IOC Radar
SHA256HighVerifiedSignal 44/100

1dbb3d08931aac2a76c9a72fe38d038e172b29f898acaf5db1ec91e180f7ec22

Location
IndonesiaIndonesia
First Seen
Nov 8, 2024
Last Seen
Oct 25, 2025
Nov 8
First Seen
603d ago
Oct 25
Last Seen
252d ago
4
Reports
source reports
44%
Confidence
high
Found in 4 reports. Confidence: high. · Confidence scores are heuristic. Verify before acting on results.
SHA-256 Hash
SHA-256 file hash — primary identifier for malware samples.
MISP Category
Artifacts Dropped
Hash Algorithm
SHA256
Confidence
44%
Signal Score
44 / 100
IDS Rule
No
Threat Context
Tags
MITRE ATT&CK

MITRE ATT&CK TTPs

50 techniques

Feed Intelligence Summary

4 reports44% confidence
4
Source reports
44%
Confidence score
Category tags
abuseantivmapplied researchasiabotnetbotnet activitybrute forcec serverc2c2 communicationc2 externalc2 internalcapturechrome accountcobalt strikecommand and controlcompromised hostcredential accesscredential harvestingcredential stuffingcredential theftdarkgatedata encryptiondata exfiltrationddos attackddos moduledeletedevelopment labsdistributed attacksexploitextortionfigurefile-hashfindftp brute forcegh0stgh0st ratgreat firewallhttp brute forcehybridie accountindicatorindonesiainfrastructure acquisitionreconnaissanceingress tool transferinnovation managementintrusion detectionkeyloggerlearnloaderlockbitmalicious activitymalicious activity indicatorsmalicious downloadmalicious linksmalicious softwaremalwaremalware distributionmicromsimsi filenetwork hostnetwork securitynewsnextphishingphishing attackphobosprocess injectionproduct developmentprotectprotocol exploitationqq accountr&d strategyransomwareremote accessremote servicesreportsresearchresearch & developmentresearch methodologyresearchedrestartscannerscientific researchsliversmallsocial engineeringsogou accountspeed securityssh attackstopsystem disruptiont1016t1021t1021.001t1036t1040t1041t1055t1059t1059.001t1059.005t1071t1071.001t1072t1076t1078t1083t1105t1110t1110.002t1113t1115t1123t1125t1189t1190t1195t1203t1204.001t1486t1490t1496t1497t1499.001t1499.002t1499.003t1547t1560t1563t1565t1566t1566.001t1566.002t1566.003t1569.002t1573t1583t1587.001t1588t1590.001t1595technology researchtelnet threatthreat actorthreat intelligencetrend microvoid arachneweb securityweb shellwinos

Activity Timeline

1 total obs
Oct 25Oct 25

Threat Activity Heatmap

· Peak: 2025-10-25
Less
More
Mon
Wed
Fri
Jun
Jul
·
·
·
Aug
·
·
·
Sep
·
·
·
·
Oct
·
·
·
Nov
·
·
·
Dec
·
·
·
·
Jan
·
·
·
Feb
·
·
·
Mar
·
·
·
·
Apr
·
·
·
May
·
·
·
Jun
·
·
·
24h
0
Dormant
7d
0
Dormant
30d
0
Dormant
3mo
0
Dormant
Threat ScoreMedium Risk
44
SIGNAL
Signal Score
44%
Confidence
4
Reports
First seenNov 8, 2024
Last seenOct 25, 2025
Verified IOC

VirusTotal

Not checked

WHOIS

description
References: https://www.trendmicro.com/content/dam/trendmicro/global/en/research/24/f/behind-the-great-wall--void-arachne-targets-chinese-speaking-users-with-the-winos-4-0-c-c-framework/WinOS4.0_IoCs.txt, confidence_level: 100, last_seen_utc: Not_Available
references
https://threatfox.abuse.ch/export/csv/recent/, https://www.trendmicro.com/content/dam/trendmicro/global/en/research/24/f/behind-the-great-wall--void-arachne-targets-chinese-speaking-users-with-the-winos-4-0-c-c-framework/WinOS4.0_IoCs.txt, https://www.trendmicro.com/en_us/research/24/f/behind-the-great-wall-void-arachne-targets-chinese-speaking-user.html

Export & API

STIX 2.1 Bundle
CSV Export
Permalink

IOC Journey

high
First detected 1 year ago · Last seen 8 months ago
Appeared in 4 threat reports