Skip to content
THE HUNTER’S LEDGER
IOC Feed
EvilSoul-Engine: A Brazilian Stealer-Builder Malware-as-a-Service
74 indicators extracted from this investigation's feed. Filter by type, then copy or download exactly what is on screen.
Raw JSON feedFull reportDetection rules
74 shown
TypeIndicatorConfidenceActionFP risk
ipv4 144.172.103.98DEFINITEMONITOR
ipv4 144.172.109.203DEFINITEBLOCK
ipv4 179.43.150.50MODERATEMONITOR
ipv4 198.1.195.207HIGHBLOCK
ipv4 198.1.195.210DEFINITEBLOCK
ipv4 198.89.99.163MODERATEMONITOR
domain c2.kaidoo.com.brDEFINITEBLOCK
domain choix-relay.comLOWMONITOR
domain evilsoul.ccDEFINITEHUNT
domain evilsoul.xyzDEFINITEHUNT
domain evilsoul1337.xyzMODERATEBLOCK
domain kaido.client.helper.hvnc.processcontrollerHIGH
domain kaido.common.messagesHIGH
domain kaidoo.com.brDEFINITEBLOCK
domain pay.x4m1k.comHIGHMONITOR
domain systemtools.devMODERATEMONITOR
domain www.kaidoo.com.brHIGHBLOCK
domain x4m1k.comHIGHBLOCK
url http://198.1.195.210:3000/tralaleroDEFINITEBLOCK
url http://evilsoul.cc/socket.io/?EIO=4&transport=pollingDEFINITEBLOCK
url http://evilsoul.xyz/download/decrypter/chrome_inject.exeHIGHBLOCK
url https://acf02ac96211.ngrok-free.appDEFINITEMONITORMODERATE, ngrok-free.app is a shared tunneling service; the specific subdomain is operator-unique (PART B)
url https://store8.gofile.io/uploadFileDEFINITEMONITORHIGH, gofile.io is a shared legitimate file-hosting service; pin on the full upload behavior + accompanying IOCs, not the domain alone (PART B)
sha256 022944768c4326d611fa3edb100eb8277228717a220580e7ffce143341aa39faDEFINITEBLOCK
sha256 0e7d6bade5a05e7b021683eba1a61f4aecbce2bd3cf3bee70cf12e995304c3a0MODERATEBLOCK
sha256 19e970052401aa72aa3d5a1145fbef9ac57a6d3a39f47e618b575ff88283797aDEFINITEHUNT
sha256 299a2e7fa8a69c495ec19fecf55d93bb766addaa78e89a4e1ad78a9cea59b31cDEFINITEBLOCK
sha256 2b1eb8470193d40c6b9f9844e4bba958103c4a629aa7d214658ce0199bf9373cHIGHHUNT
sha256 2b23eed25f5885ca2652fde9f277b295de6ef0dbcdcce0826c4fd734b34dc0b8DEFINITEHUNT
sha256 385d20ca574976e3ba3f4f3079420f8a1c3935c0ab4a3f87063beea27d41e254DEFINITEBLOCK
sha256 68f438ac293c749ebf9f71001ce5f976a34465c44c58f7b98bd3e2d1618c3366MODERATEHUNT
sha256 763303b69ad589bef248b66d1db93d5e567d9d60f95511806289289ff42a548eDEFINITEBLOCK
sha256 787624b4414a7553a50dc65e037cef8cdd5bb8ea4d79a26b9e6aee5ebb6cf8a6MODERATEBLOCK
sha256 7eb134384e6afbaa910f5670d29f32305aff4f5ec0fdbb3b34fec848a4ea24daMODERATEHUNT
sha256 934185683e2294f063bcb60b883b7cd518a2ec468597441adfbadc679c0112c8HIGHBLOCK
sha256 940bdf8421ace41cd9a93957122feed9faf0db02016c4b9daf4aeac7c0c794edDEFINITEHUNT
sha256 9e26f198ba185fcda834d3c7b7ae074baf6cea65a3261dfc85a7cc9295e5a9d2HIGHBLOCK
sha256 b90100d58b5807139eec66ed4e414bfcecdc369ddd5307e8d0fe2be90dcccde5DEFINITEHUNT
sha256 bfd3fe4ff947e29d3d33bf36c54be271bfec5885378990b3799570b402ab38bdHIGHBLOCK
sha256 c7542e8265f70d6c1dbf2e3cf6e81a90198cd157d3d6693c6d2a8a49d99a5b8dDEFINITEBLOCK
sha256 c7dc584b7c6c5c6322d2e20c0475443c7169207e0114c2d05362920aa2a1f692HIGH
sha256 cb679a4f6381f366d89c237cf07fcb09580b2e3c10c1e03a813a538e6e574c70MODERATEBLOCK
sha256 ce357b006e2c8df3a093332242d90832b023456eae272ce2c8610363107152ddMODERATEBLOCK
sha256 dd08fe79932b83890eb7811b59fe8bed37423384194cd9537ef4d8ab27b99b99DEFINITEHUNT
sha256 dd97278cc64d0a8fbdb66f177367c29d2557dd445b306e922e9ad5660ea233e2DEFINITEHUNT
sha256 fc53e32f7aec1789b26a0c4c46397306f9ba332ccf9babb657bc41eef868ff0eDEFINITEHUNT
sha256 fe55908030318879f08b185b9c5b6e6f9d6f691154c361d60cce80162d844212DEFINITEBLOCK
sha1 0acd8c90641e6e8b085aaf5a541c7ac050a65a4aDEFINITE
sha1 928f2ffa7fc84b74941fb714455d7bc14847b3afDEFINITE
sha1 d9a5b21ebb2a4384b14e03f2a44c62343779e63aDEFINITE
md5 20989b06f7c670ab973da6609855bcf9DEFINITE
md5 46176dc24f19de483395f2a41b6e1e3aDEFINITE
md5 9cd3c3703cd3ac13b42be9c7c07f92f8DEFINITE
md5 a567eab759a390a00b4605ea7d161b26DEFINITE
md5 ba77019b7bdbba07a0dd376a60c90063DEFINITE
path %APPDATA%\Microsoft\Windows\Start Menu\Programs\Startup\<8randlower>.lnkDEFINITE
path %APPDATA%\Microsoft\Windows\Start Menu\Programs\Startup\update.batDEFINITE
path %AppData%\\svchost.exeHIGH
path %TEMP%\evilsoul_.exeDEFINITE
path %TEMP%\evilsoul_mouse_.ps1DEFINITE
path %TEMP%\evilsoul_reconnect.lockDEFINITE
path %TEMP%\evilsoulblockkstarjkjaksghjhsjkahjskjak81929ijsahsjkj.txtDEFINITE
path %TEMP%\executor\chrome_decrypt.dllDEFINITE
path %TEMP%\executor\chromelevator.exeDEFINITE
path %TEMP%\updatesystem.cmdDEFINITE
path %TEMP%\watcher.vbsDEFINITE
path C:\DEFINITE
path \\.\pipe\kaido_dxgi_<8hex>HIGH
registry HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\SystemDEFINITE
registry HKCU\Software\Microsoft\Windows\CurrentVersion\RunHIGH
registry HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\PathsDEFINITE
registry HKLM\Software\Microsoft\Windows\CurrentVersion\RunHIGH
filename costura.kaido.common.dllHIGH
filename kaido_debug.txtHIGH

54 further values in this feed are not shown above, because they are not an indicator type that can be recognised reliably by shape: command names, fingerprints and behavioural patterns among them. They are all in the raw JSON, which remains the complete record.

Licensed CC BY 4.0, free to use commercially with attribution to The Hunters Ledger.