IOC Radar

Indicators are what attackers leave behind. Stolen credentials are what they arrive with.

Check Your Exposure
TLP:WHITE9 IOCs

Xenorat Malware Analysis/reports/xenorat En.md at Main · Yavuzhanzgen/xenorat Malware Analysis

OT
ORKL Threat Library
Original Report

Threat Actors

Diamond Model

SOCIAL AXISTECHNOLOGY AXISADVERSARYBRONZE UNIVERSITYEarth LuscaIRIDIUMINFRASTRUCTUREwindirsluihelper.runfodhelper.run1.0.0.0CAPABILITYunknownVICTIMunknown
Adversary(6)
Infrastructure(6)
Capability
Victim

Indicators of Compromise

Indicators of Compromise9

TypeIndicatorConfidenceScoreFirst Seen
Domainwindirsluihelper.run
indicatornetworkresearch
High
67
Oct 9, 26
SHA256868b6edee89aeee834a2d96d1534017b82304d3fbf33b07dd8d5d6184dea554e
file-hashmalwarerat
High
86
Sep 11, 26
Domainfodhelper.run
malwarenetworkrat
High
67
Oct 9, 26
IP1.0.0.0
indicatormalwarenetwork
Low
32
Oct 26, 20
Domainmessagebox.show
indicatornetworkresearch
High
67
Oct 9, 26
IP201.7.16.168
botnetmalwarenetwork
High
80
Sep 11, 26
MD586a967082cb9118c3271a925a53aa346
file-hashmalwarerat
High
86
Sep 11, 26
Domainaforge.video
aptespionageexploit
High
67
Oct 9, 26
Domaincmstphelper.run
malwarenetworkrat
High
67
Oct 9, 26

IOC Relationship Graph

IOC Relationship Graph9 total IOCs
DomainSHA256IPMD5
Domain5IP2SHA2561MD51Actors5REPORTXenorat Malware Analysis/rBRONZE UNIVERSITYEarth LuscaIRIDIUMIridiumSandworm
scroll to zoom · drag to pan · click IOC to open