ZeroTrace Multi-Family MaaS Operation (74.0.42.25) — Indicators

Raw JSON feed Full report Detection rules

143 shown

Type	Indicator
ipv4	`185.49.126.140`
ipv4	`185.49.126.97`
ipv4	`74.0.42.162`
ipv4	`74.0.42.25`
ipv4	`74.0.42.44`
domain	`adminxyzhosting.com`
domain	`chainconnects.net`
domain	`ledno.net`
domain	`readme.md`
domain	`wireon.work.gd`
domain	`ziadverisontwo.com`
domain	`ziadxyzhosting.com`
url	`http://adminxyzhosting.com/Bin/Update.Client.exe`
url	`http://ip-api.com/line/?fields=hosting`
url	`https://chainconnects.net/Bin/support.ClientSetup.msi?e=Access&y=Guest`
sha256	`0f37a2620339a4af7129848fbd9e3a4076103d037f86a80dc452f2363e3cdee9`
sha256	`102eedd5355f9aca9b3f4714a3b106b00e6defd097a2e711f878d9633d1ae4fc`
sha256	`205bffe1f49e256a8ec879667da1babbcf38b6e4d6600823012a68a8dda3c82d`
sha256	`2346318752005aeff0eb2b1bc0d8190422c39f98c2b0f3003bb93a95daa82346`
sha256	`239858491f2a7c4cb5dd44967e364f57fcbefd850da987bb62f06bd58a1f78f9`
sha256	`3b62ba4040d0d470521dce089c13cd8491d1463acbcc8391a49923caa02c08e9`
sha256	`427f818131c9beb7f8a487cb28fe13e2699db844ac3c9e9ae613fd35113fe77f`
sha256	`469af06d07e937df94534fb2b620af98a86503ab97a615f7134697b7cfe58a1c`
sha256	`5285f56688c3aa2cba539102c64e8cf50149233cdcab3d12af34205aadb4f3cb`
sha256	`57fa1c8ea6e8de464bf88591e56a2f25cd665233132361576d0887dabbf70b66`
sha256	`59e43c18ee26c1056efc9628de025e3026db63c9536f6cbd39de847762d2048e`
sha256	`61cc1fad658dd5f21e239a3767636da9038c4c08079596c6ab59d70506938b41`
sha256	`69e4b2fe9e8649e824a46e6f39722b563d00c6ada1feb8fe2a97110bd98681e2`
sha256	`6adb3df41493b1980127196ba395f469e3245baff2fd25ca5d5e8fd004b6e7f4`
sha256	`6b526c29a6961c1f03eeb1ec4ca3a0fdc5680e3f90db013dea8b27d8b63cce57`
sha256	`75322da03881d88e2cc672184aedb24ca05465af8c3aab2a45ff9d0fedd043f0`
sha256	`7a848e3509c5945f1104c0baa89032ac6e329a84844ca6bf4177b9308d98b2d3`
sha256	`8c87cec82356df6bf83af0b966b51ab5dc25b8cc63e9bbae82216e048483dec1`
sha256	`901c3f01d0f32c8aa077031c931ee8d35896d049203a215f1c0bb4e084f1ec07`
sha256	`90f58865f265722ab007abb25074b3fc4916e927402552c6be17ef9afac96405`
sha256	`973d9f9faab19e9d9b9cc942bf48859166556eaa8e3cccbf491832e130a65392`
sha256	`978ead9671e59772eeeb73344fc3b0c068c5168de7f67f738269f5b59e681a9a`
sha256	`9ce4b25efcfbfb27bdef6ae09beda10c3d1847d16a10d31044c747da05d0357f`
sha256	`a11703fd47d16020fa099a95bb4e46247d32cf8821dc1826e77a971cdd3c4c55`
sha256	`a5f36f63a80d9cfe948e70f796df38e7f1a73b4b965f78bd9b3db13053223639`
sha256	`a616c5fd9cee76d2df4d2cfec8d8519e6fd2ad605c1942e1e1cbb99aa09a278d`
sha256	`a9341a1a658bd7aed229a8508a6903fe7b94774924af14133f23b75d752dcfba`
sha256	`b34a0bb0c0ba24dae59b748f1e9dc70fc739c5d4300fe96e8ff66cf6166d3dd8`
sha256	`c31e7a44565282835e712aa5117d6b312de4c3e65c9c560a10f650dbf320b778`
sha256	`defa0f24844cb36a905194ab863a15c0215aa98ce8a1372583aaeafc20b5223d`
sha256	`e2c666332d1a0aa7dca6ed3ac41c040925e740bd1ff19c0172e87334bad5270c`
sha256	`f57c6dbff5270b02651c2886771a8dd8cc40fcd23fa5e2902d26bb10be741bf2`
sha256	`f5f14b9073f86da926a8ed319b3289b893442414d1511e45177f6915fb4e5478`
sha256	`fdca9ee6e64d67795cd48c5740fa54f509b00bff3e2e94d5f7863e21b23da7f6`
sha1	`025efa6c0d5e4318383123a294193f266f783c57`
sha1	`079afe270f2addfe137265d2322c22c50415c741`
sha1	`1b14c09c6b5323b14102e2dc4080805fb2f12557`
sha1	`257b07c4b9eb72403769a12604e9ddb2bf5545fa`
sha1	`3b299fc8597267b904b5465184941c4a74e80e20`
sha1	`4ebb6cd34a4254a80271acdd7f8d700b65acb1d8`
sha1	`4edc47021e17dd02d2b0c8b839a9dbd4da5949db`
sha1	`5b01b90137871c3c8f0d04f510c4d56b23932cbc`
sha1	`63d820731424e5e05febd1d8d23b2b5b796a21b4`
sha1	`6ea6481241e1ba63a204634c3d2813b34ced29ad`
sha1	`792c9c9eac43acf3eb740a1ed3464fa9d771c1d7`
sha1	`7b404eb56c295277ab733fbb965394594422a598`
sha1	`7ff3dde874f7b2cb34fa65147257bb1b9fdbda7a`
sha1	`92ca2749231a40c6607500f2dff6b2713af2b2c0`
sha1	`93e4f301156d120a87fe2c4be3aaa28b9dfd1a8d`
sha1	`99440d52f2442f107d245ebcb186293a2c47db45`
sha1	`ac280083d4994ecb526c02251e31a19813121e36`
sha1	`b4c272629a80cbe0bbc47bd5952d7d8897992634`
sha1	`bff2201c07c78943e6eb2aee06fb219a0fea6784`
sha1	`df8269bd9599655083a2f7aeff05545c276df24b`
sha1	`e63f78986c06a3e5a9298069495418b784f2cd6b`
sha1	`f20779f74870e87fc86d7897f7bd81275286883d`
sha1	`f278bcc83837aee08068e254fb0170e0db58151b`
sha1	`f5ce8fd075a55f34a2fab0da5c183ad52436ef3e`
md5	`04bfcd7ab968ec18de2135ac1245d08e`
md5	`0c4a765f0924b6867fb08407098327db`
md5	`195b758f252644345afe2b2b3a3397a3`
md5	`2dabc46ce85aaff29f22cd74ec074f86`
md5	`2deedd26c00fd690555b175ea9eb8ccb`
md5	`3828190a6dca5ee2a5b103b3aec7c28f`
md5	`490a1ac297430d0c6b530c66feec6c6e`
md5	`4c4cf9a5b492434e4003ad10761593dc`
md5	`4f2f8c2338dadba372269aa2a16adfec`
md5	`554cbfabfb7bce86780241a0087d51fb`
md5	`56042f57da3e53a2b058e8bcf3e81493`
md5	`56bdd11e2169e8475a95f201eb6a267f`
md5	`56ccb739926a725e78a7acf9af52c4bb`
md5	`67cc371575c0b685378f811763c3cae0`
md5	`7b2cd7af699ed4d7aba346f7bb80b39a`
md5	`7c98c4d9e3b8909e1a0ef97557236540`
md5	`8c6656533f31722c4f1ce488dc914082`
md5	`9945815fb0e750d526922582eda2bf39`
md5	`9c6229a5dc777bf98e512a8db44b66f0`
md5	`9c9245810bad661af3d6efec543d34fd`
md5	`9fdb442f58bb5b370ccfd031e2016403`
md5	`a51e031bcf76eacdb8b987bc45a5f9f5`
md5	`c8a38de8c6163f543ab3d17713bd5a30`
md5	`d08af306c343bc4c11f44306098879a6`
md5	`d2ff00949e79290b21d97ddebbc1b21c`
md5	`d323c6ea1d152899f3c78bf11740b39b`
md5	`d6a914903f4a52d15af3b1d89ceb2502`
md5	`ecf6cf7671ab75385f9854aa78bd57a8`
md5	`f04b0812e81f973ebf7eaa27c9aaae4f`
md5	`f1ab9c13d5c9d59aaa54c51506660c14`
md5	`f44d83464e64a0cd27ecef75adeab199`
md5	`f4b00fbc6a3ce80b474334a3ccaadcf0`
md5	`fa9405a7c7bfca793f3f8c0c25dc9445`
md5	`fbd8d44124b9059789af3469d87b96a3`
path	`%TEMP%\test_debug.txt`
path	`C:\Users\*\AppData\Roaming\vlcapp\vlc.exe`
path	`C:\Windows\System32\drivers\etc\hosts`
registry	`HKCU\SOFTWARE\XWorm`
registry	`HKCU\Software\Microsoft\Windows\CurrentVersion\Run`
registry	`HKCU\Software\[HWID]`
filename	`2.exe`
filename	`5666.exe`
filename	`99999999.exe`
filename	`aspdkzb.exe`
filename	`attachment.vbs`
filename	`binajg.exe`
filename	`eokqegd.exe`
filename	`faidowra.dll`
filename	`fixer.bat`
filename	`geejuev.exe`
filename	`jhmwqqkp.exe`
filename	`kwwrxbsoa.exe`
filename	`new_vzzzzzz_2828.exe`
filename	`oiflbd.exe`
filename	`ptmrxpgw.exe`
filename	`puf.ps1`
filename	`purerat.exe`
filename	`ravenoriginalstub.exe`
filename	`simplehelp_technicianwinlauncher.exe`
filename	`sync.ps1`
filename	`tckimpw.exe`
filename	`victest.exe`
filename	`vlc_boxed.exe`
filename	`xclient.exe`
filename	`xclient9999.exe`
filename	`xh.exe`
filename	`xworm_v5.6.exe`
filename	`xwormloader.exe`
filename	`ysoserial.exe`
filename	`zvafsyattl.exe`

41 further values in this feed are not shown above, because they are not an indicator type that can be recognised reliably by shape: command names, fingerprints and behavioural patterns among them. They are all in the raw JSON, which remains the complete record.

Licensed CC BY 4.0, free to use commercially with attribution to The Hunters Ledger.