Indicators are what attackers leave behind. Stolen credentials are what they arrive with.
TLP:WHITE12 IOCs
'ChainDrop' worm compromises hundreds of popular npm packages
Threat Actors
Malware Families
Diamond Model
Adversary(1)
Infrastructure(2)
Capability(1)
Victim
Indicators of Compromise
Indicators of Compromise12
| Type | Indicator | Confidence | Score | First Seen |
|---|---|---|---|---|
| SHA256 | 927387d0cfac1118df4b383decc2ea6ba49c9d2f98b47098bcbcba1efc026e1f file-hashintel-blogloader | Medium | 55 | Jun 4, 26 |
| Domain | awqhnjewqjkl.icu botnetexfiltrationintel-blog | High | 86 | Aug 4, 26 |
| SHA256 | dc1e6a7ddb29390dd53cf1e5aac40ad9204ea7c6b83ef5656e7cb7a796808b67 exfiltrationfile-hashintel-blog | Medium | 53 | Oct 9, 26 |
| SHA256 | 166be2b7b58a440f7b17520ffb0368be5d89c76661704b4945417eb04b9ada65 exfiltrationfile-hashintel-blog | Medium | 53 | Oct 9, 26 |
| SHA256 | 3f3f42d072bd36860ab7bd7fb5e10ac0d22c741c13c89505ccd6ec0ea572eea7 file-hashindicatorintel-blog | Medium | 55 | Jun 4, 26 |
| SHA1 | d446803f4c3bc116263faa3499a1d3f95b2825de exploitfile-hashintel-blog | Medium | 55 | Jun 2, 26 |
| SHA256 | 619c56acf572df75b6004a6fc013c80900316a76099b241d64312da3a44f10b4 exfiltrationfile-hashintel-blog | Medium | 53 | Oct 9, 26 |
| URL | https://awqhnjewqjkl.icu:443/router exfiltrationintel-blogmalware | High | 58 | Oct 9, 26 |
| SHA256 | fd3ca4007b225fdf8de7af4345a19179d5efa8c4bb9205f88cda806e5684b1eb file-hashintel-blogloader | High | 59 | Aug 5, 26 |
| SHA256 | 9fc2570b7cef51c1b8df116d144d11ff4096357be7d2c4c6367cfc2509cf1bcc file-hashintel-blogloader | High | 59 | Aug 5, 26 |
| SHA256 | 14eb4ce01dd4307759887ff819359b70d7d9ff709ecde039a5abc1aac325b128 file-hashintel-blogmalware | Medium | 53 | Oct 9, 26 |
| SHA256 | 29ac906c8bd801dfe1cb39596197df49f80fff2270b3e7fbab52278c24e4f1a7 exfiltrationfile-hashintel-blog | Medium | 53 | Oct 9, 26 |
IOC Relationship Graph
IOC Relationship Graph12 total IOCs
SHA256DomainSHA1URL