Indicators are what attackers leave behind. Stolen credentials are what they arrive with.
ToolMalware Family
Active Threat
ADFind
118
IOCs Tracked
2021
First Seen
Oct 28, 2026
Last Seen
0
YARA Rules
Associated IOCs118 total · showing 50
IP3
217.196.98.612026-10-09High
193.168.143.1962026-10-09Medium
45.141.87.552026-10-09High
Domain14
altynbe.com2026-10-09High
anikvan.com2026-10-09Medium
kasym500.com2026-10-09Medium
grasmetral.com2026-10-09Medium
jarkaairbo.com2026-10-09Medium
erbolsan.com2026-10-09Medium
kasymdev.com2026-10-09Medium
dauled.com2026-10-09Medium
samderat200.com2026-10-09Medium
scupolasta.store2026-10-09Medium
avtechupdate.com2026-10-09Medium
504e1c95.host.njalla.net2026-10-09High
boriz400.com2026-10-09High
504ec1c95.host.njalla.net2026-10-09High
URL9
https://185.12.45.134:443/ajax2026-10-09High
http://127.0.0.1:11664/2026-10-09High
http://127.0.0.1:24003/2026-10-09High
http://91.194.11.64/MSI.msi2026-10-09High
https://workspacin.cloud/live/2026-10-09High
https://illoskanawer.com/live/2026-10-09High
http://45.129.199.214/vodeo/wg01ck012026-10-09High
http://127.0.0.1:49157/2026-10-09High
https://cloudmeri.com/comm.php2026-10-09High
SHA25620
18f0898d595ec054d13b02915fb7d3636f65b8e53c0c66b3c7ee3b6fc37d35662026-10-09High
c2dc17bdf16a609cdb5a93bf153011d67c6206f7608931b1ca1c1d316b5ad54f2026-10-09Medium
04f48ed27a83a57a971e73072ac5c769709306f2714022770fb364fd575fd4622026-10-09Medium
6b3f835acbd954af168184f57c9d8e6798898e9ee650bd543ea6f2e9d5cf63782026-10-09Medium
e74056a729e004031b78007708bb98d759ff94b46866898c5a05d87013cd643c2026-10-09Medium
52072a8f99dacd5c293fccd051eab95516d8b880cd2bc5a7e0f4a30d008e22a72026-10-09Medium
d1ab0dff44508bac9005e95299704a887b0ffc42734a34b30ebf6d3916053dbe2026-10-09Medium
123880edc91f7dc033a769d9523f783f7b426673ee95e9e33654cdfa95a6462c2026-10-09Medium
07f87f7b3313acd772f77d35d11fc12d3eb7ca1a2cd7e5cef810f9fb657694a02026-10-09Medium
3e04eb55095ad6a45905564d91f2ab6500e07afcdf9d6c710d6166d4eef281852026-10-09Medium
4fce3d38e0a308088cd75c2ef1bb5aa312e83447d63a82f62839d3609a283b022026-10-09Medium
b39e2cf333b9f854bcdf993aa6c1f357d2a7042139e4c6ca47ed504090006a612026-10-09Medium
4123a19cda491f4d31a855e932b8b7afdcf3faf5b448f892da624c768205a2892026-10-09Medium
6d9031eb617096439bc8c8f7c32f4a11ffefc4326d99229fc78722873092e4002026-10-09Medium
af31c16dcd54ee11d425eb3a579ad0606a05b36c0605cc16007f3d3c84d8e2912026-10-09Medium
410db536a57c511b0ccac2639e0eb3320f303fc5c90242379ab43364c51ef3212026-10-09Medium
0e823a5b64ee761b70315548d484b5b9c4b61968b5068f9a8687c612ddbfeb802026-10-09Medium
006569f0a7e501e58fe15a4323eedc08f9865239131b28dc5f95f750b4767b382026-10-09Medium
2feae7574a2cc4dea2bff4eceb92e3a77cf682c0a1e78ee70be931a251794b862026-10-09Medium
d950cc937f4df9ab0bad44513d23ea7ecdfae2b0de8ba351018de5fb5d7b13822026-10-09Medium
CVE4
CVE-2021-442282026-10-28High
CVE-2017-02132026-10-09High
CVE-2021-268552026-10-09Medium
CVE-2017-118822026-10-26Medium
Related Reports4 shown
Detailed Analysis of DragonForce Ransomware
S2WJan 14, 2026
Threat Actor Profile: APT27
DeXposeSep 15, 2025
From a Single Click: How Lunar Spider Enabled a Near Two-Month Intrusion
The DFIR ReportSep 29, 2025
Blurring the Lines: Intrusion Shows Connection With Three Major Ransomware Gangs
The DFIR ReportSep 8, 2025
Threat Profile
TypeTool
StatusActive
First SeenSep 8, 2021
Last SeenOct 28, 2026
IOCs tracked118