Indicators are what attackers leave behind. Stolen credentials are what they arrive with.
54 IOCs
A VBScript campaign distributed through WhatsApp deploying RMM software
Malware Families
Excerpt
In June 2026, we observed a malware campaign distributing malicious VBScript files through direct messages in WhatsApp. The campaign affected users across multiple countries and territories, including Malaysia, Brazil, India, Mexico, Singapore, UK, Spain, Taiwan, Australia, Russia and Vietnam, with the highest number of victims observed in Malaysia. At the time of writing this article, the campaign is still active. Analysis shows that the campaign primarily targets users of…
Read the original report →Diamond Model
Adversary
Infrastructure(6)
Capability(1)
Victim
Indicators of Compromise
Open the mindmap →54 indicators
| Type | Indicator | Confidence | Score | First Seen |
|---|---|---|---|---|
| MD5 | 1a3cc75466ffb1971482f7abf7aabc3f | Medium | Score 53/100 | First seen |
| MD5 | 31037a42ca048e06e69a78f55bc2eff5 | Medium | Score 53/100 | First seen |
| MD5 | 3b1aba44dd3d9b6339b6f56e2f42034b | Medium | Score 53/100 | First seen |
| MD5 | 6359e6236471cbe434d0ef4c42b7f879 | Medium | Score 53/100 | First seen |
| Domain | shaaslong.one | High | Score 58/100 | First seen |
| MD5 | 68c16c46f8afb9e00bbaba0207fb0a46 | Medium | Score 53/100 | First seen |
| MD5 | 66705384a7ad81d14c34fc6c054a0ecf | Medium | Score 53/100 | First seen |
| MD5 | 7f81c1bc8cfd588e8998968e2621456e | Medium | Score 53/100 | First seen |
| MD5 | 74fd9f91fc93b6288b4fc253ea5b3e20 | Medium | Score 53/100 | First seen |
| MD5 | 2c6f05f1f309d89b2236e6c8b59c88f9 | Medium | Score 53/100 | First seen |
| MD5 | 8c6d9fc389ad3f20ccbc71d77eb39bfa | Medium | Score 53/100 | First seen |
| MD5 | ddaffe9849f7f3c79f8804adb9a6b3d5 | Medium | Score 53/100 | First seen |
| MD5 | 1c47c63e5ed25060d95359c57c77b107 | Medium | Score 53/100 | First seen |
| MD5 | 8c3322009b8982663c0cbecd9492e7eb | Medium | Score 53/100 | First seen |
| MD5 | 05d188f071d097f5b6bd8138749b4b14 | Medium | Score 53/100 | First seen |
| IP | 202.61.160.201 | High | Score 69/100 | First seen |
| MD5 | 5b6bbcc06cf08cc99e1afeda486d42fb | Medium | Score 53/100 | First seen |
| Domain | caiwuascw.s3.us-east-005.backblazeb2.com | High | Score 58/100 | First seen |
| IP | 202.61.160.208 | High | Score 58/100 | First seen |
| MD5 | d43fdaa1f0ee09d7e5f0f94ee9df7b6c | Medium | Score 53/100 | First seen |
| Domain | temu.baskwms.top | High | Score 58/100 | First seen |
| MD5 | dad708e050632a4280cabf98ac1376b7 | Medium | Score 53/100 | First seen |
| MD5 | 63ac85195b73753333316a889cf5880f | Medium | Score 53/100 | First seen |
| MD5 | df4fa0369eaca5cec348be293890d4af | Medium | Score 53/100 | First seen |
| MD5 | 79ecd61b09b0f2d54b34586c916c4ec9 | Medium | Score 53/100 | First seen |
| Domain | qse.shoppes.help | High | Score 58/100 | First seen |
| MD5 | b7cd06c71465038b658a6dc1f273a507 | Medium | Score 53/100 | First seen |
| IP | 202.61.160.137 | High | Score 58/100 | First seen |
| Domain | baoxis.cc | High | Score 58/100 | First seen |
| MD5 | 9f13c7b8ba391b2f597874e54d310648 | Medium | Score 53/100 | First seen |
| MD5 | d06333c360b51456f427e616c3c5f8bd | Medium | Score 53/100 | First seen |
| Domain | facaia.s3.us-east-005.backblazeb2.com | High | Score 58/100 | First seen |
| MD5 | 4f0593e8e0e8fac49429e9b45ebf7fa1 | Medium | Score 53/100 | First seen |
| MD5 | 7403cbcc5a9c32384d431856dc48fcc9 | Medium | Score 53/100 | First seen |
| MD5 | 1d94fbe9cab21278cc3f104bea334d08 | Medium | Score 53/100 | First seen |
| MD5 | c7f38cbb99c8b74fa0465293feeba700 | Medium | Score 53/100 | First seen |
| MD5 | 993f4c0cadbc769a4b0ed62a918db58d | Medium | Score 53/100 | First seen |
| MD5 | 5002eca748205d544618e3bd2dedc223 | Medium | Score 53/100 | First seen |
| IP | 202.61.160.160 | High | Score 58/100 | First seen |
| MD5 | 66442f2457eca8f47385b1fb2c6fcab8 | Medium | Score 53/100 | First seen |
| MD5 | 6fb6a55424adfb61e31f06aef33273e5 | Medium | Score 53/100 | First seen |
| MD5 | d01cad98dd0d01b75e04e784953c5e2b | Medium | Score 53/100 | First seen |
| MD5 | 0ba93109757776a44de9d8c88baa4963 | Medium | Score 53/100 | First seen |
| MD5 | 4044e4b6471c9de7b0a4ba37d9d9df9a | Medium | Score 53/100 | First seen |
| MD5 | 9d9ac85765e4a818a3ccabe2cf4fef82 | Medium | Score 53/100 | First seen |
| MD5 | 6c39900d77dcba158e1d27c7619cb06d | Medium | Score 53/100 | First seen |
| MD5 | 20209b3a32769afc6a75694b8d8839dd | Medium | Score 53/100 | First seen |
| Domain | invoice.msopsa.top | High | Score 58/100 | First seen |
| MD5 | 7f16449cd0c4862d1eadf8a5742bf09a | Medium | Score 53/100 | First seen |
| IP | 38.55.151.63 | High | Score 86/100 | First seen |
| MD5 | f90ed4b2d0b67114aa89ddfed658e5c0 | Medium | Score 53/100 | First seen |
| IP | 202.61.160.202 | High | Score 86/100 | First seen |
| MD5 | 7849061c536a3efb05a56d504694e7e7 | Medium | Score 53/100 | First seen |
| MD5 | 02bb20455cc592a69c080abac770ce90 | Medium | Score 53/100 | First seen |
IOC Relationship Graph
Building graph…