Indicators are what attackers leave behind. Stolen credentials are what they arrive with.
6 IOCs
APT36-Linked HACKERAI Implant Shows Signs of LLM-Assisted Malware Development
Threat Actors
Malware Families
Excerpt
The activity uses three previously undocumented malware families PATCHCORD, SHEETCORD, and HACKERAI C2 Agent and shows possible links to APT36 , also known as Transparent Tribe. Researchers assess the attribution with moderate confidence. The assessment is based on the group’s targeting patterns, shared infrastructure, malware similarities, and tools found on an exposed staging server. The campaign primarily targets telecom, government, defense, and energy organizations in…
Read the original report →Diamond Model
Adversary(1)
Infrastructure(4)
Capability(1)
Victim
Indicators of Compromise
Open the mindmap →6 indicators
| Type | Indicator | Confidence | Score | First Seen |
|---|---|---|---|---|
| MD5 | 2fd38c2bcf482a3fbf577b75066e0177 | Medium | Score 53/100 | First seen |
| IP | 46.30.188.13 | High | Score 58/100 | First seen |
| Domain | appstoore.solutions | High | Score 69/100 | First seen |
| Domain | nic-support.site | High | Score 69/100 | First seen |
| Domain | afghantelecom.site | High | Score 69/100 | First seen |
| MD5 | 4d96a72e21626680fc3dd4198c883f2a | Medium | Score 53/100 | First seen |
IOC Relationship Graph
Building graph…