Name: OpenStrike Expanded Toolkit — 106 New Files (2026-04-08): indicators of compromise
Creator: Joseph Harrison
Published: 2026-04-08T00:00:00+00:00
License: https://creativecommons.org/licenses/by/4.0/

Raw JSON feed Full report Detection rules

64 shown

Type	Indicator	Confidence	FP risk
ipv4	`172.105.0.126`	HIGH	MODERATE - Linode shared hosting IP; block only in context of associated behavioral indicators
url	`http://172.105.0.126/au2U`	HIGH
url	`http://172.105.0.126/en_US/all.js`	HIGH
url	`http://172.105.0.126/ga.js`	HIGH
url	`http://172.105.0.126/msI4`	HIGH
url	`http://172.105.0.126/submit.php`	HIGH
url	`http://172.105.0.126:809/ga.js`	HIGH
sha256	`008cadd72dbf3cc108000f1752e32cb6e0ebd1e5f043c4e34301598a5f64f032`
sha256	`03492f128fcc3910bda15f393c30ad3e04f5a50de36464d1e24038f49d889324`	HIGH
sha256	`042761408e83155d24884a72291d9f10803becd790fbcfa6ff65e9e72eb44446`	HIGH
sha256	`04720e01f0599ff97d85f74d1483245c59353bb5ea391f2c4c9cb6ce4ef46d35`	HIGH
sha256	`0d050b35abaa2a47340ec925727b0d508605733676552dbc94080c2da9f863d2`	HIGH
sha256	`3b2d746d0974bb5ffec7d21b47d793fb1eef2af930d639b2f494cbe900fe0c3e`	HIGH
sha256	`46a74c19bc3fecb149c452c286b912999a43e7808194a55ede4d9a19e56f4081`	HIGH
sha256	`5c65b88fe12e6116d917e0a04ca57c4d3784d283a350d9e3dcec2691fe7eff2c`	HIGH
sha256	`5dad2214471215e262910e9dcb348cf42c62fc8d8b26a85c8e959d5f1ce78c80`	MODERATE
sha256	`6797ba96336c64648d6bcccdbead8d9ab6f18d77f0108239e31a063b32665770`	HIGH
sha256	`6e8efd85110de376426cde809f25d50ffcbb1d0e39d11c82913757cb277e15dd`
sha256	`701b4f60411a26abfb137f476c9328900843ee5a49780f2fcd23a5cb15498f16`	HIGH
sha256	`7c643568b3212363cd97511f2607ad2481b9f3b6f6a829999df469af7c0184b7`	HIGH
sha256	`820cf45c92b9cce9536ad108fc4b8c1c501bb6f4e30119b1bef0486670de02e4`	HIGH
sha256	`86b581e40a9ff912683b6f3579d155a8d765669acbba10d400abce451a898be5`	HIGH
sha256	`89ec81f862be889f6e8bfbad7c3c39410a9039467f1fdfe8752f64a59e113d10`	HIGH
sha256	`8ab7e87b34d65393618fabd5b48017d803e795064d4a290128c3eea1e54742f0`	HIGH
sha256	`9bdb680d4368713273509e8c104c1903b9790ee725cc2319997e1da705af5ca0`	HIGH
sha256	`ad1fc7f801bd2166edeeeb5f97fa087bb1769cde57e500a7c0eb2a844e3ad95f`	HIGH
sha256	`af688b120db0a3b324e2cd468cfead71b7895a3c815f4026d51ac7fca0cb8ab4`	HIGH
sha256	`b0f0fe97b653e4564db8cf24cbd4cc2cad46f9c6629b67c2f147e647729f5b46`	HIGH
sha256	`f0fc7d3b3f7b2fa10b796102889a44d57a7ad403d2038bada3c0fbd983d13c81`	HIGH
sha256	`f618c8073bbc18f36ebf522aa15e680bf63e867b115c27ab1546c2326507917b`	HIGH
sha1	`12fdfc45cdc448581ba3e64479f079caedba81a3`	HIGH
sha1	`5be73b16cfc8ea42fe0695b58da4e994a0dbcc96`	HIGH
sha1	`811589e4982f25f92725e2bc6646d4e5d1e8b7be`	HIGH
sha1	`c2ddca25cff8b1187dc59c67c2a7a6386b4ceba9`	HIGH
md5	`08ca0ff3c1e3c38c6e973654689d8346`	HIGH
md5	`1cf68b213a6ba7a2b864822cc72ed4fa`	HIGH
md5	`3d60ae2e584a1be1c264cfdaa12a5e4d`	HIGH
md5	`8bb4df00c120881a1945a43e2bb2379e`
md5	`b5d391099c1376d81ebdc91b3fc55eae`	HIGH
md5	`b6e01011e2d38855dd6a4b10a79acffe`	HIGH
md5	`e7765cb6d6c71277d49ef4ca7429638c`	HIGH
path	`%TEMP%\npf.sys`	HIGH
path	`C:\Windows\Temp\beacon.dll`	HIGH
filename	`artifact32svc.exe`	HIGH
filename	`artifact64svc.exe`	HIGH
filename	`beacon80.dll`	HIGH
filename	`beacon_dl.exe`	HIGH
filename	`beacon_full.exe`	HIGH
filename	`beacon_full.x64.dll`	HIGH
filename	`beacon_loader.exe`	HIGH
filename	`beacon_patched.exe`	HIGH
filename	`beacon_port80.x64.dll`	HIGH
filename	`beacon_rdi.exe`	HIGH
filename	`beacon_srdi2.exe`	HIGH
filename	`beacon_windows_x64.exe`	HIGH
filename	`beacon_x64_sniff.exe`	HIGH
filename	`covertvpn.dll`	HIGH
filename	`dll_exec.exe`	HIGH
filename	`dll_loader.exe`	HIGH
filename	`hello.exe`	MODERATE
filename	`mini_beacon.exe`	HIGH
filename	`mini_beacon2.exe`	HIGH
filename	`stager_http_x64.exe`	HIGH
filename	`stager_http_x64.ps1`	HIGH

35 further values in this feed are not shown above, because they are not an indicator type that can be recognised reliably by shape: command names, fingerprints and behavioural patterns among them. They are all in the raw JSON, which remains the complete record.

Licensed CC BY 4.0, free to use commercially with attribution to The Hunters Ledger.