Indicators are what attackers leave behind. Stolen credentials are what they arrive with.
19 IOCs
From Registry Stored Powershell to in Memory Cryptocurrency Mining: a Multi Stage Infection Chain
Malware Families
Excerpt
https://labs.k7computing.com/index.php/from-registry-stored-powershell-to-in-memory-cryptocurrency-mining-a-multi-stage-infection-chain/ From Registry-Stored PowerShell to In-Memory Cryptocurrency Mining: A Multi-Stage Infection Chain Published: 2026-09-18 · Archived: 2026-10-09 02:01:32 UTC We had an opportunity to analyse a system with frequent detection-alerts over powershell execution. Our analysis revealed a multi-stage infection that relied heavily on obfuscation,…
Read the original report →Diamond Model
Adversary
Infrastructure(6)
Capability(1)
Victim
Indicators of Compromise
Open the mindmap →19 indicators
| Type | Indicator | Confidence | Score | First Seen |
|---|---|---|---|---|
| MD5 | f1d2fdb7f3b699da69a050c5352a33c2 | High | Score 61/100 | First seen |
| MD5 | f94de28bd66afc4679f546500db184d4 | High | Score 61/100 | First seen |
| Domain | sslvalidcert.com | High | Score 64/100 | First seen |
| URL | https://config-rg7.pages.dev/config.txt | High | Score 67/100 | First seen |
| URL | https://frames-1zm.pages.dev/frames.png | High | Score 64/100 | First seen |
| MD5 | ed276b2312f641b00f87fa18e85c48eb | High | Score 61/100 | First seen |
| MD5 | 94b50ace73cc03790678c73b867be129 | High | Score 61/100 | First seen |
| URL | https://labs.k7computing.com/index.php/from-registry-stored-powershell-to-in-memory-cryptocurrency-mining-a-multi-stage-infectio | High | Score 67/100 | First seen |
| URL | https://wavmain.pages.dev/main.wav | High | Score 67/100 | First seen |
| URL | http://txtcdn.net | High | Score 67/100 | First seen |
| MD5 | c024189e1e7fa0ae6d24353367e8b98d | High | Score 61/100 | First seen |
| URL | frames-1zm.pages.dev/frames.png | High | Score 67/100 | First seen |
| URL | https://softtestcopapool.pages.dev/rxconfig.txt | High | Score 67/100 | First seen |
| IP | 104.21.2.193 | High | Score 64/100 | First seen |
| URL | https://labs.k7computing.com/index.php/from-registry-stored-powershell-to-in-memory-cryptocurrency-mining-a-multi-stage-infection-chain/ | High | Score 67/100 | First seen |
| Domain | httptls.org | High | Score 64/100 | First seen |
| URL | https://publicwavlib.pages.dev/mav.wav | High | Score 67/100 | First seen |
| MD5 | be860a15b7e5d44b0b3d67f598238fad | High | Score 61/100 | First seen |
| URL | https://publicwavlib.pages.dev/hdaudio.wav | High | Score 67/100 | First seen |
IOC Relationship Graph
Building graph…