Indicators are what attackers leave behind. Stolen credentials are what they arrive with.

TLP:WHITE61 IOCs

More Than 4,000 Legacy Routers Compromised by AryStinger, Turned into Global Attack Proxies for Hackers

XLab

Published June 17, 2026Original Report

Malware Families

Diamond Model

Adversary

Infrastructure(5)

Capability(1)

Victim

Indicators of Compromise

Indicators of Compromise61

Type	Indicator	Confidence	Score	First Seen
MD5	d997efa98afab2c003654b8d5ce2bedf file-hashintel-blogmalware	High	56	Oct 9, 26
MD5	d79270ba44e665ebb0383eb77a52e38b file-hashintel-blogmalware	High	56	Oct 9, 26
URL	https://hgodpcx.ajb8.com/prod/standard/ intel-blogloadermalware	High	58	Oct 9, 26
MD5	e9916ff56074725f5739ead5091fe6c7 file-hashintel-blogmalware	High	56	Oct 9, 26
MD5	18f894a3168ee0b809eed321a2e748b4 file-hashintel-blogmalware	High	56	Oct 9, 26
MD5	9660895fa3fcabbef466703636f6d51d file-hashintel-blogmalware	High	56	Oct 9, 26
MD5	d2fd89ebdad493ec9ac76ce35213cec4 file-hashintel-blogmalware	High	56	Oct 9, 26
MD5	b9406e969cdfdaef433e93d0b9ad1f5d file-hashintel-blogmalware	High	56	Oct 9, 26
MD5	98e55d712a99d2cd45e8592c6dda5110 file-hashintel-blogmalware	High	56	Oct 9, 26
MD5	6869f24aecd75e2144aba8dc03dc2d0f file-hashintel-blogmalware	High	56	Oct 9, 26
MD5	abae20b26b70b526bebb5e2617092ede file-hashintel-blogmalware	High	56	Oct 9, 26
MD5	7461445fca3f9d8911148e0908d33c3b file-hashintel-blogmalware	High	56	Oct 9, 26
MD5	6f761f63642cd6329a29cfad80be50c3 file-hashintel-blogmalware	High	56	Oct 9, 26
MD5	8edb3ea62a7e643ba1a88d20799cf94f file-hashintel-blogmalware	High	56	Oct 9, 26
MD5	36ff9f683e870145aaf5a715bc934762 file-hashintel-blogmalware	High	56	Oct 9, 26
MD5	0627f034c42549e2130734b5f8dbf854 file-hashintel-blogmalware	High	56	Oct 9, 26
MD5	8deb2a60d42de0f8f8786e485d2f046f file-hashintel-blogmalware	High	56	Oct 9, 26
MD5	7b361a6d0d42309d09ec9000b53712b3 file-hashintel-blogmalware	High	56	Oct 9, 26
CVE	CVE-2013-3307 ddosexploitintel-blog	High	63	Jun 23, 26
MD5	19232d0eff3ef7aee3b5d7620c72358c file-hashintel-blogmalware	High	56	Oct 9, 26
MD5	44805c4b36bd3d97ba8ecaf6fe103572 file-hashintel-blogmalware	High	56	Oct 9, 26
MD5	fffcbd0ac2cb545496890f50395181ff file-hashintel-blogmalware	High	56	Oct 9, 26
MD5	a3181550e0e0a6153a44b7a0495535b0 file-hashintel-blogmalware	High	56	Oct 9, 26
MD5	ea2fe3b409da439aec25cf7eabf5b7a7 file-hashintel-blogmalware	High	56	Oct 9, 26
MD5	4c80d17fa5db5b1c2aaddb5351e9cb6b file-hashintel-blogmalware	High	56	Oct 9, 26
MD5	a97e552f5e655e1cfa56853f65beeb0e file-hashintel-blogmalware	High	56	Oct 9, 26
CVE	CVE-2025-11837 aptddosespionage	Medium	56	Jun 23, 26
CVE	CVE-2016-5681 ddosexploitintel-blog	Medium	56	Jun 23, 26
MD5	a2d54fcd0c2816f607a5962523fc648c file-hashintel-blogmalware	High	56	Oct 9, 26
MD5	a3e3197e2344c51e95c063541ea22205 file-hashintel-blogmalware	High	56	Oct 9, 26
MD5	ed9209111b995cbe78f8e097c289f127 file-hashintel-blogmalware	High	56	Oct 9, 26
MD5	0ffb4b4e430f4b69216fb9d2e082e482 file-hashintel-blogmalware	High	56	Oct 9, 26
MD5	10ba24db187836efe77ed7e75d279d33 file-hashintel-blogmalware	High	56	Oct 9, 26
MD5	05627d1bddb7292bb45139244f46051f file-hashintel-blogmalware	High	56	Oct 9, 26
MD5	0a2d2a4ec1ca2aa6a23a35abb5a75451 file-hashintel-blogmalware	High	56	Oct 9, 26
MD5	ff11e000f377c54dea928b09ebad9df8 file-hashintel-blogmalware	High	56	Oct 9, 26
URL	http://hgodpcx.ajb8.com active scanarystingerbotnet	Medium	43	Jun 18, 26
MD5	5d9cdb072415b191df3f444f53b2ff4b file-hashintel-blogmalware	High	56	Oct 9, 26
MD5	f093891e281bcd9c8016dea7d89cc671 file-hashintel-blogmalware	High	56	Oct 9, 26
URL	https://hgodpcx.ajb8.com/prod/RTL819X/ intel-blogloadermalware	High	58	Oct 9, 26
URL	https://hgodpcx.ajb8.com/n aptespionageintel-blog	High	58	Oct 9, 26
MD5	dd1e5a3cd9f842bd70be45a62c3ebbf6 file-hashintel-blogmalware	High	56	Oct 9, 26
MD5	a5101caf0a1789d6a4bc30e644d6b152 aptespionagefile-hash	High	56	Oct 9, 26
MD5	b0f4f813a9de094c06821366e2459aee file-hashintel-blogmalware	High	56	Oct 9, 26
MD5	c113739225ece5f6e4805466dec1401d file-hashintel-blogmalware	High	56	Oct 9, 26
MD5	8cc249b16adf7e4a658af7fa31d7998e file-hashintel-blogmalware	High	56	Oct 9, 26
MD5	fc4cee066d8526f5806bb23278f647da file-hashintel-blogmalware	High	56	Oct 9, 26
MD5	fcc9de5c040307e6ac3011e8b379f6d9 file-hashintel-blogmalware	High	56	Oct 9, 26
MD5	9973676bfa9fe89aa5c76e3cd0b21ae8 file-hashintel-blogmalware	High	56	Oct 9, 26
MD5	16fed5909de4f50351fc33fbfcf156df file-hashintel-blogmalware	High	56	Oct 9, 26
MD5	dbcc5a3e6afe41060d6357e24dc03fd3 file-hashintel-blogmalware	High	56	Oct 9, 26
MD5	df0c9f6289e56f31c0700f40590857d3 file-hashintel-blogloader	High	56	Oct 9, 26
MD5	dc35086ba0f5f83545c32a023a1f3be4 file-hashintel-blogmalware	High	56	Oct 9, 26
MD5	7f2b2e3516fa454adfd51f857ae80adf file-hashintel-blogmalware	High	56	Oct 9, 26
MD5	b104a05e8a2e218adfb7654ba8bf3d49 file-hashintel-blogmalware	High	56	Oct 9, 26
MD5	6f91d1f8f0cbaab137351936b52f7a94 file-hashintel-blogmalware	High	56	Oct 9, 26
MD5	e6b27080aa1ce1901a23dd75716d9092 file-hashintel-blogmalware	High	56	Oct 9, 26
MD5	dc71c10ca0b2c83b6b3a6a062fca314f file-hashintel-blogmalware	High	56	Oct 9, 26
URL	http://hgodpcx.ajb8.com/prod/RTL819X/ intel-blogloadermalware	High	58	Oct 9, 26
MD5	9221423d7daff9e64f7e2af54f911fea file-hashintel-blogmalware	High	56	Oct 9, 26
MD5	dbdd4d8e4aef3ce69cf65ed470425c89 file-hashintel-blogmalware	High	56	Oct 9, 26

IOC Relationship Graph

IOC Relationship Graph61 total IOCs

MD5URLCVE

scroll to zoom · drag to pan · click IOC to open