URL:
hxxp://uiccvbk[.]click:8839/invoices
hxxp://vexdico[.]shop:8539/subscriptions
hxxp://shhsift[.]click:7647/imports
hxxp://github-software[.]su/start.php
hxxp://github-software[.]su/end.php
hxxp://github-software[.]su/screen.php
hxxps://github-software[.]su/powershell/Loader.ps1
hxxps://github-software[.]su/powershell/Update.ps1
User-Agent:
"aizkHkKtfNdzmaycOJfjhDPaNLCVYKMMpkAcUysyIpYjAUhNLqsQLGyVyIWfCgnEBiJYejrZLwCwhmVkEjIxKHePMYeeEMWXarInkmuwrUmzBIs"
"GREETINGSFROMTHERABBIDSTEAM"
Домены:
software-storage[.]su
software-storage[.]org
ipapi[.]co
ipinfo[.]io
ipwho[.]is
github-software[.]su
Sha256:
935c319fdc147cb9e788eda4532cb8510f78454af079bc9840fc8640a8658717 loader.ps1
07306f4105240869c00fb06e51259381cc027a89c7022ad30bb5b377c78f5306 update.ps1
100d790089a7d6418ebd9a95840a79ae5e11d7c74c417dcc5a0d705caf9da82d 1.zip (pass: 1)
92c6531a09180fae8b2aae7384b4cea9986762f0c271b35da09b4d0e733f9f45 AutoIt3.exe
9ee701f1fbf4c03c475189d04826d7152df980dbe61f7180c3c3d7037e7188ca Helper.exe
2c485b4903e59e0ef8bb8d09038b6749d205a8a590edeae8e680acf100d8e736 Ima.a3x
25217ca23d298fe91ed1b423686d504134b2b9a83f1eb479a54b33c00df54ccc remus stealer
IP-адреса|Port:
72.62.195[.]74:8839
165.227.199[.]109:8539
159.65.136[.]5:7647
🛡 Проведен поиск угроз на всех заказчиках, а индикаторы компрометации оперативно добавлены в платформу RT Protect TI.