Indicators are what attackers leave behind. Stolen credentials are what they arrive with.
Excerpt
While monitoring Android threats in June 2026, we discovered a new piece of Android malware. What struck us as unusual was that it installed like an ordinary user app yet made no attempt to disguise itself as legitimate software: it had no user interface at all. This led us to suspect the app might be reaching users’ devices without their knowledge. Further investigation confirmed that hypothesis and allowed us to reconstruct the entire infection chain. Key findings: We…
Read the original report →Diamond Model
Adversary
Infrastructure(6)
Capability
Victim
Indicators of Compromise
Open the mindmap →58 indicators
| Type | Indicator | Confidence | Score | First Seen |
|---|---|---|---|---|
| MD5 | fe71af9ecf174de48d2b2ccc2c15fb04 | Medium | Score 53/100 | First seen |
| URL | https://t2.nmnsny.sbs | High | Score 58/100 | First seen |
| MD5 | 71ab5517f71866279d0d87d37f2ae320 | Medium | Score 53/100 | First seen |
| URL | http://t2.kshahnd.sbs | High | Score 58/100 | First seen |
| URL | http://t2.nmnsny.sbs | High | Score 58/100 | First seen |
| MD5 | c6bfb1643ac7474ed8a7b4f96a187fdb | Medium | Score 53/100 | First seen |
| Domain | ty54fgd435.my | High | Score 58/100 | First seen |
| MD5 | bd4d81cd27125ad3d9a114922d468499 | Medium | Score 53/100 | First seen |
| MD5 | e119845877089d6f4b0a70dc7388f316 | Medium | Score 53/100 | First seen |
| MD5 | 6c2e34b30da42085240ede53ab6107d4 | Medium | Score 53/100 | First seen |
| Domain | ishano456.sbs | High | Score 58/100 | First seen |
| Domain | ty4523.space | High | Score 58/100 | First seen |
| URL | http://144.217.243.201/vr34der34/dex3.68.png | High | Score 58/100 | First seen |
| MD5 | 0fbaa7092204f4b1494e0b840b014774 | Medium | Score 53/100 | First seen |
| IP | 107.151.248.132 | High | Score 58/100 | First seen |
| Domain | kshahnd.sbs | High | Score 64/100 | First seen |
| MD5 | 3ad4bf5a86d26ffbf09cae42af330a98 | Medium | Score 53/100 | First seen |
| MD5 | f0e3f7eba2cde91e2dedb921bab47422 | Medium | Score 53/100 | First seen |
| MD5 | 2a64c3efc11bf224aa54f24e876446c9 | Medium | Score 53/100 | First seen |
| MD5 | bd80bd3c3d0e4bf6b5b4a825650d01f5 | Medium | Score 53/100 | First seen |
| URL | http://ovcloudcontrol.cdn.cardoor.cn/upgrade/2024-11-07/fa831c3c23824b99871163387bcda7ad.apk | High | Score 58/100 | First seen |
| MD5 | 67dc78e544ebce16b85dc7c195dfbc58 | Medium | Score 53/100 | First seen |
| URL | http://144.217.243.201/vr34der34/sh65.io | High | Score 58/100 | First seen |
| MD5 | 412e9243f2981bbea3894254d105b3b8 | Medium | Score 53/100 | First seen |
| Domain | kookjar.com | High | Score 58/100 | First seen |
| MD5 | 44b6b213a6a3f299eaf88e078de95ecb | Medium | Score 53/100 | First seen |
| URL | https://proxyforu.com | High | Score 58/100 | First seen |
| MD5 | 8b5e513144a6138a966ea59e68bf9da2 | Medium | Score 53/100 | First seen |
| MD5 | d63bacd6d6709dd68a10ef9d374c7835 | Medium | Score 53/100 | First seen |
| MD5 | e9f3a0dab6949ce2cddab9e0aa80ae1a | Medium | Score 53/100 | First seen |
| MD5 | ba27951b4ee1c341f4415d033369ecd3 | Medium | Score 53/100 | First seen |
| Domain | cardoor.cn | High | Score 63/100 | First seen |
| Domain | ue886578433.online | High | Score 58/100 | First seen |
| MD5 | de77c3303e93c9450424759f1741441c | Medium | Score 53/100 | First seen |
| URL | http://ovcloudcontrol.cdn.cardoor.cn/upgrade/2025-06-10/fe71af9ecf174de48d2b2ccc2c15fb04.apk | High | Score 58/100 | First seen |
| MD5 | ea24487996eb70c1780922fb3063bcc5 | Medium | Score 53/100 | First seen |
| URL | http://t2.mdsjhd.sbs | High | Score 58/100 | First seen |
| MD5 | 89ef78f716a75964539f2db6520be362 | Medium | Score 53/100 | First seen |
| MD5 | 9642ae619b3165d23c6349002d1abe24 | Medium | Score 53/100 | First seen |
| Domain | mdsjhd.sbs | High | Score 64/100 | First seen |
| MD5 | 1dcf031c40ce456b6a36a00b0acf3d11 | Medium | Score 53/100 | First seen |
| IP | 128.14.210.58 | High | Score 58/100 | First seen |
| Domain | xmsae.sbs | High | Score 58/100 | First seen |
| Domain | nmnsny.sbs | High | Score 58/100 | First seen |
| MD5 | 7a4d3ba2dacccfdda55859a5dfee2671 | Medium | Score 53/100 | First seen |
| MD5 | a4223ce4288a230d1e6c3ff2c7639045 | Medium | Score 53/100 | First seen |
| MD5 | b067d5b0dbecbd6498bcdfba45dba77e | Medium | Score 53/100 | First seen |
| Domain | pxyedge.com | High | Score 58/100 | First seen |
| URL | http://ovcloudcontrol.cdn.cardoor.cn/upgrade/2026-06-08/bd80bd3c3d0e4bf6b5b4a825650d01f5.apk | High | Score 58/100 | First seen |
| URL | http://a2.mdsjhd.sbs | High | Score 58/100 | First seen |
| URL | http://a2.nmnsny.sbs | High | Score 58/100 | First seen |
| URL | https://api.kookjar.com/sayhi?channel=daihai&uuid=get_uuid_10\ | High | Score 58/100 | First seen |
| Domain | xshaon123.sbs | High | Score 58/100 | First seen |
| MD5 | fa831c3c23824b99871163387bcda7ad | Medium | Score 53/100 | First seen |
| MD5 | f8cf8c23ff597700d471fb7767df8bac | Medium | Score 53/100 | First seen |
| URL | http://a2.kshahnd.sbs | High | Score 58/100 | First seen |
| URL | http://admin.uipoxy.com/proxy/u/login | High | Score 58/100 | First seen |
| URL | https://a2.nmnsny.sbs | High | Score 58/100 | First seen |
IOC Relationship Graph
Building graph…