Indicators are what attackers leave behind. Stolen credentials are what they arrive with.
TLP:WHITE9 IOCs
A Signed Pdf Viewer That Quietly Takes Orders: the Quartzline “zenith” Backdoor – Rogueauthority.org
OT
ORKL Threat LibraryThreat Actors
Diamond Model
Adversary(4)
Infrastructure(6)
Capability
Victim
Indicators of Compromise
Indicators of Compromise9
| Type | Indicator | Confidence | Score | First Seen |
|---|---|---|---|---|
| MD5 | d62d4b7811e37ce789b40ff9343e3458 file-hashmalwarerat | High | 86 | Oct 8, 26 |
| MD5 | 1b56cb4e99fb9444645a1ce7ffc0a46b file-hashindicatorresearch | High | 67 | Oct 16, 26 |
| Domain | main.rs indicatornetworkresearch | High | 67 | Oct 16, 26 |
| Domain | westbeavers.com indicatornetworkresearch | Medium | 50 | Oct 9, 26 |
| Domain | mod.rs indicatornetworkresearch | High | 67 | Oct 16, 26 |
| Domain | motherotters.com botnetmalwarenetwork | High | 86 | Oct 13, 26 |
| SHA256 | 7f1db334fd3302cf98dd4afddf6f90e98e2a496fe7e86bf1832b89d02f3d73c3 file-hashindicatormalware | High | 86 | Aug 25, 26 |
| Domain | healskills.com botnetmalwarenetwork | High | 86 | Oct 13, 26 |
| URL | https://rogueauthority.org/quartzline-signed-pdf-viewer-zenith-backdoor networkresearchurl | High | 67 | Oct 16, 26 |
IOC Relationship Graph
IOC Relationship Graph9 total IOCs
MD5DomainSHA256URL