IOC Radar

Indicators are what attackers leave behind. Stolen credentials are what they arrive with.

Check Your Exposure
TLP:WHITE13 IOCs

$100k in Crypto Drained by the Underground Operation

OT
ORKL Threat Library
Original Report

Threat Actors

Malware Families

Diamond Model

SOCIAL AXISTECHNOLOGY AXISADVERSARYEarth LuscaBRONZE UNIVERSITYEarth LuscaINFRASTRUCTUREsky.commempool.spacehttp://95.164.53.76/n…CAPABILITYRhadamanthysVidarVICTIMunknown
Adversary(4)
Infrastructure(6)
Capability(2)
Victim

Indicators of Compromise

Indicators of Compromise13

TypeIndicatorConfidenceScoreFirst Seen
Domainsky.com
malwarenetworkrat
High
68
Oct 9, 26
Domainmempool.space
aptespionageloader
High
67
Oct 9, 26
URLhttp://95.164.53.76/new/log/8320e1a4/startloader/1767499038
loadermalwarenetwork
High
68
Oct 9, 26
URLhttp://95.164.53.76/new/log/8320E1A4/success/1767499039
loadermalwarenetwork
High
68
Oct 9, 26
Domainslow-sky.com
malwarenetworkrat
High
68
Oct 9, 26
URLhttp://95.164.53.76/new/log/29A5FDA7/failed/1769331221
loadermalwarenetwork
High
68
Oct 9, 26
URLhttps://www.netskope.com/blog/100k-in-crypto-drained-by-the-underground-operation
malwarenetworkrat
High
67
Oct 9, 26
URLhttp://95.164.53.76/new/log/29A5FDA7/startLoader/1769331211
loadermalwarenetwork
High
68
Oct 9, 26
Domaintrue-lie.com
malwarenetworkrat
High
68
Oct 9, 26
Domainquick-neo.com
loadermalwarenetwork
High
68
Oct 9, 26
URLhttp://95.164.53.76/new/log/D9D278DD/success/1696492954
loadermalwarenetwork
High
68
Oct 9, 26
URLhttp://95.164.53.76/new/log/048466C5/startCrypt
loadermalwarenetwork
High
68
Oct 9, 26
URLhttps://easybooters.com/newlog.php
c2malwarenetwork
High
68
Oct 9, 26

IOC Relationship Graph

IOC Relationship Graph13 total IOCs
DomainURL
URL8Domain5Actors4Malware2REPORT$100k in Crypto Drained byEarth LuscaBRONZE UNIVERSITYEarth LuscaEarth LuscaRhadamanthysVidar
scroll to zoom · drag to pan · click IOC to open