Back

DarkGate again but... Improved?

June 6, 2024, 9:06 a.m.

Tags

obfuscation
pikabot
rat
phishing
autohotkey
darkgate
2024-06-06

External References

https://otx.alienvault.com/

Description

The report details the latest developments surrounding the DarkGate remote access trojan, including its enhanced capabilities in version 6, the activities of its developer RastaFarEye, and an in-depth analysis of the malware's new features, execution chain, and supported commands. It highlights DarkGate's continued evolution, with the addition of novel techniques like AutoHotKey scripting for payload delivery, as well as the removal of certain functionalities, potentially to maintain a stealthier profile. The analysis underscores the persistent threat posed by this malware and its creators.

Date

Published Created Modified
June 6, 2024, 8:16 a.m. June 6, 2024, 8:16 a.m. June 6, 2024, 9:06 a.m.

Indicators

fe2c275b44ea6e35ce429f8724c0a11d0d2ed16e25ea4d34a5b1f03db504d7e3

ef5819087e14135335f0a158903c9389173d0234254c0e5cadad5948e434e23e

f79378bd1d01b75ef28ea7d19d7d80ded7cecfd8f62ef11aefcfcc8ad66dd7af

e9af323bdf200d9a7d9959e43c186421e3453bb53b948bf226da199b912505fc

e34f6758a1b84d68266447f5b06a0915fecf413722d961a5013fd33a1e20aa27

dcce467f4267254a1dfd26642008811970edff2d8e6383fba9ac7b09e3e787a8

db9654e864f86dedbf99f4380a4f7db182c17cd269bbb96bdf63e7ffb977ad37

db860bc4ee3fe65f67fb55985898b66a4187985a6bc2ab95cd6416f2e6d0c2c9

d68de20c720427d99aa6ac253402c66ae9904fb667956c98ab9e36fe34a59635

c96eb2b8f524b2be4e1801445e7f5e542d34cd7033482560712b12d76ea69da9

bf1bdcce4d86d8fce80f359f1a871c1bc70e29b3fcdff1d2ac70570ecf5a1bdc

b88716e41bac465880a7d43edfc39454c0ab3acfeb0d98ffd7e21cd738af50bf

b75ba5c4e74ee9ce20212aa53f750e0c4c1247cefa56fc4e523c5669fa236d6d

b4d9ec5ffbc05bdbdd73a7ece3aead129e0dce0631d97e40f716a909773bf928

ae81a758cb103d6b9c8495930c1478812ee57655b820be2558c1a7d81f4713c8

a4c7584c85cb62c533b09c6efb6e67c71c995eb220364ab947051da20e74db9a

98675a7d2f9bdff8c7116edd327ac5f917f3cf38897d3858e4ad6d8e04ea0a35

96aaf3e91f695059f8db4b5198606dea27710c580d3f609634ee3800a65973eb

963f2e349d9ea1acb780ffb010586eca3e32027c4602ba217a0a250b641a3878

8e7070383517cc127dfff26a726a47fc48a9169591e29c8d16df6fdd6d2c591e

91bda8770f742863f4f99d2e3dbc7ad2b8a0090b21ceaaefb1a4e8ff62b81d69

8736c0ff1b6f34f242a060cc8b1eab6d87ce9d486cc166d6964d3c5260c7f157

7ee7068f76dba64a08a7ff190a00b658acded15498de22c47cf3027096432ca1

7d04dbf0573dd2d06271b2c8df6a6d3c77aec79533422a7fe225ec2c6c977a7c

6cca9ca3044fc3ab9bb019cee5027925f54832ecfbca88e55acfe59bb5ef6a4a

6b2308012c1044bb48c8a395102ebae0524e2141237960a51651c8d9a45ecd58

5bb19a2d7dd69e280046de0f65475498678daf6a542701c027a693e39ec1890a

5aac7d31149048763e688878c3910ae4881826db80e078754f5d08f2c1f39572

544fcccd2dbefc1d8c25a469a28b525d0426d731af521a1a9288363ca7fb3581

51ab25a9a403547ec6ac5c095d904d6bc91856557049b5739457367d17e831a7

4e36289f11631a3ba04478f9e71e407af9849a47ebdf351ab868a39daca54990

4bb4266c330c9b9c301c9a2db03039547aa3004b1cd479187fbec96eb6e3f2c5

4b813d2300e46d6585df454d91bef51fbbeaeb73655c0eb9bfaa855a182cc08b

4a7f3d3493544b18437d93c33bc0a58368559bf3d6a280ea37701ed26a9eca4c

4546eef24da790a7abac1f35c78672b7c184cdd4714f08f6e3726279a80cbf50

44aba9e5f6f7291a74b53252dc11e61c5c7c4a698a9e4238066af585f4bec8e2

42e95f257811a48d632afd51008d7e20dc23eed7b0d7166cb5ec494a1e992093

4212d0d16306f8f53daff429801ceb4f633caa8a46d8c4b7b3c42377d1bf6ef9

413ca585a9217847287dd01d836d7c3a866729016bc9cb2eb6296d28bac5b937

3b7a634458e8195a13a4c1610bb25d78a77f2b904b38835fca391d38509dd530

38701a87cd1a8e714ffd4beefb374319a670cb68da2de9c19dc787a583cd5952

32685cdcf4f754ac2f2119df77c97da07169c9c7458ca5906f89bd06d5497684

2a4e4a3d760a36125da04280a3ae71e4f32a22b11d4b153f306fc0faed615f89

27a70544c6b295068ee30b155c93d61d44e2a351438c4c674a7b0d8d619a7d13

2463dc75e435c7f0f0b13c55aa7870d1c2ab56378d334261a9a913685bacdd53

11667b53618af41795c53fec397e9a76799b1ca0d3c3dc1f7ea2da9feb1394c9

08037bf46f2e4d7654b2f4d9073ed9eababb35b538927dcae5ed665ad7b4e1c6

029aeb0be8e690137fa8ef0d58823c28e6701499f9b6d2b2b2d8d2f863fb18c7

077ac6ffb10ab90307decfd2aaaa6d2672e2baa02e6e727765dc2ce3fcd7f095

007ebd9e42b39862ceff9869cfa34f46078def85805216c458601f5d22b3db0e

fa69faa4b720e67ed8e26f69e28f8ca0ce6b9a233498de638634464f995ed65d

f9d8b85fac10f088ebbccb7fe49274a263ca120486bceab6e6009ea072cb99c0

e6d47ab1a86fe3d288eecb77adac5ec7f7583376d49a2739c9533e8d307737b6

d82a6f31795134df8692bd44ae0c815538e1aac596ce8a8a861a54d4596ca410

d3fa095047743062be22a9ba5126d7bdc03d138f40bfce9874565d306c3fbf1d

cfe3c65c1e55ca444ef4f327d3e7c9f01f74040a3e4676b9a5fce76bc7d880ae

cdae6e8f3ae6d1265f0d18a5f3018d3cf23fce615a2a8705d6402b5a2c32193d

cb65d95a1496fd2e5105954eb3046df90c4262f19fa7d7d77fa59b488348b040

c764580ae6b520b5f24a81d7bfe951234a960c02ce4334af7abd3adc55fa8d41

ba8f84fdc1678e133ad265e357e99dba7031872371d444e84d6a47a022914de9

ba319d3d64ae7a39cfeb10b7f6b05ed33cddca85574d1176d34ec25d92cf668f

b3a8c88bdd9701a5ca532e0b433944e0992a3ae90e0bb974b2d091b2a01efb94

ad806df85dfb29cca1f3a2c99ed069c30cd870bae9d47f2de4c7ce727b9622ec

8de7c3ebf246e29aecaebc0bd38485d0618ae9ecf2bd45e0f412a73174bebf11

885eae8e4d2788a7c54f4123cbf84b4e897082f8388a7b3f3c2bace9f9419e13

858ecdbbcecf65c0228344230fe84efb4632cc1319d9db96bd7ebd36b0350e7b

85447a5118f3d8d48849fde8ef015d37f2058b4eebd5f99e7bb30f983b85db3a

80d25ab90da71883a38d97aca420cbe62c9089dc15f7ad790146fd4907274d68

7db0d0e3bbcf1a7f4a92d54cfcdb3337d94e4978145a1c107ea5446b8c50cd48

7af70045047e846f51a2dac1f3bed91af030de85dbd1f49e2762659cb778aa28

6ab5bcbb9179263e589e5adc18d3be59634320e15aa343caf5b9d343972a4026

5cb9876681f78d3ee8a01a5aaa5d38b05ec81edc48b09e3865b75c49a2187831

4f1c1e3fcb3b287ba7d264104e2c9ae4ea3c60ccc349c288ff14bd90646c0fa6

4d86f191c4d7a5684116b671618669ec2bdd6bc08337fa2573c773386a14b2df

44ebb9846c88e7f3beb2af2d8bd656990a1d2bf1c7122a54e949d7b50945e284

2d960acdda45cd77a0590c6f652d8496eba30e1b2b263f6a083ac5b27512d1c6

2bca640f42de96053992a55b32d457558785b5ab5684581422dc1837604c4689

23ddc266b1eb5fa6e55c45ee108d03698727e81bd45c7d4d1b40176ad5fdbff0

17c96c211562bf0f385a768af87a34a5caaefb7d4bd8ee487d97d8063095a17d

06f480d4714c9880515e4cbe4b868814bbbffe14eff2bbf7b52c7ecfb1f8f637

02acf78048776cd52064a0adf3f7a061afb7418b3da21b793960de8a258faf29

f4b5449f3e45b7ce03424cc2a800558abf2a505e38f951f41c5ede8a3ccf7284

f318cbf24bbe9e6b8f26b526bf39944361e8a29a7345673ab823daa00792a84b

f16d65b5f2cb38afa691ffd326826ec66668d979b1999018038b66326c0c5f23

d0648893bdd8b2b34b5a99fcc3f7a7d90bc77f7a8d4b8607290ed704ff6aed00

c788865f66a500b7555f78979d2874f066de21384d0fef3707785a450cd8df0e

c4b9c35b213e4ed26f3ae8812cb5c008166e1f859ff8c37f4b298ce088296f13

ae80d4382cad0ef072a1d1e98e66d49f6533c0bbd7e3054b8d482a18671daedc

ab1bf4dab902f49086f2c07119b05812d14f8e408ad01f4404ae995953b6752b

a40c2724d8922ab78d6601471d0a8bfb58ad52f10858bf5c3ed13e077c919488

9bdc1f228a0f3955e6828a4708d9d2612bb9a188127058a37608487a49c164d5

93c6dc5e923a203732b203d7ec8ce15046a55e49cd5494f83266f671833ae0f2

91e1723541517ae89803e564303bcf51048abf34737c2b2770bc909ed519db46

86ce566c81efad63927de3914cf63874aca194be959d40e5d29f2b89eefd47ab

8bff2049d56e9459bec1527838daf3561d654b8366aa0528e1c52dd8b1410d5b

7d6f93f3845ab7536c7541d47bf5d538a5e0cad08e1e95e8585731bb47d917be

7d5f587ebfa0828b64202869091a9cf5d1448631d2c06c28992b97309eacb383

6223cb890127021658ea49888ad1874814142dafaf74b0dcd581be3b1bba0c5c

5c92079b76984bab664ca892a485b564a550de3c619e44a108517f5dc7e91ebb

5977e8bd75021898159118fc1ebe905bd65af1cda561d6605ffc49aff037ee7f

586d067f33a2e8e5509cf1f65684fbe6a06bc196c2cb37c44a0b342b543f6394

388793825a1a4d42dd7edae87643845d7bc8433c2d2762e7bc51ef99b3449128

326198136323d5503c6f753a8dba16927f4405f3810cfc82286599ee394c5ded

2a8f94a33996fba229e4de6529cb14e0ac7edd16a1d26fba86f6652b054c1330

1f5e776534728d21d31ad17e78933e3516ad24dea854205a06c09cc7f4c91d2b

0ef8cf6c4f4d35772a70f389489a8cbdf7fd549f0f8efce16272d52a38571a78

0c18f065a8920d00b1e4fa02aa4166f7358c6dabe757d7ba414a6d3812092da1

089855a16a7303bcbe16123e2d9746a07021b432cd60f205916644b39b226e7d

006dc774f042accd6774bbf3c4bd3ac39e2606983fe4b3b512810f1a681d1564

fdd0cbc5d23170b1d91f1ac88912e48c8cd7e96a30e69223ec855d9028b25a5d

fa8a449ba83a3c48ecbc300ac081154b2b2d6d3a1a4be1c84653b1a8125ba909

f4b555d38b11ddad0f4b8e51c9c32060b99779778f1348fe5f0522761c446229

f34dd22b21c27d16ef7a8146aa95ee1d2f2f18396008a1bae5f6697fbf1bbcf0

ed9977ffffc2392f3d7b7698c7125e6e36fb012e90cf88056424b0152a163d55

ef5f4af60aca1a04a1abf89b3f51071836b886bd92a2f9220a7d2e5b2f68dfe5

ec16d5e20a092338ca9d42abccccb8214794ffda8233e64706d304978f67b21d

e61d43689314dbb2891dbebc0df90a91b5db3fb7d7786f462c671bad69d47d9e

e7ea31d9243af884f5c306f5767e92a07f1b65623d00a4afc217b95f9805b54d

e4c56cda9d9f413e6657f12a8e4d6352d8a2f6dc068f70d7f07a36e6340baf50

df18f12023c41ab67a41ef6ec4ad5759f5a553993ae955567879f8d1d505aa47

e30f47e03ffff5b95a547c64bbff623f03529d6f9d8057ed3c1ec0fb4702f753

dddd042d01a8d1b44428a80595c34b19a1d5d8443acf0f32f013cfaf8f2e59be

d90015b0df676bd536f127dbaece39c3d78fce56a27eb299e71efb4c29a57a5f

db3e072c94ae7ac4b84a7847debcfb753492dcf7636de99935f4a9c2dfa90d19

d8da5eeb13dfa1c2220041ac0ad6ac766c511e8bc2f16d70097369f5929acaa6

d69ba2c6b96994272d19709ca2bd6c33daa47fbd4e0028ac11d5ce50a8e91152

d892e0ea64b99e062d75c5a3536c6b6dc2a14de60f4128b27db3be524e9ba203

cfb148ddc9c486b7277cc2977181f61fd4d54f0780cd6bc2925531814f09b93a

cf9a39888e66bcbc829a2ec7c1ed5021ebbcfbd9047ab23816ef03eb4a25656d

ce97f971b2e4080b3c48af5a7e74e5f81a4a834fa5dca51ba7ef0d472302a166

cf41da5276e6fa4f91c378e73f676979bfeaad43ddea7448598a1cd008ecd3a2

cbc82126ede0df00b626a3bcdd690bd2b29def99ddcbcda749d71d8eecebf89c

c8098310e487160246de8229dc613c9819178a226c9099c2cdb004380257dba7

c67a3f5346101119a6a423e3d2636dd8cfb283ca6bee9c85880953e43eb02768

c39376e09f5919698786adf4a6aef7f0ba8c66e4463aaf80ed0c66ddf26b0348

bcffdf1a8f221d63d6f1b85d76831bbd0bafaf3ed39bf145410e661b75667b29

b8f83dcda1bf8cc1903ba347904776f542e36ba2c368b0bef44c00378e1e1a9a

b6495cb3c58bf657aa9d190e71609b752f85e641d6fae0579371ebae8e761e47

afeb576af7fb58f9099d30637b423e4896005543f583777e72ef62840468014b

b276c006bb91584a0b20e06af19c2b0f017980b911295195af2f395408cbc5da

ac450ba64d70edc472b86049f600a199d3e93503a40cda52fde13cf3a66b9c08

a7dace4355c6b1979bce2d8fd5e749383a3d640c8010f11a9315d1e2f0c9e70c

abc7135cc0628d3ff5ba6b4c5572d62929a7abf766835386d906337be6b358a7

a6d3a619a5f4c4dd814ebd7ec80b287d2b4b086e613d2c69d0848b9fca10b40d

a50743612049dce51c76ddf11c083ff1b488b07a0a2a499abb2226698b247536

a28a096033b6ebccbc66fa9d9fedde435ccd609c12af70b076188097ff5ff03b

a0669ce7830b3c247d0a91dcbc91b3130d6e254eeaa1194b23c1c6989133691e

9fbeae2c48d8c1be906f5f2a617042c99e6a4bccfb8551449df2a61b257895a6

9d942944db82a6fbbec1836ca0ee5b8b905a5ae1dcd401a0c2257cd63cba5d91

9a0c32c837a79ad5a40811f441f57b3274739508cbbf0c76e0d327b1d9aec44b

97640d79ff7ed1a68e5da12e4378313b6c2a51257c4deb3a7f1535ac3e485c2b

9882c613d9b589ba8e1ef7fc1da0af593efae678e9157ab852aeb137a8d6cef3

948d7fbcbd463c95fc5aa552b6c001f7b91f723ea56343f578631101ea0b9d59

942784174e66a7f9d1eb011111542bf32ff2b025e985b83204766ab12984a22f

93af01726fada9117d51c4160ab28f7c348b9bb16e342754a1711752632c5362

91a82f618644537fb0b05ccf2cc598582452ce6a36476f3f1d32c91259e2e21e

8f47e5fc77ca33cfa13db272a064fb2fcc6cd7fe1dd7e35f6dcf82a1f882ecf6

89dd215a0f110d1174cd8c3cf678245906a5053de489ca761d657fff29c51d76

823fc28709f26e12775c65838957ecc599115cdc66887b20dc66eba6440da134

7fcdcef06c5d17d167bcb89e0ebb1feec3cf2a3a9ca39658366f94497b6947c5

78f56c04bc68183bb5ae2603a7ec70ae9bff0d2b16507728a0a1bc4fcd6c0b49

77b18778c6708fa36be4d1cbcbe560e0824edfd09277c721d4d76b080bbb976d

762661c846fe1ab8ffb4908baee2d838733662e6959a7eba339084103095e8b2

74c9257f3316b165c65e0e8a7214eda02e02144830f87e5994fde81f16d8f720

6f8dd5f4adc9916000ab2fc0d3b2524f4518256772f8dd2edb29c393c67396dc

6c3da6374b5729b24bc079a53a7c4f258ceec67d0037f91017cd204fcd45c381

6a20b1568c0edaede64a58f2843b68a6a098cc99bd4554c7bfc339bfb4d67338

66d432a5bc700e1ffc1e7056a3ec7264f4b37ce688eb5a06f29a5248fef5ae38

6635a8648bc880c613bb1482511bffac632fada06113ec46d016b45645327201

643e8398794afb913238a64e81fc157af36aafe2f2bcdcdf34919deea6fc7a77

61dc8928be6a6ab6e3cea1f99bf6effad97d2f72bc65d520b924f9e0f630b179

60433da1d3689f2d8847cbd86de4befff3029d0f4664f58661927dbc05085313

60187ead950ef56564d6f8ed3014572cf8061f4b3b08b020dc5fbf56bd9a8a86

5f311ecc58373712fbdf045259957e9ea67c863155f44ef9e9511a727f416f54

5b7952398a0b75ef5e1af34eed7766098da0f075460b9a280b55aa8357b494d6

5a7c4b8d40cd4d7c06f11d4226edd65b734f4a24a1158c5926add4993863f09e

5a3ee8c22fb87fc8a3a248539a51a0464e57aff1271bf38d3530780daf6c92d9

5049183707e657ffc58df22659b79b76a744b40f4f5b24ab09df2e1fa5c47282

567bf9b0d0dbd5fda1f1cc5f34d39af2cb7e560fed5701fca29418ff1d87bdf7

577a79732d04ae568fcea167f3db28b5552f5757cbf9d78f3b866ab348d46845

4e06094bf9dd9ba392302e9393e26266f4bd3bc23d72710664b5e54024af1a15

4d8cec88bc99258f7962aba1d56d49d78cadc2e1ef44708b3866bd21e8e08cee

4cebc487397e68570ba5120e5b0c69cfa12dd17430a419876af359c61e88096b

4c5890dd34e4eac1d62349e13131a8401426ae3328cfeab5c338aab9fa93d932

47808e2b8007310f571bef96b472e5babb1f520bdd68a455f0c428eae1663392

4bac66de2f56d2f11b33b44d311044fc67ce56a544174669add0a5e29059811d

4758bc47eab0d5e3f8e6e0cbcbd49f6df0cd48cf285d0139420888d8fb8d2d28

45f0d0dc93959adfcbcd6dae9bad9a2a9dbe1e2e34bc856fa6ea7181c36ead27

4721df75d7bb85128d6968110264e5e5054f68d30703421bb0e120424c838157

4154044854e5bac64e8c42b81fb995cc8860d606d78023a0b7f642814956e9c2

40c35a3d9ef2c7e8f6f72e5c69e53f0963ef71c313e9c92e322da6e784d08905

4044f3890bf60cfbe1c9ab9a83857b6a8d3fca8488c94b5fc5f532150412d194

37495657e48ae76d80ce02971b8ffedfdf881b3b9edb5d6228c7f70e42cf0835

32b6ee18c9d889d9571b5f3d2236965fa7233013764115a1e92db76722a96d07

35842086cc1d3bd91d79e1ac455c22894250bdbd09211deed371fc43aed75606

2ffe86baccf9435c2a249e4d28b99db576432ae19afb409549cbb0cc44dd7ee9

2f57f9e9b4e39e10c18a3df920660f6d13ff2b4dfb33e6d623e7aa08dc61252a

2bcadefda7b9c2d506d74a25b32b35af3c3e8b4ac4d15a2d660747198d4b66fe

2bc46a200ef90a0493e6622989d53f4175e425d73dae6b65433bec413cd46fc4

2a6193b357b37b536bd93bf74b2f5b60f9d11e66ddab706b8d49170e092881ac

29345c7a146a0b47e0b03973f6ef6ae3bd0f6b14e89fe46fe43095c75ebd06f8

28902fda055fa215c6311a0cd418ce91ee066fa28edb993f0ac56d58fd0caf20

26c346d4853004bc2be4bb1d6706e5735f831b5bcf920b3e898c9b4c62e37b59

26b1991ab20be8cf7295d7ff0a42da315fd70f5b9c3e4cf5dec18c322eb3a847

26331009bc243499e6bb3937c50fb6c7701c387f9b86d589a118a9d5f9069ea1

25aa9b0126e87ead5d4472baec8cac81c29a3bd802ecced73dde59b47a78a8cb

21b0ff8dc6350b233e1fc2b14a971e466f5ecc7bf49e9b1cdbcda8a6559224e2

1f8fa564886b200ade56b49bce6d6511336718f791c71af5986b6318d21339b3

1cbe5e84beac9d801fb572c78590b32f0006d78992784728e7ccfe606a783d37

1b463e311a3855f5633c58b6f01f4d4daf696f3f6496e00214073a5626ef9ce8

189957f4a63fa039f291825b7f3fd62f6123b7e9d75dca78a69c75a5fda21552

187013275446ce6fdb036cb6a7610efffcde2fcc1bcc4ce9977bf20014426faf

186efcf47d140b869ec75d0d4f3c90ddf4d95c6378cb0195c2be293ccb646899

1213b1b9d54d5ba6955b91f5c6f43b5edc3b5ebc60d32dd0d994c7293d184f07

104caf01df79093c83ef0c10f4484e225310215484e6235d5a7219235efef180

0a8890f3ecef65ffa6ccedd76b4db79d1326f890b37dec55689407ed8a49718b

07a873959cb25c2a8ad3b9243fa37d0cad311db1e2050377ad4910c74495441e

03c78630bef9b2c6580150876e4b15a3441f0a13de7195467eefb39dd6dd41be

0304812dffc8fb006f98767e145034ef06676200f90eb19b62bc328f21a75afd

00c5f838e33930c4944a8c877adee0eb0749d5e68a673537de4ac0d05acbe52c

d74df69b8fa6675dfe1dd5b5488cd76d870013dbe256b44d77486771f9d35c57

9f3f3c6c174a9e27476634a945279026139152063067903546171a3e5e41adf6

9c9e93fae0cb9bd2075b01f48b6720749747502b73e5f97d5ec00c1ea6c82c4a

29b2724635fac3d158901d883eb67ecf881ee4b68305ae40e325c0ba686cedd8

232ceea592951167725cf41a139e2f61e8865efe156e3ba89f92c7d1258bf0ba

12018c2af0600fc1f1a75842a1d4f7777001fadb65f93125e479ec9b949e1773

dd7a8b55e4b7dc032ea6d6aed6153bec9b5b68b45369e877bb66ba21acc81455

6ed1b68de55791a6534ea96e721ff6a5662f2aefff471929d23638f854a80031

2e34908f60502ead6ad08af1554c305b88741d09e36b2c24d85fd9bac4a11d2f

1a960526c132a5293e1e02b49f43df1383bf37a0bbadd7ba7c106375c418dad4

038db3b838d0cd437fa530c001c9913a1320d1d7ac0fd3b35d974a806735c907

94.158.245.124

86.104.72.124

45.63.52.184

45.61.156.3

45.140.146.2

193.142.146.203

145.239.202.110

149.56.252.31

5.252.177.213

45.89.53.187

170.130.55.130

103.124.106.237

http://rourtmanjsdadhfakja.com/lhikchzj

http://rourtmanjsdadhfakja.com/kclddtnk

http://porsherses.com/miipnznj

http://nextroundst.com/kqcmvqtj

http://irreceiver.com/wbipazkrpk

http://irreceiver.com/vceadwkonp

http://irreceiver.com/ngvoyjqalr

http://irreceiver.com/giajwris

http://irreceiver.com/fcpivgkx

http://irreceiver.com/endbcibm

http://irreceiver.com/dxuudgzy

http://irreceiver.com/bbiafaxa

http://irreceiver.com/argigbtt

http://goingupdate.com/vzejpwemdt

http://goingupdate.com/rmgfzmtm

http://goingupdate.com/mthmvbhw

http://goingupdate.com/lrrqhysx

http://goingupdate.com/ldehoxalfr

http://goingupdate.com/eolimcsx

http://diveupdown.com/uyvbjbho

http://buassinnndm.net/czeeyrlr

http://badbutperfect.com/nrwncpwo

http://backupitfirst.com/wgfqneerod

http://backupitfirst.com/tvrewtdm

http://backupitfirst.com/rudxfiyb

http://backupitfirst.com/mhrcbdpm

http://adfhjadfbjadbfjkhad44jka.com/dekcbnwq

http://45.61.156.3/cmd.txt

http://31yc.com/jjwusvmw

http://31yc.com/gcwkaqrq

http://193.142.146.203/utjudloz

http://149.56.252.31:8094/mgmmrccw

http://103.124.106.237/rjlcmdey

http://103.124.106.237/giibkqxo

http://103.124.106.237/gsgqmjivmr

http://rourtmanjsdadhfakja.com/bjnxidjt

http://withupdate.com/zuyagaoq

http://nextroundst.com/qzaugqmb

http://goingupdate.com/ptoleqco

http://irreceiver.com/abtjvwag

http://adsfasdf.com/jklfnfol

http://45.63.52.184:8094/ydbytvzb

http://45.63.52.184:8094/nsonlrfy

http://45.63.52.184:8094/jifxcefs

http://45.63.52.184:8094

http://45.140.146.2:443/ivpzhehw

http://45.140.146.2:443

http://31yc.com/sjcgwjvm

http://149.56.252.31:8094/vnezipnf

http://149.56.252.31:8094

http://145.239.202.110:8094/cldhxbsy

http://145.239.202.110:8094

http://103.124.106.237/wctaehcw

http://backupitfirst.com/wtabzuuxye

http://backupitfirst.com/ltndniiq

http://backupitfirst.com/hcmjchqj

Attack Patterns

PikaBot

DarkGate

RastaFarEye

T1134.004

T1217

T1543.003

T1528

T1055.012

T1010

T1119

T1560.001

T1573.001

T1539

T1574.002

T1059.005

T1555.003

T1027.002

T1055.002

T1497.001

T1059.003

T1059.001

T1115

T1547.001

T1056.001

T1555

T1113

T1123

T1132.002

T1071.001

T1518.001

T1204.002

T1005

T1529

T1489

T1057

T1566.001

T1083

T1055

T1219

T1041