Indicators are what attackers leave behind. Stolen credentials are what they arrive with.
10 IOCs
Lost in relocation: analysis of a new loader distributing CASTLESTEALER
Threat Actors
Excerpt
A previously undocumented Windows loader tracked as OXLOADER is delivering the CASTLESTEALER infostealer via malicious Google Ads, with low detection rates across static engines and sandbox detonations. The loader uses several obfuscation layers (control-flow flattening, opaque predicates, mixed Boolean-Arithmetic), self-modifying decryption stubs, and abuses the Windows .reloc section to stage shellcode. Elastic Security Labs identified OXLOADER in an active campaign…
Read the original report →Diamond Model
Adversary(1)
Infrastructure(1)
Capability
Victim
Indicators of Compromise
Open the mindmap →10 indicators
| Type | Indicator | Confidence | Score | First Seen |
|---|---|---|---|---|
| SHA256 | 4ec9d9d4d10ad78fc6d7bda7cb17d52984878ccd2dd4302fd1cef152313b9741 | Medium | Score 53/100 | First seen |
| SHA256 | de4f51649ec1a33071854aefe93ffb3fc225e19f802d8dd914676dd5dfef2615 | Medium | Score 53/100 | First seen |
| SHA256 | fdfc7831e5c24cfa80152860dfe8c056ba079f7df1393bf6bb7b18ed974eda37 | Medium | Score 53/100 | First seen |
| SHA256 | 9a9939dff297997732aaade9b243d695632cbd64033c5fbcb9de3d09b7e6c28d | Medium | Score 53/100 | First seen |
| SHA256 | ed391a16389234f9ebb6727711baaf3e068d7f77c465708fa3e8b7d0565d7fb9 | Medium | Score 53/100 | First seen |
| MD5 | 956c6128e9362e075f8d006c93616a66 | Medium | Score 53/100 | First seen |
| SHA256 | 39019279686c820c3af5684012a0085a7e2109f612c9fab886dd0577ace5b5c6 | High | Score 68/100 | First seen |
| Domain | node-js.prentiva99.info | High | Score 86/100 | First seen |
| MD5 | 6e0a1f8f77f7011561f6f9ca96b71b8f | Medium | Score 53/100 | First seen |
| SHA256 | c85f2765a6c3c3f3907c17e57df12f8f68826f74bff3bbfd272af50666d065fe | Medium | Score 53/100 | First seen |
IOC Relationship Graph
Building graph…