Indicators are what attackers leave behind. Stolen credentials are what they arrive with.
12 IOCs
PHANTOMPULSE: anatomy of a hijackable blockchain-C2 RAT
Threat Actors
Excerpt
Elastic Security Labs's prior coverage of REF6598 documented an intrusion set whose Windows toolchain landed via Obsidian plugin abuse, escalated via an in-memory PE loader (PHANTOMPULL), and finished with a RAT (PHANTOMPULSE). That post focused on delivery. This post analyzes the final stage: PHANTOMPULSE, an implant that ships three process-injection techniques, resolves its C2 through Ethereum/Base/Optimism transaction inputs, and bypasses UAC via the public schuac…
Read the original report →Diamond Model
Adversary(4)
Infrastructure(6)
Capability
Victim
Indicators of Compromise
Open the mindmap →12 indicators
| Type | Indicator | Confidence | Score | First Seen |
|---|---|---|---|---|
| SHA256 | 70bbb38b70fd836d66e8166ec27be9aa8535b3876596fc80c45e3de4ce327980 | High | Score 65/100 | First seen |
| Domain | optimism.blockscout.com | High | Score 71/100 | First seen |
| URL | https://panel.fefea22134.net | High | Score 71/100 | First seen |
| SHA256 | 33dacf9f854f636216e5062ca252df8e5bed652efd78b86512f5b868b11ee70f | High | Score 65/100 | First seen |
| Domain | 0x666.info | High | Score 86/100 | First seen |
| Domain | ipif.org | High | Score 58/100 | First seen |
| Domain | thoroughly-publisher-troy-clara.trycloudflare.com | High | Score 58/100 | First seen |
| SHA256 | def66275fa3baffb16e6e4ae0297861d9790ae7161fbc271a2ba05d121f13c70 | Medium | Score 53/100 | First seen |
| Domain | base.blockscout.com | High | Score 71/100 | First seen |
| Domain | eth.blockscout.com | High | Score 71/100 | First seen |
| IP | 195.3.222.251 | High | Score 58/100 | First seen |
| Domain | fea22134.net | High | Score 58/100 | First seen |
IOC Relationship Graph
Building graph…