Indicators are what attackers leave behind. Stolen credentials are what they arrive with.
TLP:WHITE40 IOCs
From Bing Search to Ransomware: Bumblebee and AdaptixC2 Deliver Akira
Threat Actors
Malware Families
Diamond Model
Adversary(1)
Infrastructure(6)
Capability(6)
Victim
Indicators of Compromise
Indicators of Compromise40
| Type | Indicator | Confidence | Score | First Seen |
|---|---|---|---|---|
| Domain | zenmap.pro intel-blogmalwarenetwork | High | 58 | Oct 9, 26 |
| MD5 | 8c113b3aa82c81eee7c6b4ed0ba9a90f file-hashintel-blogloader | High | 85 | Jul 5, 26 |
| SHA1 | febbaf5f08a8e0782ffcce8beef1f2b4e249a52b file-hashintel-blogmalware | Medium | 53 | Oct 9, 26 |
| Domain | yj6jurm5qqkye5.org abuseactive scanadaptixc2 | High | 85 | Nov 20, 25 |
| IP | 171.22.183.43 abuseactive scanadaptixc2 | High | 75 | Jul 2, 26 |
| Domain | download-server.online intel-blogmalwarenetwork | High | 58 | Oct 9, 26 |
| Domain | soft-server.online intel-blogmalwarenetwork | High | 58 | Oct 9, 26 |
| IP | 4.239.95.1 c2intel-blogloader | High | 58 | Oct 9, 26 |
| IP | 172.96.137.160 abuseactive scanactive scanning | High | 73 | Dec 6, 22 |
| Domain | v5rjsdqogstopr.org abuseactive scanadaptixc2 | High | 86 | Jul 10, 25 |
| Domain | 6cimu4mc085em8.org abuseactive scanadaptixc2 | High | 86 | Jul 10, 25 |
| Domain | 2rxyt8yrhq0bgj.org abuseactive scanadaptixc2 | High | 87 | Jul 1, 26 |
| Domain | ks501oz9nm3v05.org abusealienvault_ransomwarebad reputation | High | 88 | Jul 1, 26 |
| MD5 | 124a48b78060fa851e1cc077ca35713c aptespionagefile-hash | Medium | 53 | Oct 9, 26 |
| SHA256 | a6df0b49a5ef9ffd6513bfe061fb60f6d2941a440038e2de8a7aeb1914945331 file-hashintel-blogloader | High | 56 | Oct 9, 26 |
| Domain | opmanager.pro abuseadaptix c2adaptixc2 | High | 82 | Jul 9, 25 |
| IP | 185.174.100.203 abuseadaptix c2adaptixc2 | Medium | 64 | Aug 5, 25 |
| Domain | 8doj8uvx604eck.org abusealienvault_ransomwarebad reputation | High | 86 | Jul 10, 25 |
| Domain | soft-hub.pro intel-blogmalwarenetwork | High | 58 | Oct 9, 26 |
| SHA256 | de730d969854c3697fd0e0803826b4222f3a14efe47e4c60ed749fff6edce19d c2file-hashintel-blog | High | 83 | Jun 21, 26 |
| IP | 188.40.187.145 abuseactive scanadaptix c2 | High | 81 | Aug 5, 25 |
| Domain | download-center.online abusealienvault_ransomwarebad reputation | High | 86 | Jul 9, 25 |
| Domain | 2rxyt9urhq0bgj.org intel-blogloadermalware | High | 58 | Oct 9, 26 |
| Domain | kwywztxoo2xdot.org abuseactive scanadaptixc2 | High | 86 | Jul 10, 25 |
| Domain | ev2sirbd269o5j.org abuseactive scanadaptix c2 | High | 83 | Jul 10, 25 |
| Domain | ovh1kn1tcqw5kp.org abusealienvault_ransomwarebad reputation | High | 86 | Jul 10, 25 |
| Domain | netml.shop intel-blogmalwarenetwork | High | 58 | Oct 9, 26 |
| Domain | ip-scanner.org aptespionageintel-blog | High | 64 | Oct 9, 26 |
| SHA1 | d66944e1a57daf04d3e809f22cd01946d593acaf file-hashintel-blogloader | Medium | 53 | Oct 9, 26 |
| Domain | shopping5.shop intel-blogmalwarenetwork | High | 58 | Oct 9, 26 |
| MD5 | ca8646dfc88423bb9fffda811160cebe file-hashintel-blogmalware | Medium | 53 | Oct 9, 26 |
| SHA1 | ab82bf27132323861810c0efcac6d5dd01600dd4 aptespionagefile-hash | Medium | 53 | Oct 9, 26 |
| IP | 109.205.195.211 abuseactive scanactive scanning | High | 85 | Aug 5, 25 |
| SHA256 | 186b26df63df3b7334043b47659cba4185c948629d857d47452cc1936f0aa5da aptespionageexfiltration | High | 56 | Oct 9, 26 |
| Domain | ewujsfb1dp5ran.org abuseactive scanadaptixc2 | High | 86 | Jul 10, 25 |
| Domain | ky1d1p1daahe5t.org abuseactive scanadaptixc2 | High | 86 | Jul 10, 25 |
| Domain | 5ka8rxp6t6eup2.org abusealienvault_ransomwarebad reputation | High | 86 | Jul 10, 25 |
| Domain | d1hmxkpwby0d4s.org indicatorintel-blogloader | Medium | 52 | Jul 28, 25 |
| IP | 170.130.55.223 aptespionageexfiltration | High | 64 | Oct 9, 26 |
| IP | 193.242.184.150 abuseactive scanningadaptix c2 | Medium | 63 | Aug 5, 25 |
IOC Relationship Graph
IOC Relationship Graph40 total IOCs
DomainMD5SHA1IPSHA256