Skip to content

Latest commit

 

History

History

get_cert campaign

Folders and files

NameName
Last commit message
Last commit date

parent directory

..
 
 

getcert.net — Indicators of compromise

Samples

SHA-1 Name/Detection name

33ccea79ddcf7d22fbc1ddd9945f353eb4981ca9

Trojan.MulDrop20.28843

c0895d0123a92f56db2940df44042e102b77e47d

VBS.DownLoader.2822

6d8716cddc3ca6c8558eb4f842d81638f00f01f8

PowerShell.DownLoader.1640 (ubr.txt)

9cd084897729ef3ade0c0b02da1414f89b24c9aa

Trojan.Inject4.47390 (ZX-uninstaller2.exe)

8e8dac022a03310da15d4c2ecd57a19c7f077ed3

Trojan.Hosts.50579 (ZX-uninstaller.exe)

7fae2f61eb513411a536544d87ce9559a351af90

Trojan.Hosts.50366 (ZE-uninstaller.exe)

5dc6c820290bfdb094f0c6e46ae33a9b46f41583

Trojan.Hosts.50962 (ZoomX.exe)

6d371a964488b7b505514a1f266b56982b38442e

Trojan.Inject4.17628 (ZoomE.exe)

4ff6a0b7ec138e855f13d0f52bb77014bd406d70

Trojan.Inject4.47388 (S32-uninstaller.exe)

c16fdeef67fd747eb82db6cc9a4a68fda2cd4dec

Trojan.Siggen19.13452 (S64-uninstaller.exe)

5dc6c820290bfdb094f0c6e46ae33a9b46f41583

Trojan.Hosts.50962 (Services32.exe)

d387755c90b43047ff649949e52fe7204b721009

Trojan.Inject4.17628 (Services64.exe)

d355dff37ed85f6d0d84eb9f42dd1fe7c02537bb

Trojan.Inject4.47388 (mc-uninstaller.exe)

2e8dd0a66cc86f307a3782d6b7f98e48d1eb36b9

Trojan.Siggen19.13452 (ec-uninstaller.exe)

5dc6c820290bfdb094f0c6e46ae33a9b46f41583

Trojan.Hosts.50962 (mclient.exe)

a9e15b26115ff8e999d9e313ec4b7e0b6d37939e

Trojan.Inject4.17628 (eclient.exe)

74487ebea9aa3d83dd68204bafd2027264c1b15b

Trojan.Siggen19.13452 (updater-uninstaller.exe)

2f7d0fb9c9b622953746ac0ceaac0e8331230483

Trojan.Siggen19.13458 (updatere-uninstaller.exe)

b8b0c2732ed6366c3ce8f0efa891f229d29244b0

Trojan.Hosts.51154 (updaterx-uninstaller.exe)

e40d372c7f9637ed83a3961035e8910c3731fc7d

Trojan.Inject4.47390 (updaterx-uninstaller2.exe)

5dc6c820290bfdb094f0c6e46ae33a9b46f41583

Trojan.Hosts.50962 (updaterx.exe)

5dc6c820290bfdb094f0c6e46ae33a9b46f41583

Trojan.Hosts.50962 (updaterx.exe)

99111907b50911f9b2853cd73b373d231ab92f79

Trojan.Hosts.51840 (un.exe)

385a72bede84c9c44b84b2f044ca77e440be0802

Trojan.Hosts.51839 (u.exe)

0f05fbb257fc71ba649175b92fcd963ff23a2540

Trojan.Siggen23.24088 (m.exe)

636c8a9736ef2c6ee894a5d32e76fc4d74600794

Trojan.Starter.8323 (Web.exe)

b72aad9ae8022bc932a6989544edc76936afe498

Trojan.Starter.8324 (Ps.exe)

283b170573316d0e693a9e66006b1634a3f6d021

Trojan.PackedNET.3150 (Myapps.exe)

146ba5563eff1627f9fcc45e26b95d89b0f64c8c

PowerShell.DownLoader.2151 (cgtalent.txt)

1d46a948eabbaa85fede43fd50a49ad820e96833

PowerShell.Starter.98 (Metamorph.txt)

8d791539be6a22eec6ab612e427a3c9bbe7e1daa

assignmentbmp.zip

4b583d399d16bf174938daaefbcce7b8a15e0413

PowerShell.DownLoader.2153

90e473b93ce0ff3ee2e9fb13a138843a8dda40a3

images.zip

a7b09c73aa9ddd6a6a535eed2a2598697ad8a5be

PowerShell.Siggen.2099 (Cleaner.txt)

87a2b37aa36ff0ce60e0f5d13e4b27b61e596353

PowerShell.Siggen.2099 (Cleaner.txt)

60c5cc8e93ddf35d006a36b0be8e3b68c1ee809b

PowerShell.DownLoader.2154 (m.txt)

3208c2d40e9feeebf2669985d63d79005cf8fce7

Trojan.InjectNET.14

0f05fbb257fc71ba649175b92fcd963ff23a2540

Trojan.Siggen23.24088

7764945007b03d746b0b0108144a15eb9112a2f8

Trojan.Inject4.30867

a92da5e57a8e50ec1b4e8d3b029f5b2150bc3f27

Trojan.PackedNET.3149

aaef9da0c976797717a93c6b48b9cc672d6f06bb

Trojan.PackedNET.2191

f5329857be92d3b70e85481026963991bd9c1feb

Trojan.InjectNET.14

8de8e5474c5d0f638ce56e0db758b8bec675f762

PowerShell.Starter.107 (Async.ps1)

f7d890de0931d733d6d0a37c36bb00f0f1cc0b91

Trojan.PackedNET.2429 (Aevnocvfiq.exe)

df660ed3a9ebae8a727529984562d98872452167

Trojan.Starter.8322 (AdminSetup.exe)

c0a29d4e74d39308a50f4fd21d0cca1f98cb02c1

Trojan.PWS.Amadey.18

Network indicators

URLs

hxxps://asobimo[.]link/ubr.txt
hxxps://asobimo[.]link/ZX-uninstaller2.rdp
hxxps://asobimo[.]link/ZX-uninstaller.rdp
hxxps://asobimo[.]link/ZE-uninstaller.rdp
hxxps://asobimo[.]link/ZX.rdp
hxxps://asobimo[.]link/ZE.rdp
hxxps://asobimo[.]link/S32-uninstaller.rdp
hxxps://asobimo[.]link/S64-uninstaller.rdp
hxxps://asobimo[.]link/S32.rdp
hxxps://asobimo[.]link/S64.rdp
hxxps://asobimo[.]link/mc-uninstaller.rdp
hxxps://asobimo[.]link/ec-uninstaller.rdp
hxxps://asobimo[.]link/mc.rdp
hxxps://asobimo[.]link/ec.rdp
hxxps://asobimo[.]link/updater-uninstaller.rdp
hxxps://asobimo[.]link/updatere-uninstaller.rdp
hxxps://asobimo[.]link/updaterx-uninstaller.rdp
hxxps://asobimo[.]link/updaterx-uninstaller2.rdp
hxxps://asobimo[.]link/updater.rdp
hxxps://asobimo[.]link/updaterx.rdp
hxxps://asobimo[.]link/updater.rdp
hxxps://asobimo[.]link/updaterx.rdp
hxxps://asobimo[.]link/checkubr.txt
hxxps://asobimo[.]link/asom-uninstaller.rdp
hxxps://asobimo[.]link/xz-uninstaller.rdp
hxxps://asobimo[.]link/xz.rdp
hxxp://myownservice.duckdns[.]org:8000/mclient.txt
hxxps://asobimo[.]link/marosa.txt
hxxps://pastebin[.]com/raw/9UHQkGec
hxxps://ipv4object[.]net/MetaWeb.txt
hxxps://ipv4object[.]net/MetaNev.txt
hxxps://ipv4object[.]net/Metamorph.txt
hxxps://txtcatch[.]com/archive/link.txt
hxxps://ipv4object[.]net/licence
hxxps://getcert[.]net/assignmentbmp.zip
hxxps://drive.usercontent.google[.]com/download?id=1zGHGEpbLq7I1p90YFn70ZaZU3v1YyLNz&export=download
hxxps://ia601208.us.archive[.]org/31/items/images_20231226_0815/Images.zip
hxxps://getcert[.]net/Images.zip
hxxps://ipv4object[.]net/Cleaner.txt
hxxps://ipv4object[.]net/m.txt
hxxps://ipv4object[.]net/Net.txt
hxxps://getcert[.]net/m.txt
hxxps://txtc[.]cloud/m.txt
hxxp://validssl[.]online/m.txt
hxxps://github.com/torpedo0x/
hxxps://i.imghippo[.]com/files/NkKm6518aVQ.Bmp
hxxps://i.imghippo[.]com/files/iBrq9443HWk.Bmp
hxxps://i.imghippo[.]com/files/RRqb3512Vb.Bmp
hxxps://i.imghippo[.]com/files/iBrq9443HWk.Bmp
hxxps://i.imghippo[.]com/files/GGV9604Lg.Bmp
hxxps://i.imghippo[.]com/files/vitY7320btA.Bmp
hxxps://i.imghippo[.]com/files/set5912PyY.Bmp
hxxs://i.imghippo[.]com/files/jlj5300oyU.Bmp

Domains

asobimo[.]link
myownservice.duckdns[.]org
txtc[.]cloud
validssl[.]net
validip[.]net
validssl[.]online
validip[.]online
txtkey[.]online
txtcatch[.]com
getcert[.]net
ipv4object[.]net
filenav[.]net
windowscdn[.]site
buyclients[.]xyz

IP addresses

95.216.99[.]206

Wallets

49dERm4bKtG1Pz64KDE73r6oCKnowVieph41y996zq6Q6Mdhbks6EMQh1qyn2dsvyHW9CoBTqAU7BZQKxz5AfGov3c7PgS4
46nUxRJRF1s7EXgxHB8fUghtpuZ8amdE42XqNyUkPi4bN96nL1BsZq1JmLMeL8a4x4AUVXcxXxVbD7qP9ZvHqzwi5zw7gxi
44SC1Wk3tmZeVr6LvcaVcsZbnYCT5hUVWe4ptAPE445NWhcYUvkShPuJiYkxi5yofgdTWqPUCCNdcBar18Kecbgs15gRzhk