Indicators are what attackers leave behind. Stolen credentials are what they arrive with.
98 IOCs
Arsenal revamped: Core Werewolf hits Russian organizations with CoreRAT
Excerpt
The threat actor uses custom malware instead of UltraVNC Overview From June to July 2026, we recorded Core Werewolf and detected a previously undocumented CoreRAT. The malicious payload was distributed via the 7zSFX and Rust droppers. The threat actor penetrated infrastructures through phishing messages on Telegram. We assumed the attackers targeted Russia’s public sector and defense industry. Our retrospective analysis identified that CoreRAT had been used since at least…
Read the original report →Diamond Model
Adversary
Infrastructure(6)
Capability
Victim
Indicators of Compromise
Open the mindmap →98 indicators
| Type | Indicator | Confidence | Score | First Seen |
|---|---|---|---|---|
| MD5 | 761f92ed3f949daa790b2cc96d2efbd5 | Medium | Score 53/100 | First seen |
| MD5 | 73a8ef0d8fb7960ce6a29c38190aec6d | Medium | Score 53/100 | First seen |
| SHA256 | 604ffe14ab558bf79f00adbf050760ba5d0156ad7326586013c5d3fb3d7ef2f7 | Medium | Score 53/100 | First seen |
| SHA256 | 6ccfd6b2964f564ab1b308b1c6b4d78f994ec1e975f4e848620ebb302d3e70ac | Medium | Score 53/100 | First seen |
| MD5 | 63ae279bcfc0babcab0539f44b97c76a | Medium | Score 53/100 | First seen |
| SHA256 | 7c5dd94fbda84bd1dc9122dc7f6b2df1469f9e757f7ca577ba82d3ab4bc13d08 | Medium | Score 53/100 | First seen |
| IP | 94.232.248.34 | High | Score 72/100 | First seen |
| SHA256 | 085db99b37298266b48dba20749c1567f99895b5ae3f60d3ea08047d3903542d | Medium | Score 53/100 | First seen |
| SHA256 | ea9600c3d62d807c07055f0951d08db03725417b9342a76e62410e2694050033 | Medium | Score 53/100 | First seen |
| IP | 95.81.125.145 | High | Score 58/100 | First seen |
| MD5 | 6dbb3abbd19859c6f2771d7e32029818 | Medium | Score 53/100 | First seen |
| MD5 | 5bef05f58d53791fc49ee8d66f2cb652 | Medium | Score 53/100 | First seen |
| IP | 130.49.181.212 | High | Score 58/100 | First seen |
| IP | 138.124.76.77 | High | Score 58/100 | First seen |
| MD5 | bc0608ca923518bb05bc00b608f377eb | Medium | Score 53/100 | First seen |
| MD5 | f34f4b89e95084d3a9b00b9c878fdfca | Medium | Score 53/100 | First seen |
| SHA256 | d447e296f7da71a05d38077ae27295519151d56b6cd44ca272e731d702f7fe63 | Medium | Score 53/100 | First seen |
| MD5 | 7c3835a540173253460763b19a4565fa | Medium | Score 53/100 | First seen |
| SHA256 | 909dfb4388334d66877debcb46d36c7d0a5a75c231241aa4c989ff0cafacc8f9 | Medium | Score 53/100 | First seen |
| MD5 | a5be3e5a8bd37feee8bcff7b5d4a4dba | Medium | Score 53/100 | First seen |
| MD5 | 9705d2d1c30b0ae4c4a50c6acb3a9dc8 | Medium | Score 53/100 | First seen |
| MD5 | 09c659fa24c98ba0f65c7a0369649903 | Medium | Score 53/100 | First seen |
| SHA256 | fe2cc8991ec22325283cd246856f7869caae0ff8b4d90cbbb734593b5b3d99ed | Medium | Score 53/100 | First seen |
| IP | 95.215.108.140 | High | Score 58/100 | First seen |
| MD5 | 4b0c15b864b643c3a4ab38360c7c027a | Medium | Score 53/100 | First seen |
| IP | 185.102.139.30 | High | Score 58/100 | First seen |
| SHA256 | be8a351d80e15c6ae88dd566939600162375441c538ee61be36bb81c93da182f | Medium | Score 53/100 | First seen |
| MD5 | 4ced3337ca412a638a504e697caa954f | Medium | Score 53/100 | First seen |
| MD5 | a2ef7d18d943af3c9dc6e9960f26ccbd | Medium | Score 53/100 | First seen |
| IP | 194.190.153.182 | High | Score 72/100 | First seen |
| SHA256 | 6f04ceb8d83ceb8b160314ac1829fba7054464006990e47a1493faf1185c2dab | Medium | Score 53/100 | First seen |
| MD5 | 3efbb378747d3e7d96d077ec6afefbc7 | Medium | Score 53/100 | First seen |
| SHA256 | 07956ee6bbd628bcaaefe36c4b01f3fe146b87df16bbbb6d884c5e5ab1608858 | Medium | Score 53/100 | First seen |
| IP | 104.128.129.184 | High | Score 58/100 | First seen |
| MD5 | 305b6e15b0209a0684fc6d8352b49839 | Medium | Score 53/100 | First seen |
| MD5 | fa3948732fef4f81dbc13102db6f641f | Medium | Score 53/100 | First seen |
| MD5 | a29ba2ff5388d667cc353730075fba4b | Medium | Score 53/100 | First seen |
| SHA256 | 8925168fa34fb8e823f7329fb775b6c2cc3b41767524fc639452e93ec5c360e1 | Medium | Score 53/100 | First seen |
| MD5 | 1406fb20fce3c82bd55616e7949e7aca | Medium | Score 53/100 | First seen |
| MD5 | eee77075b5077c5abf03a9e09567ca08 | Medium | Score 53/100 | First seen |
| IP | 5.101.88.7 | High | Score 58/100 | First seen |
| MD5 | 3215f75e96dad896f961e13a23c5d17f | Medium | Score 53/100 | First seen |
| MD5 | b1410e77bfee794f52adc29e0ef9aed6 | Medium | Score 53/100 | First seen |
| MD5 | 2304e7a62565f45db890a341fb7a7d70 | Medium | Score 53/100 | First seen |
| SHA256 | 31ef487ed72e96d3d8ce50459e2d63786f51925b6e7fc4ede372e26ea7709a1c | Medium | Score 53/100 | First seen |
| MD5 | b3eef6b2ecb165e50d057e1e210d6558 | Medium | Score 53/100 | First seen |
| SHA256 | 1402053d6edb096b59b8df3b81d56d5a30e6577f9022ef9b5dae910f328d0401 | High | Score 68/100 | First seen |
| MD5 | 1c69c262000994ac06ec153469eab55b | Medium | Score 53/100 | First seen |
| MD5 | 0d003702bec166aec8f3869d53ccf89f | Medium | Score 53/100 | First seen |
| MD5 | 808157c74ecd47961c7d2d6f934d706f | Medium | Score 53/100 | First seen |
| IP | 45.128.150.49 | High | Score 58/100 | First seen |
| MD5 | 3454030cd9b40280f1a0e7e585c0f639 | Medium | Score 53/100 | First seen |
| MD5 | 3cbb25f5f3a9ac6908d93cc58909536d | Medium | Score 53/100 | First seen |
| MD5 | 65a9da2d23cf0baae86bd0be8d97ed03 | Medium | Score 53/100 | First seen |
| MD5 | b90f78b83282a7c7ccf8b6f61ab4af4d | Medium | Score 53/100 | First seen |
| MD5 | 6813c4f5170125d134a38ea2af45da97 | Medium | Score 53/100 | First seen |
| MD5 | 65d112c2e2673d5fa5b22deb1b4a430e | Medium | Score 53/100 | First seen |
| MD5 | 0aaeb5c679e8f42e160248d5ef9e1d83 | Medium | Score 53/100 | First seen |
| SHA256 | b40b8978430ebbcbe8101ec51409fef86798d88e24287a1173fde2a106fd0d76 | Medium | Score 53/100 | First seen |
| MD5 | 720e4c35995f95413d9d3d7ebe57d88f | Medium | Score 53/100 | First seen |
| MD5 | 907988b8337495e5245f3a01fd6fd121 | Medium | Score 53/100 | First seen |
| IP | 195.47.250.173 | High | Score 58/100 | First seen |
| MD5 | 3da4b2eaa2359e55bc33cca7468792ad | Medium | Score 53/100 | First seen |
| SHA256 | 1641001dd82ed4e7ad59dfc4e5f4d9c6cd9937d47a6e59931d382926c0632de3 | Medium | Score 53/100 | First seen |
| MD5 | bb7eae1628af407ed9fc0240e92eccfe | Medium | Score 53/100 | First seen |
| MD5 | 9b4f048ec84b13d5138d937109f2cdb6 | Medium | Score 53/100 | First seen |
| SHA256 | 9a1491258e5d0131b0bb237c7221016c737af79961427c1f2fed9f80d75787b3 | Medium | Score 53/100 | First seen |
| MD5 | b6a7dc31b3e1059b227e032f35727ebd | Medium | Score 53/100 | First seen |
| MD5 | d4af404ee8b55fc40b3ef620d90396aa | Medium | Score 53/100 | First seen |
| MD5 | af7ad3dbf7666a88e19d076efe858f49 | Medium | Score 53/100 | First seen |
| MD5 | 92d4dabf7348b0dad11c1295b030611d | Medium | Score 53/100 | First seen |
| MD5 | 7228b3f08edb7754dec4d4e555fe8539 | Medium | Score 53/100 | First seen |
| SHA256 | d34eb87981cd144c0916b1e720b94dc22b52924b3358c32350a235925e7dfa7e | Medium | Score 53/100 | First seen |
| MD5 | a59c46d04b6274de33093e6d9f62f334 | Medium | Score 53/100 | First seen |
| MD5 | 9e372e0f2356edd059af47e70044830a | Medium | Score 53/100 | First seen |
| SHA256 | 7a489dc1e1dc13ec35fb94b4faedcb294879c7fe3597888aec7ad3f516c1cc20 | Medium | Score 53/100 | First seen |
| MD5 | 04028f5fd20a6fa60694962ae72bb96f | Medium | Score 53/100 | First seen |
| MD5 | 7c3754bb07904de3708f1fae02bb9d0c | Medium | Score 53/100 | First seen |
| SHA256 | 4661735db0f33dd567d29b2a056a967bb3762f831eb3678b27c4ffb06dbb8ec1 | High | Score 68/100 | First seen |
| SHA256 | a4f21177027e07280edf929adfd1403e0f4e7eb1892ca38069d45a9cd06e2929 | Medium | Score 53/100 | First seen |
| MD5 | 8d4900aed87db884e183145d2a56ea92 | Medium | Score 53/100 | First seen |
| MD5 | 800076766e58c0f4cfd8a929865a6c9e | Medium | Score 53/100 | First seen |
| MD5 | d98ed128086144ef699ef7584f858aa1 | Medium | Score 53/100 | First seen |
| MD5 | 729598a8473203c1938b69995d816c31 | Medium | Score 53/100 | First seen |
| SHA256 | c907b15b60fe77e42d3c37932f545e5d094370d5b709966a2fb572c5a6799660 | Medium | Score 53/100 | First seen |
| MD5 | bd128b66eb000fd08ada754ed9ceba2e | Medium | Score 53/100 | First seen |
| MD5 | f4a647575c4fd3cb3c29b2a69c3aa6fe | Medium | Score 53/100 | First seen |
| MD5 | bf17c89f315e0b11a812a87783417c0f | Medium | Score 53/100 | First seen |
| SHA256 | 722e7b896d5c6026af26ac368de2aed93ff341128478a6cd57849549abf773d2 | Medium | Score 53/100 | First seen |
| MD5 | b8d7886ca654a5e6feb3f9a56fa40b75 | Medium | Score 53/100 | First seen |
| MD5 | 09f192018e1a42f577d0f136b59e2888 | Medium | Score 53/100 | First seen |
| MD5 | dc8dc902852fff973c9c51cef62bb4ba | Medium | Score 53/100 | First seen |
| SHA256 | 465913946d4985ab60899ed2b7bc779ea83d08683c041d0e33b496358b684106 | Medium | Score 53/100 | First seen |
| SHA256 | 02933405aac6676fd892ff311418877185bbaadc7151807f54a3bc3d6b75241d | Medium | Score 53/100 | First seen |
| IP | 178.253.39.45 | High | Score 58/100 | First seen |
| MD5 | c2af530aff5108ab953eec30ec2399e7 | Medium | Score 53/100 | First seen |
| IP | 91.212.150.141 | High | Score 58/100 | First seen |
| MD5 | ad5f31bb0f53662c5ad659a3de2df2d0 | Medium | Score 53/100 | First seen |
IOC Relationship Graph
Building graph…