SHA256MediumSignal 100/100
21fb4fdce85ab75430e18d9362a35f61dcaeb628c28836403472c054d6ceab8c
Location
United KingdomFirst Seen
Jul 6, 2025
Last Seen
Jan 29, 2026
Found in 4 reports. Confidence: medium. · Confidence scores are heuristic. Verify before acting on results.
SHA-256 Hash
SHA-256 file hash — primary identifier for malware samples.
MISP Category
Artifacts Dropped
Hash Algorithm
SHA256
Confidence
99%
Signal Score
100 / 100
IDS Rule
No
Threat Context
Tags
MITRE ATT&CK
MITRE ATT&CK TTPs
Feed Intelligence Summary
4 reports99% confidence
4
Source reports
99%
Confidence score
Category tags
aaaaabuseacceptaccept encodingaccessaccount compromiseactionuactive relatedad fraudadd indicatoradded activeaddressadobe stockadobe systemsadsenseadsense naadvertising network abuseah typesaho dataahtrnaah typakamai rankallyalphacrypt cncamerica asnamerica flagantiguaantivmappleapple pegasusapple webkitapple_webkitapplication developmentapplication layer protocolascii textashburnaustria austriaavast avgazure rsabackdoorbad trafficbae systemsbarbuda asnbayrobbcclassbeaconbodybody lengthbotnetbrian sabeybritainbrowse tobrowserbrowser hijackingc0002 wininetc2 communicationca odigicertcameracapecarlos illescascchk asnas26658certificate authoritycertificate manipulationcexpxg .xyzcheckinchildchromecidrcity sanck idck idsck matrixclasscloud servicescloud storagecnccndigicert sha2cnmicrosoft ecccnwe1 ogooglecode executioncode injectioncomkxjs .xyzcommandcommand and controlcommand executioncommunication protocolcommunication technologiescommunity managementcompromised credentialscompromised websitesconnectconnections droppedcontacted hostscontent sharingcontrol ta0011cookiecorporation cuscreation datecredential harvestingcredential theftcrlf linecus subjectcustom audiencecyber weaponizationdaisy colemandangerous tooldata accessdata analyticsdata copyingdata encryptiondata exfiltrationdata theftdata transferdata udata uploaddata uptoaddefense evasiondeletedelete cdenver postdesktopdetect-debug-environmentdevelopment methodologiesdevopsdigital platformsdistributed attacksdiv divdockdom domdomains topdoxingdropdrop ordropbox 4xxdropbox plusdropbox spywaredulce sphowndynadot privacydynamicloaderecaccela ferencryptenterenter senter scenter sourceentrieserreurerroret attet malwareeuropeeurope/asiaevasion ta0005exclude dataexclude suggesexclude suggestexfiltrationexpirationexpiration dateexpiration httpexploitexploit ss7extortionextrextr includedextr pleaseextra dataextracextractextract dataextradextreextriextri pleasefailedfailurefbi flashfile-hashfilesfiles showfilet filetfindfind sfind suxesteuflagfolderformfort collinsfoundfrancefrontfunctionfwlinkgeckogeneral fullgermanyget httpgoogle connectivity checkgoogle safegpp functiongrumguardhall renderhashhasheshelp4uhighhookwowlow junhos hosthos hostnamehostname addhostname enumerationhttp attackhttp requesthttp responsehttp scannerhttpsimages baeinc cusincludeinclude reviewincludec reviewincluded dataincluded icincluded iocsind indicatorindicaindicalok noindicatorindicators hindicators showinformation gatheringinformation operationsinformation technologyinfostealerinfrastructure acquisitionreconnaissanceingress tool transferinjectioninput validation bypassinsurance fraudiocsipv4ipv6it infrastructurejeffrey scottjeffrey scott reimerjsonkhtmllangeslateral movementlearnlearn morelegal manipulationlinklinuxlocallockerlondonlookuplowfilummamaasmainmalicious activitymalicious advertisingmalicious linksmalicious powershell activitymalicious softwaremalvertisementmalvertisingmalwaremalware campaignmalware distributionmalware hostingmanually addmaps assistmateo countrymedia centermedia contentmediummelikametadata analysismg2 stringmiss xrqmitre attmobilemobile carriersmobile networksmobile securitymonths agomovedmsiemsilmultiple attacksname johnname serversname tacticsname valuenetwork intrusionnetwork scanningnetwork trafficnews manipulationnews videosnextnext associatednitrogenno entriesno expirationnorth americanumberobjectoctoseek publiconline harassmentonline smear campaignonv incmdeony incudeopcode anomalyopeniocoperating systemorg domainsosano functionoverlaypackingpacwpw .xyzpassive dnspatchedpath traversalpattern matchpay-per-click fraudpcappdf reportpeexepegasusperupetyaphishingphishing attackphone callssmsphotos cs3pleaseplease subportpresent aprpresent janpresent julpresent junpresent marpresent octpresent sepprocess detailsprocess injectionproduct developmentprotocol h2proxypseudopulspulsepulse pulsespulse showpulse sthowpulse submitpulsespulses hostnamepulses urlquality assuranceragnarragnar lockerransomransomwareransomware activity detectedransomx-genread creconnaissancerecord valueredlineregexpreimer dptrelatedrelated cncrelated pulsesremote accessremote servicesreport spamrequestresearchedresults aprreverse dnsreverse domainreviewreview datareview excludereview iocreview iocsreview iousrobotorolerole titlerozenarsarun keysrussiasa victimsabeysafe searchsakula ratsc datasc typescanscriptscript urlsscripting attacksse extrse extractionsearchsearch filtersearch otxsearch settingsseard datasecure serversecurity operationssecurity tlsselect fileserver caserver nginxserver responseserversserving ipshared contentshiptonshowshow processshow techniqueshowingsiteid1slcc2smearsnakeso typesocial analyticssocial engineeringsocial mediasocial media exploitationsocial media manipulationsocial media marketingsocial media securitysocial networkingsoftware architecturesoftware developmentsoftware engineeringsoftware exploitationsoftware testingsourcesouth americaspanspan spanspawnsspearphishing attachmentspyware infectionsqgzl .xyzstartupstatusstatus codestatus domainstealerstealer relatedsteamsteam communitystixstock photosstranger thingsstwa lredmondsubjectsuggessugges datasurveillance technologysynapsesystem disruptionsystems defenset1003t1005t1011t1021t1021.001t1027t1030t1036t1036.003t1041t1043t1045t1051t1053t1055t1056t1057t1059t1059.001t1059.005t1059.007t1060t1063t1064t1068t1069.001t1070t1071t1071.001t1078t1080t1081t1082t1083t1085t1086t1105t1112t1114t1119t1123t1125t1129t1133t1140t1143t1155t1179t1189t1190t1199t1203t1204t1204.001t1204.002t1210t1213t1218t1480t1480 executiont1486t1490t1496t1499.001t1499.002t1499.003t1506t1547t1553t1555t1560t1562t1565t1566t1566.001t1566.002t1566.003t1566.004t1568t1583t1583.001t1584t1584.004t1586t1587.001t1588t1588.002t1588.006t1589.001t1590.001t1590.002t1591t1591.002t1598t1608t1608.001t1609ta0004 defensetag managertbmvidtcfapi functiontelecom servicestelecommunicationsterse httptewdida datatext dragthemida junthisthreat actorthreat intelligencetiktoktime sabeytitle addedtlstls handshaketls issuingtls snitofseetofsee botnettotaltrojan malwaretrojanclickertrojandroppertrsuv .xyztrusttyp datatyp fileltyp indicaltypetype indicatortype notype oltypeof etypeof ttypestypes ofu excludedunitedunited kingdomunited statesunknown nsunknown soaunurew .xyzupdate secureupx alertsur extractionurarfx .xyzurlsurls showurlvoidus creationuser engagementuspapiutc facebookutc googleutc gsrdlm5jnx1utc gtmtlfp4rutc gtmwrp73mtuunetvaluevalue emailsverdictvideo capturevirgin islandsvirtoolvoidwaveweallweb application exploitationweb attackweb exploitationweb securityweb trafficweeks agowestlawwhoiswidthwin32 malwarewin32upatre augwindowwindows malwarewindows ntwininetwordpress vipworker's compensationwormwritex20trnfxml titlexorddosyandexyarayara detectionsyear agozombie
Activity Timeline
Jan 29Jan 29
Threat Activity Heatmap
· Peak: 2026-01-29LessMore
Mon
Wed
Fri
24h
0
Dormant
7d
0
Dormant
30d
0
Dormant
3mo
0
Dormant
Threat ScoreHigh Risk
100
SIGNAL
Signal Score
99%
Confidence
4
Reports
First seenJul 6, 2025
Last seenJan 29, 2026
VirusTotal
Not checked
WHOIS
- description
- PE32+ executable (GUI) x86-64, for MS Windows
- references
- 146.112.61.107 (146.112.48.0/20) AS 36692 ( CISCO UMBRELLA ) US, IDS Detections: Win32/Lumma Stealer Related • CnC Domain in DNS Lookup (pacwpw .xyz), Lumma Stealer CNC {FILEHASH SHA256 bc9c5c8dfdcf0d2a321478207b0870274fba25b93075fc987768623237973646} t.me / Dropbox, Win32/Lumma Stealer Related CnC Domain in DNS Lookup (comkxjs .xyz) (unurew .xyz) (trsuv .xyz), Win32/Lumma Stealer Related CnC Domain in DNS Lookup (sqgzl .xyz) (cexpxg .xyz) (cexpxg .xyz) (urarfx .xyz), Win.Exploit.Rozena {FileHash-SHA256 21fb4fdce85ab75430e18d9362a35f61dcaeb628c28836403472c054d6ceab8c}, Lumma Stealer https://t.me/pizdenka202020 / t.me, Query to a *.top domain - Likely Hostile 192.168.122.95 1.1.1.1 SHOWING 1 TO 22 OF 22 ENTRIES HTTP Request Get 1 Post 2 Put 0 Delete 0 URL HOST PORT METHOD USER AGENT https://steamcommunity.com/profiles/76561199863199067 steamcommunity.com 443 GET N/A { "src": "192.168.122.95", "sport": 49227, "dst": "23.59.52.127", "dport":, "protocol": "https", "method": "GET", "host": "steamcommunity.com", "uri": "/profiles/76561199863199067", "status": 200, "request": "GET /profiles/7656119986319, Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 Safari/537.36, (KHTML, like Gecko) Chrome/109.0.0.0 Safari/537.36 Content-Length: 30038 Host: accsrf.top
Export & API
STIX 2.1 Bundle
CSV Export
Permalink
IOC Journey
mediumFirst detected 11 months ago · Last seen 4 months ago
Appeared in 4 threat reports