IOC Radar
MD5HighVerifiedSignal 93/100

c0230d748e61819d9dfad0da03fe6ec8

Location
PeruPeru
First Seen
Apr 1, 2025
Last Seen
Apr 7, 2026
Apr 1
First Seen
440d ago
Apr 7
Last Seen
70d ago
6
Reports
source reports
93%
Confidence
high
Found in 6 reports. Confidence: high. · Confidence scores are heuristic. Verify before acting on results.
MD5 Hash
MD5 file hash associated with malicious samples.
MISP Category
Artifacts Dropped
Hash Algorithm
MD5
Confidence
93%
Signal Score
93 / 100
IDS Rule
No
Threat Context
Tags
MITRE ATT&CK

MITRE ATT&CK TTPs

222 techniques

Feed Intelligence Summary

6 reports93% confidence
6
Source reports
93%
Confidence score
Category tags
abuseaccess tokenactive scanasyncratattackautoitbad reputationbadgerblacksuitblacksuit ransomwareblacksuitebotnetbotnet activitybrute forcebrute ratelbrute ratel c4bublupbublup cloud storagechecks-user-inputck technniquecloud infrastructurecobaltcobalt strikecode executioncommand & controlcommand and controlcommand executioncommentcompromised softwarecredential accesscredential harvestingcredential stuffingdarkvncdata encryptiondata exfiltrationdata store exposuredefense evasiondetect-debug-environmentdistributed attacksdll side-loadingdll sideloadingducktailencryptionexfiltrationexploitationexploitation activityextortionfake zoom installerfile-hashfileless malwaregreenhijackloadericedididentity & access exploitationimpactindicatoringress tool transferinitial accessinjection activityipv4addrlateral movementlsassmalicious activitymalicious downloadmalicious powershell activitymalicious softwaremalwaremalware distributionmetasploitmulti-stage payloadnidsoperating systemoverlaypayloadpayload deliverypayload executionpeexeperuphishingphishing attackpikabotpowershell executionprivilege escalationprocess injectionproxyproxychainspsexecqdoorqdoor backdoorransomwarerar archiveratelrdp exploitationrdp proxyingremote accessremote access toolsremote servicesresearchedrestrevoked-certscams & fraudscripting attackssectopratshellsignedsliversliver c2social engineeringsoftware exploitationsoftware installersouth americaspearphishingspearphishing attachmentsteamsystem disruptiont1003t1003.001t1003.005t1003.006t1003.007t1003.008t1005t1007t1010t1012t1016t1016.001t1016.002t1018t1020t1021t1021.001t1021.002t1027t1027.001t1027.002t1027.003t1027.004t1033t1036t1036.003t1036.004t1036.005t1036.007t1036.009t1041t1047t1049t1053t1053.005t1055t1055.001t1055.002t1055.003t1055.004t1056t1056.001t1056.002t1056.003t1056.004t1057t1059t1059.001t1059.003t1068t1069t1069.001t1069.002t1070t1070.001t1070.002t1070.003t1070.004t1070.005t1071t1071.001t1071.002t1071.004t1076t1078t1078.001t1078.002t1078.003t1080t1082t1083t1086t1087t1087.001t1087.002t1087.003t1087.004t1090.001t1090.002t1102t1102.001t1104t1105t1106t1110t1110.001t1110.002t1110.003t1112t1120t1124t1127t1127.001t1134t1134.001t1134.002t1134.003t1134.004t1135t1136t1136.001t1136.002t1136.003t1137.001t1137.005t1137.006t1140t1176t1189t1190t1195.001t1195.002t1195.003t1202t1203t1204t1204.002t1210t1213t1213.001t1213.002t1213.003t1218t1218.005t1218.007t1218.010t1218.011t1482t1485t1486t1489t1490t1496t1499.002t1499.003t1505t1505.003t1505.004t1505.005t1518t1518.001t1530t1543t1543.001t1543.002t1543.003t1543.004t1543.005t1546t1547t1547.001t1547.002t1547.004t1548t1548.001t1548.002t1548.003t1548.004t1553t1553.001t1553.002t1553.003t1553.004t1553.005t1553.006t1555t1555.001t1555.003t1555.004t1555.005t1560t1560.001t1562t1562.001t1562.002t1562.003t1562.004t1563t1564t1564.001t1564.003t1564.004t1565t1566t1566.001t1566.002t1566.003t1567t1567.002t1568t1568.001t1568.002t1569t1569.002t1570t1572t1573.001t1573.002t1574.001t1574.002t1574.009t1583t1583.001t1583.002t1583.003t1584t1584.002t1584.003t1584.004t1588t1588.001t1588.002t1588.004t1595t1595.001t1595.002t1595.003t1598t1598.001t1598.003t1602.001t1602.002threat actortime to ransomwaretor nodetrojan malwarevenomratvulnerability scanwin32 malwarewindows malwarewinrarwinrar vulnerabilitywmiwmicwritezoomzoom exploitzoom impersonation

Activity Timeline

1 total obs
Apr 7Apr 7

Threat Activity Heatmap

· Peak: 2026-04-07
Less
More
Mon
Wed
Fri
Jun
·
·
Jul
·
·
·
Aug
·
·
·
Sep
·
·
·
·
Oct
·
·
·
Nov
·
·
·
Dec
·
·
·
·
Jan
·
·
·
Feb
·
·
·
Mar
·
·
·
·
Apr
·
·
·
May
·
·
·
Jun
·
24h
0
Dormant
7d
0
Dormant
30d
0
Dormant
3mo
1
Minimal
Threat ScoreHigh Risk
93
SIGNAL
Signal Score
93%
Confidence
6
Reports
First seenApr 1, 2025
Last seenApr 7, 2026
Verified IOC

VirusTotal

Not checked

WHOIS

description
PE32 executable (GUI) Intel 80386, for MS Windows
references
https://thedfirreport.com/2025/03/31/fake-zoom-ends-in-blacksuit-ransomware/, https://thedfirreport.com/2025/03/31/fake-zoom-ends-in-blacksuit-ransomware/#indicators, https://github.com/esThreatIntelligence/iocs/blob/main/D3F%40ck_Loader/iocs_7-23-2024.txt, IB-24-10067.stix.xml, IB-24-10067.csv

Export & API

STIX 2.1 Bundle
CSV Export
Permalink

IOC Journey

high
First detected 1 year ago · Last seen 2 months ago
Appeared in 6 threat reports