Skip to content
THE HUNTER’S LEDGER
IOC Feed
ZeroTrace Multi-Family MaaS Operation (74.0.42.25)
143 indicators extracted from this investigation's feed. Filter by type, then copy or download exactly what is on screen.
Raw JSON feedFull reportDetection rules
143 shown
TypeIndicatorConfidence
ipv4 185.49.126.140DEFINITE
ipv4 185.49.126.97HIGH
ipv4 74.0.42.162DEFINITE
ipv4 74.0.42.25DEFINITE
ipv4 74.0.42.44HIGH
domain adminxyzhosting.comDEFINITE
domain chainconnects.netDEFINITE
domain ledno.netMODERATE
domain readme.mdDEFINITE
domain wireon.work.gdMODERATE
domain ziadverisontwo.comMODERATE
domain ziadxyzhosting.comMODERATE
url http://adminxyzhosting.com/Bin/Update.Client.exeDEFINITE
url http://ip-api.com/line/?fields=hostingDEFINITE
url https://chainconnects.net/Bin/support.ClientSetup.msi?e=Access&y=GuestDEFINITE
sha256 0f37a2620339a4af7129848fbd9e3a4076103d037f86a80dc452f2363e3cdee9HIGH
sha256 102eedd5355f9aca9b3f4714a3b106b00e6defd097a2e711f878d9633d1ae4fcDEFINITE
sha256 205bffe1f49e256a8ec879667da1babbcf38b6e4d6600823012a68a8dda3c82dDEFINITE
sha256 2346318752005aeff0eb2b1bc0d8190422c39f98c2b0f3003bb93a95daa82346HIGH
sha256 239858491f2a7c4cb5dd44967e364f57fcbefd850da987bb62f06bd58a1f78f9DEFINITE
sha256 3b62ba4040d0d470521dce089c13cd8491d1463acbcc8391a49923caa02c08e9HIGH
sha256 427f818131c9beb7f8a487cb28fe13e2699db844ac3c9e9ae613fd35113fe77fDEFINITE
sha256 469af06d07e937df94534fb2b620af98a86503ab97a615f7134697b7cfe58a1cHIGH
sha256 5285f56688c3aa2cba539102c64e8cf50149233cdcab3d12af34205aadb4f3cbHIGH
sha256 57fa1c8ea6e8de464bf88591e56a2f25cd665233132361576d0887dabbf70b66HIGH
sha256 59e43c18ee26c1056efc9628de025e3026db63c9536f6cbd39de847762d2048eDEFINITE
sha256 61cc1fad658dd5f21e239a3767636da9038c4c08079596c6ab59d70506938b41DEFINITE
sha256 69e4b2fe9e8649e824a46e6f39722b563d00c6ada1feb8fe2a97110bd98681e2HIGH
sha256 6adb3df41493b1980127196ba395f469e3245baff2fd25ca5d5e8fd004b6e7f4HIGH
sha256 6b526c29a6961c1f03eeb1ec4ca3a0fdc5680e3f90db013dea8b27d8b63cce57HIGH
sha256 75322da03881d88e2cc672184aedb24ca05465af8c3aab2a45ff9d0fedd043f0HIGH
sha256 7a848e3509c5945f1104c0baa89032ac6e329a84844ca6bf4177b9308d98b2d3HIGH
sha256 8c87cec82356df6bf83af0b966b51ab5dc25b8cc63e9bbae82216e048483dec1HIGH
sha256 901c3f01d0f32c8aa077031c931ee8d35896d049203a215f1c0bb4e084f1ec07HIGH
sha256 90f58865f265722ab007abb25074b3fc4916e927402552c6be17ef9afac96405DEFINITE
sha256 973d9f9faab19e9d9b9cc942bf48859166556eaa8e3cccbf491832e130a65392DEFINITE
sha256 978ead9671e59772eeeb73344fc3b0c068c5168de7f67f738269f5b59e681a9aHIGH
sha256 9ce4b25efcfbfb27bdef6ae09beda10c3d1847d16a10d31044c747da05d0357fHIGH
sha256 a11703fd47d16020fa099a95bb4e46247d32cf8821dc1826e77a971cdd3c4c55DEFINITE
sha256 a5f36f63a80d9cfe948e70f796df38e7f1a73b4b965f78bd9b3db13053223639HIGH
sha256 a616c5fd9cee76d2df4d2cfec8d8519e6fd2ad605c1942e1e1cbb99aa09a278dDEFINITE
sha256 a9341a1a658bd7aed229a8508a6903fe7b94774924af14133f23b75d752dcfbaHIGH
sha256 b34a0bb0c0ba24dae59b748f1e9dc70fc739c5d4300fe96e8ff66cf6166d3dd8DEFINITE
sha256 c31e7a44565282835e712aa5117d6b312de4c3e65c9c560a10f650dbf320b778HIGH
sha256 defa0f24844cb36a905194ab863a15c0215aa98ce8a1372583aaeafc20b5223dHIGH
sha256 e2c666332d1a0aa7dca6ed3ac41c040925e740bd1ff19c0172e87334bad5270cHIGH
sha256 f57c6dbff5270b02651c2886771a8dd8cc40fcd23fa5e2902d26bb10be741bf2DEFINITE
sha256 f5f14b9073f86da926a8ed319b3289b893442414d1511e45177f6915fb4e5478DEFINITE
sha256 fdca9ee6e64d67795cd48c5740fa54f509b00bff3e2e94d5f7863e21b23da7f6DEFINITE
sha1 025efa6c0d5e4318383123a294193f266f783c57HIGH
sha1 079afe270f2addfe137265d2322c22c50415c741DEFINITE
sha1 1b14c09c6b5323b14102e2dc4080805fb2f12557HIGH
sha1 257b07c4b9eb72403769a12604e9ddb2bf5545faDEFINITE
sha1 3b299fc8597267b904b5465184941c4a74e80e20HIGH
sha1 4ebb6cd34a4254a80271acdd7f8d700b65acb1d8DEFINITE
sha1 4edc47021e17dd02d2b0c8b839a9dbd4da5949dbHIGH
sha1 5b01b90137871c3c8f0d04f510c4d56b23932cbcDEFINITE
sha1 63d820731424e5e05febd1d8d23b2b5b796a21b4DEFINITE
sha1 6ea6481241e1ba63a204634c3d2813b34ced29adDEFINITE
sha1 792c9c9eac43acf3eb740a1ed3464fa9d771c1d7HIGH
sha1 7b404eb56c295277ab733fbb965394594422a598HIGH
sha1 7ff3dde874f7b2cb34fa65147257bb1b9fdbda7aHIGH
sha1 92ca2749231a40c6607500f2dff6b2713af2b2c0HIGH
sha1 93e4f301156d120a87fe2c4be3aaa28b9dfd1a8dDEFINITE
sha1 99440d52f2442f107d245ebcb186293a2c47db45HIGH
sha1 ac280083d4994ecb526c02251e31a19813121e36HIGH
sha1 b4c272629a80cbe0bbc47bd5952d7d8897992634DEFINITE
sha1 bff2201c07c78943e6eb2aee06fb219a0fea6784DEFINITE
sha1 df8269bd9599655083a2f7aeff05545c276df24bDEFINITE
sha1 e63f78986c06a3e5a9298069495418b784f2cd6bDEFINITE
sha1 f20779f74870e87fc86d7897f7bd81275286883dHIGH
sha1 f278bcc83837aee08068e254fb0170e0db58151bDEFINITE
sha1 f5ce8fd075a55f34a2fab0da5c183ad52436ef3eHIGH
md5 04bfcd7ab968ec18de2135ac1245d08eDEFINITE
md5 0c4a765f0924b6867fb08407098327dbDEFINITE
md5 195b758f252644345afe2b2b3a3397a3DEFINITE
md5 2dabc46ce85aaff29f22cd74ec074f86DEFINITE
md5 2deedd26c00fd690555b175ea9eb8ccbHIGH
md5 3828190a6dca5ee2a5b103b3aec7c28fDEFINITE
md5 490a1ac297430d0c6b530c66feec6c6eHIGH
md5 4c4cf9a5b492434e4003ad10761593dcDEFINITE
md5 4f2f8c2338dadba372269aa2a16adfecHIGH
md5 554cbfabfb7bce86780241a0087d51fbHIGH
md5 56042f57da3e53a2b058e8bcf3e81493HIGH
md5 56bdd11e2169e8475a95f201eb6a267fHIGH
md5 56ccb739926a725e78a7acf9af52c4bbDEFINITE
md5 67cc371575c0b685378f811763c3cae0HIGH
md5 7b2cd7af699ed4d7aba346f7bb80b39aHIGH
md5 7c98c4d9e3b8909e1a0ef97557236540HIGH
md5 8c6656533f31722c4f1ce488dc914082HIGH
md5 9945815fb0e750d526922582eda2bf39HIGH
md5 9c6229a5dc777bf98e512a8db44b66f0HIGH
md5 9c9245810bad661af3d6efec543d34fdDEFINITE
md5 9fdb442f58bb5b370ccfd031e2016403DEFINITE
md5 a51e031bcf76eacdb8b987bc45a5f9f5DEFINITE
md5 c8a38de8c6163f543ab3d17713bd5a30DEFINITE
md5 d08af306c343bc4c11f44306098879a6HIGH
md5 d2ff00949e79290b21d97ddebbc1b21cDEFINITE
md5 d323c6ea1d152899f3c78bf11740b39bHIGH
md5 d6a914903f4a52d15af3b1d89ceb2502HIGH
md5 ecf6cf7671ab75385f9854aa78bd57a8HIGH
md5 f04b0812e81f973ebf7eaa27c9aaae4fHIGH
md5 f1ab9c13d5c9d59aaa54c51506660c14HIGH
md5 f44d83464e64a0cd27ecef75adeab199DEFINITE
md5 f4b00fbc6a3ce80b474334a3ccaadcf0DEFINITE
md5 fa9405a7c7bfca793f3f8c0c25dc9445HIGH
md5 fbd8d44124b9059789af3469d87b96a3HIGH
path %TEMP%\test_debug.txtHIGH
path C:\Users\*\AppData\Roaming\vlcapp\vlc.exeHIGH
path C:\Windows\System32\drivers\etc\hostsHIGH
registry HKCU\SOFTWARE\XWormDEFINITE
registry HKCU\Software\Microsoft\Windows\CurrentVersion\RunDEFINITE
registry HKCU\Software\[HWID]HIGH
filename 2.exeDEFINITE
filename 5666.exeDEFINITE
filename 99999999.exeDEFINITE
filename aspdkzb.exeHIGH
filename attachment.vbsDEFINITE
filename binajg.exeHIGH
filename eokqegd.exeHIGH
filename faidowra.dllHIGH
filename fixer.batDEFINITE
filename geejuev.exeHIGH
filename jhmwqqkp.exeHIGH
filename kwwrxbsoa.exeHIGH
filename new_vzzzzzz_2828.exeDEFINITE
filename oiflbd.exeHIGH
filename ptmrxpgw.exeHIGH
filename puf.ps1HIGH
filename purerat.exeDEFINITE
filename ravenoriginalstub.exeDEFINITE
filename simplehelp_technicianwinlauncher.exeHIGH
filename sync.ps1HIGH
filename tckimpw.exeHIGH
filename victest.exeDEFINITE
filename vlc_boxed.exeHIGH
filename xclient.exeDEFINITE
filename xclient9999.exeDEFINITE
filename xh.exeHIGH
filename xworm_v5.6.exeDEFINITE
filename xwormloader.exeDEFINITE
filename ysoserial.exeHIGH
filename zvafsyattl.exeHIGH

41 further values in this feed are not shown above, because they are not an indicator type that can be recognised reliably by shape: command names, fingerprints and behavioural patterns among them. They are all in the raw JSON, which remains the complete record.

Licensed CC BY 4.0, free to use commercially with attribution to The Hunters Ledger.