HijackLoader / Penguish / Rugmi to AsyncRAT Multi-Vector Phishing Campaign — Indicators

Raw JSON feed Full report Detection rules

175 shown

Type	Indicator
ipv4	`109.120.137.6`
ipv4	`185.241.208.129`
ipv4	`23.106.161.1`
ipv4	`62.60.237.100`
ipv4	`80.253.249.186`
domain	`g.s4.mega.io`
domain	`goproxy.github.io`
domain	`microsoft.com-app.cc`
domain	`nda2026.zip`
domain	`onedrive.to`
domain	`price.zip`
domain	`price2026.zip`
domain	`s3.g.s4.mega.io`
domain	`www-microsoft.live`
url	`http://109.120.137.6/PUTTY.exe`
url	`http://62.60.237.100:80/Documents/`
url	`http://62.60.237.100:80/Documents/Carriers.exe`
url	`http://62.60.237.100:80/download/Documents/`
url	`http://80.253.249.186:5504/BugSplat.dll`
url	`http://80.253.249.186:5504/COMSupport.dll`
url	`http://80.253.249.186:5504/DBGHelp.dll`
url	`http://80.253.249.186:5504/DVDSetting.dll`
url	`http://80.253.249.186:5504/NLEResource.dll`
url	`http://80.253.249.186:5504/NLETransitionMgr.dll`
url	`http://80.253.249.186:5504/WSUtilities.dll`
url	`http://80.253.249.186:5504/WS_ImageProc.dll`
url	`http://80.253.249.186:5504/WS_Log.dll`
url	`http://80.253.249.186:5504/WsBurn.dll`
url	`https://s3.g.s4.mega.io/aileqac3yep7oqdhygjpberqqnk2zrnhck2lx/busket/Bravo/vida/NGZTDICF.exe`
url	`https://s3.g.s4.mega.io/aileqac3yep7oqdhygjpberqqnk2zrnhck2lx/busket/putty.exe`
url	`https://s3.g.s4.mega.io/aileqac3yep7oqdhygjpberqqnk2zrnhck2lx/busket/putty2.exe`
sha256	`00103e807a4d31570f9c11cea37310d7464b8f275e62f4517b071daeb3c47a29`
sha256	`005161d5e2be81c4af5facea96fe901c51cff16cedbd31be7211d07bf92c8963`
sha256	`1861e9cd45136ed09f60391450171658c995a5ea6b0b9361658cc69db7fea10c`
sha256	`1afbe5d960af45832539b11e92a09b808f0c3868ab437a7ef1b5d1bd5e16d0c3`
sha256	`2303fa9d3836f99eb40ab338f4ddc40521299501d117be65b19ff9f61e2beb88`
sha256	`253fdb10a694c8749fc83554ac458dd0592ef40cd87755ab558d4719b6e202ef`
sha256	`2d8728f0f371107ff124a39b3c9f624cae115f8b6cc6ec87fbeb96fc8c2b51e6`
sha256	`30200bcf6fab87862f9348cac03f97a3d8d735040314163dda173635291087dc`
sha256	`30b9b877aa1112105069be6b4de794b7a7147a1d968e71fa63f2edc7397e126f`
sha256	`3480d0478d35d8a12331b97769401e16e4956bdc24b9a7175ae08e2c9e9acf8f`
sha256	`3594a835ed3dbf80ac460c0e852fa91baa3b17aadff9c3b40c03eff6b34658d2`
sha256	`3666f859cc9f49957a150b6fed225dc8226160ef173161edccd15dd68fffef88`
sha256	`41050f6f6919a4516d481f7c9b5fe6074c447afc6e9cc28d180982eea50ae165`
sha256	`44f009ca786bc541cda11c61bab7b272e96ce9e3d656c10bdac2e126f3a9cc35`
sha256	`4b2595eee4a24d2caa885e9fe6bf06d5fed9aa3a40d94b75f766b4433bcddbc2`
sha256	`4b33ee0e8a4153c0c8ccd945adb18d8f91b5b824746a15986bf6781f081f9968`
sha256	`4c765ffe43c1fa4be6a33d6c5bc76bdca989be2f780f416a4815e0b6bf956603`
sha256	`5268a97aea245c15220126d4ddb7e10d56a47d2d1492efd859da8e4223f9ecb0`
sha256	`5273fc9f5c5c754bf37c58a391fe9ea7d98de470f042d2478d3beb0b71838b77`
sha256	`585f41db259ff0150f717e0862dcc4c6df91b1b5624439037420736d1d35c80b`
sha256	`58ef42507d9fc1e8a7b240ef5cddc9f600c3d9a61ee6a42a4045278bb332b86a`
sha256	`6091a6e5ce9a8e0d7f896ebd3dfd798ac41a7c355a48e5643dfcf798437cf736`
sha256	`68bee500e0080f21c003126e73b6d07804d23ac98b2376a8b76c26297d467abe`
sha256	`68fb61225b457172368d43af7ec2afe48f59404089d095584944edbfd0171feb`
sha256	`692ed97141059a1481fa2aacd5d48f037792f5bfddfa44f72078fc7256c764ad`
sha256	`718cfb5195d0e43e795627c781fb3f427856f1cf29f33eedbbc6059b6f214549`
sha256	`729e5965e43ff458f6da901536c9a43be52a3820718e2dd5456150e2d73bb97f`
sha256	`7cd5072111581133c5e28b56bef060b3d3b0d8acca3396ef23c6c384eb292d25`
sha256	`7d366451fcd530c4493a75bc577283a96f28fc8a72e64310e8742f561068725c`
sha256	`7e2000ceb89574fe95e819f5f47da346119b666b7f64e8b5b01e5152e37d76cf`
sha256	`8477b9fb3f6aaa7d2d50a661a238ff1ac34ab58df6638e535cc004587d209e0c`
sha256	`8667ef6e2d71585f963dc7076c3409390f5d63da6b66e02a0194b6d4ea448a0f`
sha256	`8ad22e349a1cb327857228f179cefc0ff25f9d36e5267312dfee96b5646f9915`
sha256	`8e302ffb38ff4ef382baadb06f5e644e1a007b241573f54f96b9bebcd7ddb211`
sha256	`8fcae9719a3f831cb73ef50b587a6222ff73d6c1a6ae617636cb31c6e02d5e3a`
sha256	`90193252040e222733522603e17be8c21e52cd04cd99897392aea189a78bb217`
sha256	`990a90036c974aaecef681776fb28972f5a3a72d044308339c974eb37990e9bc`
sha256	`a1cc69dfb1350f4c9fe1a9ef24c27fd2d72eea9407457c472fbb98c49aa6b6b9`
sha256	`a35073d242f8325801766660b9effd52993b99f1f370a947d4ec5688b0b0341a`
sha256	`a3d0a9c71be732cdaafc7c1a9ef00c2a5a01e93b4a29c8944f8ea14a79f52ce0`
sha256	`a98ce0c5bb2933100f84ff1adb8c4ece702a42cbb70f1154c9855c35a3889a90`
sha256	`b1038928a6da2a1b5064a27187403563f3ab7e8d4ec034dfa8d5d3f6be231191`
sha256	`b4098f2bb99ce112fb27560237b84a52d9303fade048b8f83ac40f0d082ee2f7`
sha256	`b51c6db1160f9c55c404a7202bad5378a1f1bbb6bd0b5f45af4fcb770ea989eb`
sha256	`b8da80a5ecdeb2536911cb38c878014d6873aad998f4f510301929146717941f`
sha256	`c085a724a067eec46d9a2c1eeae3cc04db33b9840f5c33eb87cc3027e12a6bcd`
sha256	`c1275ddf04a0942b416c1a0b2d32003a4eda732c6f97c74181c236e35d12420f`
sha256	`c2b7b67e9daafef4847d99b4014b7ba77369fb776bba333a585f16d736c192e4`
sha256	`c2e62475768c9546efe1da92a55f3bb2a55350eed83241139917aabd1ad25f8a`
sha256	`c50bffbef786eb689358c63fc0585792d174c5e281499f12035afa1ce2ce19c8`
sha256	`ca9f859f01940c1d4cfe7465460485398e2de8606e3a4eea977a430555c3bcae`
sha256	`d8b5f0befed26af5c5d1d2d8307bc54145c7472189145668600be6c6a2aaca31`
sha256	`dd4874b7646798264bf6e204ca74ab3b4e4f7b7b4124bd16ce6cbd9d2d5e28c9`
sha256	`dd4ec224c574a9d1f301568a1b82ed57ed1d0a5efe8b725138dfd23361b3f624`
sha256	`df54bff16203d07df01eda47fe57aefa5cf4847a0f1d48e2b43e115a6173cd9b`
sha256	`e3a777326a9a1a91d3224b90683642db22d2b7143dd21985200b9ac3ad2afc05`
sha256	`e841fe9fa09ddc4292f22db95cb2d348d8f37594513f5848d545db92e3b07c66`
sha256	`f1ba9ec2ec964bb29c8999d88b0ca8496ab23e9f44fecf5cc819ed62e447dee5`
sha256	`f9bd3434f8be8b13890c5a8f4c200cf1447d2a4199b29ff37f645fee90ae1e1d`
sha256	`fcebe8bee86d02093380c7c2eb6dd083ec4d765ed1dae9a1d9fbc1a6328a7778`
sha256	`fd89aea524a9c6b77efcf0d9d350f2fd625525887a1ef078017d8ceee0eaafee`
sha1	`bc99a77a68f18005cac0c784a176d3199f735ecf`
md5	`051ba42fa7a26bf65df9922daa07c458`
md5	`059917fd7718808bc34be224e415216f`
md5	`07af4aa9e4d215a5ee63f9a0a277fbe3`
md5	`1730e17c2277c47cd6c40037d2f12133`
md5	`1a8abfce832bdbfe1c3ba9a134948e63`
md5	`33bc1ffdcc8fc3aa7646fc2cb1a0a5e5`
md5	`34ea62976f42c141fa01de955bc809f4`
md5	`5f9f88c9a16b62dc38504549e93d3667`
md5	`8a331882e1fcfed10f2664231c7ce1af`
md5	`921f3ea587ffbd647ff4d520165ecd50`
md5	`9fe84f7e1a8efc69d6169f47f9b67257`
md5	`a4b240cce6e3da6e959f33bd82394034`
md5	`ab9e4224c1ccf1355ae462a22ff3253e`
md5	`adcd9682585d11d95f17bb6ffa76f15e`
md5	`e8ac1646024d52d1534a88da2e8037cd`
path	`C:\ProgramData\WVault.exe`
path	`C:\ProgramData\adv_ctrl`
path	`C:\ProgramData\adv_ctrl\`
path	`C:\ProgramData\adv_ctrl\CrystSupervisor32.exe`
path	`C:\Users\*\AppData\Local\Temp\????????.tmp`
path	`C:\Users\\AppData\Local\Temp\is-.tmp\CrystSupervisor32.exe`
path	`C:\Users\\AppData\Local\Temp\is-.tmp\ExceptionHandler.dll`
path	`C:\Users\\AppData\Local\Temp\is-.tmp\networkspec17.log`
path	`C:\Users\\AppData\Local\Temp\is-.tmp\shadermgr93.rc`
path	`C:\Users\*\AppData\Roaming\adv_ctrl\Crisp.exe`
path	`C:\Windows\System32\Tasks\watchermgmt`
path	`C:\Windows\Tasks\watchermgmt.job`
path	`D:\project\MediaAuthorLib\NLEPlatform\SymbolTable\Release\NLEService.pdb`
path	`I:\CompanySource\Plowshare\Src\Symbol\Release\ExceptionHandler.pdb`
path	`\\.\pipe\WondershareCrashServices`
path	`\\microsoft.com-app.cc\download\6f14\putty.exe`
path	`\\onedrive.to\DavWWWRoot\Carriers\`
path	`\\onedrive.to\DavWWWRoot\Carriers\putty.exe`
path	`\\onedrive.to\download\Documents\NDA_Agreements.PDF_2025-12-22-06-50-39-658.exe`
registry	`HKCU\Software\Microsoft\Office\1[6,9].0\Excel\Security`
registry	`HKCU\Software\Microsoft\Office\1[6,9].0\Word\Security`
registry	`HKEY_USERS\\Software\Microsoft\SystemCertificates\Root\Certificates\0174E68C97DDF1E0EEEA415EA336A163D2B61AFD`
registry	`HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths`
registry	`HKLM\Software\Microsoft\Windows\CurrentVersion\Uninstall\{1F2952E4-FC07-4482-B9E6-E795507DA7D2}_is1`
filename	`1.msc`
filename	`13223.lnk`
filename	`807d7b6.tmp`
filename	`865fdfd.tmp`
filename	`bugsplat.dll`
filename	`carriers.exe`
filename	`carriers.tmp`
filename	`carriers_agreements_009rcarheffd..scr`
filename	`comsupport.dll`
filename	`crisp.exe`
filename	`crystsupervisor32.exe`
filename	`cytotoxin.exe`
filename	`dvdsetting.dll`
filename	`excel_2016_windows.bat`
filename	`exceptionhandler.dll`
filename	`macros64_2_.xll`
filename	`mozhno-li-vyvesti-dengi-s-krakena.html`
filename	`mscfile.msc`
filename	`mwxtckdb.exe`
filename	`nda.doc`
filename	`nda_agreementsfdp.msi`
filename	`nda_verification222.url`
filename	`networkspec17.log`
filename	`nleresource.dll`
filename	`nleservice.dll`
filename	`nletransitionmgr.dll`
filename	`ppmanlyp.exe`
filename	`price2.pdf.msc`
filename	`price3.xll`
filename	`price4.xls`
filename	`price5.docm`
filename	`price6.doc`
filename	`shadermgr93.rc`
filename	`sss.lnk`
filename	`stage2_shellcode.bin`
filename	`vfszqptv.exe`
filename	`vsezbsrabotat.url`
filename	`watchermgmt.job`
filename	`ws_imageproc.dll`
filename	`ws_log.dll`
filename	`wsburn.dll`
filename	`wsutilities.dll`
filename	`xxx.lnk`

88 further values in this feed are not shown above, because they are not an indicator type that can be recognised reliably by shape: command names, fingerprints and behavioural patterns among them. They are all in the raw JSON, which remains the complete record.

Licensed CC BY 4.0, free to use commercially with attribution to The Hunters Ledger.