Indicators are what attackers leave behind. Stolen credentials are what they arrive with.
TLP:WHITE106 IOCs
Microsoft’s MSHTA Legacy Tool Still Powers Malware Campaigns on Windows
Malware Families
Diamond Model
Adversary
Infrastructure(6)
Capability(3)
Victim
Indicators of Compromise
106 indicators
| Type | Indicator | Confidence | Score | First Seen |
|---|---|---|---|---|
| Domain | web3-walletnotify.cc | High | Score 58/100 | First seen |
| IP | 173.208.166.226 | High | Score 58/100 | First seen |
| IP | 201.138.238.195 | High | Score 58/100 | First seen |
| IP | 156.224.232.98 | High | Score 58/100 | First seen |
| SHA256 | 1e0e375f3ee82d5af5dfe6f7df0e2fac9a7d37c67add3390d05a93afd85b7c84 | Medium | Score 53/100 | First seen |
| IP | 103.83.212.194 | High | Score 58/100 | First seen |
| IP | 103.124.106.194 | High | Score 58/100 | First seen |
| Domain | my-smart-house1.com | High | Score 81/100 | First seen |
| Domain | hell7-kitty.cc | High | Score 58/100 | First seen |
| Domain | explorer.vg | High | Score 58/100 | First seen |
| Domain | files-storage.cc | High | Score 58/100 | First seen |
| Domain | hell4-kitty.cc | High | Score 58/100 | First seen |
| IP | 195.189.28.244 | High | Score 58/100 | First seen |
| Domain | google-services.cc | High | Score 87/100 | First seen |
| IP | 110.42.51.229 | High | Score 58/100 | First seen |
| Domain | msgrouppolicy.vg | High | Score 58/100 | First seen |
| Domain | immortal-service.cc | High | Score 58/100 | First seen |
| SHA256 | 333e2192f2551415659fb4094e81b911708921bb588eecf65e27f51c9938dfc2 | Medium | Score 53/100 | First seen |
| IP | 61.136.101.152 | High | Score 58/100 | First seen |
| Domain | hell1-kitty.cc | High | Score 58/100 | First seen |
| Domain | microservice.gl | High | Score 58/100 | First seen |
| Domain | azure-s3-bucket.cc | High | Score 58/100 | First seen |
| IP | 89.117.2.159 | High | Score 58/100 | First seen |
| Domain | forest-entity.cc | High | Score 90/100 | First seen |
| Domain | acio-patron.cc | Medium | Score 53/100 | First seen |
| Domain | hell10-kitty.cc | High | Score 58/100 | First seen |
| Domain | s2-microservice-updatehub.cc | High | Score 58/100 | First seen |
| Domain | communicationfirewall-security.cc | High | Score 58/100 | First seen |
| Domain | geo-foundation.vg | High | Score 58/100 | First seen |
| IP | 222.73.29.92 | High | Score 58/100 | First seen |
| IP | 157.66.153.154 | High | Score 58/100 | First seen |
| Domain | microservice-update-s2-bucket.cc | High | Score 58/100 | First seen |
| Domain | hell5-kitty.cc | High | Score 58/100 | First seen |
| Domain | holiday-forever.cc | High | Score 58/100 | First seen |
| IP | 103.55.70.212 | High | Score 58/100 | First seen |
| Domain | hosting-control.cc | High | Score 58/100 | First seen |
| Domain | s8-microservice-updatehub.cc | High | Score 58/100 | First seen |
| Domain | ms-team-ping6.com | High | Score 58/100 | First seen |
| IP | 103.115.17.90 | High | Score 58/100 | First seen |
| SHA256 | aa845a8fb4ab38aebe6a16a2a8f80ca4467ac0991d3eef4d8a10bdf97dedb1e9 | Medium | Score 53/100 | First seen |
| Domain | s4-microservice-updatehub.cc | High | Score 58/100 | First seen |
| Domain | s5-microservice-updatehub.cc | High | Score 58/100 | First seen |
| Domain | health-smooth-eu2.com | High | Score 58/100 | First seen |
| Domain | hell9-kitty.cc | Medium | Score 44/100 | First seen |
| Domain | s1-microservice-updatehub.cc | High | Score 58/100 | First seen |
| SHA256 | 7d0487afc91b0fe8b2fbf732ab54c3c07e86bf69471bba6c283aabea190499ba | Medium | Score 53/100 | First seen |
| IP | 103.113.195.244 | High | Score 58/100 | First seen |
| SHA256 | 02630fa994b1566ad1515fd87220fc037b967f07495985a3637d68d7e08c57ee | Medium | Score 53/100 | First seen |
| Domain | hardware-office.cc | High | Score 58/100 | First seen |
| Domain | msedge.vg | High | Score 69/100 | First seen |
| Domain | memory-scanner.cc | High | Score 58/100 | First seen |
| URL | http://92.255.57.155/b.jpg | High | Score 58/100 | First seen |
| IP | 187.102.48.229 | High | Score 58/100 | First seen |
| IP | 58.221.252.210 | High | Score 58/100 | First seen |
| IP | 61.147.108.92 | High | Score 58/100 | First seen |
| SHA256 | 38fe562136ade372fc4cedde67826aeea8404e93a54a4a4736ddb4c8c8d4c96d | Medium | Score 53/100 | First seen |
| Domain | deluxe.gl | High | Score 58/100 | First seen |
| Domain | globalsnn1-new.cc | High | Score 76/100 | First seen |
| IP | 58.221.59.20 | High | Score 58/100 | First seen |
| Domain | memory-protection-layer1.cc | High | Score 58/100 | First seen |
| IP | 110.45.196.155 | High | Score 58/100 | First seen |
| Domain | system-monitor.cc | High | Score 58/100 | First seen |
| Domain | some-othertag.cc | High | Score 58/100 | First seen |
| Domain | health-smooth-eu3.com | High | Score 58/100 | First seen |
| Domain | polystore9-servicebucket.cc | High | Score 74/100 | First seen |
| IP | 190.111.12.242 | High | Score 58/100 | First seen |
| Domain | s10-microservice-updatehub.cc | High | Score 58/100 | First seen |
| MD5 | f8d33485bec26b2b1969f910c131f027 | Medium | Score 53/100 | First seen |
| Domain | hell6-kitty.cc | High | Score 58/100 | First seen |
| IP | 193.112.70.226 | High | Score 58/100 | First seen |
| Domain | holiday-updateservice.com | High | Score 58/100 | First seen |
| Domain | s3-updatehub.cc | High | Score 58/100 | First seen |
| Domain | critical-service.cc | High | Score 58/100 | First seen |
| Domain | microservice-update-s1-bucket.cc | High | Score 74/100 | First seen |
| Domain | globalsnn2-new.cc | High | Score 58/100 | First seen |
| Domain | s6-microservice-updatehub.cc | High | Score 58/100 | First seen |
| Domain | s3-microservice-updatehub.cc | High | Score 58/100 | First seen |
| Domain | network-defender.cc | High | Score 58/100 | First seen |
| Domain | hell8-kitty.cc | High | Score 58/100 | First seen |
| Domain | offshore-storage.cc | High | Score 58/100 | First seen |
| Domain | urugvai.cc | High | Score 58/100 | First seen |
| Domain | globalsnn3-new.cc | High | Score 58/100 | First seen |
| Domain | hell2-kitty.cc | High | Score 58/100 | First seen |
| Domain | alphazero1-endscape.cc | High | Score 58/100 | First seen |
| Domain | s7-microservice-updatehub.cc | High | Score 58/100 | First seen |
| Domain | indeanapolice.cc | High | Score 58/100 | First seen |
| Domain | fileless-storage-s3.cc | High | Score 58/100 | First seen |
| IP | 122.165.219.142 | High | Score 58/100 | First seen |
| Domain | bigbrainsholdings.com | High | Score 58/100 | First seen |
| Domain | s9-microservice-updatehub.cc | High | Score 58/100 | First seen |
| Domain | fileless-market.cc | High | Score 58/100 | First seen |
| IP | 103.36.223.87 | High | Score 58/100 | First seen |
| Domain | holypriest.gl | High | Score 58/100 | First seen |
| Domain | silverhost.vg | High | Score 58/100 | First seen |
| Domain | sentinel1-endpoint-security.cc | High | Score 58/100 | First seen |
| IP | 100.1.121.27 | High | Score 58/100 | First seen |
| Domain | alpha-centavr.cc | High | Score 58/100 | First seen |
| Domain | py-installer.cc | High | Score 58/100 | First seen |
| Domain | debank-api.cc | High | Score 58/100 | First seen |
| IP | 107.175.187.11 | High | Score 58/100 | First seen |
| Domain | hell3-kitty.cc | High | Score 58/100 | First seen |
| Domain | parent-control.cc | High | Score 58/100 | First seen |
| Domain | domain-monitoring.cc | High | Score 58/100 | First seen |
| IP | 204.44.110.216 | High | Score 58/100 | First seen |
| Domain | ccleaner.gl | High | Score 58/100 | First seen |
| IP | 60.173.116.152 | High | Score 58/100 | First seen |
IOC Relationship Graph
106 total IOCs
DomainIPSHA256URLMD5
scroll to zoom · drag to pan · click IOC to open