Indicators are what attackers leave behind. Stolen credentials are what they arrive with.
TLP:WHITE20 IOCs
Unpacking “Cruciferra”: An Analysis of a Sophisticated Crypter Service
Threat Actors
Malware Families
Diamond Model
Adversary(2)
Infrastructure(6)
Capability(6)
Victim
Indicators of Compromise
Indicators of Compromise20
| Type | Indicator | Confidence | Score | First Seen |
|---|---|---|---|---|
| SHA256 | c5b1e9aafc8f2b4ab05effc00fd43f3114b9ef1d592a086c952793ac4e299809 file-hashintel-blogmalware | Medium | 53 | Oct 9, 26 |
| Domain | exploit.in exploitindicatorintel-blog | Low | 30 | Nov 10, 25 |
| SHA256 | 59ad96dd3b4d5f10a5c53bbd465446e52dc7701a4ac633632f762bf1336d3347 file-hashintel-blogmalware | Medium | 53 | Oct 9, 26 |
| SHA256 | 2fdfdd13a0c548bb68c9d5aa8599a9265d4659da3e237fe7a42ac6ac06b9a06a file-hashintel-blogmalware | Medium | 53 | Oct 9, 26 |
| SHA256 | 17aae57cf6255c7eb169bf62ea67376d9708976eb7831f8cdd0ea38bdcb37dc4 file-hashintel-blogmalware | Medium | 53 | Oct 9, 26 |
| SHA256 | 3f31aee0948d16f8d64bf6bec69a4331099993e502b11bfc56b2c0112024489d file-hashintel-blogmalware | High | 85 | Jun 29, 26 |
| Domain | gatuso.duckdns.org intel-blogmalwarenetwork | High | 58 | Oct 9, 26 |
| SHA256 | c46e907886e2158cbc453e767183aecf07887b5ac8848f19684451883d69f5f0 file-hashintel-blogmalware | Medium | 53 | Oct 9, 26 |
| SHA256 | 5b4f59236a9b950bcd5191b35d19125f60cfb9e1a1e1aa2e4f914b6745dde9df file-hashindicatorintel-blog | High | 56 | Oct 6, 26 |
| SHA256 | 09bedbf7a41e0f8dabe4f41d331db58373ce15b2e9204540873a1884f38bdde1 file-hashintel-blogmalware | Medium | 53 | Oct 9, 26 |
| Domain | 0zbqnac1t4dv2t2wuodv1m.com intel-blogmalwarenetwork | High | 69 | Jul 18, 26 |
| SHA256 | 66dbe675480dc229e5b3ab8ad74207f73486e64e57805074f784bb2e01bcb865 file-hashintel-blogmalware | Medium | 53 | Oct 9, 26 |
| SHA256 | a6fb779be35592fb0ff624a8f8e12ab3cafe7bcfc312cd98263814db7fb01e02 file-hashintel-blogmalware | Medium | 53 | Oct 9, 26 |
| SHA256 | c4e93449453cf67c5d5605bb8f425207a738a242fdb432d720acc32faa74926c file-hashintel-blogmalware | Medium | 53 | Oct 9, 26 |
| SHA256 | 7887e919555fb5948c217556ba149392a72982b1bc427d3db779db9dcbf09ee8 file-hashintel-blogmalware | Medium | 53 | Oct 9, 26 |
| URL | https://digital-magicians.com/photo295825092412.zip?_r=ea623202 intel-blogmalwarenetwork | High | 58 | Oct 9, 26 |
| SHA256 | 6dbd6f9f2fa636c16ac4fa81418b68a604424861b9650dd9c4f2b0ba6f67d6ac file-hashintel-blogmalware | Medium | 53 | Oct 9, 26 |
| IP | 89.34.90.99 botnetintel-blogmalware | High | 86 | Jul 18, 26 |
| SHA256 | 3c181f642e24c28602a87be7f195e2f3d1ffa30b37e20f5121d99f88b22ab80e file-hashintel-blogmalware | Medium | 53 | Oct 9, 26 |
| URL | https://almacensantangel.com/wp-includes/assets/YourSSA_Documents_0000000676152_05_187_2026_Document_0000000676152.rar intel-blogmalwarenetwork | High | 58 | Oct 9, 26 |
IOC Relationship Graph
IOC Relationship Graph20 total IOCs
SHA256DomainURLIP