Indicators are what attackers leave behind. Stolen credentials are what they arrive with.
Threat Actors
Malware Families
Excerpt
Perl based macOS/linux Stealer | Malware Analysis Malware Analysis Perl based macOS/linux Stealer Jul 20, 2025 Randy McEoin Summary A post on X about a ClickFix targeting linux lead to the discovery of a seemingly undocumented Perl-based macOS/linux stealer. Here I will: dig into the ClickFix Javascript that targets not just Windows, but macOS and Linux deobfuscate the Perl delivered by the ClickFix describe much of the Perl stealer Pearl Stealer As I have not found this…
Read the original report →Diamond Model
Adversary(1)
Infrastructure(6)
Capability(1)
Victim
Indicators of Compromise
Open the mindmap →21 indicators
| Type | Indicator | Confidence | Score | First Seen |
|---|---|---|---|---|
| URL | http://213.108.198.227:8080/get_ip/$current_ip | High | Score 58/100 | First seen |
| URL | https://cloudflare.blazing-cloud.com/linux/verify/captcha/ | High | Score 58/100 | First seen |
| URL | http://213.108.198.227/parallel | High | Score 58/100 | First seen |
| URL | http://213.108.198.227/data_extracter | High | Score 58/100 | First seen |
| URL | http://cloudflare.blazing-cloud.com/mac/verify/captcha/dj5fbdevxtib | High | Score 58/100 | First seen |
| SHA256 | 2f52ced92662bfc025db92787435e0d3f73469fe888973e62c8b5bd830e08e62 | Medium | Score 53/100 | First seen |
| URL | http://213.108.198.227/start_process_data | High | Score 58/100 | First seen |
| SHA256 | eafa12df62f778180984cdbb510dabf8a3ad36a3d2cd250dad0ee12cdca1286f | Medium | Score 53/100 | First seen |
| SHA256 | 50bc21ca2b8fcfd4d46d51d94ab1ac4450a25167a1607074695a7b048ce3c1b3 | Medium | Score 53/100 | First seen |
| URL | http://213.108.198.227/fileicon.tar.gz | High | Score 58/100 | First seen |
| SHA256 | d18aa1f4e03b50b649491ca2c401cd8c5e89e72be91ff758952ad2ab5a83135d | Medium | Score 53/100 | First seen |
| URL | http://213.108.198.227/curl | High | Score 58/100 | First seen |
| SHA256 | 05c922345ab0113c55824a1b2c658b0149a88c4cf4fecc01bf2409bfd81bbca1 | Medium | Score 53/100 | First seen |
| URL | http://213.108.198.227/util/upload_data/$identifier | High | Score 58/100 | First seen |
| URL | https://www.madeinci.ci/socket.io/?EIO=4&transport=websocket | High | Score 58/100 | First seen |
| URL | http://213.108.198.227/notes_processed/$identifier | High | Score 58/100 | First seen |
| SHA256 | 0d904998d082a51c27c05a23cd62b2f5f030a511af911110a814afffbe3fd1e4 | Medium | Score 53/100 | First seen |
| URL | http://213.108.198.227/system.pl | High | Score 58/100 | First seen |
| URL | https://cloudflare.blazing-cloud.com/mac/verify/captcha/ | High | Score 58/100 | First seen |
| SHA256 | 7d3d2d0f17a5ddd1e9c32ad611a8c00bbd53088734784726cd4c6dcd44248a37 | Medium | Score 53/100 | First seen |
| URL | http://213.108.198.227/data_processed/$identifier | High | Score 58/100 | First seen |
IOC Relationship Graph
Building graph…