Indicators are what attackers leave behind. Stolen credentials are what they arrive with.
Malware Families
Excerpt
XorBee RAT | Malware Analysis Malware Analysis XorBee RAT Apr 13, 2026 Randy McEoin Summary KongTuke infects legitimate websites and uses the ClickFix technique to convince victims to run malware. Since early 2024 it has delivered several different sorts of malware to victim’s devices. As of at least October 2025, if it is Windows and domain joined, it may potentially download and run what I am calling “XorBee RAT”. XorBee RAT is a reverse shell written in Python. It allows…
Read the original report →Diamond Model
Adversary
Infrastructure(6)
Capability(3)
Victim
Indicators of Compromise
Open the mindmap →21 indicators
| Type | Indicator | Confidence | Score | First Seen |
|---|---|---|---|---|
| URL | http://144.31.221.84:5555/test888 | High | Score 58/100 | First seen |
| SHA256 | 36b6c054e1067be0a2f397f7cfabf0bd45011f60f0fa2d5ece429b4e53037464 | Medium | Score 53/100 | First seen |
| URL | https://pcdcinc.com/6n7n.js | High | Score 58/100 | First seen |
| SHA256 | 5b9c0f85ab4b557ad1b541a0a31536606ae409e488336e1ef4820dd68cc45c06 | Medium | Score 53/100 | First seen |
| SHA256 | 0bc2eb43884c1cba1c99065970a3ef7c6368526f859424bd6aadd3fa25c06235 | Medium | Score 53/100 | First seen |
| SHA256 | 896c33f29f4b8e9231c07b628be85b5391d7c25a35d30d94370de9cd3ea564ff | Medium | Score 53/100 | First seen |
| URL | http://144.31.221.84:5555/nothing000 | High | Score 58/100 | First seen |
| URL | https://www.updater-worelos.com/lsdkfhnwoiu.pdf | High | Score 58/100 | First seen |
| URL | https://defs.updater-worelos.com/0oIWAdtB2AUftpdExh1C | High | Score 58/100 | First seen |
| URL | https://plein-soleil.top/final10 | High | Score 58/100 | First seen |
| URL | https://plein-soleil.top/o | High | Score 58/100 | First seen |
| IP | 195.66.27.92 | High | Score 58/100 | First seen |
| URL | https://pcdcinc.com/js.php | High | Score 58/100 | First seen |
| URL | https://oeannon.com/t2 | High | Score 58/100 | First seen |
| Domain | windlrr.com | High | Score 58/100 | First seen |
| URL | http://144.31.221.84:5555/code777 | High | Score 58/100 | First seen |
| IP | 144.31.221.137 | High | Score 58/100 | First seen |
| SHA256 | 7bfd9d58ae585fd28ab730b1e362f9d12612b62894869466cb6ef199321db676 | Medium | Score 53/100 | First seen |
| URL | http://144.31.221.84:5555/notify | High | Score 58/100 | First seen |
| URL | https://plein-soleil.top/m | High | Score 58/100 | First seen |
| IP | 144.31.221.84 | High | Score 58/100 | First seen |
IOC Relationship Graph
Building graph…