Indicators are what attackers leave behind. Stolen credentials are what they arrive with.
14 IOCs
UAC-0184: From HTA to a Signed Network Stack
Threat Actors
Excerpt
by Robin Dost EDIT: The next article in my UAC series is out: https://blog.synapticsystems.de/uac-0247-malware-targeting-fpv-operators/ Actor : UAC-0184 / MB-0007 ( Malwarebox ID IIM Chain : https://feed.iim.malwarebox.eu/chain/uac-0184-pseudo-png-passmark-2026-05 In the last articles, I spent quite some time looking at actors that primarily target Ukraine. Gamaredon and APT28 are the obvious names people know. But there are other clusters that are less well documented and…
Read the original report →Diamond Model
Adversary(2)
Infrastructure(5)
Capability
Victim
Indicators of Compromise
Open the mindmap →14 indicators
| Type | Indicator | Confidence | Score | First Seen |
|---|---|---|---|---|
| URL | http://169.40.135.35/dctrprraclus.zip | High | Score 58/100 | First seen |
| SHA256 | f5ca9c53d1537142889d7172c6643e886b2164233b91f0fc2d41ca010f035372 | Medium | Score 53/100 | First seen |
| URL | http://169.40.135.35/dctrpr/*.hta | High | Score 58/100 | First seen |
| SHA256 | b811f28b844eff8c1f4f931639bed5bcc41113364fdfc44d7703259457839edb | Medium | Score 53/100 | First seen |
| URL | http://169.40.135.35/dctrpr/agentdiesel.hta | High | Score 58/100 | First seen |
| SHA256 | 81d93004a02a455af01b0f709e34d5134108ec350f9391dc0f91a00a54998590 | Medium | Score 53/100 | First seen |
| SHA256 | df6942dc1a89226359adf1aac597c3b270f4a408214b4f7c2083f9524605e0f7 | Medium | Score 53/100 | First seen |
| URL | http://169.40.135.35/dctrpr/slippersuppity.hta | High | Score 58/100 | First seen |
| URL | http://169.40.135.35/dctrpr/basketpast.hta | High | Score 58/100 | First seen |
| SHA256 | 30a5f342c3f9bff21d18b874d51c289a5414837731118e6765dad225c55d5996 | Medium | Score 53/100 | First seen |
| SHA256 | dc6cddc391b373b18f105f49a80ff83d53b430d8dea35c1f1576832fa9fbd2b3 | Medium | Score 53/100 | First seen |
| SHA256 | 651b07f731b23e8608eecf87e45194f903c2ccb3fd8b55ea8a6e0ca984ff8518 | Medium | Score 53/100 | First seen |
| SHA256 | d735004496f54a943647a50f42ecdd094cd3d0f58a4ee5d2e36d10c5493337b7 | Medium | Score 53/100 | First seen |
| SHA256 | 33e44dea247eaa8b0fc8ed1f8ed575905f6ce0b7119337ddd29863bbb03288b3 | Medium | Score 53/100 | First seen |
IOC Relationship Graph
Building graph…