Malware Analysis Report: RemcosRAT (SHA256: 38ad20887d2715778f071a6cc5a0528469f6a883e242d9f68a10a32c3858d660). Upon execution on F5 BIG-IP, the sample creates /opt/app/bin/winlogon.exe and injects into legitimate processes. Network analysis shows beaconing to 124.176.96.161 every 60 seconds and DNS queries to relaycloud.online. The second stage was fetched from https://edgerelay.net/admin/config and written to C:\Users\admin\Downloads\backdoor.elf. The payload uses Hashcat-style techniques for defense evasion. A secondary hash (SHA1: dd008052b4ed983e7fd1aa5891fd930232661f7a) was extracted from the unpacked payload.


Malware Analysis Report: Latrodectus (MD5: 92d82a0eaa8956ed8b6e0f15d703680a). Upon execution on SonicWall SMA, the sample creates /home/user/.config/payload.bin and injects into legitimate processes. Network analysis shows beaconing to 192.175.134.17 every 60 seconds and DNS queries to gatewayupdate.io. The second stage was fetched from hxxps://auth-data.online/api/v2/auth and written to /etc/cron.d/agent.py. The payload uses Brute Ratel-style techniques for defense evasion. A secondary hash (SHA1: 9c990507e7d51e1b1122226c0cc41b47df3af991) was extracted from the unpacked payload.


Malware Analysis Report: Latrodectus (SHA256: a41ca0840ba8e96f9c48c7cfa2488e7d10b60c76fcf0ae646d7c85a2f0f3fd49). Upon execution on Juniper SRX, the sample creates C:\Users\admin\AppData\Local\Temp\dropper.ps1 and injects into legitimate processes. Network analysis shows beaconing to 172.99.72.216 every 60 seconds and DNS queries to update-cloud.club. The second stage was fetched from hxxp://nodestatic.link/collect and written to /etc/cron.d/dropper.ps1. The payload uses PsExec-style techniques for defense evasion. A secondary hash (SHA1: 5dcb546ed18eaad28fcb44468c28326a586ca35f) was extracted from the unpacked payload.


Malware Analysis Report: REvil (MD5: 24d9f83b5f9a861987bb18010d2d5db8). Upon execution on Apache Struts, the sample creates C:\Program Files\Common Files\beacon.dll and injects into legitimate processes. Network analysis shows beaconing to 192.84.115.216 every 60 seconds and DNS queries to edge-static.site. The second stage was fetched from https://sync-cdn.site/callback and written to C:\Windows\Tasks\winlogon.exe. The payload uses CrackMapExec-style techniques for defense evasion. A secondary hash (SHA256: 22c5e4505b5a736bc350dda15612e06d7c4057a1d7790acbf542cf8162e38cae) was extracted from the unpacked payload.


Malware Analysis Report: Emotet (SHA256: 6e5e20d1fead7fe9f9fda50776850e5e04600198a5d74b4077cd412109504e27). Upon execution on Ivanti Connect Secure, the sample creates C:\Program Files\Common Files\lsass.dmp and injects into legitimate processes. Network analysis shows beaconing to 54.34.30.194 every 60 seconds and DNS queries to loginlogin.online. The second stage was fetched from hxxp://data-portal.link/admin/config and written to /tmp/helper.sh. The payload uses Covenant-style techniques for defense evasion. A secondary hash (MD5: f6fe795a70dbfe4be1a038f33c21a2ae) was extracted from the unpacked payload.


Malware Analysis Report: IcedID (SHA256: 4bac1f77ec283db1640c35398e9b367869b9ae3b7608bcd4922de1031634bf98). Upon execution on Zyxel USG, the sample creates C:\Users\Public\Documents\implant.so and injects into legitimate processes. Network analysis shows beaconing to 172.63.77.53 every 60 seconds and DNS queries to loginsync.link. The second stage was fetched from https://updateauth.io/panel/index.html and written to /dev/shm/helper.sh. The payload uses PowerView-style techniques for defense evasion. A secondary hash (MD5: 73419d10cab2520407d7090ec183bd2b) was extracted from the unpacked payload.


Malware Analysis Report: AsyncRAT (SHA256: 8fbc7ebabe3492c2d1be2827c288ec0706cee3d431ac1448201760ba651a2206). Upon execution on Ubuntu 22.04, the sample creates /dev/shm/agent.py and injects into legitimate processes. Network analysis shows beaconing to 40.36.174.225 every 60 seconds and DNS queries to cdnportal.live. The second stage was fetched from hxxp://authrelay.site/assets/js/payload.js and written to /var/tmp/loader.exe. The payload uses Metasploit-style techniques for defense evasion. A secondary hash (SHA1: c66ab7c114177d18b666adeb15fc39432be2e76a) was extracted from the unpacked payload.


Malware Analysis Report: StealC (SHA1: b9afe374931065135a980483ff461e36de0102a2). Upon execution on F5 BIG-IP, the sample creates /usr/local/bin/csrss.exe and injects into legitimate processes. Network analysis shows beaconing to 192.253.221.108 every 60 seconds and DNS queries to auth-sync.live. The second stage was fetched from http://syncnode.tech/admin/config and written to C:\ProgramData\svchost.exe. The payload uses Metasploit-style techniques for defense evasion. A secondary hash (MD5: b8b2d1e13c89c9930f568cad1c0fa0c2) was extracted from the unpacked payload.


Malware Analysis Report: BumbleBee (SHA1: b8f5787ce46ec96d8f909a4d60aca6d067d0b338). Upon execution on VMware ESXi, the sample creates C:\Users\Public\Documents\shell.php and injects into legitimate processes. Network analysis shows beaconing to 192.222.136.27 every 60 seconds and DNS queries to edgestatic.live. The second stage was fetched from http://staticnode.live/login and written to C:\Users\Public\Documents\shell.php. The payload uses Metasploit-style techniques for defense evasion. A secondary hash (MD5: 7c72780a56275f245e7bda7e0a49630b) was extracted from the unpacked payload.


Malware Analysis Report: BumbleBee (MD5: df5ee9ef1c10d7be6b403da2975112d7). Upon execution on SonicWall SMA, the sample creates C:\Users\admin\Downloads\svchost.exe and injects into legitimate processes. Network analysis shows beaconing to 209.201.20.89 every 60 seconds and DNS queries to relaycache.live. The second stage was fetched from hxxps://portal-gateway.top/wp-content/uploads/doc.php and written to /opt/app/bin/taskhost.exe. The payload uses Burp Suite-style techniques for defense evasion. A secondary hash (SHA1: 98a9aba421b7fcbc90318065dc0b2b1883d01c51) was extracted from the unpacked payload.


Malware Analysis Report: TrickBot (SHA1: 8cc14b98a2b8f33796c2b4ea956b0bb00f0f83aa). Upon execution on Ivanti Connect Secure, the sample creates /tmp/dropper.ps1 and injects into legitimate processes. Network analysis shows beaconing to 92.176.180.250 every 60 seconds and DNS queries to sync-relay.link. The second stage was fetched from https://storage-relay.club/download/update.exe and written to /opt/app/bin/lsass.dmp. The payload uses Seatbelt-style techniques for defense evasion. A secondary hash (MD5: 26b014c2caacd25fd9df3b3a70dcc74f) was extracted from the unpacked payload.


Malware Analysis Report: DarkSide (MD5: 345876da8aad9baea9b7199097fd9232). Upon execution on Zyxel USG, the sample creates /tmp/backdoor.elf and injects into legitimate processes. Network analysis shows beaconing to 91.116.162.213 every 60 seconds and DNS queries to authapi.top. The second stage was fetched from hxxp://storagestatic.online/callback and written to /dev/shm/csrss.exe. The payload uses Hashcat-style techniques for defense evasion. A secondary hash (SHA256: 15f80ad278186ff733af1d9d2a463c694207e4d27eac25126f6f29d8c9fba3d2) was extracted from the unpacked payload.


Malware Analysis Report: RedLine Stealer (SHA256: 3f40ba9425e052fa584e61e52a675e31fc129fcc97e7045d280c74e59e48fa39). Upon execution on Atlassian Confluence, the sample creates C:\ProgramData\chrome_helper.exe and injects into legitimate processes. Network analysis shows beaconing to 5.57.97.149 every 60 seconds and DNS queries to nodeedge.info. The second stage was fetched from hxxps://portal-static.club/wp-content/uploads/doc.php and written to C:\Users\admin\Desktop\backdoor.elf. The payload uses CrackMapExec-style techniques for defense evasion. A secondary hash (SHA256: ccbaad49c780271950c3fd3a226c39f39b7ee834befa66f167e4e9c4dd971f52) was extracted from the unpacked payload.


Malware Analysis Report: WarmCookie (MD5: b57736d23b88e681bfe3895cffa11fd1). Upon execution on Microsoft Exchange, the sample creates /dev/shm/helper.sh and injects into legitimate processes. Network analysis shows beaconing to 172.53.150.158 every 60 seconds and DNS queries to storage-data.online. The second stage was fetched from https://data-edge.org/login and written to /var/tmp/helper.sh. The payload uses Mythic-style techniques for defense evasion. A secondary hash (MD5: fff4af1c56e13fdd4781727045ae89dc) was extracted from the unpacked payload.


Malware Analysis Report: PlugX (SHA1: 32bb7b53bdf2961f69a02116840357b084cd8599). Upon execution on Cisco ASA, the sample creates C:\Users\admin\Downloads\loader.exe and injects into legitimate processes. Network analysis shows beaconing to 10.151.124.247 every 60 seconds and DNS queries to static-proxy.live. The second stage was fetched from hxxp://gatewayedge.io/callback and written to C:\Users\admin\Desktop\shell.php. The payload uses Mythic-style techniques for defense evasion. A secondary hash (SHA256: 6c32ba2fb2c0be197cec7aa720f749e1c9096aebfd0cc37b9ee8531469a0e9af) was extracted from the unpacked payload.


Malware Analysis Report: SmokeLoader (SHA1: 9dfa98f7ea8496e031ed346617a682ae1211b70c). Upon execution on VMware ESXi, the sample creates C:\Windows\System32\taskhost.exe and injects into legitimate processes. Network analysis shows beaconing to 111.189.186.231 every 60 seconds and DNS queries to storage-edge.tech. The second stage was fetched from hxxp://login-storage.live/panel/index.html and written to /dev/shm/dropper.ps1. The payload uses Hashcat-style techniques for defense evasion. A secondary hash (MD5: f7238b7ed065ed3768120d806d431c0f) was extracted from the unpacked payload.


Malware Analysis Report: StealC (SHA256: 312947aa18fbc2c887ed60b56f35e64c6f3b16d6240c82c8b07d2711f716f72b). Upon execution on Citrix NetScaler, the sample creates C:\Windows\Tasks\dropper.ps1 and injects into legitimate processes. Network analysis shows beaconing to 184.114.238.69 every 60 seconds and DNS queries to relay-static.online. The second stage was fetched from hxxp://cachegateway.net/login and written to C:\Users\admin\AppData\Local\Temp\csrss.exe. The payload uses PowerShell Empire-style techniques for defense evasion. A secondary hash (SHA1: 636c3d3daa2f73a51b243258f9f3c9640be983f4) was extracted from the unpacked payload.


Malware Analysis Report: IcedID (SHA1: 74733f9f4dec7f78d9fcb7e78373399c22133a03). Upon execution on Juniper SRX, the sample creates /home/user/.config/winlogon.exe and injects into legitimate processes. Network analysis shows beaconing to 192.141.129.243 every 60 seconds and DNS queries to static-proxy.site. The second stage was fetched from http://portal-cloud.top/portal/verify and written to /var/tmp/shell.php. The payload uses GhostPack-style techniques for defense evasion. A secondary hash (MD5: 4ab1753b530ec0b74506a3dd3b4155ed) was extracted from the unpacked payload.


Malware Analysis Report: FormBook (SHA256: 7251c78f9a7774ea7b13b882eb805e8a421fd28ba4657214f56c890c65cf7098). Upon execution on Fortinet FortiGate, the sample creates C:\Users\admin\Downloads\runtime.dll and injects into legitimate processes. Network analysis shows beaconing to 221.3.27.183 every 60 seconds and DNS queries to cacheauth.link. The second stage was fetched from http://static-api.io/assets/js/payload.js and written to /var/tmp/implant.so. The payload uses Seatbelt-style techniques for defense evasion. A secondary hash (SHA1: c7799fc1d11c1a14bb15791c15007c0c00730713) was extracted from the unpacked payload.


Malware Analysis Report: DarkSide (SHA256: 151ce5ab8cf6deef1cbe5dcf8e26ecaf8ae1db0094ac8c2088c5239128872cf8). Upon execution on Fortinet FortiGate, the sample creates /opt/app/bin/config.dat and injects into legitimate processes. Network analysis shows beaconing to 187.61.169.23 every 60 seconds and DNS queries to portal-cache.club. The second stage was fetched from http://gatewayportal.club/download/update.exe and written to C:\Users\Public\Documents\agent.py. The payload uses Chisel-style techniques for defense evasion. A secondary hash (SHA1: a162d46f181fc78b2383ea3c1474cec495556faa) was extracted from the unpacked payload.


Malware Analysis Report: XLoader (MD5: 212a0840d69c0c91eb91801079793986). Upon execution on Fortinet FortiGate, the sample creates C:\Users\admin\AppData\Local\Temp\dropper.ps1 and injects into legitimate processes. Network analysis shows beaconing to 10.133.205.52 every 60 seconds and DNS queries to mail-api.tech. The second stage was fetched from hxxps://authnode.info/collect and written to C:\Users\admin\AppData\Local\Temp\csrss.exe. The payload uses Metasploit-style techniques for defense evasion. A secondary hash (MD5: bd2a9085ac8557f4f159d5398e0273e6) was extracted from the unpacked payload.


Malware Analysis Report: Emotet (SHA1: ceb1ac9c61fc1f73edc92b3548fbfde86a095eb8). Upon execution on Zyxel USG, the sample creates C:\Windows\System32\implant.so and injects into legitimate processes. Network analysis shows beaconing to 172.196.156.8 every 60 seconds and DNS queries to apisecure.xyz. The second stage was fetched from https://secureedge.xyz/api/v2/auth and written to /etc/cron.d/shell.php. The payload uses Rubeus-style techniques for defense evasion. A secondary hash (SHA256: 8d899cd4c6ad2d9d9e4ddb54adabf344d8d7f00d9d78b6f96036560bb4838295) was extracted from the unpacked payload.


Malware Analysis Report: DarkSide (SHA1: 9a02bc32fefcf478767f8e0a9edfe77b2323afb6). Upon execution on Atlassian Confluence, the sample creates /tmp/implant.so and injects into legitimate processes. Network analysis shows beaconing to 8.19.61.207 every 60 seconds and DNS queries to backupauth.tech. The second stage was fetched from hxxps://cache-node.org/gate.php and written to C:\Windows\System32\implant.so. The payload uses Merlin-style techniques for defense evasion. A secondary hash (SHA256: d6dde6d1ea8937c5557f12a9669ecfd73027dd7934b8b2c44152c358341ac128) was extracted from the unpacked payload.


Malware Analysis Report: ShadowPad (SHA1: 693dc3ed9c2cd21f9d9e0386b82bb70fa33c8047). Upon execution on Juniper SRX, the sample creates /etc/cron.d/update.dll and injects into legitimate processes. Network analysis shows beaconing to 201.229.59.172 every 60 seconds and DNS queries to storage-data.tech. The second stage was fetched from http://data-proxy.xyz/login and written to /dev/shm/shell.php. The payload uses Metasploit-style techniques for defense evasion. A secondary hash (SHA1: 52e1b1ddae5cd80de9de8937a28232db2615a2fe) was extracted from the unpacked payload.


Malware Analysis Report: Dridex (SHA1: bd96cd72d2d750d97fb13b221be90c13e31a073c). Upon execution on Atlassian Confluence, the sample creates C:\ProgramData\beacon.dll and injects into legitimate processes. Network analysis shows beaconing to 135.201.102.73 every 60 seconds and DNS queries to loginrelay.link. The second stage was fetched from http://backup-gateway.site/callback and written to C:\Windows\Temp\beacon.dll. The payload uses Metasploit-style techniques for defense evasion. A secondary hash (SHA1: 2fe283e209de3ccdcf6523d968de9ec93940690a) was extracted from the unpacked payload.


Malware Analysis Report: Latrodectus (MD5: e022b6b9636d830185c293bce0bcb95e). Upon execution on Cisco ASA, the sample creates /opt/app/bin/update.dll and injects into legitimate processes. Network analysis shows beaconing to 79.254.147.198 every 60 seconds and DNS queries to node-cdn.xyz. The second stage was fetched from hxxp://backup-cache.club/admin/config and written to C:\Windows\Temp\update.dll. The payload uses Burp Suite-style techniques for defense evasion. A secondary hash (SHA1: 8d141583ed43a1880430057a80783e2333fee723) was extracted from the unpacked payload.


Malware Analysis Report: Hive (MD5: eaeac760556812f2c57c5b8574b2084c). Upon execution on Progress Telerik, the sample creates /tmp/beacon.dll and injects into legitimate processes. Network analysis shows beaconing to 192.222.91.131 every 60 seconds and DNS queries to cdncloud.net. The second stage was fetched from https://securedata.club/api/v2/auth and written to /tmp/shell.php. The payload uses Sharphound-style techniques for defense evasion. A secondary hash (SHA1: 469a42abd758563d56ca739fde1abeac87c1a26f) was extracted from the unpacked payload.


Malware Analysis Report: Emotet (SHA256: 052dcb920be5a1866a31792ad66276ac21edde89b39c16608902259658f7d822). Upon execution on MOVEit Transfer, the sample creates /var/tmp/implant.so and injects into legitimate processes. Network analysis shows beaconing to 192.59.148.2 every 60 seconds and DNS queries to storage-secure.site. The second stage was fetched from hxxp://mail-portal.com/download/update.exe and written to /usr/local/bin/ntds.dit. The payload uses PowerView-style techniques for defense evasion. A secondary hash (MD5: 5c47bfb1f42b0df00fa93e5f9760b569) was extracted from the unpacked payload.


Malware Analysis Report: AsyncRAT (SHA256: 401ba4b115bc86583dc156675c8730310663a90c329eaad5a81facd515649495). Upon execution on Microsoft Exchange, the sample creates C:\Users\admin\Desktop\update.dll and injects into legitimate processes. Network analysis shows beaconing to 105.5.212.211 every 60 seconds and DNS queries to portalsync.live. The second stage was fetched from hxxps://proxy-sync.cc/admin/config and written to C:\Windows\Tasks\payload.bin. The payload uses PowerView-style techniques for defense evasion. A secondary hash (SHA1: 315b3d38b78792d28a725c1d194065d47ca427c9) was extracted from the unpacked payload.


Malware Analysis Report: IcedID (SHA1: 54202225be570aaa0b0c7e002da471ae5c40bc23). Upon execution on Palo Alto PAN-OS, the sample creates /usr/local/bin/taskhost.exe and injects into legitimate processes. Network analysis shows beaconing to 10.250.34.47 every 60 seconds and DNS queries to securesync.top. The second stage was fetched from https://backupedge.info/collect and written to C:\Users\Public\Documents\lsass.dmp. The payload uses Covenant-style techniques for defense evasion. A secondary hash (SHA256: 7b3b03a23758733b9ffd3a3f85c46a83fb92bdf64e47efe3df4863327a025a2d) was extracted from the unpacked payload.


Malware Analysis Report: Dridex (SHA1: 639784c521af2928bd2e87879e2e558738cbb2bb). Upon execution on Citrix NetScaler, the sample creates C:\Program Files\Common Files\implant.so and injects into legitimate processes. Network analysis shows beaconing to 10.18.240.123 every 60 seconds and DNS queries to auth-data.com. The second stage was fetched from hxxps://secureapi.link/wp-content/uploads/doc.php and written to /etc/cron.d/sam.hive. The payload uses LinPEAS-style techniques for defense evasion. A secondary hash (MD5: 22828dfd50fe6b019abc606ed78cdd39) was extracted from the unpacked payload.


Malware Analysis Report: PlugX (SHA1: 47e508f895a1513205d7696e9ffd7edf351a44be). Upon execution on Juniper SRX, the sample creates C:\Users\admin\AppData\Local\Temp\lsass.dmp and injects into legitimate processes. Network analysis shows beaconing to 10.162.22.146 every 60 seconds and DNS queries to login-storage.live. The second stage was fetched from hxxp://securemail.online/admin/config and written to C:\Users\admin\Desktop\payload.bin. The payload uses Burp Suite-style techniques for defense evasion. A secondary hash (SHA256: 6fe267b7614d8f066c35a79c2f90e7bf233ef25069ebbf1a3ad14fb8831b22c6) was extracted from the unpacked payload.


Malware Analysis Report: IcedID (SHA256: 073ef0072781e5ffc16ce5bd909ccc097d9f21765a28b97732d29731aaa27563). Upon execution on Windows Server 2019, the sample creates C:\Users\Public\Documents\chrome_helper.exe and injects into legitimate processes. Network analysis shows beaconing to 172.224.12.224 every 60 seconds and DNS queries to apidata.cc. The second stage was fetched from https://edgesecure.org/login and written to C:\Program Files\Common Files\loader.exe. The payload uses Certutil-style techniques for defense evasion. A secondary hash (SHA256: 7f22279bb920973cb46e02994674ecff74a47cd9be1eca2f2e637a53d001f1db) was extracted from the unpacked payload.


Malware Analysis Report: Meduza Stealer (SHA1: 0eb7017578d3f557506a41fc1f31674e5aa43f39). Upon execution on Ubuntu 22.04, the sample creates C:\Users\Public\Documents\helper.sh and injects into legitimate processes. Network analysis shows beaconing to 95.19.73.231 every 60 seconds and DNS queries to data-update.site. The second stage was fetched from http://cache-cdn.live/collect and written to C:\Users\admin\AppData\Local\Temp\shell.php. The payload uses Certutil-style techniques for defense evasion. A secondary hash (SHA256: 4fb33710dec16d3051b1b7cd74e66c4ff170d71609ac8b4dd99d03ba0d07d63f) was extracted from the unpacked payload.


Malware Analysis Report: TrickBot (SHA1: ba625661ea87ee5c4f15c2ed8bb29001a323fafe). Upon execution on Fortinet FortiGate, the sample creates /etc/cron.d/helper.sh and injects into legitimate processes. Network analysis shows beaconing to 73.198.230.234 every 60 seconds and DNS queries to proxy-static.info. The second stage was fetched from hxxp://relayproxy.dev/gate.php and written to C:\Windows\System32\agent.py. The payload uses Sharphound-style techniques for defense evasion. A secondary hash (MD5: 85a8eab5038058e64f2007b85e753a44) was extracted from the unpacked payload.


Malware Analysis Report: Raccoon Stealer (MD5: 7d2a3e14f37b033a2eb370df599a4f52). Upon execution on SonicWall SMA, the sample creates /etc/cron.d/runtime.dll and injects into legitimate processes. Network analysis shows beaconing to 190.10.221.207 every 60 seconds and DNS queries to logincdn.online. The second stage was fetched from hxxp://edgedata.site/admin/config and written to C:\Users\admin\Desktop\ntds.dit. The payload uses Mythic-style techniques for defense evasion. A secondary hash (SHA256: 000fd555bacb9fce27a064d234f8d843543359a986d0053d75e24cd21e5e2d06) was extracted from the unpacked payload.


Malware Analysis Report: ShadowPad (SHA1: 555c257765857c35771bb0fac228a9b6eb9c32c6). Upon execution on SonicWall SMA, the sample creates /tmp/implant.so and injects into legitimate processes. Network analysis shows beaconing to 100.237.186.87 every 60 seconds and DNS queries to portallogin.club. The second stage was fetched from hxxp://data-cloud.club/collect and written to /etc/cron.d/sam.hive. The payload uses Certutil-style techniques for defense evasion. A secondary hash (MD5: 8527a7e3c907b7484865bd1d8e014b15) was extracted from the unpacked payload.


Malware Analysis Report: RedLine Stealer (SHA1: 4ee874d400ac4c712dee704a94dbef23ef4f667b). Upon execution on Windows Server 2019, the sample creates C:\Users\admin\Desktop\loader.exe and injects into legitimate processes. Network analysis shows beaconing to 172.72.240.28 every 60 seconds and DNS queries to backupstatic.site. The second stage was fetched from hxxp://cloud-cloud.tech/admin/config and written to C:\Program Files\Common Files\config.dat. The payload uses Brute Ratel-style techniques for defense evasion. A secondary hash (MD5: e57a159b4b176fdfc04dbe1b7b51db96) was extracted from the unpacked payload.


Malware Analysis Report: Royal (MD5: f531700044e9b51483a841f6b37424f9). Upon execution on Windows Server 2019, the sample creates C:\Users\admin\AppData\Local\Temp\taskhost.exe and injects into legitimate processes. Network analysis shows beaconing to 172.79.205.148 every 60 seconds and DNS queries to login-gateway.tech. The second stage was fetched from http://datalogin.link/secure/token and written to C:\ProgramData\chrome_helper.exe. The payload uses Mimikatz-style techniques for defense evasion. A secondary hash (SHA1: 2ce745a1fd71db25afa19306f087607f54d46755) was extracted from the unpacked payload.


Malware Analysis Report: QakBot (MD5: 7f3e3a96adda5569af5fed0df51ae116). Upon execution on Barracuda ESG, the sample creates C:\Users\admin\Downloads\agent.py and injects into legitimate processes. Network analysis shows beaconing to 92.103.77.246 every 60 seconds and DNS queries to backup-api.tech. The second stage was fetched from https://cacherelay.online/assets/js/payload.js and written to /home/user/.config/taskhost.exe. The payload uses GhostPack-style techniques for defense evasion. A secondary hash (SHA256: 52171878734e186739a62cfd0191f096a9cbaa9e19342a88cafcd165def1826e) was extracted from the unpacked payload.


Malware Analysis Report: REvil (SHA256: 5ed2c3c8458307e6eea7548647b83300feb71a510b1da6306974c0ca1c7f7001). Upon execution on Windows Server 2019, the sample creates C:\Users\admin\Desktop\beacon.dll and injects into legitimate processes. Network analysis shows beaconing to 31.209.81.144 every 60 seconds and DNS queries to syncdata.net. The second stage was fetched from hxxps://relay-auth.link/download/update.exe and written to C:\Users\admin\Desktop\beacon.dll. The payload uses Rubeus-style techniques for defense evasion. A secondary hash (SHA256: 060843a64b865f38527b2ed2c5d66d6e9955d1674a20c5430f5799e4e9c9a6e7) was extracted from the unpacked payload.


Malware Analysis Report: Lumma Stealer (SHA1: 0814eb0a39edf798063ae10cc90cba65ab8c5d73). Upon execution on Palo Alto PAN-OS, the sample creates /home/user/.config/lsass.dmp and injects into legitimate processes. Network analysis shows beaconing to 150.93.229.229 every 60 seconds and DNS queries to proxy-cache.tech. The second stage was fetched from hxxp://apimail.net/download/update.exe and written to C:\Windows\System32\taskhost.exe. The payload uses Merlin-style techniques for defense evasion. A secondary hash (MD5: 865bb5cdf5a83a8f8d59db5cdbd49a3f) was extracted from the unpacked payload.


Malware Analysis Report: RemcosRAT (MD5: ef1f2475c21839bd3f404e73e318136b). Upon execution on Apache Struts, the sample creates /opt/app/bin/config.dat and injects into legitimate processes. Network analysis shows beaconing to 172.253.8.160 every 60 seconds and DNS queries to securemail.live. The second stage was fetched from hxxps://cloudnode.info/gate.php and written to C:\Users\admin\AppData\Local\Temp\helper.sh. The payload uses WinPEAS-style techniques for defense evasion. A secondary hash (SHA1: 6d1ddfb83f9320f8ffd20d543eb3b7b882e581c5) was extracted from the unpacked payload.


Malware Analysis Report: SmokeLoader (MD5: 4a0ec73e5463116af0e51285fb2c43f1). Upon execution on Windows 11, the sample creates C:\Users\admin\Desktop\runtime.dll and injects into legitimate processes. Network analysis shows beaconing to 11.139.234.169 every 60 seconds and DNS queries to storage-edge.com. The second stage was fetched from hxxps://static-update.club/portal/verify and written to /dev/shm/lsass.dmp. The payload uses Ligolo-style techniques for defense evasion. A secondary hash (MD5: c8298a88ad47630d6cb97f53b599419a) was extracted from the unpacked payload.


Malware Analysis Report: SystemBC (SHA1: 1e8dbf41897cf32a81a8df13b0ed049d87fe7b99). Upon execution on Juniper SRX, the sample creates C:\ProgramData\sam.hive and injects into legitimate processes. Network analysis shows beaconing to 94.217.208.182 every 60 seconds and DNS queries to loginmail.club. The second stage was fetched from https://edgecloud.online/portal/verify and written to C:\ProgramData\winlogon.exe. The payload uses Havoc-style techniques for defense evasion. A secondary hash (MD5: fba3620678f3284860670faa5ecb64f6) was extracted from the unpacked payload.


Malware Analysis Report: Conti (SHA256: ecf918534bbe284a5ca72aec778d12972d7e503d1366b6a35fdb0322e8707549). Upon execution on Zyxel USG, the sample creates /opt/app/bin/implant.so and injects into legitimate processes. Network analysis shows beaconing to 10.38.90.96 every 60 seconds and DNS queries to login-cache.link. The second stage was fetched from hxxps://api-api.com/assets/js/payload.js and written to C:\ProgramData\payload.bin. The payload uses BITSAdmin-style techniques for defense evasion. A secondary hash (SHA256: ca5ef186bf7de79650af30eaa62b1214e435e406447a2461820d543ee2461302) was extracted from the unpacked payload.


Malware Analysis Report: NjRAT (SHA1: 8eb28cf85605c6d941e1153096ec4699ad77ab16). Upon execution on Juniper SRX, the sample creates C:\Users\admin\AppData\Local\Temp\chrome_helper.exe and injects into legitimate processes. Network analysis shows beaconing to 10.71.102.236 every 60 seconds and DNS queries to secure-api.club. The second stage was fetched from hxxp://update-gateway.link/wp-content/uploads/doc.php and written to C:\Users\admin\Desktop\winlogon.exe. The payload uses Sharphound-style techniques for defense evasion. A secondary hash (SHA256: a45433045b4eaa05e6ab869aa248b6a6162edb84797c5bcf04b982711a6fd980) was extracted from the unpacked payload.


Malware Analysis Report: Hive (MD5: 4c8d534a3897f648d0787fc1edcccb8f). Upon execution on Atlassian Confluence, the sample creates /tmp/taskhost.exe and injects into legitimate processes. Network analysis shows beaconing to 155.95.240.74 every 60 seconds and DNS queries to relay-secure.io. The second stage was fetched from https://api-secure.xyz/download/update.exe and written to C:\ProgramData\runtime.dll. The payload uses Rubeus-style techniques for defense evasion. A secondary hash (SHA256: c1e7f00e02db9a3ad9ef7ae8b96fb3512ad210a3996288621e74bcde020fb3ab) was extracted from the unpacked payload.


Malware Analysis Report: Play (SHA256: 85763adb54f4ac53b92d3da8ae72ff630a2b80b25b11896e68daf48e16f3c351). Upon execution on Ivanti Connect Secure, the sample creates C:\Users\admin\Downloads\chrome_helper.exe and injects into legitimate processes. Network analysis shows beaconing to 154.211.146.56 every 60 seconds and DNS queries to syncmail.club. The second stage was fetched from https://node-update.top/portal/verify and written to C:\Users\admin\AppData\Local\Temp\chrome_helper.exe. The payload uses PowerShell Empire-style techniques for defense evasion. A secondary hash (MD5: 2c97181e571b3ddb46e6082847ef63f3) was extracted from the unpacked payload.


Malware Analysis Report: QakBot (SHA1: 2402bec33a819e26f0c2a8632e5b2ba9d7eb512f). Upon execution on F5 BIG-IP, the sample creates /opt/app/bin/sam.hive and injects into legitimate processes. Network analysis shows beaconing to 192.228.6.251 every 60 seconds and DNS queries to storage-cache.link. The second stage was fetched from https://staticapi.cc/assets/js/payload.js and written to /etc/cron.d/beacon.dll. The payload uses Chisel-style techniques for defense evasion. A secondary hash (MD5: b9c8dd7bd9bf494c553ec469fceb53cf) was extracted from the unpacked payload.


Malware Analysis Report: AsyncRAT (MD5: 7afce390a5777656fc861f345bdd152e). Upon execution on Citrix NetScaler, the sample creates C:\Windows\System32\payload.bin and injects into legitimate processes. Network analysis shows beaconing to 10.87.21.177 every 60 seconds and DNS queries to gatewayrelay.dev. The second stage was fetched from http://storageportal.online/gate.php and written to C:\Users\admin\Desktop\ntds.dit. The payload uses Mimikatz-style techniques for defense evasion. A secondary hash (MD5: 7e81320c73b3c036163e6afc0f81b499) was extracted from the unpacked payload.


Malware Analysis Report: RemcosRAT (MD5: 6bf753ff87824ec41bf2cf9ab26860ba). Upon execution on Cisco ASA, the sample creates /usr/local/bin/winlogon.exe and injects into legitimate processes. Network analysis shows beaconing to 172.187.7.112 every 60 seconds and DNS queries to login-cache.org. The second stage was fetched from http://auth-update.site/download/update.exe and written to /tmp/svchost.exe. The payload uses PowerShell Empire-style techniques for defense evasion. A secondary hash (SHA1: 4974b26a59a7276f5b6620322e45110f1565bfc1) was extracted from the unpacked payload.


Malware Analysis Report: REvil (MD5: 68bf6b25c4ac4408208ecbc3059eafb8). Upon execution on Juniper SRX, the sample creates /opt/app/bin/beacon.dll and injects into legitimate processes. Network analysis shows beaconing to 59.97.249.156 every 60 seconds and DNS queries to gatewaygateway.live. The second stage was fetched from hxxps://proxy-cdn.tech/api/v2/auth and written to /home/user/.config/payload.bin. The payload uses PsExec-style techniques for defense evasion. A secondary hash (SHA1: d6684abe5b3560372744974d573854ec8379fcdb) was extracted from the unpacked payload.


Malware Analysis Report: Qbot (SHA256: 64f55ce017bf221672e98bc8e0d260c6c69297176c46b376cab60596ea4cb137). Upon execution on Ubuntu 22.04, the sample creates /etc/cron.d/payload.bin and injects into legitimate processes. Network analysis shows beaconing to 4.157.81.87 every 60 seconds and DNS queries to staticgateway.cc. The second stage was fetched from https://static-login.io/secure/token and written to /etc/cron.d/shell.php. The payload uses PowerShell Empire-style techniques for defense evasion. A secondary hash (MD5: 7b6a675c5c4a58104ce84f59432e9ce4) was extracted from the unpacked payload.


Malware Analysis Report: TrickBot (MD5: ee3aebaf9202e1a10cfd88d5d14df76d). Upon execution on Microsoft Exchange, the sample creates /tmp/payload.bin and injects into legitimate processes. Network analysis shows beaconing to 64.107.167.177 every 60 seconds and DNS queries to storage-proxy.link. The second stage was fetched from https://edgestorage.cc/assets/js/payload.js and written to /opt/app/bin/shell.php. The payload uses Merlin-style techniques for defense evasion. A secondary hash (MD5: 54b2feeacd9aaa5c105fe0cd4f57f535) was extracted from the unpacked payload.


Malware Analysis Report: Lumma Stealer (SHA1: 13d9cdb3c3670447ac0adad94ca51470a0f2cc51). Upon execution on Palo Alto PAN-OS, the sample creates /usr/local/bin/chrome_helper.exe and injects into legitimate processes. Network analysis shows beaconing to 172.240.9.81 every 60 seconds and DNS queries to portal-login.cc. The second stage was fetched from http://apinode.online/collect and written to C:\Windows\Tasks\lsass.dmp. The payload uses Seatbelt-style techniques for defense evasion. A secondary hash (SHA256: 144dd456de640cccfbd601e4daac55f64794a1d9d8370cc840e6135e724ec1ad) was extracted from the unpacked payload.


Malware Analysis Report: SystemBC (SHA1: 277812d1f47ed2c8f9e023e478e7900eebd309f4). Upon execution on Progress Telerik, the sample creates /dev/shm/winlogon.exe and injects into legitimate processes. Network analysis shows beaconing to 218.30.242.64 every 60 seconds and DNS queries to update-storage.tech. The second stage was fetched from https://edgelogin.link/secure/token and written to /tmp/runtime.dll. The payload uses Merlin-style techniques for defense evasion. A secondary hash (SHA256: fe846ae4f5f4e5940700d391463685f3027f767d399237317b20ca43055860bc) was extracted from the unpacked payload.


Malware Analysis Report: StealC (SHA256: 9cd282cae7a5c3bd34c56dcca1d62f233eabf98303a1bf91dcfe29927ae4cb1b). Upon execution on Citrix NetScaler, the sample creates C:\Program Files\Common Files\chrome_helper.exe and injects into legitimate processes. Network analysis shows beaconing to 192.99.144.64 every 60 seconds and DNS queries to gatewayupdate.info. The second stage was fetched from hxxps://cloudlogin.info/login and written to /etc/cron.d/sam.hive. The payload uses Seatbelt-style techniques for defense evasion. A secondary hash (MD5: 16b22c205c0a2a64728438f703d720fb) was extracted from the unpacked payload.


Malware Analysis Report: PlugX (SHA1: 04e53ab7e9c48038c583633c9265f0b8e8ee092a). Upon execution on F5 BIG-IP, the sample creates C:\Windows\Temp\taskhost.exe and injects into legitimate processes. Network analysis shows beaconing to 192.227.160.28 every 60 seconds and DNS queries to relaysync.xyz. The second stage was fetched from hxxp://backupsecure.cc/secure/token and written to C:\Users\admin\AppData\Local\Temp\winlogon.exe. The payload uses Certutil-style techniques for defense evasion. A secondary hash (MD5: e8e6c237398482121103362166ec3c54) was extracted from the unpacked payload.


Malware Analysis Report: RedLine Stealer (SHA256: 9ad46f3289ae2f5b329218fbde2389eec7bae31efe417b95eb66c1849bf670ba). Upon execution on Ubuntu 22.04, the sample creates C:\Users\admin\AppData\Local\Temp\payload.bin and injects into legitimate processes. Network analysis shows beaconing to 141.13.222.166 every 60 seconds and DNS queries to portalsecure.tech. The second stage was fetched from hxxps://backup-storage.cc/panel/index.html and written to /dev/shm/chrome_helper.exe. The payload uses Merlin-style techniques for defense evasion. A secondary hash (MD5: 7132903d1a97078e0a388d1c655dd3f7) was extracted from the unpacked payload.


Malware Analysis Report: BlackCat (SHA256: fec1a163206af4199a737eab445a207af3967c8a831a327c70feb7c29722739a). Upon execution on Citrix NetScaler, the sample creates C:\Users\admin\AppData\Local\Temp\loader.exe and injects into legitimate processes. Network analysis shows beaconing to 192.120.47.194 every 60 seconds and DNS queries to mailstorage.net. The second stage was fetched from http://storageapi.online/panel/index.html and written to C:\Program Files\Common Files\lsass.dmp. The payload uses WinPEAS-style techniques for defense evasion. A secondary hash (SHA256: e39b89896b184198693ea1b1f8548f6b8b25ea915f7369e10bd575e4c5fc5473) was extracted from the unpacked payload.


Malware Analysis Report: Latrodectus (SHA256: d064307ffa6519a42e7181729f3a8d775f5a6df3aec95061d7f9ea7b92f9ee47). Upon execution on Atlassian Confluence, the sample creates /var/tmp/payload.bin and injects into legitimate processes. Network analysis shows beaconing to 41.59.133.59 every 60 seconds and DNS queries to cdn-edge.com. The second stage was fetched from hxxps://data-proxy.com/wp-content/uploads/doc.php and written to C:\Windows\System32\loader.exe. The payload uses Hashcat-style techniques for defense evasion. A secondary hash (SHA256: d7a3654c04b0bba4fa5410ba1ce1f2ce4fc535ec62cb5d8c84ef5040992bfe11) was extracted from the unpacked payload.


Malware Analysis Report: Raccoon Stealer (SHA1: d17f9dff75d99b2294390956079810c867ac3a98). Upon execution on Ivanti Connect Secure, the sample creates /dev/shm/svchost.exe and injects into legitimate processes. Network analysis shows beaconing to 5.148.252.7 every 60 seconds and DNS queries to edgeapi.com. The second stage was fetched from hxxp://cache-cdn.xyz/collect and written to /etc/cron.d/chrome_helper.exe. The payload uses BITSAdmin-style techniques for defense evasion. A secondary hash (SHA1: 0536a3443eb1b7a8a363c4f71539ab3012994e1d) was extracted from the unpacked payload.


Malware Analysis Report: BatLoader (SHA256: ff1e12efdbca4130b384ae67d9f669d312133d60b6466d62af14c4f0bc4582ef). Upon execution on Windows Server 2019, the sample creates /usr/local/bin/lsass.dmp and injects into legitimate processes. Network analysis shows beaconing to 10.3.144.69 every 60 seconds and DNS queries to nodeportal.org. The second stage was fetched from hxxp://static-sync.tech/secure/token and written to C:\Users\Public\Documents\agent.py. The payload uses Brute Ratel-style techniques for defense evasion. A secondary hash (MD5: 7c488e9d008882d109ea5451e5c3636d) was extracted from the unpacked payload.


Malware Analysis Report: PlugX (SHA1: 710fa62480ff2b1ffe3915a92d1ef93694cd4792). Upon execution on Active Directory, the sample creates C:\Windows\Tasks\update.dll and injects into legitimate processes. Network analysis shows beaconing to 53.94.57.11 every 60 seconds and DNS queries to authcloud.xyz. The second stage was fetched from https://cloudcache.live/secure/token and written to /var/tmp/shell.php. The payload uses Mythic-style techniques for defense evasion. A secondary hash (SHA1: 196bdf61a03296e0171c9447b83245d1b7893703) was extracted from the unpacked payload.


Malware Analysis Report: Royal (SHA1: 78c6bb5547245f6ad55ef7758ad42b9b0831cdad). Upon execution on Progress Telerik, the sample creates /dev/shm/dropper.ps1 and injects into legitimate processes. Network analysis shows beaconing to 4.110.92.221 every 60 seconds and DNS queries to cloudproxy.club. The second stage was fetched from hxxp://storagerelay.site/gate.php and written to /home/user/.config/helper.sh. The payload uses Impacket-style techniques for defense evasion. A secondary hash (SHA256: dfada12a3875767049eb8a5c300d93323045a910eee1cd967cdf6e01fc7ff1e2) was extracted from the unpacked payload.


Malware Analysis Report: Ryuk (SHA256: 67e873bfc126b14a1b0a1173cb99e6173adf8b3c95b67d814dfeb294889368a1). Upon execution on Windows Server 2019, the sample creates /etc/cron.d/chrome_helper.exe and injects into legitimate processes. Network analysis shows beaconing to 10.140.0.78 every 60 seconds and DNS queries to portalcache.org. The second stage was fetched from hxxp://cdn-mail.xyz/callback and written to /usr/local/bin/ntds.dit. The payload uses Sharphound-style techniques for defense evasion. A secondary hash (SHA256: 606cee21448c5a97cfc4e8ffd3ec876786b07b5dc939868d0c31e8278a201b83) was extracted from the unpacked payload.


Malware Analysis Report: AsyncRAT (SHA256: 6ee79c710a4c373c71e5c8df455a5f004e8f3345b9c846feb1a2d9ce6faa921f). Upon execution on MOVEit Transfer, the sample creates /var/tmp/sam.hive and injects into legitimate processes. Network analysis shows beaconing to 37.134.233.239 every 60 seconds and DNS queries to auth-update.dev. The second stage was fetched from hxxps://secureupdate.net/assets/js/payload.js and written to /usr/local/bin/backdoor.elf. The payload uses Mimikatz-style techniques for defense evasion. A secondary hash (SHA256: 5cff378a7b81e2a0c4ac8310de34988459d389d6b5dab7fcce14d7f78c665f65) was extracted from the unpacked payload.


Malware Analysis Report: Amadey (SHA256: 8be962bbc9c639b20fcd7ecee99cd55f300f867cc52cc5b3785c4030ad78b248). Upon execution on F5 BIG-IP, the sample creates C:\Users\admin\AppData\Local\Temp\chrome_helper.exe and injects into legitimate processes. Network analysis shows beaconing to 10.33.203.174 every 60 seconds and DNS queries to updatecdn.online. The second stage was fetched from hxxps://relaygateway.org/collect and written to /usr/local/bin/agent.py. The payload uses LinPEAS-style techniques for defense evasion. A secondary hash (SHA1: 152cdc97bcba936a5a6645b5d337342e57bd29ea) was extracted from the unpacked payload.


Malware Analysis Report: Hive (MD5: d26d75bedb1e829479b48b2484ceb122). Upon execution on Ivanti Connect Secure, the sample creates C:\Users\admin\AppData\Local\Temp\agent.py and injects into legitimate processes. Network analysis shows beaconing to 49.120.229.208 every 60 seconds and DNS queries to cdn-cache.live. The second stage was fetched from hxxp://edgeproxy.link/assets/js/payload.js and written to /etc/cron.d/chrome_helper.exe. The payload uses ADFind-style techniques for defense evasion. A secondary hash (SHA256: 1766d648e87c8571692cc52965355e4b2182719044ef8bcd75766dab3a73babb) was extracted from the unpacked payload.


Malware Analysis Report: ShadowPad (MD5: 561b92984a9ce23ceb8228b961011f42). Upon execution on Ubuntu 22.04, the sample creates /dev/shm/dropper.ps1 and injects into legitimate processes. Network analysis shows beaconing to 172.190.74.83 every 60 seconds and DNS queries to gatewaysecure.cc. The second stage was fetched from https://mailrelay.tech/download/update.exe and written to C:\Program Files\Common Files\csrss.exe. The payload uses Sliver-style techniques for defense evasion. A secondary hash (SHA1: e2fd0b75be730bbf9734bd05078c91dab4f4b7e4) was extracted from the unpacked payload.


Malware Analysis Report: StealC (MD5: 8e43570803376f4ad1b23e602c0b2470). Upon execution on SonicWall SMA, the sample creates C:\Windows\System32\runtime.dll and injects into legitimate processes. Network analysis shows beaconing to 92.238.230.193 every 60 seconds and DNS queries to cdn-storage.io. The second stage was fetched from hxxp://static-storage.io/collect and written to C:\Users\admin\Desktop\chrome_helper.exe. The payload uses Covenant-style techniques for defense evasion. A secondary hash (SHA256: 4ca832a4b2856bd3d6a53e26b9b94571d8f10d51b87e4534a88f39996c8a3e0c) was extracted from the unpacked payload.


Malware Analysis Report: Conti (SHA1: db0ea2deb71ec9d6283f737189ce8f3475c81b47). Upon execution on VMware ESXi, the sample creates C:\Users\admin\Desktop\helper.sh and injects into legitimate processes. Network analysis shows beaconing to 192.53.2.66 every 60 seconds and DNS queries to data-storage.online. The second stage was fetched from http://storage-mail.io/panel/index.html and written to /etc/cron.d/ntds.dit. The payload uses WinPEAS-style techniques for defense evasion. A secondary hash (SHA1: d72b75248cb7b183f0e1bf2c069e84d59b2fc0d6) was extracted from the unpacked payload.


Malware Analysis Report: Play (SHA1: c1f4cca96dbae6c01b26d511f82de7254693759a). Upon execution on Windows Server 2019, the sample creates /tmp/dropper.ps1 and injects into legitimate processes. Network analysis shows beaconing to 40.96.0.229 every 60 seconds and DNS queries to proxy-login.dev. The second stage was fetched from http://backup-data.link/portal/verify and written to C:\Users\Public\Documents\runtime.dll. The payload uses Mimikatz-style techniques for defense evasion. A secondary hash (SHA1: 355134e666fab3b99669fe11d6e48170884e9f32) was extracted from the unpacked payload.


Malware Analysis Report: TrickBot (MD5: 89096ac84aa40ae758bba8a777296c93). Upon execution on MOVEit Transfer, the sample creates /etc/cron.d/runtime.dll and injects into legitimate processes. Network analysis shows beaconing to 10.36.34.65 every 60 seconds and DNS queries to authgateway.tech. The second stage was fetched from https://updatestatic.info/callback and written to /home/user/.config/ntds.dit. The payload uses ADFind-style techniques for defense evasion. A secondary hash (SHA256: d88c19411afa62a6b129f23903a763706f8be190eaecfc50fa90f475fa1a97f7) was extracted from the unpacked payload.


Malware Analysis Report: Amadey (SHA1: e39e81935a57e2009bf1fc3f4af82c1489812ebb). Upon execution on F5 BIG-IP, the sample creates /etc/cron.d/beacon.dll and injects into legitimate processes. Network analysis shows beaconing to 192.251.16.128 every 60 seconds and DNS queries to mailupdate.info. The second stage was fetched from hxxps://portaledge.link/callback and written to C:\Windows\Temp\lsass.dmp. The payload uses BloodHound-style techniques for defense evasion. A secondary hash (SHA1: 49dd6025d7b43b822edb8b4211b299df11b92069) was extracted from the unpacked payload.


Malware Analysis Report: Dridex (MD5: b7b0e42b23a70bdd4e715dc6d2d77bbc). Upon execution on Windows Server 2019, the sample creates C:\Program Files\Common Files\taskhost.exe and injects into legitimate processes. Network analysis shows beaconing to 10.125.48.117 every 60 seconds and DNS queries to storagedata.cc. The second stage was fetched from http://cdnstorage.info/wp-content/uploads/doc.php and written to C:\Windows\Temp\payload.bin. The payload uses BITSAdmin-style techniques for defense evasion. A secondary hash (MD5: 5407da544c72daf7132b0d1584feeb80) was extracted from the unpacked payload.


Malware Analysis Report: BatLoader (MD5: 871b258a3b957b58be76ab0289ae84db). Upon execution on Citrix NetScaler, the sample creates /home/user/.config/implant.so and injects into legitimate processes. Network analysis shows beaconing to 172.140.198.206 every 60 seconds and DNS queries to sync-cache.net. The second stage was fetched from hxxp://securerelay.info/login and written to /opt/app/bin/ntds.dit. The payload uses Metasploit-style techniques for defense evasion. A secondary hash (SHA256: 4f9f9d9f947a8457211b27ec145af1de85f10717333923d522cd6716fa4d5b36) was extracted from the unpacked payload.


Malware Analysis Report: IcedID (SHA256: eb94e503b38830cb04fcd556cef4a792ac8516422ecc34b5238ea5530052972f). Upon execution on Citrix NetScaler, the sample creates C:\Windows\Tasks\taskhost.exe and injects into legitimate processes. Network analysis shows beaconing to 64.2.198.199 every 60 seconds and DNS queries to portal-cdn.info. The second stage was fetched from http://data-storage.live/wp-content/uploads/doc.php and written to C:\Users\Public\Documents\config.dat. The payload uses CrackMapExec-style techniques for defense evasion. A secondary hash (MD5: 3a74d18f311a4500832ee852e632e689) was extracted from the unpacked payload.


Malware Analysis Report: StealC (SHA1: 273915e046c972662143c19fbe2813e472860c9f). Upon execution on Cisco ASA, the sample creates C:\ProgramData\chrome_helper.exe and injects into legitimate processes. Network analysis shows beaconing to 128.187.220.6 every 60 seconds and DNS queries to edgeauth.site. The second stage was fetched from http://cdnsync.site/api/v2/auth and written to /usr/local/bin/csrss.exe. The payload uses PowerShell Empire-style techniques for defense evasion. A secondary hash (SHA256: 0c7bf78b5207676ef73382b0bd993462ed73e03fbe028569dd825a102b2a1ed6) was extracted from the unpacked payload.


Malware Analysis Report: BatLoader (SHA256: 91cd398d82e52cea5203f1188aa76c1d566433cd7b5eff07dcc9fb14595dfbec). Upon execution on Windows 11, the sample creates C:\Users\admin\Downloads\shell.php and injects into legitimate processes. Network analysis shows beaconing to 10.82.44.147 every 60 seconds and DNS queries to cloud-relay.top. The second stage was fetched from hxxps://edgesync.online/admin/config and written to C:\Program Files\Common Files\taskhost.exe. The payload uses Certutil-style techniques for defense evasion. A secondary hash (SHA256: d8834ef915d43a013345fae7c67b24ac1faa6050ce348545a4371d4dca78a255) was extracted from the unpacked payload.


Malware Analysis Report: Play (SHA256: 7f146d8ce4c39d0501e29185d450783497d47803087543d672edbd1953fdd7bb). Upon execution on F5 BIG-IP, the sample creates /opt/app/bin/helper.sh and injects into legitimate processes. Network analysis shows beaconing to 35.200.5.96 every 60 seconds and DNS queries to node-update.net. The second stage was fetched from https://cachenode.com/download/update.exe and written to /dev/shm/runtime.dll. The payload uses SharpHound-style techniques for defense evasion. A secondary hash (SHA256: a75314bb41b1392ae089ad9412e1e0343feee00bf7151636b29f005fe13383f5) was extracted from the unpacked payload.


Malware Analysis Report: Amadey (MD5: 97dda2ca028226f26ec9443f732caa96). Upon execution on Windows 11, the sample creates C:\Program Files\Common Files\csrss.exe and injects into legitimate processes. Network analysis shows beaconing to 10.198.36.38 every 60 seconds and DNS queries to node-login.live. The second stage was fetched from hxxp://proxy-node.net/wp-content/uploads/doc.php and written to /var/tmp/backdoor.elf. The payload uses Sliver-style techniques for defense evasion. A secondary hash (SHA256: fd600b8a4da758a12bc2a66fac8b3b62bd3c739d2f7ee709796e0e294146f912) was extracted from the unpacked payload.


Malware Analysis Report: XLoader (SHA256: aa90121b9a54b7586a88772e639d3ebf15eff2a3251a615a80b93c3584544919). Upon execution on Ubuntu 22.04, the sample creates C:\Users\admin\Downloads\helper.sh and injects into legitimate processes. Network analysis shows beaconing to 8.98.191.101 every 60 seconds and DNS queries to staticdata.club. The second stage was fetched from http://proxy-static.link/admin/config and written to /home/user/.config/beacon.dll. The payload uses Seatbelt-style techniques for defense evasion. A secondary hash (MD5: ba30891fabcca2a835bae9d1e23fcfda) was extracted from the unpacked payload.


Malware Analysis Report: XLoader (SHA1: 038433fda6e93adcf2f6b92249df058a5d144b9c). Upon execution on MOVEit Transfer, the sample creates /dev/shm/loader.exe and injects into legitimate processes. Network analysis shows beaconing to 17.43.74.198 every 60 seconds and DNS queries to mail-sync.site. The second stage was fetched from https://relaystorage.info/portal/verify and written to /dev/shm/lsass.dmp. The payload uses Seatbelt-style techniques for defense evasion. A secondary hash (SHA256: da5728de5cff60ed9bfd581adfa2150989cc57af5f803e8d755f97f65e01c475) was extracted from the unpacked payload.


Malware Analysis Report: Latrodectus (SHA1: 6f573265a646c611cd726cb49b19c88b84a8718b). Upon execution on Palo Alto PAN-OS, the sample creates /var/tmp/winlogon.exe and injects into legitimate processes. Network analysis shows beaconing to 172.172.46.178 every 60 seconds and DNS queries to storageedge.io. The second stage was fetched from https://sync-sync.dev/portal/verify and written to /opt/app/bin/helper.sh. The payload uses BITSAdmin-style techniques for defense evasion. A secondary hash (SHA1: 4290ad4093f13e0f2a4f27ebd7d84120560c2d88) was extracted from the unpacked payload.


Malware Analysis Report: AgentTesla (MD5: ff53eeada2a233a29e096376ae646da4). Upon execution on Fortinet FortiGate, the sample creates /opt/app/bin/runtime.dll and injects into legitimate processes. Network analysis shows beaconing to 133.210.142.68 every 60 seconds and DNS queries to cloudstatic.dev. The second stage was fetched from https://backup-cloud.top/assets/js/payload.js and written to C:\Windows\Tasks\shell.php. The payload uses LaZagne-style techniques for defense evasion. A secondary hash (SHA256: e90d68e8ef5c1c576538f12f3b2c8d590c483684d970ee75fce9346a18dd7ce6) was extracted from the unpacked payload.


Malware Analysis Report: Conti (SHA1: 63ca8e9737f0f4f81dda226ca748b526d6de1c1f). Upon execution on Progress Telerik, the sample creates C:\Windows\Tasks\dropper.ps1 and injects into legitimate processes. Network analysis shows beaconing to 164.126.105.154 every 60 seconds and DNS queries to secureproxy.tech. The second stage was fetched from https://portal-proxy.club/collect and written to /opt/app/bin/payload.bin. The payload uses Nmap-style techniques for defense evasion. A secondary hash (SHA1: f9765294dfbb0412874a862b43fa68ba0ccfb146) was extracted from the unpacked payload.


Malware Analysis Report: IcedID (MD5: 129058d65d3e40d314d85634ca10d382). Upon execution on F5 BIG-IP, the sample creates C:\Users\admin\AppData\Local\Temp\ntds.dit and injects into legitimate processes. Network analysis shows beaconing to 209.201.1.18 every 60 seconds and DNS queries to sync-proxy.online. The second stage was fetched from hxxp://nodecache.site/portal/verify and written to /dev/shm/implant.so. The payload uses Metasploit-style techniques for defense evasion. A secondary hash (SHA256: 786ab3bfa019031e2bace7526d64909b1e06aae5baa9e56c896c71926f023125) was extracted from the unpacked payload.


Malware Analysis Report: XLoader (MD5: 64f99d249ba76cd48ea9537548099cc0). Upon execution on Windows Server 2019, the sample creates C:\Program Files\Common Files\runtime.dll and injects into legitimate processes. Network analysis shows beaconing to 10.92.62.93 every 60 seconds and DNS queries to cdn-api.info. The second stage was fetched from hxxp://edge-edge.info/api/v2/auth and written to C:\Users\admin\AppData\Local\Temp\shell.php. The payload uses BloodHound-style techniques for defense evasion. A secondary hash (MD5: 243208ec90c180c6d47bc9e4f2270362) was extracted from the unpacked payload.


Malware Analysis Report: Conti (MD5: ffdf6f86b266dd6b6fec4ad734668304). Upon execution on Cisco ASA, the sample creates C:\Windows\Temp\dropper.ps1 and injects into legitimate processes. Network analysis shows beaconing to 73.220.123.60 every 60 seconds and DNS queries to static-static.cc. The second stage was fetched from hxxp://edgemail.live/download/update.exe and written to /opt/app/bin/helper.sh. The payload uses Rubeus-style techniques for defense evasion. A secondary hash (SHA1: 01fbcd6ca63acb13312ca7a9b3d4741abe84a84c) was extracted from the unpacked payload.


Malware Analysis Report: Royal (SHA1: 0b9ad99ee412a7cf43cc2ef5cc2724c8dc9c5623). Upon execution on Apache Struts, the sample creates /var/tmp/backdoor.elf and injects into legitimate processes. Network analysis shows beaconing to 10.46.138.208 every 60 seconds and DNS queries to authauth.xyz. The second stage was fetched from hxxp://datadata.online/download/update.exe and written to C:\Users\Public\Documents\svchost.exe. The payload uses PsExec-style techniques for defense evasion. A secondary hash (SHA1: 0e71f8c9c80783fd513b697f01eb2885fb3e74d3) was extracted from the unpacked payload.


Malware Analysis Report: XLoader (SHA1: bf4731ab3ab4cffaa49ac4b253e1087d8ed10cc7). Upon execution on Juniper SRX, the sample creates /usr/local/bin/runtime.dll and injects into legitimate processes. Network analysis shows beaconing to 115.109.118.26 every 60 seconds and DNS queries to gateway-relay.online. The second stage was fetched from http://portal-static.link/login and written to /dev/shm/ntds.dit. The payload uses GhostPack-style techniques for defense evasion. A secondary hash (SHA1: 845d9628fa3312d40ab2d99398c04697df5d04a6) was extracted from the unpacked payload.


Malware Analysis Report: NjRAT (MD5: b57cb60a9855c1f66f20eb15013ed490). Upon execution on Microsoft Exchange, the sample creates /tmp/winlogon.exe and injects into legitimate processes. Network analysis shows beaconing to 130.198.226.156 every 60 seconds and DNS queries to mail-login.club. The second stage was fetched from http://static-portal.org/wp-content/uploads/doc.php and written to /etc/cron.d/lsass.dmp. The payload uses Nmap-style techniques for defense evasion. A secondary hash (SHA256: a3e59525b583b4a97be341840d965f0d4a9e285687abb30a2aadde318abda9d6) was extracted from the unpacked payload.


Malware Analysis Report: Gootloader (SHA256: 34a7ad0ce21bcf6e68cbfbc0d2e33c091afbd5698b0ebabcedcd8aa1c6a1e69c). Upon execution on Ivanti Connect Secure, the sample creates C:\Windows\Tasks\ntds.dit and injects into legitimate processes. Network analysis shows beaconing to 7.124.33.116 every 60 seconds and DNS queries to portal-cache.tech. The second stage was fetched from http://portalupdate.online/assets/js/payload.js and written to C:\ProgramData\ntds.dit. The payload uses Nmap-style techniques for defense evasion. A secondary hash (MD5: d6f637ae2fc4c3f3676b04962c61ad61) was extracted from the unpacked payload.


Malware Analysis Report: Play (MD5: 1d1ed4af0c2c0a79335e3b8dc59ee752). Upon execution on Active Directory, the sample creates C:\Users\admin\AppData\Local\Temp\backdoor.elf and injects into legitimate processes. Network analysis shows beaconing to 123.80.86.57 every 60 seconds and DNS queries to cdn-portal.tech. The second stage was fetched from hxxp://data-api.club/api/v2/auth and written to C:\ProgramData\loader.exe. The payload uses Merlin-style techniques for defense evasion. A secondary hash (MD5: e896cddcca1a5948ef7c7cfeae092c6a) was extracted from the unpacked payload.


Malware Analysis Report: PlugX (SHA256: 4b94c65f19c797fdb3d42b188d95b70cff4d6b2e5be41a1c2e5ea9e7c9ea1ffa). Upon execution on Fortinet FortiGate, the sample creates C:\Users\admin\Downloads\agent.py and injects into legitimate processes. Network analysis shows beaconing to 172.142.95.59 every 60 seconds and DNS queries to backupsecure.io. The second stage was fetched from hxxps://data-api.cc/collect and written to /dev/shm/ntds.dit. The payload uses Mythic-style techniques for defense evasion. A secondary hash (MD5: 8893ecc371f52530f507cca2f2949a27) was extracted from the unpacked payload.


Malware Analysis Report: BumbleBee (SHA256: 544a8e4ae99d98541c9fb5c7f69a475ef2fd32fcc282812a0ba77e77c936be7a). Upon execution on Fortinet FortiGate, the sample creates C:\Users\admin\Downloads\helper.sh and injects into legitimate processes. Network analysis shows beaconing to 10.51.137.210 every 60 seconds and DNS queries to edge-auth.link. The second stage was fetched from hxxp://edgemail.club/download/update.exe and written to C:\Windows\Temp\winlogon.exe. The payload uses Havoc-style techniques for defense evasion. A secondary hash (SHA256: 61644f440729330083264a1c5331e5b3eaecd065470d4a9dff3fbda3fb91d2e3) was extracted from the unpacked payload.


Malware Analysis Report: SystemBC (SHA1: 4c22e645e79c79c035783888d19b397cf4a85a07). Upon execution on Progress Telerik, the sample creates C:\Users\admin\Downloads\taskhost.exe and injects into legitimate processes. Network analysis shows beaconing to 172.69.85.13 every 60 seconds and DNS queries to loginlogin.xyz. The second stage was fetched from hxxp://cachesync.online/gate.php and written to /var/tmp/config.dat. The payload uses Sharphound-style techniques for defense evasion. A secondary hash (SHA256: d3641f7e57e943f1a3bddb56a7c385eb3c682ef70fee3825a978f48f5769c794) was extracted from the unpacked payload.


Malware Analysis Report: Cobalt Strike (SHA256: 8a725168c90a8721519b50338da043dbdb805409950524951e6808bc6ee31fd5). Upon execution on F5 BIG-IP, the sample creates C:\Users\admin\Desktop\backdoor.elf and injects into legitimate processes. Network analysis shows beaconing to 10.147.235.136 every 60 seconds and DNS queries to portaledge.io. The second stage was fetched from https://noderelay.top/collect and written to C:\Program Files\Common Files\config.dat. The payload uses LaZagne-style techniques for defense evasion. A secondary hash (MD5: ce6fa2eea4ae8e6d9bcdfb1902e65bbf) was extracted from the unpacked payload.


Malware Analysis Report: BlackCat (SHA256: a2837586defebc5f521c6637fd98afa5f4fa8cbbe82e0122671bdb47e5d4f1e2). Upon execution on MOVEit Transfer, the sample creates /tmp/ntds.dit and injects into legitimate processes. Network analysis shows beaconing to 192.188.152.30 every 60 seconds and DNS queries to portalportal.info. The second stage was fetched from hxxp://updatestorage.online/login and written to C:\Windows\System32\sam.hive. The payload uses Havoc-style techniques for defense evasion. A secondary hash (SHA256: 0d9601027c507910bee629f13b57523d7434ba9dee24d933013c0728429f48cc) was extracted from the unpacked payload.


Malware Analysis Report: BlackCat (SHA1: 4badc3fe5d500a0ee06b28a7b79ac9522412317b). Upon execution on VMware ESXi, the sample creates C:\Windows\System32\ntds.dit and injects into legitimate processes. Network analysis shows beaconing to 63.72.8.231 every 60 seconds and DNS queries to relay-sync.online. The second stage was fetched from hxxp://relayrelay.tech/gate.php and written to C:\Users\admin\AppData\Local\Temp\helper.sh. The payload uses CrackMapExec-style techniques for defense evasion. A secondary hash (MD5: da078f267320b633160e8c1632de0e61) was extracted from the unpacked payload.


Malware Analysis Report: Gootloader (MD5: bf383d4f4a8c9229b2c4ed34f0498e5c). Upon execution on Citrix NetScaler, the sample creates /tmp/agent.py and injects into legitimate processes. Network analysis shows beaconing to 120.197.221.20 every 60 seconds and DNS queries to mailnode.io. The second stage was fetched from https://cdnproxy.net/secure/token and written to C:\Users\admin\Downloads\svchost.exe. The payload uses Metasploit-style techniques for defense evasion. A secondary hash (SHA256: 3eea8046927ebde536d6349798c5e7e0d9cd6f86dd6bb31bc5e479481ae11636) was extracted from the unpacked payload.


Malware Analysis Report: Latrodectus (MD5: 4ba829318284212151662cd8b5b0edaa). Upon execution on F5 BIG-IP, the sample creates C:\Users\admin\AppData\Local\Temp\loader.exe and injects into legitimate processes. Network analysis shows beaconing to 192.111.190.7 every 60 seconds and DNS queries to portalstorage.link. The second stage was fetched from https://mailstatic.tech/secure/token and written to C:\Users\Public\Documents\sam.hive. The payload uses Seatbelt-style techniques for defense evasion. A secondary hash (SHA256: 230c15db32df67687908b45af1dc053f744c1cd3199e42740d7593ff4ea3c136) was extracted from the unpacked payload.


Malware Analysis Report: XLoader (SHA1: 78ddfbc06827b192534dbac65e30dbe4de674a9a). Upon execution on Citrix NetScaler, the sample creates /var/tmp/update.dll and injects into legitimate processes. Network analysis shows beaconing to 10.193.169.170 every 60 seconds and DNS queries to synclogin.org. The second stage was fetched from https://api-static.site/callback and written to C:\Users\admin\AppData\Local\Temp\agent.py. The payload uses Mimikatz-style techniques for defense evasion. A secondary hash (SHA256: 62bb9ca27c26a2f3112ad3ea4ae968d801463a1444673780271e5c5ad10bf89a) was extracted from the unpacked payload.


Malware Analysis Report: Hive (MD5: b73d1d39467e447cdea82a221faee369). Upon execution on Ubuntu 22.04, the sample creates /var/tmp/sam.hive and injects into legitimate processes. Network analysis shows beaconing to 172.77.218.141 every 60 seconds and DNS queries to cloudupdate.net. The second stage was fetched from http://cdn-sync.club/api/v2/auth and written to C:\Users\admin\Downloads\beacon.dll. The payload uses Metasploit-style techniques for defense evasion. A secondary hash (SHA1: 76aa029a5d5258ca206d2e10dbd108961db3dadb) was extracted from the unpacked payload.


Malware Analysis Report: ShadowPad (MD5: 989184ff1c7a6711dbdbf118cf5f8364). Upon execution on F5 BIG-IP, the sample creates /dev/shm/backdoor.elf and injects into legitimate processes. Network analysis shows beaconing to 218.240.132.148 every 60 seconds and DNS queries to storagenode.org. The second stage was fetched from hxxps://staticdata.xyz/callback and written to /opt/app/bin/loader.exe. The payload uses Burp Suite-style techniques for defense evasion. A secondary hash (SHA1: 69f8ba122a086af4b1e15a923b341898ecfeef18) was extracted from the unpacked payload.


Malware Analysis Report: Vidar (SHA256: 50df7eaf6c17024c396639b4e074d33807f8fa16b3be489a06c5e69bb1003340). Upon execution on Atlassian Confluence, the sample creates /etc/cron.d/ntds.dit and injects into legitimate processes. Network analysis shows beaconing to 206.131.54.211 every 60 seconds and DNS queries to edge-data.live. The second stage was fetched from hxxp://data-relay.dev/api/v2/auth and written to C:\Users\admin\Desktop\ntds.dit. The payload uses BITSAdmin-style techniques for defense evasion. A secondary hash (SHA1: 6e9f28b1a35307e2abefd6b75fb15d4dc1882d74) was extracted from the unpacked payload.


Malware Analysis Report: AsyncRAT (SHA256: 3643c09bcc27171042e2ee76371c3fc329f91fa97ef6fd236f0960484040e6be). Upon execution on F5 BIG-IP, the sample creates /etc/cron.d/taskhost.exe and injects into legitimate processes. Network analysis shows beaconing to 192.246.33.199 every 60 seconds and DNS queries to cdngateway.site. The second stage was fetched from hxxps://logingateway.online/secure/token and written to /home/user/.config/helper.sh. The payload uses PowerShell Empire-style techniques for defense evasion. A secondary hash (SHA256: 20e11f40167718564de81cd4743b9b410ff6029cdaa065be8b3b2507ed3ab3c0) was extracted from the unpacked payload.


Malware Analysis Report: Vidar (SHA1: 71a3aaaab8e01e071e82ee30a4e6deaddb5776fb). Upon execution on SonicWall SMA, the sample creates C:\ProgramData\chrome_helper.exe and injects into legitimate processes. Network analysis shows beaconing to 111.120.146.63 every 60 seconds and DNS queries to storage-secure.cc. The second stage was fetched from hxxps://cacheportal.live/api/v2/auth and written to C:\Windows\Temp\payload.bin. The payload uses Certutil-style techniques for defense evasion. A secondary hash (SHA256: 9f4045ba031c3d49fa1b5f6d2beacc1312b6b5afe71ae0eb19e37b07466ad321) was extracted from the unpacked payload.


Malware Analysis Report: Qbot (SHA256: b27dbf9cb8afc9b46f99a7f3c3b8ba696975ffae2b293474a236c4a3996b59ba). Upon execution on Ubuntu 22.04, the sample creates /home/user/.config/winlogon.exe and injects into legitimate processes. Network analysis shows beaconing to 10.1.241.46 every 60 seconds and DNS queries to login-backup.live. The second stage was fetched from hxxps://mailcache.net/download/update.exe and written to C:\Users\Public\Documents\update.dll. The payload uses BITSAdmin-style techniques for defense evasion. A secondary hash (SHA1: 15e01b3ffbd628d541967d4a5dc4f92fe15049b7) was extracted from the unpacked payload.


Malware Analysis Report: Cobalt Strike (SHA1: 162ac8acf50b7631bc3f64c49cc63a2c8fd37ca2). Upon execution on Microsoft Exchange, the sample creates /usr/local/bin/config.dat and injects into legitimate processes. Network analysis shows beaconing to 10.200.251.28 every 60 seconds and DNS queries to cachebackup.cc. The second stage was fetched from hxxps://static-backup.org/gate.php and written to C:\Users\Public\Documents\beacon.dll. The payload uses ADFind-style techniques for defense evasion. A secondary hash (SHA256: bf1388b2190ec4454380f010d28ffe8e7a9b853f5461239f3c0b241b6d55d824) was extracted from the unpacked payload.


Malware Analysis Report: Gootloader (SHA256: 6302f4cb2eb5592f761ace9da3188c559b551f3334a41ece7c7a2655fa623944). Upon execution on Citrix NetScaler, the sample creates /opt/app/bin/runtime.dll and injects into legitimate processes. Network analysis shows beaconing to 171.83.242.208 every 60 seconds and DNS queries to mailnode.info. The second stage was fetched from hxxp://portalgateway.link/portal/verify and written to /var/tmp/sam.hive. The payload uses CrackMapExec-style techniques for defense evasion. A secondary hash (MD5: 4b268f56470128b36d3042d5d65d900d) was extracted from the unpacked payload.


Malware Analysis Report: Cobalt Strike (SHA256: 0825652d71b472ca7071d651c1100972ef293c292eede3c0a687d2b7dfe21a83). Upon execution on F5 BIG-IP, the sample creates C:\Program Files\Common Files\taskhost.exe and injects into legitimate processes. Network analysis shows beaconing to 10.55.229.33 every 60 seconds and DNS queries to api-backup.link. The second stage was fetched from http://storagecache.xyz/callback and written to /home/user/.config/runtime.dll. The payload uses Mythic-style techniques for defense evasion. A secondary hash (SHA256: 5d0112c7954f369f957a88d01a751e2b66b63d7a1ad8f1d47554815fb1aca617) was extracted from the unpacked payload.


Malware Analysis Report: Cobalt Strike (MD5: c646d47d8c9e7d1ee000b451077e82ba). Upon execution on MOVEit Transfer, the sample creates C:\Windows\System32\winlogon.exe and injects into legitimate processes. Network analysis shows beaconing to 50.176.33.13 every 60 seconds and DNS queries to sync-portal.org. The second stage was fetched from https://relayportal.link/gate.php and written to C:\Program Files\Common Files\winlogon.exe. The payload uses Merlin-style techniques for defense evasion. A secondary hash (SHA256: f880fa972aa35ca6ec16d0d281cee33adaf5c2cd215f8ee5be4e0db851da6dbe) was extracted from the unpacked payload.


Malware Analysis Report: DarkSide (SHA256: 6fe9339377033735f2e7f8b1d8d123d81af77ec34c67924087305f7df5bb7d2a). Upon execution on Windows Server 2019, the sample creates /tmp/config.dat and injects into legitimate processes. Network analysis shows beaconing to 107.47.249.225 every 60 seconds and DNS queries to logincdn.dev. The second stage was fetched from http://data-node.cc/portal/verify and written to C:\Program Files\Common Files\update.dll. The payload uses Seatbelt-style techniques for defense evasion. A secondary hash (SHA256: 265bdbaa1c64d43a6ddd930feb93f6aa6658b8110f399225ccdfbc4efd1d53c2) was extracted from the unpacked payload.


Malware Analysis Report: RedLine Stealer (SHA1: 762f947c7466f2da511999c5889c53519e930956). Upon execution on Zyxel USG, the sample creates C:\Users\admin\AppData\Local\Temp\sam.hive and injects into legitimate processes. Network analysis shows beaconing to 87.1.53.124 every 60 seconds and DNS queries to cloud-login.tech. The second stage was fetched from hxxp://nodeportal.dev/callback and written to /home/user/.config/dropper.ps1. The payload uses Seatbelt-style techniques for defense evasion. A secondary hash (MD5: 29b71c161c624a68de5a139247b14613) was extracted from the unpacked payload.


Malware Analysis Report: Cobalt Strike (MD5: 7bea6dbcb67399327c8dcb456b9078ed). Upon execution on Cisco ASA, the sample creates /home/user/.config/update.dll and injects into legitimate processes. Network analysis shows beaconing to 172.32.242.213 every 60 seconds and DNS queries to relaystatic.cc. The second stage was fetched from http://storage-cache.xyz/portal/verify and written to /var/tmp/shell.php. The payload uses Nmap-style techniques for defense evasion. A secondary hash (MD5: 69dcc1a6210e591560a440df22b7a456) was extracted from the unpacked payload.


Malware Analysis Report: SmokeLoader (SHA256: 1ba1c74836218bbccd27f480d277489d5b85de7e60a5fdcb133448facb64e690). Upon execution on Palo Alto PAN-OS, the sample creates /home/user/.config/implant.so and injects into legitimate processes. Network analysis shows beaconing to 10.113.230.62 every 60 seconds and DNS queries to updategateway.com. The second stage was fetched from http://sync-edge.live/login and written to C:\Users\admin\AppData\Local\Temp\beacon.dll. The payload uses BITSAdmin-style techniques for defense evasion. A secondary hash (SHA1: 02cade93700a51bc7926aa9f7aacc72996286509) was extracted from the unpacked payload.


Malware Analysis Report: WarmCookie (SHA1: b8be3f9d1120996537073d8c2087373051aeabb3). Upon execution on Active Directory, the sample creates /var/tmp/beacon.dll and injects into legitimate processes. Network analysis shows beaconing to 200.59.120.237 every 60 seconds and DNS queries to edgestorage.org. The second stage was fetched from https://update-gateway.net/admin/config and written to C:\Windows\Temp\taskhost.exe. The payload uses CrackMapExec-style techniques for defense evasion. A secondary hash (SHA1: 8b171cfa4962ff8f7bb0261df6fe81ad2c86117b) was extracted from the unpacked payload.


Malware Analysis Report: REvil (SHA1: f330a7922307ec6c3bcf14dcc7bf4ec1234eab14). Upon execution on Active Directory, the sample creates C:\Windows\System32\taskhost.exe and injects into legitimate processes. Network analysis shows beaconing to 107.82.218.53 every 60 seconds and DNS queries to mail-auth.link. The second stage was fetched from hxxps://backupedge.club/api/v2/auth and written to C:\Windows\Temp\helper.sh. The payload uses Impacket-style techniques for defense evasion. A secondary hash (MD5: 36d808bd3255e732f8cfe38298e7fc3a) was extracted from the unpacked payload.


Malware Analysis Report: DarkSide (SHA256: 2d0631490eac82f9e247d922a3589c969929d7497987db53dd76d7d0bf22b8fe). Upon execution on Citrix NetScaler, the sample creates /usr/local/bin/svchost.exe and injects into legitimate processes. Network analysis shows beaconing to 32.238.62.124 every 60 seconds and DNS queries to apimail.link. The second stage was fetched from hxxp://mail-secure.site/panel/index.html and written to C:\ProgramData\chrome_helper.exe. The payload uses Rubeus-style techniques for defense evasion. A secondary hash (MD5: 538441b09255270e6959bd971c47fbd7) was extracted from the unpacked payload.


Malware Analysis Report: NjRAT (SHA256: d21a92f807e15db26b913f3ad2da59a19e1d008acde09af04a9e4c6ed9fb8552). Upon execution on Zyxel USG, the sample creates C:\ProgramData\helper.sh and injects into legitimate processes. Network analysis shows beaconing to 172.179.15.88 every 60 seconds and DNS queries to gatewayauth.link. The second stage was fetched from http://cloudsecure.xyz/collect and written to /dev/shm/dropper.ps1. The payload uses Seatbelt-style techniques for defense evasion. A secondary hash (SHA1: f2da3a507e9fb87626886bcb92556aaa9c2f0fad) was extracted from the unpacked payload.


Malware Analysis Report: Raccoon Stealer (MD5: d094fd875d5db9e9eb8866170636b1f1). Upon execution on Juniper SRX, the sample creates C:\Windows\Tasks\chrome_helper.exe and injects into legitimate processes. Network analysis shows beaconing to 51.21.18.116 every 60 seconds and DNS queries to update-cache.tech. The second stage was fetched from hxxps://mail-storage.site/secure/token and written to C:\Windows\System32\taskhost.exe. The payload uses ADFind-style techniques for defense evasion. A secondary hash (SHA1: b779237bdc4c9a0473ae77ac6c4d2ff993eb04e4) was extracted from the unpacked payload.


Malware Analysis Report: Latrodectus (SHA256: 30b99c127b1471a45c47609309821cb38781aa97a1bae7c125044f4e0dacd4b9). Upon execution on Active Directory, the sample creates /home/user/.config/payload.bin and injects into legitimate processes. Network analysis shows beaconing to 172.253.174.31 every 60 seconds and DNS queries to storage-data.info. The second stage was fetched from hxxps://backupcdn.live/login and written to /usr/local/bin/lsass.dmp. The payload uses CrackMapExec-style techniques for defense evasion. A secondary hash (SHA1: 80cb6766654801df8bba83f322a3eb7425066053) was extracted from the unpacked payload.


Malware Analysis Report: NjRAT (MD5: 0c4a37d206508e4ea364dcb3c2a826da). Upon execution on Atlassian Confluence, the sample creates C:\Users\Public\Documents\csrss.exe and injects into legitimate processes. Network analysis shows beaconing to 20.255.157.190 every 60 seconds and DNS queries to gatewayupdate.com. The second stage was fetched from hxxps://storagesecure.club/download/update.exe and written to C:\Users\Public\Documents\taskhost.exe. The payload uses Nmap-style techniques for defense evasion. A secondary hash (SHA256: 242d7091d4af7d7070db8571e9b757ed39fcba7ea2cd3c208712e6e200a262f6) was extracted from the unpacked payload.


Malware Analysis Report: RemcosRAT (SHA256: 7dcfc8a53b05f230e8b1fae3b914807b6b176447a9f2354e36d8dbdcdcdbc2d7). Upon execution on SonicWall SMA, the sample creates /home/user/.config/taskhost.exe and injects into legitimate processes. Network analysis shows beaconing to 192.40.118.13 every 60 seconds and DNS queries to backupedge.link. The second stage was fetched from https://edge-cache.live/panel/index.html and written to C:\Users\admin\Desktop\update.dll. The payload uses Burp Suite-style techniques for defense evasion. A secondary hash (SHA256: 9c92b6fb066a774b7fe4c0a1b70e62620aa7b68e3fd85dcbe63b79499d73dbb3) was extracted from the unpacked payload.


Malware Analysis Report: Dridex (SHA1: 9361bc61bb02ae5363238069c39f4417113531ec). Upon execution on Microsoft Exchange, the sample creates C:\Users\Public\Documents\backdoor.elf and injects into legitimate processes. Network analysis shows beaconing to 190.26.70.18 every 60 seconds and DNS queries to cache-update.net. The second stage was fetched from https://cdnproxy.link/callback and written to C:\Users\admin\Downloads\shell.php. The payload uses Certutil-style techniques for defense evasion. A secondary hash (MD5: 51aebf756cf2e3378df7787c31b5345e) was extracted from the unpacked payload.


Malware Analysis Report: Dridex (MD5: 24a42dceaf8d2ced05517979fdab3652). Upon execution on Palo Alto PAN-OS, the sample creates /tmp/beacon.dll and injects into legitimate processes. Network analysis shows beaconing to 192.53.8.121 every 60 seconds and DNS queries to login-secure.club. The second stage was fetched from https://gateway-update.top/collect and written to /var/tmp/update.dll. The payload uses Sliver-style techniques for defense evasion. A secondary hash (SHA256: 6412d63d36cf538bd4557562d5580fda77148dd599996175b852e3db158b977c) was extracted from the unpacked payload.


Malware Analysis Report: Meduza Stealer (SHA1: d463fe1638ab93e839224768875b7e7f77219e62). Upon execution on Cisco ASA, the sample creates C:\Program Files\Common Files\backdoor.elf and injects into legitimate processes. Network analysis shows beaconing to 192.149.176.35 every 60 seconds and DNS queries to cachegateway.dev. The second stage was fetched from hxxps://syncdata.cc/assets/js/payload.js and written to /dev/shm/svchost.exe. The payload uses Metasploit-style techniques for defense evasion. A secondary hash (MD5: 140fb1625d73ce80a3052316a10aa807) was extracted from the unpacked payload.


Malware Analysis Report: Lumma Stealer (SHA256: ad94756b526476b72d2716ad80a02096f808456e7ba6c1592619e8e73ec49926). Upon execution on VMware ESXi, the sample creates C:\ProgramData\lsass.dmp and injects into legitimate processes. Network analysis shows beaconing to 177.65.94.209 every 60 seconds and DNS queries to data-login.club. The second stage was fetched from hxxps://data-data.club/assets/js/payload.js and written to C:\Windows\System32\runtime.dll. The payload uses Nmap-style techniques for defense evasion. A secondary hash (SHA1: 4d3a6e8b780782031ddaac7a4c1a742c3da7c1e0) was extracted from the unpacked payload.


Malware Analysis Report: DanaBot (SHA256: 319459d98b9b7f4f961e9363532aaededef9513a723dd33bb0a1887a1e8d8897). Upon execution on Palo Alto PAN-OS, the sample creates C:\Program Files\Common Files\lsass.dmp and injects into legitimate processes. Network analysis shows beaconing to 192.56.7.106 every 60 seconds and DNS queries to storage-cloud.online. The second stage was fetched from https://login-auth.live/secure/token and written to /usr/local/bin/sam.hive. The payload uses PowerView-style techniques for defense evasion. A secondary hash (SHA1: de71d149e724dc0f53e62c51fa8fc88e541386fb) was extracted from the unpacked payload.


Malware Analysis Report: LockBit (SHA256: 5be61f924a1b840f50b54eaaeb77450806c194101a2d0d8ba481cf40592b7eeb). Upon execution on VMware ESXi, the sample creates C:\Windows\Tasks\loader.exe and injects into legitimate processes. Network analysis shows beaconing to 49.124.250.126 every 60 seconds and DNS queries to gatewaycdn.info. The second stage was fetched from hxxps://gateway-relay.org/login and written to /home/user/.config/runtime.dll. The payload uses Sliver-style techniques for defense evasion. A secondary hash (MD5: 7bd4b89ef217f571e3e33794a18ad8de) was extracted from the unpacked payload.


Malware Analysis Report: Gootloader (SHA256: 6eba6f886fc85167dec24f29876dcd1c57cd1a983629390c837a883ba70a09ce). Upon execution on Zyxel USG, the sample creates C:\Users\admin\Desktop\backdoor.elf and injects into legitimate processes. Network analysis shows beaconing to 46.218.7.122 every 60 seconds and DNS queries to cache-relay.tech. The second stage was fetched from https://datarelay.xyz/gate.php and written to C:\Users\admin\Downloads\beacon.dll. The payload uses PsExec-style techniques for defense evasion. A secondary hash (MD5: c6a07f47bed6b88f93cf3f9f5c84a0bc) was extracted from the unpacked payload.


Malware Analysis Report: BlackCat (SHA256: bac424b7d51bb34f7ce94c60dde718144f11f2201ce2907cf75dedf024cad28e). Upon execution on VMware ESXi, the sample creates C:\Users\admin\Desktop\svchost.exe and injects into legitimate processes. Network analysis shows beaconing to 99.112.74.29 every 60 seconds and DNS queries to mailnode.info. The second stage was fetched from https://sync-node.link/assets/js/payload.js and written to C:\ProgramData\shell.php. The payload uses Mythic-style techniques for defense evasion. A secondary hash (SHA256: e838e7338f4fe0842822f93f9b8b529e14158da3c49e8300dcd1f898d64c94a3) was extracted from the unpacked payload.


Malware Analysis Report: BumbleBee (MD5: 2895e414828048cc93966bd1f5d7b485). Upon execution on Active Directory, the sample creates C:\Users\admin\Downloads\taskhost.exe and injects into legitimate processes. Network analysis shows beaconing to 192.93.254.251 every 60 seconds and DNS queries to login-update.tech. The second stage was fetched from http://cachestorage.com/wp-content/uploads/doc.php and written to /home/user/.config/ntds.dit. The payload uses Nmap-style techniques for defense evasion. A secondary hash (MD5: a5c924f1e082eef969c1c5358a232220) was extracted from the unpacked payload.


Malware Analysis Report: Lumma Stealer (SHA256: 06948d09af44afdd113fc92928e6fe8b9aa65470558e30794a97933dd51e4d9e). Upon execution on SonicWall SMA, the sample creates /dev/shm/helper.sh and injects into legitimate processes. Network analysis shows beaconing to 172.182.49.98 every 60 seconds and DNS queries to staticcloud.dev. The second stage was fetched from https://storage-cdn.live/secure/token and written to /opt/app/bin/beacon.dll. The payload uses PsExec-style techniques for defense evasion. A secondary hash (SHA1: e153351fcd673f171a2db9790bc0f24b2f9f26bb) was extracted from the unpacked payload.


Malware Analysis Report: Latrodectus (SHA256: de2ed04f2149a7eec041afa4290905b712668a4001c63002016feb028ea75e47). Upon execution on Active Directory, the sample creates /tmp/runtime.dll and injects into legitimate processes. Network analysis shows beaconing to 10.70.118.106 every 60 seconds and DNS queries to cloud-relay.site. The second stage was fetched from hxxp://auth-edge.online/wp-content/uploads/doc.php and written to /etc/cron.d/taskhost.exe. The payload uses BloodHound-style techniques for defense evasion. A secondary hash (SHA1: 060f9d117b5cec5db3649b67b6bca8ec7946776e) was extracted from the unpacked payload.


Malware Analysis Report: Emotet (SHA1: 09a445c5fe964cec72c1a31fc642aa57e2324edb). Upon execution on F5 BIG-IP, the sample creates /dev/shm/backdoor.elf and injects into legitimate processes. Network analysis shows beaconing to 172.230.107.24 every 60 seconds and DNS queries to datastatic.net. The second stage was fetched from hxxp://sync-static.io/login and written to C:\Users\admin\Downloads\svchost.exe. The payload uses Merlin-style techniques for defense evasion. A secondary hash (MD5: 9ddd792d07c38c683fcad214c26e0015) was extracted from the unpacked payload.


Malware Analysis Report: Royal (MD5: 84f11cd52bc1f3cc370639c4b2efaf42). Upon execution on Fortinet FortiGate, the sample creates C:\Windows\Temp\backdoor.elf and injects into legitimate processes. Network analysis shows beaconing to 10.117.142.1 every 60 seconds and DNS queries to mailmail.link. The second stage was fetched from hxxps://edgesecure.com/admin/config and written to /tmp/config.dat. The payload uses Covenant-style techniques for defense evasion. A secondary hash (MD5: 439e778b0d9d03c3fd1b6337d5b34343) was extracted from the unpacked payload.


Malware Analysis Report: Play (SHA1: f9ab81b8a8a2a712f8d6aa9ab0b0651eeb5c181a). Upon execution on Ubuntu 22.04, the sample creates /tmp/csrss.exe and injects into legitimate processes. Network analysis shows beaconing to 10.107.101.34 every 60 seconds and DNS queries to relaycdn.top. The second stage was fetched from hxxps://datastatic.org/api/v2/auth and written to /home/user/.config/ntds.dit. The payload uses CrackMapExec-style techniques for defense evasion. A secondary hash (SHA256: 65842fb0c32b8b0ca4c7a6b9e2e473e919f21e7582a5c254dff3119425a9c9dc) was extracted from the unpacked payload.


Malware Analysis Report: REvil (MD5: 2c1666c9f68bc119f178aea512ce4987). Upon execution on Juniper SRX, the sample creates C:\Program Files\Common Files\helper.sh and injects into legitimate processes. Network analysis shows beaconing to 10.191.17.137 every 60 seconds and DNS queries to gateway-auth.net. The second stage was fetched from http://cloud-api.org/api/v2/auth and written to C:\Users\admin\Downloads\backdoor.elf. The payload uses WinPEAS-style techniques for defense evasion. A secondary hash (MD5: 0133cb5d34c6ea6a4ea9b69370215847) was extracted from the unpacked payload.


Malware Analysis Report: Latrodectus (SHA1: 23c260a7e848094cdb5a4740aa502bba349d6152). Upon execution on Barracuda ESG, the sample creates C:\Windows\Temp\runtime.dll and injects into legitimate processes. Network analysis shows beaconing to 116.80.110.245 every 60 seconds and DNS queries to gatewaysecure.cc. The second stage was fetched from hxxp://syncstorage.info/assets/js/payload.js and written to C:\Users\admin\Desktop\agent.py. The payload uses Ligolo-style techniques for defense evasion. A secondary hash (SHA1: b3af32d6ed30aaf46881333cf7c5f4557f5308c1) was extracted from the unpacked payload.


Malware Analysis Report: ShadowPad (SHA256: a877fa590746bef30fc8982070f32381ccec9184f2195ed75209912c8aea0053). Upon execution on Barracuda ESG, the sample creates /var/tmp/update.dll and injects into legitimate processes. Network analysis shows beaconing to 192.64.27.59 every 60 seconds and DNS queries to edge-proxy.site. The second stage was fetched from hxxp://cdn-node.org/download/update.exe and written to C:\ProgramData\helper.sh. The payload uses Certutil-style techniques for defense evasion. A secondary hash (SHA1: fe4e08d58b7775511c927b5e1d8caf6076dcf788) was extracted from the unpacked payload.


Malware Analysis Report: Dridex (MD5: 3b5fdea7a3ef1e2a886d386ab5c30f82). Upon execution on Ubuntu 22.04, the sample creates C:\ProgramData\loader.exe and injects into legitimate processes. Network analysis shows beaconing to 172.133.170.141 every 60 seconds and DNS queries to secure-cdn.site. The second stage was fetched from hxxp://cloudlogin.link/assets/js/payload.js and written to C:\Windows\System32\implant.so. The payload uses Brute Ratel-style techniques for defense evasion. A secondary hash (SHA1: 2cb908e5c7190d51d6918aa104ff47406c251f92) was extracted from the unpacked payload.


Malware Analysis Report: XLoader (SHA1: f9b1c6f61ec52739c125c3ec3ac884c9ec4e0555). Upon execution on Palo Alto PAN-OS, the sample creates /opt/app/bin/config.dat and injects into legitimate processes. Network analysis shows beaconing to 192.164.235.43 every 60 seconds and DNS queries to storageupdate.com. The second stage was fetched from hxxps://update-update.live/api/v2/auth and written to C:\ProgramData\chrome_helper.exe. The payload uses WinPEAS-style techniques for defense evasion. A secondary hash (SHA1: a456f327d763fa0825e8257a30fffb6446c60857) was extracted from the unpacked payload.


Malware Analysis Report: Amadey (SHA256: 01951d2758b6ca769f7c4c8db98e324158d877716d5b4e055ed095f36a3448f4). Upon execution on MOVEit Transfer, the sample creates C:\Users\admin\Downloads\chrome_helper.exe and injects into legitimate processes. Network analysis shows beaconing to 15.13.76.254 every 60 seconds and DNS queries to storageportal.top. The second stage was fetched from https://node-backup.link/portal/verify and written to C:\Windows\System32\implant.so. The payload uses PowerView-style techniques for defense evasion. A secondary hash (MD5: ce76d692cd4336cd89f64df0646c7199) was extracted from the unpacked payload.


Malware Analysis Report: WarmCookie (MD5: 8e7d05464f9b5f901edcc20575df2b85). Upon execution on Windows 11, the sample creates C:\Program Files\Common Files\sam.hive and injects into legitimate processes. Network analysis shows beaconing to 134.39.77.45 every 60 seconds and DNS queries to nodestatic.link. The second stage was fetched from hxxps://storage-portal.online/panel/index.html and written to C:\Windows\Temp\update.dll. The payload uses ADFind-style techniques for defense evasion. A secondary hash (MD5: 3aaa1ea6f7b163c41ed0dd810307d601) was extracted from the unpacked payload.


Malware Analysis Report: Emotet (SHA1: 51445d2ee01f5de4b9ce83ee8978bce542cdb3da). Upon execution on Atlassian Confluence, the sample creates C:\Program Files\Common Files\payload.bin and injects into legitimate processes. Network analysis shows beaconing to 172.176.174.23 every 60 seconds and DNS queries to nodesync.io. The second stage was fetched from hxxps://portal-portal.cc/wp-content/uploads/doc.php and written to /usr/local/bin/loader.exe. The payload uses PsExec-style techniques for defense evasion. A secondary hash (MD5: 02feed0cf1eadb96af3117f0612703c6) was extracted from the unpacked payload.


Malware Analysis Report: RedLine Stealer (SHA1: 4fa993498d9a346aadd534b88a98c7cd651f1f87). Upon execution on Progress Telerik, the sample creates C:\Windows\Tasks\implant.so and injects into legitimate processes. Network analysis shows beaconing to 80.87.192.187 every 60 seconds and DNS queries to edge-cdn.top. The second stage was fetched from hxxp://cdngateway.xyz/callback and written to /etc/cron.d/svchost.exe. The payload uses Seatbelt-style techniques for defense evasion. A secondary hash (SHA256: 6b40f10ba355d3f4bbe49789601101447ff0daf47ef8895cac7b65aac4399506) was extracted from the unpacked payload.


Vulnerability Advisory: CVE-2026-38492 is a critical authentication bypass affecting Citrix NetScaler. Recorded Future confirmed active exploitation by UNC2452 in the wild. Exploitation delivers SmokeLoader (MD5: 3ac43dea138ef64a44f3348ed7f58622) which is dropped to C:\Users\admin\Downloads\dropper.ps1. The exploit payload is hosted at hxxps://syncnode.net/portal/verify and communicates to 172.24.62.222 for C2.


Vulnerability Advisory: CVE-2026-10752 is a critical command injection affecting Juniper SRX. Cisco Talos confirmed active exploitation by Forest Blizzard in the wild. Exploitation delivers Vidar (SHA1: 3cd18c4ccfd01403bd5ff58b9b6404e29076ae11) which is dropped to /home/user/.config/config.dat. The exploit payload is hosted at hxxps://datalogin.top/download/update.exe and communicates to 184.96.32.103 for C2.


Vulnerability Advisory: CVE-2023-27691 is a critical SSRF vulnerability affecting Apache Struts. Google TAG confirmed active exploitation by Midnight Blizzard in the wild. Exploitation delivers Cobalt Strike (SHA1: ff219910b8adc2dd03fc077f975e967428a4e32e) which is dropped to C:\Users\admin\Desktop\agent.py. The exploit payload is hosted at https://cloudauth.info/api/v2/auth and communicates to 10.214.66.95 for C2.


Vulnerability Advisory: CVE-2024-26162 is a critical authentication bypass affecting Ivanti Connect Secure. Huntress confirmed active exploitation by Sandworm in the wild. Exploitation delivers TrickBot (MD5: 5416b4f14b630160015d2781a17a15fc) which is dropped to C:\ProgramData\beacon.dll. The exploit payload is hosted at hxxp://datamail.tech/portal/verify and communicates to 194.148.21.48 for C2.


Vulnerability Advisory: CVE-2023-27691 is a critical SSRF vulnerability affecting Active Directory. Qualys confirmed active exploitation by Scattered Spider in the wild. Exploitation delivers BlackCat (SHA1: 5bf0fa08d4a614abedb0275844eb0b27649ed479) which is dropped to C:\Windows\Tasks\implant.so. The exploit payload is hosted at hxxp://mail-data.io/portal/verify and communicates to 132.11.115.188 for C2.


Vulnerability Advisory: CVE-2020-25247 is a critical heap overflow affecting Windows 11. Trend Micro confirmed active exploitation by Scattered Spider in the wild. Exploitation delivers Conti (SHA256: ce31d1af971c75f902dbd901d894191bcbf9b49d84fc7f75c674327b03691305) which is dropped to C:\Users\admin\Desktop\helper.sh. The exploit payload is hosted at https://cloud-mail.xyz/collect and communicates to 172.122.104.235 for C2.


Vulnerability Advisory: CVE-2021-28231 is a critical SQL injection affecting VMware ESXi. Secureworks confirmed active exploitation by Star Blizzard in the wild. Exploitation delivers Hive (SHA256: 91345b1f8760ab13300e4c661bcd6508063e879768f15fcb8fc247964a6ab4c3) which is dropped to /dev/shm/runtime.dll. The exploit payload is hosted at hxxps://static-cloud.xyz/admin/config and communicates to 135.238.63.140 for C2.


Vulnerability Advisory: CVE-2025-48311 is a critical heap overflow affecting Microsoft Exchange. Mandiant confirmed active exploitation by Kimsuky in the wild. Exploitation delivers ShadowPad (SHA1: 0ee697c3d4909e3eb765e215ef53f9ba309da6dd) which is dropped to C:\Program Files\Common Files\dropper.ps1. The exploit payload is hosted at https://static-node.online/callback and communicates to 219.17.39.245 for C2.


Vulnerability Advisory: CVE-2026-38492 is a critical buffer overflow affecting Windows Server 2019. FireEye confirmed active exploitation by Charming Kitten in the wild. Exploitation delivers Emotet (MD5: 14b0001b1ea0a678e74c92d22b95f2a6) which is dropped to /var/tmp/lsass.dmp. The exploit payload is hosted at hxxp://storage-gateway.net/collect and communicates to 10.13.15.151 for C2.


Vulnerability Advisory: CVE-2026-35216 is a critical IDOR vulnerability affecting Active Directory. Volexity confirmed active exploitation by Granite Typhoon in the wild. Exploitation delivers AgentTesla (SHA256: 1548b3225be81d4de1f4097f92c222d80906a46b83b0cbaaaae7bc3cd0eb29ba) which is dropped to C:\Windows\System32\update.dll. The exploit payload is hosted at https://static-cloud.site/collect and communicates to 211.61.212.235 for C2.


Vulnerability Advisory: CVE-2023-46500 is a critical type confusion affecting Ubuntu 22.04. Rapid7 confirmed active exploitation by Flax Typhoon in the wild. Exploitation delivers TrickBot (SHA256: ee0508d79eda99bc7532b2fab948d2a2783d945d49b281c83991cb91779ec170) which is dropped to C:\Windows\System32\ntds.dit. The exploit payload is hosted at http://datadata.site/secure/token and communicates to 192.146.55.139 for C2.


Vulnerability Advisory: CVE-2022-12847 is a critical authentication bypass affecting Palo Alto PAN-OS. INTERPOL confirmed active exploitation by Diamond Sleet in the wild. Exploitation delivers Cobalt Strike (SHA1: 33d466aab42eeede24bda56aa97b1d494cdabafb) which is dropped to /home/user/.config/payload.bin. The exploit payload is hosted at hxxps://storagegateway.net/portal/verify and communicates to 10.122.231.71 for C2.


Vulnerability Advisory: CVE-2026-10212 is a critical SSRF vulnerability affecting Windows 11. Tenable confirmed active exploitation by Forest Blizzard in the wild. Exploitation delivers Ryuk (MD5: 2a0422f79dfb9062495a1051a14f4195) which is dropped to C:\Users\Public\Documents\payload.bin. The exploit payload is hosted at hxxps://portalgateway.site/panel/index.html and communicates to 162.10.172.61 for C2.


Vulnerability Advisory: CVE-2020-24628 is a critical remote code execution affecting Palo Alto PAN-OS. Qualys confirmed active exploitation by Mustang Panda in the wild. Exploitation delivers ShadowPad (SHA1: 06286daeb99f440f244664a4bd6efd3a59537569) which is dropped to C:\ProgramData\winlogon.exe. The exploit payload is hosted at hxxps://staticapi.live/callback and communicates to 192.104.184.100 for C2.


Vulnerability Advisory: CVE-2022-14558 is a critical cross-site scripting affecting Fortinet FortiGate. Huntress confirmed active exploitation by Kimsuky in the wild. Exploitation delivers Qbot (SHA1: 757465a40f1e173f565f97b98608229218862958) which is dropped to /dev/shm/ntds.dit. The exploit payload is hosted at http://nodeedge.org/collect and communicates to 172.174.182.14 for C2.


Vulnerability Advisory: CVE-2021-16078 is a critical type confusion affecting Palo Alto PAN-OS. NSA confirmed active exploitation by Scattered Spider in the wild. Exploitation delivers AsyncRAT (SHA1: 42023d94ec9303e6f3d8010c1b5b3aad166d85dd) which is dropped to /var/tmp/beacon.dll. The exploit payload is hosted at http://edgeupdate.link/wp-content/uploads/doc.php and communicates to 75.20.59.62 for C2.


Vulnerability Advisory: CVE-2026-20365 is a critical privilege escalation affecting SonicWall SMA. Mandiant confirmed active exploitation by Flax Typhoon in the wild. Exploitation delivers QakBot (SHA1: 2ce11c6330df244cbf46c4e1baaf7aa6456b26fb) which is dropped to /etc/cron.d/shell.php. The exploit payload is hosted at hxxps://mail-relay.club/collect and communicates to 10.191.63.14 for C2.


Vulnerability Advisory: CVE-2020-43118 is a critical use-after-free affecting Apache Struts. Europol confirmed active exploitation by OilRig in the wild. Exploitation delivers Raccoon Stealer (SHA1: 0007ba3d16c89ccec20f4c2dc7f62e92f5fb2aba) which is dropped to /home/user/.config/dropper.ps1. The exploit payload is hosted at http://portal-static.club/collect and communicates to 10.231.130.150 for C2.


Vulnerability Advisory: CVE-2025-20484 is a critical SQL injection affecting Juniper SRX. Trend Micro confirmed active exploitation by APT28 in the wild. Exploitation delivers BatLoader (SHA1: da3adcf38b0e0d0ab4a7ad7536b6b98fe5178527) which is dropped to /home/user/.config/shell.php. The exploit payload is hosted at hxxps://login-storage.cc/portal/verify and communicates to 192.187.196.164 for C2.