: MD5: 45fd5a232c3be063d28dc12f3130db50.


Forensic Investigation Notes: Analysis of the compromised host revealed Sliver artifacts at C:\Windows\System32\runtime.dll. Memory dump analysis confirmed execution of Mythic. Registry modifications pointed to persistence via /var/tmp/csrss.exe. Network forensics identified connections to 172.112.63.227 and gatewaysecure.top. Email headers traced the initial vector to noreply@identity-verify.cc. File C:\Windows\Tasks\ntds.dit (SHA256: 81d7a62ecd8b00de5030cd519e535c0b970e8677e830f3a1f1e75f3452f34979) was identified as the initial dropper. A staging URL https://portal-relay.io/assets/js/payload.js resolved to 78.143.182.119. Secondary artifact hash: MD5: 08ef0a531047b0968339a0d6058df5a5.


Forensic Investigation Notes: Analysis of the compromised host revealed Brute Ratel artifacts at C:\Users\admin\AppData\Local\Temp\loader.exe. Memory dump analysis confirmed execution of GhostPack. Registry modifications pointed to persistence via /dev/shm/beacon.dll. Network forensics identified connections to 176.146.122.241 and cloudrelay.club. Email headers traced the initial vector to hr@phishing-domain.com. File /usr/local/bin/beacon.dll (MD5: b653caa707f8cd58a24fab7fa59a0735) was identified as the initial dropper. A staging URL http://proxy-portal.online/panel/index.html resolved to 215.171.70.151. Secondary artifact hash: SHA1: b08a1ea2f3b2d40d6d2126041f168b7606ab3762.


Forensic Investigation Notes: Analysis of the compromised host revealed SharpHound artifacts at /dev/shm/agent.py. Memory dump analysis confirmed execution of Sharphound. Registry modifications pointed to persistence via C:\Windows\Temp\backdoor.elf. Network forensics identified connections to 91.41.157.153 and storage-proxy.link. Email headers traced the initial vector to billing@phishing-domain.com. File C:\Windows\System32\svchost.exe (MD5: 12efbae8d15872eb97f37df951c8783b) was identified as the initial dropper. A staging URL https://cdn-cdn.cc/assets/js/payload.js resolved to 90.102.152.23. Secondary artifact hash: MD5: 2dc1e3e3aec00df390e446936d30cef3.


Forensic Investigation Notes: Analysis of the compromised host revealed PowerView artifacts at C:\Users\admin\AppData\Local\Temp\ntds.dit. Memory dump analysis confirmed execution of CrackMapExec. Registry modifications pointed to persistence via /etc/cron.d/lsass.dmp. Network forensics identified connections to 185.134.175.63 and securecloud.live. Email headers traced the initial vector to contact@identity-verify.cc. File /etc/cron.d/loader.exe (SHA256: ac2200ec9b2b50b90faac294bba278decb4f30d9e5a7ba3819fe92f661f29561) was identified as the initial dropper. A staging URL http://update-cdn.info/login resolved to 168.216.187.63. Secondary artifact hash: SHA256: 41ee6167e67a874e0caf23853e87c92cbf23e3a03d0f95caefe71aa021287f1b.


Forensic Investigation Notes: Analysis of the compromised host revealed Brute Ratel artifacts at C:\ProgramData\chrome_helper.exe. Memory dump analysis confirmed execution of GhostPack. Registry modifications pointed to persistence via C:\Users\admin\AppData\Local\Temp\helper.sh. Network forensics identified connections to 20.40.204.214 and nodecloud.club. Email headers traced the initial vector to hr@identity-verify.cc. File /home/user/.config/shell.php (SHA1: ef84894859cb8551aa54b2a42f139cddacda7a1d) was identified as the initial dropper. A staging URL https://apibackup.club/gate.php resolved to 21.44.52.175. Secondary artifact hash: MD5: 532a3d38927cc72c92dbb027d3cd594d.


Forensic Investigation Notes: Analysis of the compromised host revealed Hashcat artifacts at C:\Windows\Tasks\ntds.dit. Memory dump analysis confirmed execution of ADFind. Registry modifications pointed to persistence via C:\ProgramData\loader.exe. Network forensics identified connections to 172.236.210.103 and loginmail.site. Email headers traced the initial vector to notification@auth-check.org. File C:\Program Files\Common Files\loader.exe (MD5: 61736131561a1dcc216c90540374e895) was identified as the initial dropper. A staging URL https://node-static.net/assets/js/payload.js resolved to 141.75.8.190. Secondary artifact hash: SHA1: 2c1cb55403a1938b72030d825f03ac1a4801d318.


Forensic Investigation Notes: Analysis of the compromised host revealed Nmap artifacts at C:\Users\admin\Downloads\helper.sh. Memory dump analysis confirmed execution of BloodHound. Registry modifications pointed to persistence via /var/tmp/svchost.exe. Network forensics identified connections to 109.146.8.81 and securelogin.net. Email headers traced the initial vector to it@secure-verify.net. File C:\Users\admin\Downloads\shell.php (SHA1: 780a2f6055fd5b3ada318fb8cee450d1d9f50478) was identified as the initial dropper. A staging URL http://api-edge.site/login resolved to 215.246.123.160. Secondary artifact hash: SHA256: df4e312cc92286b5477c912ee22ce7c27bf8a195ada2efe8af521773da1bc578.


Forensic Investigation Notes: Analysis of the compromised host revealed ADFind artifacts at /home/user/.config/beacon.dll. Memory dump analysis confirmed execution of Nmap. Registry modifications pointed to persistence via /home/user/.config/sam.hive. Network forensics identified connections to 172.232.173.43 and update-cloud.tech. Email headers traced the initial vector to finance@secure-verify.net. File /var/tmp/runtime.dll (SHA1: e178909baff16e1d2877b330a73732751d083344) was identified as the initial dropper. A staging URL http://secure-data.link/admin/config resolved to 117.153.154.212. Secondary artifact hash: SHA1: 4280be449dfade9c158f0eaed52b07fa10be3b2d.


Forensic Investigation Notes: Analysis of the compromised host revealed SharpHound artifacts at /var/tmp/csrss.exe. Memory dump analysis confirmed execution of Nmap. Registry modifications pointed to persistence via C:\ProgramData\dropper.ps1. Network forensics identified connections to 78.48.104.24 and mail-node.tech. Email headers traced the initial vector to contact@auth-check.org. File C:\Program Files\Common Files\ntds.dit (MD5: d0ff17410737c72764ae666de5d21d03) was identified as the initial dropper. A staging URL https://mail-cloud.cc/admin/config resolved to 172.39.96.3. Secondary artifact hash: MD5: 51e75def40795f5ae388444a8a872b2a.


Forensic Investigation Notes: Analysis of the compromised host revealed Seatbelt artifacts at C:\Users\admin\Downloads\taskhost.exe. Memory dump analysis confirmed execution of ADFind. Registry modifications pointed to persistence via /dev/shm/dropper.ps1. Network forensics identified connections to 192.155.38.235 and portal-relay.tech. Email headers traced the initial vector to security@login-portal.tech. File /opt/app/bin/winlogon.exe (SHA1: fc037c369afb4c148277b21663ca6fa1a1d6779f) was identified as the initial dropper. A staging URL https://auth-cache.xyz/panel/index.html resolved to 192.192.169.93. Secondary artifact hash: SHA1: b747466656ec2f6d313573189c9678fcc2b0c175.


Forensic Investigation Notes: Analysis of the compromised host revealed Covenant artifacts at C:\ProgramData\dropper.ps1. Memory dump analysis confirmed execution of PsExec. Registry modifications pointed to persistence via C:\Users\admin\AppData\Local\Temp\update.dll. Network forensics identified connections to 49.132.65.181 and cacherelay.club. Email headers traced the initial vector to support@document-share.link. File /tmp/dropper.ps1 (SHA256: efc579ca54aa436e24649bf9892e593a2928c4bb29d888f81827610ff935cfa1) was identified as the initial dropper. A staging URL https://secure-api.io/download/update.exe resolved to 172.80.52.177. Secondary artifact hash: MD5: 8dced8f9485739c43b692f78b7041a9f.


Forensic Investigation Notes: Analysis of the compromised host revealed SharpHound artifacts at /dev/shm/runtime.dll. Memory dump analysis confirmed execution of BloodHound. Registry modifications pointed to persistence via /home/user/.config/chrome_helper.exe. Network forensics identified connections to 10.127.42.86 and storage-data.com. Email headers traced the initial vector to finance@mail-service.info. File C:\ProgramData\agent.py (SHA1: 4681e5b856d59e5036457d2eb2031d8718051687) was identified as the initial dropper. A staging URL hxxps://relay-relay.io/admin/config resolved to 93.100.27.244. Secondary artifact hash: MD5: 3fc82c6c184cf65deace2dfa93bad4a1.


Forensic Investigation Notes: Analysis of the compromised host revealed CrackMapExec artifacts at C:\Users\Public\Documents\update.dll. Memory dump analysis confirmed execution of Sliver. Registry modifications pointed to persistence via C:\Program Files\Common Files\csrss.exe. Network forensics identified connections to 190.221.121.192 and static-cache.net. Email headers traced the initial vector to report@document-share.link. File /home/user/.config/winlogon.exe (MD5: 957c97c1ca25e1785d27696c248975cd) was identified as the initial dropper. A staging URL http://storagelogin.com/portal/verify resolved to 84.155.61.201. Secondary artifact hash: MD5: 741e805361b89941c2bf2026ec7852c2.


Forensic Investigation Notes: Analysis of the compromised host revealed Certutil artifacts at C:\ProgramData\implant.so. Memory dump analysis confirmed execution of CrackMapExec. Registry modifications pointed to persistence via C:\Users\Public\Documents\svchost.exe. Network forensics identified connections to 165.194.47.5 and loginauth.site. Email headers traced the initial vector to contact@urgent-notice.online. File C:\Program Files\Common Files\taskhost.exe (SHA1: f2ced5a1df3a4e8769902d1282d536d987665292) was identified as the initial dropper. A staging URL http://login-api.top/secure/token resolved to 192.67.81.171. Secondary artifact hash: SHA1: c55a95118f286de674c162d21b02f3df66e83873.


Forensic Investigation Notes: Analysis of the compromised host revealed CrackMapExec artifacts at C:\Users\admin\Desktop\config.dat. Memory dump analysis confirmed execution of Seatbelt. Registry modifications pointed to persistence via C:\Users\admin\Desktop\implant.so. Network forensics identified connections to 192.138.254.147 and login-mail.online. Email headers traced the initial vector to noreply@urgent-notice.online. File C:\Users\admin\Desktop\payload.bin (SHA256: 899ca48a05fca3d061f05b9991eabe487bce735b595c9f28c6c279ea1d0bc18b) was identified as the initial dropper. A staging URL hxxp://cdncloud.org/login resolved to 192.1.5.89. Secondary artifact hash: SHA1: 469f7ae1a07aae4c98da7005c2d88af5b83bf4d6.


Forensic Investigation Notes: Analysis of the compromised host revealed PowerView artifacts at C:\Users\admin\AppData\Local\Temp\sam.hive. Memory dump analysis confirmed execution of LaZagne. Registry modifications pointed to persistence via /usr/local/bin/dropper.ps1. Network forensics identified connections to 172.97.237.241 and securecdn.tech. Email headers traced the initial vector to admin@account-update.xyz. File /opt/app/bin/implant.so (MD5: aec11a3effad6d34eedd1b1e561da08c) was identified as the initial dropper. A staging URL https://updateportal.com/panel/index.html resolved to 10.179.45.76. Secondary artifact hash: SHA1: fc7cd02ff5a28a7b4ea73852d08186782d761e59.


Forensic Investigation Notes: Analysis of the compromised host revealed Hashcat artifacts at C:\Windows\Temp\config.dat. Memory dump analysis confirmed execution of Sliver. Registry modifications pointed to persistence via C:\Users\admin\Downloads\backdoor.elf. Network forensics identified connections to 68.230.204.178 and node-cache.io. Email headers traced the initial vector to service@mail-service.info. File C:\Windows\Temp\ntds.dit (MD5: 9b0ff016906de92cf1e84c1ce2e7f553) was identified as the initial dropper. A staging URL http://cdn-auth.dev/secure/token resolved to 11.11.131.223. Secondary artifact hash: MD5: b79dad70f528eba4fbbd43718108ce1e.


Forensic Investigation Notes: Analysis of the compromised host revealed Merlin artifacts at /etc/cron.d/ntds.dit. Memory dump analysis confirmed execution of CrackMapExec. Registry modifications pointed to persistence via C:\Windows\System32\helper.sh. Network forensics identified connections to 187.195.177.109 and gateway-login.dev. Email headers traced the initial vector to notification@phishing-domain.com. File /dev/shm/loader.exe (SHA1: d2fddf9c9cf2aa7818fd8df6504ea8cd1cac3852) was identified as the initial dropper. A staging URL http://auth-cloud.io/login resolved to 10.105.199.169. Secondary artifact hash: SHA1: dcffcd59fb25a4b0348d3d02579024a948ac999a.


Forensic Investigation Notes: Analysis of the compromised host revealed BITSAdmin artifacts at /usr/local/bin/beacon.dll. Memory dump analysis confirmed execution of Burp Suite. Registry modifications pointed to persistence via /usr/local/bin/sam.hive. Network forensics identified connections to 192.8.106.85 and edge-secure.club. Email headers traced the initial vector to finance@secure-verify.net. File C:\ProgramData\shell.php (SHA1: ef97785c16b8e1aca953a72947b111b34d647e54) was identified as the initial dropper. A staging URL hxxps://sync-relay.link/secure/token resolved to 192.131.165.187. Secondary artifact hash: SHA256: e826f894a0feccd054b3c5b70617519e4d86c48beb534c33224d5d8290340212.


Forensic Investigation Notes: Analysis of the compromised host revealed Certutil artifacts at /var/tmp/agent.py. Memory dump analysis confirmed execution of Nmap. Registry modifications pointed to persistence via C:\Windows\Tasks\payload.bin. Network forensics identified connections to 122.110.28.210 and proxyupdate.link. Email headers traced the initial vector to account@urgent-notice.online. File /var/tmp/shell.php (MD5: f3cb935b98de5ab1f88cb0a8c29d34e0) was identified as the initial dropper. A staging URL https://nodegateway.live/callback resolved to 187.113.64.169. Secondary artifact hash: SHA256: 68902d29541a21b6d563f4cc80415f88d0111dc7a8c8cc98b6641ee403499e05.


Forensic Investigation Notes: Analysis of the compromised host revealed Burp Suite artifacts at C:\Windows\System32\shell.php. Memory dump analysis confirmed execution of PowerView. Registry modifications pointed to persistence via C:\Users\admin\Downloads\csrss.exe. Network forensics identified connections to 10.111.78.63 and gatewayedge.club. Email headers traced the initial vector to contact@credential-check.site. File C:\Users\admin\Downloads\config.dat (SHA1: 72c2a3c0bd19e42888e49e68382dfd398e4af720) was identified as the initial dropper. A staging URL http://proxynode.com/portal/verify resolved to 54.21.223.230. Secondary artifact hash: SHA256: 2f77f71a2c08c6cbac30fdcbba509f7003be71405d0c22b90fdced9c203397cc.


Forensic Investigation Notes: Analysis of the compromised host revealed GhostPack artifacts at /opt/app/bin/dropper.ps1. Memory dump analysis confirmed execution of WinPEAS. Registry modifications pointed to persistence via /var/tmp/beacon.dll. Network forensics identified connections to 86.75.40.60 and storagemail.top. Email headers traced the initial vector to ceo@document-share.link. File /usr/local/bin/backdoor.elf (SHA1: beb9f396f5b89e44699ecf672d45f956d823c016) was identified as the initial dropper. A staging URL https://node-static.online/panel/index.html resolved to 163.102.41.241. Secondary artifact hash: MD5: 55fbf2d19b6e510f76f9c2b0f5efb81b.


Forensic Investigation Notes: Analysis of the compromised host revealed ADFind artifacts at C:\Windows\Tasks\backdoor.elf. Memory dump analysis confirmed execution of Sliver. Registry modifications pointed to persistence via C:\ProgramData\chrome_helper.exe. Network forensics identified connections to 172.227.165.195 and storagedata.info. Email headers traced the initial vector to it@auth-check.org. File /home/user/.config/loader.exe (MD5: 007d0c419075844a85c8ec9b07e2686b) was identified as the initial dropper. A staging URL hxxps://mail-gateway.info/collect resolved to 192.60.252.109. Secondary artifact hash: SHA1: 1d7428e9adc06b53f68dfe7b4989514ce56d6b88.


Forensic Investigation Notes: Analysis of the compromised host revealed Sharphound artifacts at C:\Users\admin\Desktop\sam.hive. Memory dump analysis confirmed execution of CrackMapExec. Registry modifications pointed to persistence via C:\Program Files\Common Files\helper.sh. Network forensics identified connections to 189.94.31.214 and cacheproxy.top. Email headers traced the initial vector to security@mail-service.info. File C:\Windows\Temp\update.dll (SHA1: e12466a2460396ee74915b8f9912bf832bf1e76f) was identified as the initial dropper. A staging URL hxxp://login-node.info/portal/verify resolved to 172.98.19.22. Secondary artifact hash: SHA256: 1077d226afc07516ccade0010d864d3aebb35ce45d5f123fae3d21af18b38c49.


Forensic Investigation Notes: Analysis of the compromised host revealed Covenant artifacts at C:\Users\admin\Downloads\beacon.dll. Memory dump analysis confirmed execution of Havoc. Registry modifications pointed to persistence via C:\Users\admin\Desktop\ntds.dit. Network forensics identified connections to 112.25.42.206 and edgeupdate.net. Email headers traced the initial vector to ceo@login-portal.tech. File C:\Users\admin\AppData\Local\Temp\shell.php (SHA1: 6fbd1ea03dc1749d4a6937358d6dc1c1ed977ced) was identified as the initial dropper. A staging URL http://datamail.link/callback resolved to 172.4.104.51. Secondary artifact hash: SHA1: 87c9429b8496df279c3e271773d463b3c877585f.


Forensic Investigation Notes: Analysis of the compromised host revealed Sharphound artifacts at /dev/shm/taskhost.exe. Memory dump analysis confirmed execution of Hashcat. Registry modifications pointed to persistence via /etc/cron.d/winlogon.exe. Network forensics identified connections to 63.78.201.11 and proxy-login.com. Email headers traced the initial vector to billing@identity-verify.cc. File /usr/local/bin/backdoor.elf (MD5: 3b475ae00a89a394509026902caa7a3b) was identified as the initial dropper. A staging URL hxxps://staticcache.net/collect resolved to 125.136.206.163. Secondary artifact hash: SHA256: 654ff8b548489a71a8ffe81591016b04da3d219c5a9d5bfcd957c3e1bb87ed52.


Forensic Investigation Notes: Analysis of the compromised host revealed Havoc artifacts at C:\Windows\System32\loader.exe. Memory dump analysis confirmed execution of Hashcat. Registry modifications pointed to persistence via /etc/cron.d/ntds.dit. Network forensics identified connections to 10.43.182.249 and proxy-relay.tech. Email headers traced the initial vector to confirm@account-update.xyz. File C:\Windows\Tasks\payload.bin (SHA1: cfc8d12241a5d24a9b2c8808ba471120108cc75a) was identified as the initial dropper. A staging URL http://secure-portal.org/portal/verify resolved to 185.111.125.221. Secondary artifact hash: MD5: af0b6abbf3b0dc5964b3536a85a2bfe6.


Forensic Investigation Notes: Analysis of the compromised host revealed Brute Ratel artifacts at /tmp/implant.so. Memory dump analysis confirmed execution of PowerShell Empire. Registry modifications pointed to persistence via /etc/cron.d/lsass.dmp. Network forensics identified connections to 1.228.11.213 and static-node.net. Email headers traced the initial vector to it@auth-check.org. File /dev/shm/loader.exe (MD5: 8d852ddc394da2366c238ccf07d8f827) was identified as the initial dropper. A staging URL https://login-cache.top/portal/verify resolved to 213.175.42.171. Secondary artifact hash: MD5: 837d71a564d65ec8accc1907b704b50f.


Forensic Investigation Notes: Analysis of the compromised host revealed Mythic artifacts at C:\Users\Public\Documents\agent.py. Memory dump analysis confirmed execution of BloodHound. Registry modifications pointed to persistence via C:\Users\admin\Downloads\winlogon.exe. Network forensics identified connections to 192.125.172.170 and portalstorage.cc. Email headers traced the initial vector to verify@phishing-domain.com. File /tmp/taskhost.exe (MD5: 8eac6863fcdc0bcba6dcf5c13df69cfe) was identified as the initial dropper. A staging URL https://storagebackup.club/admin/config resolved to 70.225.227.112. Secondary artifact hash: MD5: 426ed2e78ea72dbb8922cf31e9acd77f.


Forensic Investigation Notes: Analysis of the compromised host revealed Metasploit artifacts at /tmp/agent.py. Memory dump analysis confirmed execution of Chisel. Registry modifications pointed to persistence via /var/tmp/ntds.dit. Network forensics identified connections to 205.89.72.186 and databackup.live. Email headers traced the initial vector to billing@auth-check.org. File /dev/shm/beacon.dll (SHA256: 59dbbb67daba322fb1ea439f819be2a6fa600b7fbd413315eb79b740525aab40) was identified as the initial dropper. A staging URL hxxps://relayauth.com/api/v2/auth resolved to 192.136.27.125. Secondary artifact hash: MD5: f435621b2eb843ae45737f81868806a1.


Forensic Investigation Notes: Analysis of the compromised host revealed Ligolo artifacts at C:\Users\Public\Documents\winlogon.exe. Memory dump analysis confirmed execution of Nmap. Registry modifications pointed to persistence via /usr/local/bin/sam.hive. Network forensics identified connections to 62.36.134.178 and relaynode.tech. Email headers traced the initial vector to alert@login-portal.tech. File C:\Windows\Tasks\helper.sh (MD5: 3907b7f91da58708dd0e6ee9fb4e7f51) was identified as the initial dropper. A staging URL hxxps://syncproxy.info/callback resolved to 35.88.180.242. Secondary artifact hash: SHA1: 0212854989ed01c67f6250e5485bb650fe56e008.


Forensic Investigation Notes: Analysis of the compromised host revealed CrackMapExec artifacts at /opt/app/bin/csrss.exe. Memory dump analysis confirmed execution of GhostPack. Registry modifications pointed to persistence via C:\Windows\Tasks\runtime.dll. Network forensics identified connections to 96.178.9.214 and gateway-portal.com. Email headers traced the initial vector to account@mail-service.info. File /opt/app/bin/payload.bin (SHA256: fbd3d9c0cbae32967244f2ef27a3bf7b44515ad8726de5ddf9982c6e94123801) was identified as the initial dropper. A staging URL hxxp://cloud-gateway.org/wp-content/uploads/doc.php resolved to 125.154.249.93. Secondary artifact hash: SHA256: 3b9ead3b3e4438feea83ebb8260040819a2cb4f2e4a3bb9ca5a18ce5f51e8cae.


Forensic Investigation Notes: Analysis of the compromised host revealed WinPEAS artifacts at /home/user/.config/sam.hive. Memory dump analysis confirmed execution of Hashcat. Registry modifications pointed to persistence via C:\Windows\Temp\agent.py. Network forensics identified connections to 207.227.49.66 and authedge.tech. Email headers traced the initial vector to notification@auth-check.org. File C:\Windows\Temp\sam.hive (SHA256: d41372dd2da9739c0613aa1cf181a91a7628316c65cdd42744069c7203294f18) was identified as the initial dropper. A staging URL https://node-cloud.online/secure/token resolved to 172.250.125.250. Secondary artifact hash: MD5: 8ad07133d461910c2e99090c9c58ae27.


Forensic Investigation Notes: Analysis of the compromised host revealed GhostPack artifacts at C:\Users\admin\Desktop\update.dll. Memory dump analysis confirmed execution of Sharphound. Registry modifications pointed to persistence via C:\Users\Public\Documents\sam.hive. Network forensics identified connections to 10.39.235.90 and portal-relay.cc. Email headers traced the initial vector to hr@document-share.link. File C:\Windows\Temp\runtime.dll (SHA1: 00b472a7ef475a63668c17948525561e7c369d96) was identified as the initial dropper. A staging URL hxxp://proxy-edge.site/panel/index.html resolved to 192.20.53.113. Secondary artifact hash: MD5: c48b4cf283597b4f25d38ba6bf4eff08.


Forensic Investigation Notes: Analysis of the compromised host revealed LaZagne artifacts at /opt/app/bin/winlogon.exe. Memory dump analysis confirmed execution of ADFind. Registry modifications pointed to persistence via C:\Users\Public\Documents\lsass.dmp. Network forensics identified connections to 192.217.227.103 and mail-mail.club. Email headers traced the initial vector to contact@phishing-domain.com. File C:\Windows\System32\taskhost.exe (SHA1: b925ef5a1bfe13ed90fb0d58cac8fb4840c97931) was identified as the initial dropper. A staging URL hxxp://cdnrelay.org/panel/index.html resolved to 172.101.219.125. Secondary artifact hash: MD5: c53468ce263953cd06f72b572bdaf3be.


Forensic Investigation Notes: Analysis of the compromised host revealed Ligolo artifacts at /tmp/backdoor.elf. Memory dump analysis confirmed execution of Havoc. Registry modifications pointed to persistence via C:\ProgramData\runtime.dll. Network forensics identified connections to 10.139.97.13 and staticdata.site. Email headers traced the initial vector to helpdesk@auth-check.org. File /var/tmp/csrss.exe (SHA256: eca409dd8e0dd22accc1dc85728be4b9714d4b28f917ea74ace5daddcc7f5703) was identified as the initial dropper. A staging URL hxxps://cachegateway.online/assets/js/payload.js resolved to 220.158.84.127. Secondary artifact hash: SHA256: cd3ab10f7d3c6ad3da62e14db14ecd84a00109997635dfffd3f303c4ecaf44a9.


Forensic Investigation Notes: Analysis of the compromised host revealed Mythic artifacts at /usr/local/bin/loader.exe. Memory dump analysis confirmed execution of LinPEAS. Registry modifications pointed to persistence via C:\Windows\Temp\runtime.dll. Network forensics identified connections to 172.223.186.144 and securegateway.xyz. Email headers traced the initial vector to verify@document-share.link. File C:\Windows\Temp\update.dll (MD5: 25dd4e3dbff622622ba62cdfb52da5e2) was identified as the initial dropper. A staging URL http://apilogin.dev/callback resolved to 172.12.89.250. Secondary artifact hash: SHA1: f55c73ad686980efb9fb329606b2ed241a5e0321.


Forensic Investigation Notes: Analysis of the compromised host revealed Seatbelt artifacts at C:\Users\Public\Documents\chrome_helper.exe. Memory dump analysis confirmed execution of Hashcat. Registry modifications pointed to persistence via C:\Windows\System32\payload.bin. Network forensics identified connections to 172.81.193.22 and staticbackup.site. Email headers traced the initial vector to updates@mail-service.info. File /tmp/config.dat (SHA256: 6020ba3371a662a792583c8c57d6458b29b9d839deb02b6fad8f62cb29a40752) was identified as the initial dropper. A staging URL hxxp://portalmail.club/download/update.exe resolved to 192.250.75.216. Secondary artifact hash: MD5: c824da4473e88f4315149d186def9d40.


Forensic Investigation Notes: Analysis of the compromised host revealed Sharphound artifacts at /etc/cron.d/winlogon.exe. Memory dump analysis confirmed execution of Certutil. Registry modifications pointed to persistence via /usr/local/bin/agent.py. Network forensics identified connections to 22.109.195.236 and cloud-edge.live. Email headers traced the initial vector to alert@document-share.link. File C:\ProgramData\taskhost.exe (SHA1: 213fe93b81928609f1b06209c4151478790cda64) was identified as the initial dropper. A staging URL https://relay-gateway.io/api/v2/auth resolved to 49.9.173.37. Secondary artifact hash: SHA256: 57d7e72f63a13cd53260efd61521680f35f37bc1ba68bdad5736b28ac80a4420.


Forensic Investigation Notes: Analysis of the compromised host revealed SharpHound artifacts at /usr/local/bin/beacon.dll. Memory dump analysis confirmed execution of Merlin. Registry modifications pointed to persistence via C:\ProgramData\backdoor.elf. Network forensics identified connections to 172.124.101.63 and relay-secure.io. Email headers traced the initial vector to service@phishing-domain.com. File C:\Users\admin\Desktop\payload.bin (SHA256: a0e0c676f1f7c2be4d95ca9263b202536e129cb78a4e3c8add640e0fe7f5b983) was identified as the initial dropper. A staging URL http://update-node.online/portal/verify resolved to 69.30.49.29. Secondary artifact hash: SHA256: b1f45be04ecddcb1d8f5aa7ebf865b7d6fc3a7f076680ed3d8b192c4bbdb99f0.


Forensic Investigation Notes: Analysis of the compromised host revealed Covenant artifacts at C:\Windows\Tasks\beacon.dll. Memory dump analysis confirmed execution of Impacket. Registry modifications pointed to persistence via C:\Users\admin\AppData\Local\Temp\shell.php. Network forensics identified connections to 112.55.121.199 and gatewayproxy.club. Email headers traced the initial vector to contact@account-update.xyz. File C:\Windows\Temp\ntds.dit (SHA1: ff1264517e7f9008f3d6ae77a4ab7ec4754ba7be) was identified as the initial dropper. A staging URL https://proxy-login.com/panel/index.html resolved to 97.73.191.1. Secondary artifact hash: SHA1: 0c962f371cf05264eebcf1faa399691b86541f7f.


Forensic Investigation Notes: Analysis of the compromised host revealed BITSAdmin artifacts at C:\Users\admin\Desktop\dropper.ps1. Memory dump analysis confirmed execution of ADFind. Registry modifications pointed to persistence via C:\Users\admin\AppData\Local\Temp\agent.py. Network forensics identified connections to 10.115.82.100 and relaybackup.net. Email headers traced the initial vector to info@identity-verify.cc. File C:\Users\Public\Documents\loader.exe (MD5: fb1997cdf75f005338ba055108262574) was identified as the initial dropper. A staging URL hxxps://storage-data.cc/callback resolved to 168.168.205.66. Secondary artifact hash: SHA1: 5688978ac750cc96f89feedf187a3f54534fda66.


Forensic Investigation Notes: Analysis of the compromised host revealed CrackMapExec artifacts at /usr/local/bin/shell.php. Memory dump analysis confirmed execution of BITSAdmin. Registry modifications pointed to persistence via C:\Users\admin\AppData\Local\Temp\shell.php. Network forensics identified connections to 172.58.230.175 and cloud-portal.io. Email headers traced the initial vector to service@credential-check.site. File /dev/shm/svchost.exe (SHA256: 936e4eaadb4717d1990c15dc24e401d2a9f0d47dbad03bc26b02e0e8ed4a24f4) was identified as the initial dropper. A staging URL hxxps://relay-sync.org/secure/token resolved to 10.35.191.144. Secondary artifact hash: MD5: 64c6c797c30f7e11cd114ee28a5751eb.


Forensic Investigation Notes: Analysis of the compromised host revealed Havoc artifacts at /var/tmp/chrome_helper.exe. Memory dump analysis confirmed execution of Covenant. Registry modifications pointed to persistence via /var/tmp/lsass.dmp. Network forensics identified connections to 10.89.57.109 and nodeupdate.org. Email headers traced the initial vector to report@login-portal.tech. File C:\Windows\System32\winlogon.exe (SHA256: 1ad1da004cd3d5cfca8762f44ebbd556159d01d134a17386bda8e3b4e9d5fbc1) was identified as the initial dropper. A staging URL https://mail-edge.xyz/wp-content/uploads/doc.php resolved to 192.233.187.203. Secondary artifact hash: MD5: 45fccbaef432937befcd158a8399982b.


Forensic Investigation Notes: Analysis of the compromised host revealed Merlin artifacts at C:\ProgramData\svchost.exe. Memory dump analysis confirmed execution of GhostPack. Registry modifications pointed to persistence via C:\Program Files\Common Files\csrss.exe. Network forensics identified connections to 80.173.129.97 and api-backup.com. Email headers traced the initial vector to info@account-update.xyz. File C:\Windows\Tasks\helper.sh (MD5: c211ee1e68447fe7d7870f46fbdacbb7) was identified as the initial dropper. A staging URL https://cloud-api.cc/secure/token resolved to 192.176.62.7. Secondary artifact hash: SHA256: 8a5cc2effcc53140675759b5f3e5a15769f1b7faffbcd1d4121b3bfb95ac9363.


Forensic Investigation Notes: Analysis of the compromised host revealed Impacket artifacts at /dev/shm/shell.php. Memory dump analysis confirmed execution of CrackMapExec. Registry modifications pointed to persistence via C:\Windows\Temp\helper.sh. Network forensics identified connections to 127.41.248.180 and cdncache.info. Email headers traced the initial vector to hr@identity-verify.cc. File /opt/app/bin/implant.so (MD5: 6a115677993d4691477f2fb952a642a0) was identified as the initial dropper. A staging URL https://storage-api.site/panel/index.html resolved to 10.16.176.106. Secondary artifact hash: SHA256: 139229bc5787d6b98ec393bab060212dce46cff080016305cf7df3e64c1838ae.


Forensic Investigation Notes: Analysis of the compromised host revealed Hashcat artifacts at /var/tmp/dropper.ps1. Memory dump analysis confirmed execution of Sharphound. Registry modifications pointed to persistence via /opt/app/bin/runtime.dll. Network forensics identified connections to 30.232.206.118 and syncdata.info. Email headers traced the initial vector to notification@credential-check.site. File /var/tmp/sam.hive (MD5: 6bbc016c66942019e0042e624f36cb26) was identified as the initial dropper. A staging URL hxxp://api-proxy.link/login resolved to 222.223.31.3. Secondary artifact hash: SHA1: de234f683902f93c597b9f70480c059ca7105608.


Forensic Investigation Notes: Analysis of the compromised host revealed Metasploit artifacts at /var/tmp/helper.sh. Memory dump analysis confirmed execution of Certutil. Registry modifications pointed to persistence via C:\Users\admin\Downloads\backdoor.elf. Network forensics identified connections to 223.174.59.200 and relaycloud.live. Email headers traced the initial vector to info@auth-check.org. File C:\Program Files\Common Files\sam.hive (MD5: e90b5c6f63028736b96242d567db123a) was identified as the initial dropper. A staging URL https://updatestorage.live/download/update.exe resolved to 172.143.22.151. Secondary artifact hash: MD5: 3c55d5377d8b8b08f7b53a75325b22fa.


Forensic Investigation Notes: Analysis of the compromised host revealed LinPEAS artifacts at /dev/shm/update.dll. Memory dump analysis confirmed execution of Chisel. Registry modifications pointed to persistence via C:\Windows\Tasks\implant.so. Network forensics identified connections to 106.60.53.28 and mailbackup.top. Email headers traced the initial vector to contact@auth-check.org. File /etc/cron.d/shell.php (SHA1: cf2190edd3bf57c794d13b2bf730275966045f7e) was identified as the initial dropper. A staging URL http://loginnode.cc/download/update.exe resolved to 172.242.200.79. Secondary artifact hash: MD5: d5650ee4cb905ef3351d05e23657789a.


Forensic Investigation Notes: Analysis of the compromised host revealed ADFind artifacts at C:\Users\admin\Downloads\lsass.dmp. Memory dump analysis confirmed execution of Rubeus. Registry modifications pointed to persistence via /tmp/agent.py. Network forensics identified connections to 192.5.132.245 and portalcache.club. Email headers traced the initial vector to contact@secure-verify.net. File /opt/app/bin/backdoor.elf (SHA1: 2f06e5e77c2316bcc698764210ecbb4911f3a7b8) was identified as the initial dropper. A staging URL http://node-login.dev/panel/index.html resolved to 136.178.213.3. Secondary artifact hash: SHA256: f16b28019a254c809fa3ef4c7f20e19cb8d5c03a8fcdeceedff3211119567cb6.


Forensic Investigation Notes: Analysis of the compromised host revealed GhostPack artifacts at /dev/shm/update.dll. Memory dump analysis confirmed execution of Impacket. Registry modifications pointed to persistence via C:\Windows\Tasks\sam.hive. Network forensics identified connections to 11.105.208.37 and relay-api.top. Email headers traced the initial vector to support@credential-check.site. File C:\Windows\Tasks\sam.hive (SHA1: cbfcb01457735f027b930200bd4ace3fbde0d043) was identified as the initial dropper. A staging URL http://mail-auth.org/download/update.exe resolved to 58.254.239.151. Secondary artifact hash: MD5: d2101a073e6a732570fcab70298516a4.


Forensic Investigation Notes: Analysis of the compromised host revealed WinPEAS artifacts at C:\Users\admin\Downloads\update.dll. Memory dump analysis confirmed execution of Mythic. Registry modifications pointed to persistence via C:\Program Files\Common Files\dropper.ps1. Network forensics identified connections to 10.123.26.202 and updateportal.live. Email headers traced the initial vector to admin@identity-verify.cc. File C:\Users\admin\Downloads\agent.py (SHA256: 62f57f3e7ff60d48cd8c4c7e1f95c4d48abb90fbc0728a7c0537b567adfa777b) was identified as the initial dropper. A staging URL https://dataupdate.site/admin/config resolved to 10.117.129.72. Secondary artifact hash: SHA256: 72bce74331d3aa18022936633fbece31d60da5356cd78419cd8d2f9aefd82f2a.


Forensic Investigation Notes: Analysis of the compromised host revealed Mythic artifacts at C:\Windows\System32\runtime.dll. Memory dump analysis confirmed execution of Covenant. Registry modifications pointed to persistence via /opt/app/bin/sam.hive. Network forensics identified connections to 24.69.175.63 and syncsync.io. Email headers traced the initial vector to confirm@auth-check.org. File C:\Users\admin\Desktop\winlogon.exe (SHA256: b86e29372fdc04cd8ef14e6b2160d1838f222c2b1948bc4ce94095a243a58a6b) was identified as the initial dropper. A staging URL https://edgeproxy.link/wp-content/uploads/doc.php resolved to 184.24.16.202. Secondary artifact hash: SHA1: b05554c70364f2f60a798729b13872fe29f2ce54.


Forensic Investigation Notes: Analysis of the compromised host revealed Havoc artifacts at C:\Users\Public\Documents\taskhost.exe. Memory dump analysis confirmed execution of Sliver. Registry modifications pointed to persistence via C:\Windows\Temp\backdoor.elf. Network forensics identified connections to 192.3.165.64 and updateproxy.io. Email headers traced the initial vector to confirm@urgent-notice.online. File C:\Users\admin\Downloads\csrss.exe (MD5: ca2e43e0d51d5aa85fb9ed9fdf332d94) was identified as the initial dropper. A staging URL hxxp://edgeportal.com/login resolved to 106.154.67.94. Secondary artifact hash: MD5: d278f188220e7ccfa1ecb1e51fbc3a94.


Forensic Investigation Notes: Analysis of the compromised host revealed SharpHound artifacts at /var/tmp/shell.php. Memory dump analysis confirmed execution of Covenant. Registry modifications pointed to persistence via C:\Windows\System32\config.dat. Network forensics identified connections to 10.166.205.247 and securenode.online. Email headers traced the initial vector to info@mail-service.info. File C:\Users\Public\Documents\helper.sh (SHA256: b7f0f4cf45fca295d1ade884e5f7db5157b3f2dd093337305f1a8340b7ab6f1f) was identified as the initial dropper. A staging URL http://backup-cache.tech/download/update.exe resolved to 54.67.241.145. Secondary artifact hash: MD5: 199d4e83864eb06462efbd89a5951e57.


Forensic Investigation Notes: Analysis of the compromised host revealed Burp Suite artifacts at C:\Users\Public\Documents\beacon.dll. Memory dump analysis confirmed execution of Hashcat. Registry modifications pointed to persistence via C:\Users\admin\Desktop\agent.py. Network forensics identified connections to 10.93.3.121 and secure-node.online. Email headers traced the initial vector to info@account-update.xyz. File /home/user/.config/taskhost.exe (MD5: a87444b41ea4b2d200b047d3f044e276) was identified as the initial dropper. A staging URL hxxps://login-secure.club/api/v2/auth resolved to 10.165.40.180. Secondary artifact hash: SHA256: ae619e98a6b28a5cd6cd2e4fc03c81572cecd892766e6c5e6bc0717cdf19be43.


Forensic Investigation Notes: Analysis of the compromised host revealed Metasploit artifacts at /dev/shm/csrss.exe. Memory dump analysis confirmed execution of Chisel. Registry modifications pointed to persistence via /home/user/.config/csrss.exe. Network forensics identified connections to 159.70.34.15 and storageupdate.link. Email headers traced the initial vector to security@identity-verify.cc. File /usr/local/bin/chrome_helper.exe (MD5: 846560ce3c1096a71b0c9faffc5c7d6e) was identified as the initial dropper. A staging URL hxxps://syncsync.org/wp-content/uploads/doc.php resolved to 104.212.67.224. Secondary artifact hash: MD5: 16bf9a924f6956a8830b5d638fae4124.


Forensic Investigation Notes: Analysis of the compromised host revealed Impacket artifacts at C:\Users\admin\Desktop\update.dll. Memory dump analysis confirmed execution of Havoc. Registry modifications pointed to persistence via /dev/shm/dropper.ps1. Network forensics identified connections to 10.6.190.130 and gateway-cdn.link. Email headers traced the initial vector to hr@auth-check.org. File /opt/app/bin/agent.py (SHA1: a55243413e5b2edd6ede7684f3d77d883454013d) was identified as the initial dropper. A staging URL hxxp://staticlogin.xyz/callback resolved to 37.121.110.102. Secondary artifact hash: SHA1: ce25ca7064f5d36994832f369f8a92fd6c128d47.


Forensic Investigation Notes: Analysis of the compromised host revealed CrackMapExec artifacts at /dev/shm/chrome_helper.exe. Memory dump analysis confirmed execution of Chisel. Registry modifications pointed to persistence via /usr/local/bin/dropper.ps1. Network forensics identified connections to 2.48.186.12 and loginupdate.cc. Email headers traced the initial vector to info@document-share.link. File /opt/app/bin/loader.exe (SHA1: c86f64bc9ee77d30f5bce6341c0a300c93b29e09) was identified as the initial dropper. A staging URL hxxp://cdn-auth.live/panel/index.html resolved to 192.221.254.156. Secondary artifact hash: SHA256: 570400991888f798b5a4b7714f01079e1f820f7701d5c5657dae4d6a5f228ceb.


Forensic Investigation Notes: Analysis of the compromised host revealed Sliver artifacts at /etc/cron.d/payload.bin. Memory dump analysis confirmed execution of Covenant. Registry modifications pointed to persistence via /var/tmp/helper.sh. Network forensics identified connections to 148.101.244.150 and storageauth.net. Email headers traced the initial vector to billing@document-share.link. File C:\Windows\System32\shell.php (MD5: f6995f79dd9359bc2da92c020bd6cef0) was identified as the initial dropper. A staging URL hxxp://apibackup.cc/login resolved to 130.82.52.88. Secondary artifact hash: SHA256: c686c256e6fc5fc08c95e325977f2395ab9085b935411ef0680a1b42dcb2f79e.


Forensic Investigation Notes: Analysis of the compromised host revealed Sharphound artifacts at C:\Windows\Tasks\winlogon.exe. Memory dump analysis confirmed execution of BITSAdmin. Registry modifications pointed to persistence via C:\Windows\Tasks\agent.py. Network forensics identified connections to 212.121.210.41 and api-secure.info. Email headers traced the initial vector to verify@credential-check.site. File C:\Users\Public\Documents\agent.py (SHA256: 19f5795942180767228cc378c475432066be5c42b780ea35c3feb5c2d544edd0) was identified as the initial dropper. A staging URL hxxp://gateway-relay.online/portal/verify resolved to 34.177.40.133. Secondary artifact hash: MD5: c34efaeb1e5351816675f6a16daa8496.


Forensic Investigation Notes: Analysis of the compromised host revealed BITSAdmin artifacts at /home/user/.config/runtime.dll. Memory dump analysis confirmed execution of BloodHound. Registry modifications pointed to persistence via /home/user/.config/runtime.dll. Network forensics identified connections to 43.192.185.122 and secure-static.dev. Email headers traced the initial vector to helpdesk@mail-service.info. File /opt/app/bin/agent.py (SHA1: 2dc4c23329049eea88ca496befb5dc81b1b86492) was identified as the initial dropper. A staging URL http://backup-login.info/collect resolved to 172.207.157.58. Secondary artifact hash: MD5: 08e56a543e26d209532bc4115f1fdd78.


Forensic Investigation Notes: Analysis of the compromised host revealed Seatbelt artifacts at C:\Program Files\Common Files\update.dll. Memory dump analysis confirmed execution of WinPEAS. Registry modifications pointed to persistence via C:\Windows\Temp\update.dll. Network forensics identified connections to 179.181.247.59 and portal-portal.club. Email headers traced the initial vector to noreply@account-update.xyz. File /home/user/.config/svchost.exe (SHA1: ea1770a8c791419e9d4ba854f93baa64f7efa0a5) was identified as the initial dropper. A staging URL hxxps://syncstatic.org/wp-content/uploads/doc.php resolved to 107.65.147.226. Secondary artifact hash: SHA256: 2ce7e92bf743efdf5b75af69d3c02dc00c72d155ca0e3776240d734335db3389.


Forensic Investigation Notes: Analysis of the compromised host revealed Impacket artifacts at C:\Program Files\Common Files\implant.so. Memory dump analysis confirmed execution of Nmap. Registry modifications pointed to persistence via /var/tmp/update.dll. Network forensics identified connections to 192.170.75.120 and portal-backup.dev. Email headers traced the initial vector to verify@auth-check.org. File C:\ProgramData\backdoor.elf (SHA1: b6d4c26a4710006384e7129246055564e4d307a0) was identified as the initial dropper. A staging URL hxxps://cacheupdate.dev/admin/config resolved to 10.58.235.48. Secondary artifact hash: SHA256: 7f91f92264bf002ada975440a1b29821f26576d3643ee602cec90b935705f49a.


Forensic Investigation Notes: Analysis of the compromised host revealed Merlin artifacts at C:\ProgramData\loader.exe. Memory dump analysis confirmed execution of Impacket. Registry modifications pointed to persistence via /usr/local/bin/payload.bin. Network forensics identified connections to 115.156.83.41 and proxyproxy.link. Email headers traced the initial vector to it@login-portal.tech. File /var/tmp/runtime.dll (MD5: 85a1466e4e86f82b6d0fe8baa0dc4781) was identified as the initial dropper. A staging URL hxxp://secure-secure.site/assets/js/payload.js resolved to 192.165.213.176. Secondary artifact hash: SHA1: 9fbafb71b8fccb96f76d8d18debe2e07d6de6604.


Forensic Investigation Notes: Analysis of the compromised host revealed Brute Ratel artifacts at /home/user/.config/sam.hive. Memory dump analysis confirmed execution of LaZagne. Registry modifications pointed to persistence via /var/tmp/lsass.dmp. Network forensics identified connections to 10.8.19.181 and backup-backup.org. Email headers traced the initial vector to verify@login-portal.tech. File /opt/app/bin/svchost.exe (SHA256: 7c1b2e633c278cd2f296d5f2fe45d21b7aac649b3590be6feec766fa17b09a69) was identified as the initial dropper. A staging URL hxxps://storagesync.top/assets/js/payload.js resolved to 172.153.232.105. Secondary artifact hash: SHA1: 93c752654a64a34d8b30263ca579e573f38a5506.


Forensic Investigation Notes: Analysis of the compromised host revealed BITSAdmin artifacts at /home/user/.config/config.dat. Memory dump analysis confirmed execution of Ligolo. Registry modifications pointed to persistence via /var/tmp/taskhost.exe. Network forensics identified connections to 192.31.221.114 and backup-data.top. Email headers traced the initial vector to notification@phishing-domain.com. File C:\Users\admin\Desktop\implant.so (MD5: 60b5c8b909899da177be196e1f249415) was identified as the initial dropper. A staging URL hxxp://storagecloud.club/assets/js/payload.js resolved to 208.137.115.160. Secondary artifact hash: SHA1: 7a2588961d8ba92da62dad5672993037a3d4d3e1.


Forensic Investigation Notes: Analysis of the compromised host revealed PsExec artifacts at /etc/cron.d/config.dat. Memory dump analysis confirmed execution of Sliver. Registry modifications pointed to persistence via /dev/shm/dropper.ps1. Network forensics identified connections to 192.50.113.64 and cloud-cdn.org. Email headers traced the initial vector to finance@secure-verify.net. File /var/tmp/winlogon.exe (MD5: e44101d9609bf1d52e4d28e3dba5f6ee) was identified as the initial dropper. A staging URL http://login-backup.link/portal/verify resolved to 172.119.141.88. Secondary artifact hash: SHA256: ff6321b03e02967fb6c494bd6f72fc244a9dca9755e4f23fbe1acabfcddd2775.


Forensic Investigation Notes: Analysis of the compromised host revealed Mimikatz artifacts at C:\Windows\Temp\shell.php. Memory dump analysis confirmed execution of PowerShell Empire. Registry modifications pointed to persistence via /etc/cron.d/runtime.dll. Network forensics identified connections to 172.22.165.235 and storage-auth.live. Email headers traced the initial vector to info@auth-check.org. File C:\Windows\Tasks\config.dat (SHA256: 4bf4c62d0406287a63ebac6599b1e026d392671bb6d6f0e7c30b367bdbb0621c) was identified as the initial dropper. A staging URL http://storageedge.live/login resolved to 172.24.64.64. Secondary artifact hash: SHA256: 0275a4e5f4a35de4bfbf652741de4a489c4e4b4e5bc0a34ef4e09fa66cf4995b.


Forensic Investigation Notes: Analysis of the compromised host revealed Seatbelt artifacts at /usr/local/bin/update.dll. Memory dump analysis confirmed execution of LaZagne. Registry modifications pointed to persistence via /usr/local/bin/payload.bin. Network forensics identified connections to 19.40.80.96 and node-cdn.online. Email headers traced the initial vector to info@document-share.link. File C:\Windows\System32\agent.py (MD5: 2fc8739d4c5ab2b5afcec4540af3074f) was identified as the initial dropper. A staging URL hxxps://data-mail.dev/secure/token resolved to 220.44.67.83. Secondary artifact hash: MD5: cfb71a80eb61496f0b8dcb2e661fabd9.


Forensic Investigation Notes: Analysis of the compromised host revealed Mimikatz artifacts at /var/tmp/agent.py. Memory dump analysis confirmed execution of Covenant. Registry modifications pointed to persistence via /usr/local/bin/chrome_helper.exe. Network forensics identified connections to 220.160.183.128 and sync-gateway.xyz. Email headers traced the initial vector to contact@secure-verify.net. File /dev/shm/taskhost.exe (MD5: 0be6383fdc3e9ae48b1d8a47606bc5a6) was identified as the initial dropper. A staging URL https://loginapi.top/assets/js/payload.js resolved to 172.221.118.45. Secondary artifact hash: SHA1: d37d89f867324261d0e44634f39529788fd32387.


Forensic Investigation Notes: Analysis of the compromised host revealed Mythic artifacts at C:\Program Files\Common Files\helper.sh. Memory dump analysis confirmed execution of Impacket. Registry modifications pointed to persistence via /opt/app/bin/payload.bin. Network forensics identified connections to 172.21.148.40 and staticrelay.online. Email headers traced the initial vector to finance@login-portal.tech. File C:\Windows\Temp\svchost.exe (MD5: 72c453e7ea2832a4f35a1a8fd52aa284) was identified as the initial dropper. A staging URL hxxps://gateway-update.dev/assets/js/payload.js resolved to 172.197.183.171. Secondary artifact hash: MD5: 3a9b6f376de5578d52a52fdf62dfea31.


Forensic Investigation Notes: Analysis of the compromised host revealed Certutil artifacts at C:\Users\admin\AppData\Local\Temp\taskhost.exe. Memory dump analysis confirmed execution of LaZagne. Registry modifications pointed to persistence via C:\Users\admin\AppData\Local\Temp\chrome_helper.exe. Network forensics identified connections to 192.110.76.125 and authportal.xyz. Email headers traced the initial vector to alert@identity-verify.cc. File /home/user/.config/ntds.dit (SHA1: 3a510bdafffd53483c1879790fc47d8af0f85326) was identified as the initial dropper. A staging URL https://edgemail.net/callback resolved to 192.106.19.72. Secondary artifact hash: SHA256: 1db99cd164f01b294d64e353545117da0745184ae951bac91bc622f0a506099e.


Forensic Investigation Notes: Analysis of the compromised host revealed Sharphound artifacts at C:\Users\admin\AppData\Local\Temp\csrss.exe. Memory dump analysis confirmed execution of Certutil. Registry modifications pointed to persistence via C:\Users\admin\AppData\Local\Temp\shell.php. Network forensics identified connections to 172.245.90.135 and secureupdate.club. Email headers traced the initial vector to alert@mail-service.info. File C:\Users\admin\Desktop\winlogon.exe (MD5: 7935e8f78b9fe82de865144598c9fb3d) was identified as the initial dropper. A staging URL hxxp://logincloud.online/secure/token resolved to 10.245.79.183. Secondary artifact hash: SHA1: 65c0e21901b008953fb35877e60af0683ca3f095.


Forensic Investigation Notes: Analysis of the compromised host revealed PowerShell Empire artifacts at C:\Program Files\Common Files\agent.py. Memory dump analysis confirmed execution of Nmap. Registry modifications pointed to persistence via C:\Windows\Temp\sam.hive. Network forensics identified connections to 172.227.190.27 and apisync.site. Email headers traced the initial vector to notification@phishing-domain.com. File /var/tmp/svchost.exe (SHA1: ff462eed44b9277c2ca2b6c4c8e69543e0effc1e) was identified as the initial dropper. A staging URL http://portalnode.io/gate.php resolved to 89.145.104.106. Secondary artifact hash: SHA256: aef3f88227dddbced576df997ff1bbb8b94ae99dd2395ffe214b673a8b66010e.


Forensic Investigation Notes: Analysis of the compromised host revealed Merlin artifacts at /etc/cron.d/chrome_helper.exe. Memory dump analysis confirmed execution of Sharphound. Registry modifications pointed to persistence via /opt/app/bin/beacon.dll. Network forensics identified connections to 111.23.179.172 and api-node.com. Email headers traced the initial vector to updates@login-portal.tech. File C:\Users\Public\Documents\chrome_helper.exe (MD5: 927e5db7b8dbca2aa2aed483ecd9b826) was identified as the initial dropper. A staging URL https://update-cdn.org/panel/index.html resolved to 211.205.106.78. Secondary artifact hash: MD5: eb5038d2b8f98e63290ebecfaadeb234.


Forensic Investigation Notes: Analysis of the compromised host revealed Rubeus artifacts at /etc/cron.d/ntds.dit. Memory dump analysis confirmed execution of Covenant. Registry modifications pointed to persistence via /opt/app/bin/runtime.dll. Network forensics identified connections to 204.123.9.174 and authcache.link. Email headers traced the initial vector to contact@secure-verify.net. File /var/tmp/beacon.dll (SHA1: aefb874c29b87f07d2167dbf1af18fb511dc92cb) was identified as the initial dropper. A staging URL hxxp://backupedge.online/login resolved to 10.193.253.177. Secondary artifact hash: MD5: 3420a0c88c210223520d8798a1c2b975.


Forensic Investigation Notes: Analysis of the compromised host revealed LaZagne artifacts at C:\Users\Public\Documents\payload.bin. Memory dump analysis confirmed execution of PowerShell Empire. Registry modifications pointed to persistence via /usr/local/bin/update.dll. Network forensics identified connections to 7.29.175.76 and portalrelay.xyz. Email headers traced the initial vector to noreply@mail-service.info. File C:\Windows\System32\csrss.exe (MD5: 54d50a5e98dd6f90eb7680909e49a431) was identified as the initial dropper. A staging URL hxxps://authportal.xyz/wp-content/uploads/doc.php resolved to 192.18.106.146. Secondary artifact hash: MD5: 682db8603d8178596213a53b5e8fcaaf.


Forensic Investigation Notes: Analysis of the compromised host revealed BITSAdmin artifacts at /home/user/.config/helper.sh. Memory dump analysis confirmed execution of Sharphound. Registry modifications pointed to persistence via /var/tmp/update.dll. Network forensics identified connections to 58.160.80.158 and authrelay.cc. Email headers traced the initial vector to contact@auth-check.org. File C:\Windows\Temp\svchost.exe (SHA1: 191f002c6f4a341f6a04b46da27d2a19acc21ddb) was identified as the initial dropper. A staging URL http://gatewayportal.org/assets/js/payload.js resolved to 159.115.9.126. Secondary artifact hash: SHA256: e1b1ab6378c4a9ca5edb2d656ed21f3c764b5ba759ecfe14e9ca7086171234c3.


Forensic Investigation Notes: Analysis of the compromised host revealed Chisel artifacts at /tmp/csrss.exe. Memory dump analysis confirmed execution of Ligolo. Registry modifications pointed to persistence via C:\Users\Public\Documents\loader.exe. Network forensics identified connections to 172.167.206.15 and data-backup.com. Email headers traced the initial vector to updates@credential-check.site. File C:\Users\admin\Desktop\config.dat (SHA256: a7014c28e3407ce844ca9946b11a6dbf129786eb05dfa018ff0f17f127193460) was identified as the initial dropper. A staging URL https://secure-mail.net/panel/index.html resolved to 10.65.127.10. Secondary artifact hash: MD5: 273682b11d313cc43020580110056737.


Forensic Investigation Notes: Analysis of the compromised host revealed ADFind artifacts at C:\Users\admin\AppData\Local\Temp\backdoor.elf. Memory dump analysis confirmed execution of BloodHound. Registry modifications pointed to persistence via C:\Users\Public\Documents\loader.exe. Network forensics identified connections to 172.206.220.12 and syncproxy.top. Email headers traced the initial vector to notification@urgent-notice.online. File C:\Users\admin\Downloads\loader.exe (SHA256: dae10011278a06fc0e3897ac50c55860172949d68e2af67971935ffe4afee9d9) was identified as the initial dropper. A staging URL https://cloudgateway.net/download/update.exe resolved to 10.111.65.125. Secondary artifact hash: MD5: 011ebe322979a2b61ca679514edfe3d6.


Forensic Investigation Notes: Analysis of the compromised host revealed Brute Ratel artifacts at /dev/shm/lsass.dmp. Memory dump analysis confirmed execution of Impacket. Registry modifications pointed to persistence via /opt/app/bin/dropper.ps1. Network forensics identified connections to 10.81.132.178 and data-relay.xyz. Email headers traced the initial vector to finance@auth-check.org. File /home/user/.config/agent.py (MD5: fdc7e61a8a7f2450b81e0806b6823ec6) was identified as the initial dropper. A staging URL hxxps://data-api.live/panel/index.html resolved to 172.201.97.186. Secondary artifact hash: SHA256: 1b5bc5901a6c11a892975e4e1e8c329abb196b9506532825abb6d6d4c6624ce2.


Forensic Investigation Notes: Analysis of the compromised host revealed LinPEAS artifacts at C:\Users\admin\AppData\Local\Temp\payload.bin. Memory dump analysis confirmed execution of Metasploit. Registry modifications pointed to persistence via C:\Users\admin\Desktop\lsass.dmp. Network forensics identified connections to 192.209.3.99 and node-cache.live. Email headers traced the initial vector to alert@document-share.link. File C:\Users\Public\Documents\backdoor.elf (SHA256: 2d8d7761553f026654d921c8caf1bbccac88a6f9bf5b757045441a7607fcf377) was identified as the initial dropper. A staging URL hxxp://storage-portal.top/portal/verify resolved to 10.135.232.239. Secondary artifact hash: SHA1: ef81507f1031d04d8cd39f95f9b30b07b59a16cd.


Forensic Investigation Notes: Analysis of the compromised host revealed Merlin artifacts at /dev/shm/ntds.dit. Memory dump analysis confirmed execution of Impacket. Registry modifications pointed to persistence via /tmp/agent.py. Network forensics identified connections to 172.47.101.194 and backup-update.tech. Email headers traced the initial vector to helpdesk@account-update.xyz. File C:\ProgramData\update.dll (SHA256: 6bf125aa6367aafaf4717c64ccf8d15e02656e3e63b6d6ed59582bedecc69935) was identified as the initial dropper. A staging URL hxxps://authrelay.live/portal/verify resolved to 192.53.56.242. Secondary artifact hash: MD5: 9f081681c17f2fbcaa0d8052505e9179.