Indicators are what attackers leave behind. Stolen credentials are what they arrive with.
41 IOCs
Fake Installers to Monero: A Multi-Tool Mining Operation
Malware Families
Excerpt
Introduction Elastic Security Labs has been tracking a financially motivated operation, designated REF1695, that has been active since at least late 2023. The operator deploys a combination of RATs, cryptominers, and custom XMRig loaders through fake installer packages. Across all observed campaigns, the infection chains share a consistent packing technique, overlapping C2 infrastructure, and common social engineering patterns, linking them to a single operator. Beyond…
Read the original report →Diamond Model
Adversary
Infrastructure(6)
Capability(2)
Victim
Indicators of Compromise
Open the mindmap →41 indicators
| Type | Indicator | Confidence | Score | First Seen |
|---|---|---|---|---|
| URL | https://softappsbase.top/UnamWebPanel7/api/endpoint.php | High | Score 58/100 | First seen |
| SHA256 | 6492e50e79b979254314988228a513d5acbdaa950346414955dc052ae77d2988 | Medium | Score 53/100 | First seen |
| URL | https://autoupdatewinsystem.top/UWP1/cpu.txt | High | Score 58/100 | First seen |
| SHA256 | 6a01cc61f367d3bae34439f94ff3599fcccb66d05a8e000760626abb9886beac | Medium | Score 53/100 | First seen |
| SHA256 | 82c03866670b70047209c39153615512f7253f125a252fe3dcd828c6598fdf86 | Medium | Score 53/100 | First seen |
| Domain | winautordr.kozow.com | High | Score 58/100 | First seen |
| SHA256 | f84b00fc75f183c571c8f49fcc1d7e0241f538025db0f2daa4e2c5b9a6739049 | Medium | Score 53/100 | First seen |
| SHA256 | c6c4a9725653b585a9d65fc90698d4610579b289bcfb2539f7a5f7e64e69f2e4 | Medium | Score 53/100 | First seen |
| Domain | ident.me | High | Score 58/100 | First seen |
| URL | https://rapidfilesbaze.top/z78fGbs2b7XceWop21aQsrx41Rkeydsktp/ | High | Score 58/100 | First seen |
| SHA256 | 27db41f654b53e41a4e1621a83f2478fa46b1bbffc1923e5070440a7d410b8d3 | Medium | Score 53/100 | First seen |
| Domain | wndlogon.hopto.org | High | Score 58/100 | First seen |
| URL | https://autoupdatewinsystem.top/UWP1/api/endpoint.php | High | Score 58/100 | First seen |
| Domain | winautordr.ydns.eu | High | Score 58/100 | First seen |
| IP | 172.94.15.211 | High | Score 58/100 | First seen |
| SHA256 | 1f7441d72eff2e9403be1d9ce0bb07792793b2cb963f2601ecfdf8c91cd9af73 | Medium | Score 53/100 | First seen |
| SHA256 | 468441d32f62520020d57ff1f24bb08af1bc10e9b4d4da1b937450f44e80a9be | Medium | Score 53/100 | First seen |
| SHA256 | 7bb0e91558244bcc79b6d7a4fe9d9882f11d3a99b70e1527aac979e27165f1d7 | Medium | Score 53/100 | First seen |
| Domain | wndlogon.ydns.eu | High | Score 58/100 | First seen |
| SHA256 | a3f84aa1d15fd33506157c61368fd602d0b81f69aff6c69249bf833d217308bb | Medium | Score 53/100 | First seen |
| Domain | wndlogon.itemdb.com | High | Score 58/100 | First seen |
| SHA256 | 0176ffaf278b9281aa207c59b858c8c0b6e38fdb13141f7ed391c9f8b2dc7630 | Medium | Score 53/100 | First seen |
| SHA256 | e1e87d11079d33ec1a1c25629cbb747e56fe17071bde5fd8c982461b5baa80a4 | Medium | Score 53/100 | First seen |
| SHA256 | b8b7aecce2a4d00f209b1e4d30128ba6ef0f83bbdc05127f6f8ba97e7d6df291 | Medium | Score 53/100 | First seen |
| Domain | winautordr.hopto.org | High | Score 58/100 | First seen |
| Domain | windirautoupdates.top | High | Score 58/100 | First seen |
| URL | https://autoupdatewinsystem.top/MyMNRconfigs/0226.txt | High | Score 58/100 | First seen |
| SHA256 | 9409f9c398645ddac096e3331d2782705b62e388a8ecb1c4e9d527616f0c6a9e | Medium | Score 53/100 | First seen |
| SHA256 | 460203070b5a928390b126fcd52c15ed3a668b77536faa6f0a0282cf1c157162 | Medium | Score 53/100 | First seen |
| URL | https://rapidfilesbaze.top/z78fGbs2b7XceWop21aQsrx41Rkeymbl/ | High | Score 58/100 | First seen |
| Domain | winautordr.itemdb.com | High | Score 58/100 | First seen |
| URL | https://softappsbase.top/UnammnrsettingsCPU.txt | High | Score 58/100 | First seen |
| SHA256 | 542d2267b40c160b693646bc852df34cc508281c4f6ed2693b98147dae293678 | Medium | Score 53/100 | First seen |
| SHA256 | 9977b9185472c7d4be22c20f93bc401dd74bb47223957015a3261994d54c59fc | Medium | Score 53/100 | First seen |
| SHA256 | 4e6b8fdd819293ca3fe8f8add6937bf6531a936955d9ac974a6b231823c7330e | Medium | Score 53/100 | First seen |
| SHA256 | 9fa23382820b1e781f3e05e9452176a72529395643f09080777fab7b9c6b1f5c | Medium | Score 53/100 | First seen |
| SHA256 | bb48a52bae2ee8b98ee1888b3e7d05539c85b24548dd4c6acc08fbe5f0d7631a | Medium | Score 53/100 | First seen |
| Domain | wndlogon.kozow.com | High | Score 58/100 | First seen |
| URL | https://softwaredatabase.xyz/UnammnrsettingsCPU.txt | High | Score 58/100 | First seen |
| SHA256 | ce90cb3a9bfb8a276cb50462be932e063ed408af8c5591dd2c50f1c6d18c394c | Medium | Score 53/100 | First seen |
| URL | https://softwaredatabase.xyz/UnamWebPanel7/api/endpoint.php | High | Score 58/100 | First seen |
IOC Relationship Graph
Building graph…