| 2026-10-11 15:42 | SHA256 | 14f50765a47707faa45dadce7207b0caaaabb6872b549b5050ee11e57f82398a | Malware sample | — |
| 2026-10-11 15:39 | SHA256 | 8aab1c532a70a53cd60fd5a54bdd64e529349e0c8a110d08dfa5ad7c20f82ac5 | Malware sample | — |
| 2026-10-11 15:01 | SHA256 | 865918c46c7d8275411ffd0a8f1e7691ed1baaadaa9a28711a357b61d940711e | Malware sample | — |
| 2026-10-11 07:02 | Domain | wruser[.]org | Botnet C2 | — |
| 2026-10-11 07:02 | Domain | salator[.]es | Botnet C2 | — |
| 2026-10-11 07:02 | Domain | websalat[.]top | Botnet C2 | — |
| 2026-10-11 07:02 | IP | 64.204.180[.]24:443 | Botnet C2 | — |
| 2026-10-11 07:02 | IP | 141.95.112[.]163:443 | Botnet C2 | — |
| 2026-10-11 07:02 | IP | 109.237.98[.]213:443 | Botnet C2 | — |
| 2026-10-11 07:02 | Domain | webrat[.]es | Botnet C2 | — |
| 2026-10-10 20:56 | SHA256 | 5898cab97f4e82f4b3fc1ded1f26c7c3451ab137dcffffeaa68e6360558ad607 | Malware sample | — |
| 2026-10-10 15:11 | SHA256 | 62077aa1d53bc5269053c9e53e32f37be8f71ef7aea1503c78b53faa95c88c5f | Malware sample | — |
| 2026-10-08 14:33 | MD5 | 5c9bc5f302bd0e2e31fbfefcd96d4a6a | payload | — |
| 2026-10-08 14:33 | MD5 | 88bd93c3462c1e219d6b64af47ab22fc | payload | — |
| 2026-10-08 14:33 | SHA256 | 217b221e5bcfad247ba6fa8f11809967a57d536a6d049c7200542cb8efe883c4 | payload | — |
| 2026-10-08 14:33 | SHA1 | 41e845c2b85a3b7fd8db67d25028dd904876e094 | payload | — |
| 2026-10-08 14:33 | SHA256 | 680a01fc7667fe9589137b855256e60e391700f4063dd887d165a86d72c8c9ef | payload | — |
| 2026-10-08 14:33 | SHA1 | c3103ab2f313ab8c70d4f0ac3beaf67e51e2f849 | payload | — |
| 2026-10-08 07:51 | SHA256 | 680a01fc7667fe9589137b855256e60e391700f4063dd887d165a86d72c8c9ef | Malware sample | — |
| 2026-10-08 07:50 | SHA256 | 217b221e5bcfad247ba6fa8f11809967a57d536a6d049c7200542cb8efe883c4 | Malware sample | — |
| 2026-10-07 16:33 | SHA256 | dc978cecad6e55b168f42ffcaab296a4513c3a46af58707fb1f6af5d162a69e0 | payload | — |
| 2026-10-07 16:33 | SHA1 | 10b0b5bbc48e6b9bfc70eba5e3d099b68e96c802 | payload | — |
| 2026-10-07 16:33 | MD5 | fa553cae460341d33e5b04d4296c601e | payload | — |
| 2026-10-06 19:25 | SHA256 | 374c1bcedd9eb8d9e537dd47759685e5d9db21c0aa9b943592cd95aadbd18248 | payload | — |
| 2026-10-06 19:25 | SHA1 | 9c68b869355bf750c8e67d6d83c1d97d01961291 | payload | — |
| 2026-10-06 19:25 | MD5 | f221f1a45d3646cb8117fcc5f699c20b | payload | — |
| 2026-10-06 19:25 | SHA256 | 5381889f657250a50a62c8a629ee825ad3249a1ecac97454bbf9f0f0f30e7d6f | payload | — |
| 2026-10-06 19:25 | SHA1 | e08985a27c82d06869335f776041db29b7bc92bf | payload | — |
| 2026-10-06 19:25 | MD5 | 38f0046416e3fdf6af81b5b3326e2240 | payload | — |
| 2026-10-06 11:18 | URL | hxxps://wruser[.]org/sa1at/ | Botnet C2 | — |
| 2026-10-06 11:18 | URL | hxxps://wruser[.]org:992/sa1at/ | Botnet C2 | — |
| 2026-10-06 11:18 | URL | hxxps://sa1atik[.]cn/sa1at/ | Botnet C2 | — |
| 2026-10-06 11:18 | URL | hxxps://salator[.]es/sa1at/ | Botnet C2 | — |
| 2026-10-05 16:40 | SHA256 | 5381889f657250a50a62c8a629ee825ad3249a1ecac97454bbf9f0f0f30e7d6f | Malware sample | — |
| 2026-10-05 16:39 | SHA256 | 374c1bcedd9eb8d9e537dd47759685e5d9db21c0aa9b943592cd95aadbd18248 | Malware sample | — |
| 2026-10-05 02:33 | MD5 | 8dcdcd4a750b248d9eedb87c422edc88 | payload | — |
| 2026-10-05 02:33 | SHA256 | 0b8e3baabf8c4d764431e3927e2cd549efcb5d2cd05ae7c62c145fb8fdfb144f | payload | — |
| 2026-10-05 02:33 | SHA1 | c88aa9c10e63eb89e5842b3a8f1ee4ec24c116ee | payload | — |
| 2026-04-25 16:07 | Domain | sa1atik[.]cn | Botnet C2 | — |
| 2026-03-14 17:18 | TLS cert | a7446ad26ff75707d6846e0e3d86833d362e35cc | Botnet C2 | — |
| 2026-01-31 16:45 | TLS cert | 0f4e5aaccb97182bf96d4dec2745543d2500e161 | Botnet C2 | — |
| 2025-10-16 13:29 | URL | hxxps://websalat[.]top/sa1at/ | Botnet C2 | — |