MultiRAT (DcRAT, XWorm и VenomRAT)
Indicators of Compromise
IPv4 Port Combinations
- 157.20.182.172:3232
- 157.20.182.172:4449
- 157.20.182.172:7000
- 157.20.182.172:8000
- 45.66.231.150:3232
Domain Port Combinations
- dcxwq1.duckdns.org:3232
- dcxwq1.duckdns.org:4449
- dcxwq1.duckdns.org:7000
- dcxwq1.duckdns.org:8000
Malicious LNK
- \\laws-behalf-ld-sapphire.trycloudflare.com@SSL\DavWWWRoot\new.bat
URLs
- https://australian-jews-wise-enhanced.trycloudflare.com/
- https://australian-jews-wise-enhanced.trycloudflare.com/a.pdf
- https://australian-jews-wise-enhanced.trycloudflare.com/plat.zip
- https://australian-jews-wise-enhanced.trycloudflare.com/policy.pdf
- https://laws-behalf-ld-sapphire.trycloudflare.com/RE
- https://pastebin.com/raw/zNe6NH5y
MD5
- 0232119984d94f63f467dfca879bd678
- 0c60f7d22b838383553a4f1fe9ce382c
- 0d0c68d1e0edf99c130235b5cc2131bf
- 12574c0e1a8541119c7b7f82bb68bda2
- 3bd76f604398b26d18ac297e60372323
- 81135c5cbabb1639f2850e05a7744b22
- 902f4ecd4c40073cd9c8d5448075fa37
- b89fae5d49909e5aed51e63b5971d3df
- c1fa0be59a1dafb916beefefd2446b81
- c6d41b8e95c2120904c9982b18d8c165
- c714a5475996b806918eebaa65faa591
- e9521dba8a36bfbcfe6f1acf1a340663
SHA1
- 1163f24bcbec41d5ccaab626a0c5790a65936e07
- 1704b36a8ba096b517e3f2d4fa185a38185f7da9
- 2c6a2f720082216e062a3cc8950e853e53f9e2f7
- 2c6b45c4a882555134e1e2ba2fbdc000b82dcf27
- 3703ea1c3f21286fea66df741f05ffff9345503c
- 5a91f98c5215ee6375dc6288f484ae370b289db3
- 5cadabd99df94ee4a1a6e743ab55ae15126a31ef
- ac5aa73b5935c9a7d59a126c5cc1cb0336bb4541
- b2cca1edfd5760c0444c1e26da6bd22212520698
- c56f1ca24eaa5703bdfa19d867290e518618f329
- c5d4024c1fe910a0db90805bbaad3d00f8d85900
- d90a37b31efb40aadcd7ad3e0d7482956ce3aa2e
SHA256
- 111fff00f3205b3d369fdac2d14000c8b3d36a13010470e9f6ce668a7783c51c
- 39b377f4119a380dbe07108cf203f9c833bce6120f5dd8779820d0fae3dadb0d
- 3cab84159dd0a977ec1af09c07ffa543e01e300321f00eac4a844b627cedc8ea
- 4bb6ca3a4f3bd5f2357c983d7f767ee203112765e86ba38b017bb202b74e9853
- 4d86fdf825c7fdf093f9d1ad768563da67293adf1a8418085ca7c62c14c9d6fe
- 646ae2ed8e1704dbf660f0968d9788fb64b07ed742d5dae31909483e5cb0729a
- 83be34edfc08c0be569ba4c6ced914322cb6689034746bbeb9167dcf717b82fa
- 9ad90785140cabe52ca855f81014fd7a2337ca15b1b130ee7f9d22de0c4488ac
- b33544b1fb705a77db7e27ed2c6c8c840f729714bd84ecde7638792b69f5b3e8
- b87f5b8abd70c0b13ec9dcfbe17a5c642c56387cbfd52773638d073668738ab3
- d13cd401cd3e151ecc1ddaba54245fbaadb91e76614f0ec7b203522a7fee8baf
- f44f1dd94d14417a8e52e12d6572680a4b2a1907fe4530853fc554bf70b19002
