Indicators are what attackers leave behind. Stolen credentials are what they arrive with.
TLP:WHITE8 IOCs
Sauron Loader: A New Loader Lurking in Underground Forums
Threat Actors
Malware Families
Diamond Model
Adversary(5)
Infrastructure(4)
Capability(4)
Victim
Indicators of Compromise
Indicators of Compromise8
| Type | Indicator | Confidence | Score | First Seen |
|---|---|---|---|---|
| SHA256 | 194d7e8870ff783ce1e4e4e3015c895cc67ae52fd5e063c89dd1c069400d3991 botnetfile-hashindicator | High | 65 | Jul 21, 26 |
| SHA256 | ee727d639eaa4ee2e0d7cafbe496e14aaac8df0955d9fb599f2c11dfa1d0f8f2 botnetfile-hashintel-blog | High | 85 | Jul 21, 26 |
| SHA256 | 6551293e996d19755ba497f50b30a18c178f0d6e2a73b29ae742b8171e2985b7 file-hashintel-blogloader | Medium | 53 | Oct 9, 26 |
| URL | https://api.quinlantours.com intel-blogmalwarenetwork | High | 58 | Oct 9, 26 |
| SHA256 | 5606afdc5191d42f38d3c4f1692eda0a629c88810e29bfe78528733284ad1bf8 botnetfile-hashintel-blog | Medium | 53 | Oct 9, 26 |
| URL | https://api.namsb-show.com intel-blogmalwarenetwork | High | 58 | Oct 9, 26 |
| URL | https://api.lahaina-shores.com intel-blogmalwarenetwork | High | 58 | Oct 9, 26 |
| URL | https://api.virtual-magic.com intel-blogmalwarenetwork | High | 58 | Oct 9, 26 |
IOC Relationship Graph
IOC Relationship Graph8 total IOCs
SHA256URL