| 2026-10-12 00:58 | URL | hxxp://116[.]58[.]62[.]74/av.scr | Payload delivery | — |
| 2026-10-12 00:56 | URL | hxxp://111[.]59[.]254[.]165:8084/20250703/photo.scr | Payload delivery | — |
| 2026-10-11 23:43 | SHA256 | 58a7ce70ecf1ca520babfd4213c6758e494b929a411ad8b4d4e802cb7690d911 | Malware sample | — |
| 2026-10-11 22:53 | URL | hxxp://116[.]171[.]106[.]3:3435/to…es/com/vkl/ckts/cksy/base/info.zip | Payload delivery | — |
| 2026-10-11 16:12 | SHA256 | 66020bbfa6744e606b312416f65e1c69b44f98ad9fee49c63e100bf32ffee4b7 | payload | — |
| 2026-10-11 15:56 | SHA256 | 66020bbfa6744e606b312416f65e1c69b44f98ad9fee49c63e100bf32ffee4b7 | Malware sample | — |
| 2026-10-11 15:46 | SHA256 | e9ba70f1edc3f1f31406ecc5e2d02efc2a7a7fa1088b518dacff89d9e10a7933 | payload | — |
| 2026-10-11 15:46 | SHA1 | e03a2a50c6dd001c8419971ae4c46349e3cffde4 | payload | — |
| 2026-10-11 15:46 | MD5 | 4ecf88981e7726812fb94db1bb1688d1 | payload | — |
| 2026-10-11 15:31 | SHA256 | 3060f865fd3b9af33fd778b52600d0fdd4ff5920329747f881afda256ed10219 | Malware sample | — |
| 2026-10-11 15:29 | SHA256 | a24b6b1e9cbe266e5c0b55f1f9e601bb54d6232a3833befc9e7fa41a345ddb15 | Malware sample | — |
| 2026-10-11 05:02 | SHA256 | e9ba70f1edc3f1f31406ecc5e2d02efc2a7a7fa1088b518dacff89d9e10a7933 | Malware sample | — |
| 2026-10-11 01:01 | SHA256 | 2dccab5b3b7a88abf6a2e2c7e592fbf54a017ce6e465ce6a722c2f5fc656b553 | Malware sample | — |
| 2026-10-10 23:07 | URL | hxxp://31[.]77[.]144[.]86:49104/ddb64.dll | Payload delivery | — |
| 2026-10-10 21:09 | SHA256 | cf03c5920933f4c0f79c71e52edb28d238bb8396e71558ecc9b33a595fc0a9ae | payload | — |
| 2026-10-10 21:09 | SHA1 | 0c77484252a50e76e06efd8d53cbec7a71397c2e | payload | — |
| 2026-10-10 21:09 | MD5 | 31525df166ed1ca0a0da57f68b2fbb3e | payload | — |
| 2026-10-10 21:09 | MD5 | 82967b6c24f52664a3b9399f853ea812 | payload | — |
| 2026-10-10 21:09 | SHA1 | 064e83897c545f71f2f6a879ea0845f6d23ec9b9 | payload | — |
| 2026-10-10 21:08 | SHA1 | b38b68931a8607e1f78f00188843fdd4a4ee60b0 | payload | — |
| 2026-10-10 21:08 | MD5 | e44b8803d57a6bc4a3561f61b95ff731 | payload | — |
| 2026-10-10 21:08 | MD5 | 070c2cc17d3f0c3086f6410df6886a6b | payload | — |
| 2026-10-10 21:08 | SHA256 | 87d8778250a4515ed73221ba47fb861ac9fb0303c49045dd9f5cc6954021477a | payload | — |
| 2026-10-10 21:08 | SHA1 | 5c6c793ed469e95cb67f4389db9d1b41a7c35bf0 | payload | — |
| 2026-10-10 19:21 | SHA256 | 87d8778250a4515ed73221ba47fb861ac9fb0303c49045dd9f5cc6954021477a | Malware sample | — |
| 2026-10-10 08:41 | SHA256 | 5c24c3ccf5aa8fb28d57d43271657e690a1f505113a73d9dc8e1b16be5dc02d3 | Malware sample | — |
| 2026-10-10 06:02 | URL | hxxps://www[.]osmb[.]net/OSMB.jar | Payload delivery | — |
| 2026-10-10 06:02 | Domain | www[.]osmb[.]net | Payload delivery | — |
| 2026-10-10 06:02 | Domain | osbot[.]net | Payload delivery | — |
| 2026-10-10 01:12 | SHA256 | 385c518f5251712671b029d3e862a4d4ce25dea3c4d578c6512f1d4d911cf14d | payload | — |
| 2026-10-10 01:12 | SHA256 | 528458c9d7ac88959d2d83aecd0544bf75727d34795deaf658ff3b82000a9e44 | payload | — |
| 2026-10-10 00:07 | SHA256 | 385c518f5251712671b029d3e862a4d4ce25dea3c4d578c6512f1d4d911cf14d | Malware sample | — |
| 2026-10-10 00:03 | SHA256 | 528458c9d7ac88959d2d83aecd0544bf75727d34795deaf658ff3b82000a9e44 | Malware sample | — |
| 2026-10-09 19:03 | SHA256 | cf03c5920933f4c0f79c71e52edb28d238bb8396e71558ecc9b33a595fc0a9ae | Malware sample | — |
| 2026-10-09 15:45 | SHA1 | 30e3cdc2d6accb4037e0d3078058d34654a4935e | payload | — |
| 2026-10-09 15:45 | MD5 | 6e7fb5ed733aedc9943cc4eb2ce744f5 | payload | — |
| 2026-10-09 15:45 | SHA1 | be687d344be9e4df16978bd689caa3c64c6abe36 | payload | — |
| 2026-10-09 15:45 | MD5 | fe7c856701c13f3bd2b3825fb61d47c8 | payload | — |
| 2026-10-09 15:45 | SHA256 | 448b653511a12b85616230b744e0c270a28593b2eff222ab432f0a077ad3e328 | payload | — |
| 2026-10-08 20:19 | SHA256 | 448b653511a12b85616230b744e0c270a28593b2eff222ab432f0a077ad3e328 | Malware sample | — |
| 2026-10-08 16:39 | SHA256 | 3f790d1fc0bae05463f75c5c2fda33b7616230a361630da56e87f7cf26e5fd89 | payload | — |
| 2026-10-08 15:38 | SHA256 | 3f790d1fc0bae05463f75c5c2fda33b7616230a361630da56e87f7cf26e5fd89 | Malware sample | — |
| 2026-10-07 15:41 | SHA256 | fba55fd42a6cb14c417c3922d09fbcd105bdce13aff48ef908e6a201174a535d | Malware sample | — |
| 2026-10-07 08:40 | SHA256 | f8176877cc9f083324e0d69c2d932a98129eb4ad3f6f24ecf7d002cbaafcc8b8 | Malware sample | — |
| 2026-10-06 19:25 | SHA256 | abda1607910d3b8653aed50d74bf7e8d7189db192d553086a3c1b85a78bb7235 | payload | — |
| 2026-10-06 19:25 | SHA1 | 0cfa7f7be36e8d4c67efebac3bc21ae4c89849e5 | payload | — |
| 2026-10-06 19:25 | MD5 | 096622abc355ce5302f4154d45751620 | payload | — |
| 2026-10-06 19:25 | MD5 | cd1fd8e06c31dc642b038cec1e234442 | payload | — |
| 2026-10-06 19:25 | SHA256 | b4359324e3cffb3dc521a808dfa0b5d7bd92dc6e08eb7527da41e1e1312d3265 | payload | — |
| 2026-10-06 19:25 | SHA1 | 37eb569f7ec3502a1013e8c554864024a25489a1 | payload | — |
| 2026-10-06 19:24 | SHA256 | e740b087ea540c1fabcb0623399c7142aa6dd68fd9b4a4cadd7521170c332935 | payload | — |
| 2026-10-06 19:24 | SHA1 | 48ff4494c64d8a4480ff4b22ea71d3e79a6e799f | payload | — |
| 2026-10-06 19:24 | MD5 | cfcc97cb95e356ac0cd2e295c025dd25 | payload | — |
| 2026-10-06 19:24 | SHA256 | ed554c51f7f69c2ca0e80c18d4b0e1240a33d74ba999ec9006cf5440b1f7bdb4 | payload | — |
| 2026-10-06 19:24 | SHA1 | e9c5434e128e8b8134ea3c80b6a54d6416d50bce | payload | — |
| 2026-10-06 19:24 | MD5 | 2feb859f5ad6cbb84746b2be2bac7c99 | payload | — |
| 2026-10-06 16:44 | SHA256 | 5a15602695f7ad57725792d8714fa2305748b49f2b7a460849842d122b926249 | Malware sample | — |
| 2026-10-06 15:45 | SHA256 | b449341fb97c5dd248f2091d92ad27d4dc32861ba5bc86deb0ccbbc627d4843e | Malware sample | — |
| 2026-10-06 10:13 | SHA256 | ed554c51f7f69c2ca0e80c18d4b0e1240a33d74ba999ec9006cf5440b1f7bdb4 | Malware sample | — |
| 2026-10-06 06:46 | SHA256 | 4741fe9894bbe49d6014cec8d30993f7ff77326938315c5515f6923be9f75375 | Malware sample | — |
| 2026-10-06 03:24 | SHA256 | e740b087ea540c1fabcb0623399c7142aa6dd68fd9b4a4cadd7521170c332935 | Malware sample | — |
| 2026-10-06 01:46 | SHA256 | 50a6bc7170cb47da6bb1206ad4d0997ccbeac2980e2e95552866981551db91e9 | payload | — |
| 2026-10-06 01:46 | SHA256 | e80d37143b54b81a5d54a251cc7a317497e92a399c5f18ca506d01683b04903f | payload | — |
| 2026-10-05 22:46 | SHA256 | b5e0708d7c6d694b4701763be412aa40bd9e3007bbbde45e30217ee2018a9753 | payload | — |
| 2026-10-05 18:23 | SHA256 | b4359324e3cffb3dc521a808dfa0b5d7bd92dc6e08eb7527da41e1e1312d3265 | Malware sample | — |
| 2026-10-05 16:05 | SHA256 | abda1607910d3b8653aed50d74bf7e8d7189db192d553086a3c1b85a78bb7235 | Malware sample | — |
| 2026-10-05 14:30 | MD5 | 8de4f7dc19cf7f78385e3cbb5b31a684 | payload | — |
| 2026-10-05 14:30 | SHA1 | 4f1cf8799aca04e99ebce7553a3042ae29706f00 | payload | — |
| 2026-10-05 14:29 | SHA256 | 1c8fd52d6fa54459b837faf44b8addfdaf01793406a827ae93abcdd0dc497f64 | Malware sample | — |
| 2026-10-05 02:46 | SHA256 | fb7460f1febcc0f1e96f2df6c4b940f3beac750ce8cd1f30f98086400fbbe20e | payload | — |
| 2026-10-05 02:33 | SHA256 | 9e2f886322137391fdfd8555e5a2e317a3c507b51e897c53273d5d696531cc12 | payload | — |
| 2026-10-05 02:33 | SHA1 | 390edc87148e627f812bfda0bb14f038d259d5f3 | payload | — |
| 2026-10-05 02:33 | MD5 | 547f24096e74bfe49d1682b8aecb6fde | payload | — |
| 2026-02-23 09:33 | TLS cert | b44adcee870498302673e7c1d0cb75fab1d730dc | Botnet C2 | — |
| 2025-10-07 22:06 | URL | hxxp://111[.]59[.]254[.]165:8084/20250728/Photo.scr | Payload delivery | — |
| 2025-07-26 18:09 | TLS cert | 353f040565bfa1b6795ac875aaddeb4483df2144 | Botnet C2 | — |
| 2018-10-16 06:20 | TLS cert | 84ec9d5d579caa0983fe30917e09aa355af9fe3c | Botnet C2 | — |
| 2018-04-15 15:49 | JA3 | 40adfd923eb82b89d8836ba37a19bca1 | malware_tls_client | — |