Indicators of Compromise
Every IOC SafeDep has linked to a malicious package or campaign — domains, IPs, emails, hashes, and crypto wallets.
Every IOC SafeDep has linked to a malicious package or campaign — domains, IPs, emails, hashes, and crypto wallets.
| value | context | campaigns | Copy |
|---|---|---|---|
| github repoalisista/aht-testnet | Victim GitHub repo poisoned by IronWorm. Malicious commit SHA 10c619e75181d07ddcccb5c1f62766c85fef08df. | 1 | |
| github repoocrybit/mweb3waves | Victim GitHub repo (compromised account ocrybit) poisoned by IronWorm. Malicious commit SHA 0fe6a098fe698e586188e0f2e851ef43f1a35958. | 1 | |
| github repoocrybit/by-coffeescript | Victim GitHub repo (compromised account ocrybit) poisoned by IronWorm. Malicious commit SHA fd64413119575fa119eaa9f94d32208c7d916796. | 1 | |
| emailepsteinfuckniggerss911@proton.me | npm maintainer email for account speedsteraxios (faster-axios publisher). Offensive/racist throwaway. Weak actor selector. | 1 | |
| sha256f89694ba247a7a67e582572094c9f19d2e09882eff8917f78125d54b733bd24e | faster-axios@1.17.3 npm tarball | 1 | |
| sha25680c18e0d71a31a2e66d8796c6d7081fa3414c1801057131f1cd851c87c1a029e | faster-axios@1.17.4 npm tarball | 1 | |
| sha256bc46e88b1fdf8c27e3404146306b4651f69728f7d8d939a219dfbcb5a23ef69a | Stage 4 hello.exe. PE32 NSIS self-extracting installer, 86,235,515 bytes (~86MB). Contains electron-builder Electron app with Epsilon Stealer in resources/app.asar -> src/index.js (3,360 lines). NSIS header references www.inkscape.org (decoy). | 1 | |
| urlhttps://cold5.gofile.io/download/web/c5d2304a-2ede-4fd8-904b-9a6cdd3f8a6c/analyst.js | faster-axios v1.17.3 stage-2 delivery URL (gofile.io file hosting). Now returns landing page; likely token-gated or removed. | 1 | |
| urlhttps://apparently-movers-mysql-heights.trycloudflare.com/download/datab1 | faster-axios v1.17.4 stage-2 delivery URL (Cloudflare quick-tunnel C2). LIVE, returned HTTP 200. Stage 3 = Windows-only dropper. | 1 | |
| urlhttps://apparently-movers-mysql-heights.trycloudflare.com/download/epsilon | Stage 4 download URL. Dropper fetches hello.exe to %TEMP% and runs via child_process.execFile. | 1 | |
| urlhttps://apparently-movers-mysql-heights.trycloudflare.com/download/browser | Shellcode download URL. Epsilon Stealer fetches XOR-encoded (key 0xAA) shellcode for process injection into dllhost.exe. | 1 | |
| domainapparently-movers-mysql-heights.trycloudflare.com | Cloudflare quick-tunnel C2 host for faster-axios. Serves: stage-2 delivery (/download/datab1), stage-4 PE (/download/epsilon), and shellcode (/download/browser). | 1 | |
| domainrecorded-distinct-face-girlfriend.trycloudflare.com | Epsilon Stealer exfil API tunnel. Endpoints: /customer (registration), /upload (file exfil), /discord-token (Discord token exfil), /clip (clipboard data). | 1 | |
| urlhttps://recorded-distinct-face-girlfriend.trycloudflare.com/customer | Epsilon Stealer exfil API base. Sub-endpoints: /upload, /discord-token, /clip. | 1 | |
| domainconsequences-faces-weblogs-clinical.trycloudflare.com | SHARED INFRASTRUCTURE linking turbo-axios and faster-axios (high confidence same operator). turbo-axios v1.17.2 used this tunnel as stage-2 C2 at /download/datab1. faster-axios Epsilon Stealer source references this tunnel as DOWNLOAD_URL constant (line 99) at /download/load. Campaign-level pivot indicator. | 1 | |
| urlhttps://consequences-faces-weblogs-clinical.trycloudflare.com/download/load | Secondary download URL used by Epsilon Stealer (faster-axios) for additional payload retrieval. | 1 | |
| urlhttps://consequences-faces-weblogs-clinical.trycloudflare.com/download/datab1 | turbo-axios v1.17.2 stage-2 C2 endpoint. Same tunnel reused in faster-axios Epsilon Stealer source. Key infrastructure pivot linking both packages to one operator. | 1 | |
| domainphilosophy-moms-incoming-milton.trycloudflare.com | Cloudflare quick-tunnel C2 for turbo-axios v1.17.3 stage-2 delivery. Endpoint: /download/datab1. Rotated tunnel after consequences-faces-weblogs-clinical was used for v1.17.2. | 1 | |
| urlhttps://philosophy-moms-incoming-milton.trycloudflare.com/download/datab1 | turbo-axios v1.17.3 stage-2 delivery URL. Rotated Cloudflare quick-tunnel with same /download/datab1 path pattern as all other campaign tunnels. | 1 | |
| domainprep-integer-lit-preferences.trycloudflare.com | WebSocket RAT gateway for Epsilon Stealer. Persistent WSS connection with auto-reconnect. Supports arbitrary cmd.exe/powershell execution with real-time stdout streaming. | 1 | |
| file path%TEMP%\hello.exe | Windows drop path for stage-4 NSIS PE, executed via child_process.execFile. | 1 | |
| file path%LOCALAPPDATA%\Microsoft\Windows\0\svchost.exe | Epsilon Stealer persistence copy. Binary copied here and launched via HKCU Run key on reboot. | 0 | |
| file pathHKCU\Software\Microsoft\Windows\CurrentVersion\Run\svchost | Registry Run key set by Epsilon Stealer for boot persistence. Points to %LOCALAPPDATA%\Microsoft\Windows\0\svchost.exe. | 0 | |
| file path%TEMP%\browser-extraction-<username> | Staging directory for injected browser credential data. <username> replaced with victim's Windows username. | 0 | |
| file path%TEMP%\epsilon-<username> | Main staging directory for all Epsilon Stealer exfil data. <username> replaced with victim's Windows username. | 0 | |
| github repospeedsteraxios | npm publisher account handle for faster-axios (used as weak actor selector; not a confirmed GitHub repo). | 1 | |
| emailemcd-vue@proton.me | npm maintainer email for the emcd-vue account that published the Wave 3 packages. Anonymous Proton Mail address. Fourth email identity tied to the oob-moika-tech campaign. | 1 | |
| domainemcd-vue.io | Fake domain used in Wave 3 package README and metadata to impersonate the EMCD organization. Not related to real emcd.io. Social engineering artifact. | 1 | |
| domaingithub.emcd-vue.io | Fake GitHub subdomain used as the repository URL in @emcd-vue package metadata (git+https://github.emcd-vue.io/platform/auth.git). Social engineering artifact designed to mimic a private GitHub Enterprise instance. | 0 | |
| file path~/.emcd-vue_init.js | Second-stage dropper written to the user home directory (not OS temp dir) by the Wave 3 postinstall hook, then spawned detached. Dot-hidden file. Persistence upgrade over Waves 1+2 which used os.tmpdir(). | 1 | |
| file path~/.emcd-vue_init/ | Home-directory cache directory used for run-once deduplication. Contains JSON files keyed by hash(package_name + hostname + project_root). Wave 3 replacement for Wave 2's ~/.cache/._t-in-one_init/. | 0 | |
| file pathEMCD_VUE_NO_TELEMETRY | Functional kill switch environment variable checked by the Wave 3 postinstall code. Setting this variable causes the payload to exit early without beaconing. NOT the variable advertised in the README (which is EMCD_VUE_8D440FE1_NO_TEL — non-functional by design). | 0 | |
| file pathEMCD_VUE_8D440FE1_NO_TEL | README-advertised kill switch env var — deliberately mismatched from the functional code kill switch (EMCD_VUE_NO_TELEMETRY). Setting this variable does NOT prevent payload execution. Social engineering artifact: the 8D440FE1 hex fragment in the name indicates deliberate construction, not a typo. | 0 | |
| sha256031ba872d5a84bfb18115f432811e4b45180346a1bae653f7fd85f918e7bb3a3 | patch-client@4.0.4 malicious tarball SHA256 | 1 | |
| sha256df1732f5bfec12e066be44dee02ec8a243e4868d38672c1b1d065359dd735a14 | index.js dropper SHA256 (ROT-9 + AES-128-GCM loader) | 1 | |
| sha2560dc06ecdaa63fe24859cfd955053c23245c536e4733480239d14bebf12688e35 | decrypted Bun worm payload SHA256 | 1 | |
| urlhttps://registry.npmjs.org/-/npm/v1/oidc/token/exchange/package/ | npm OIDC-to-publish-token exchange endpoint abused for self-propagation | 1 | |
| urlhttps://github.com/oven-sh/bun/releases/download/bun-v1.3.13/ | Bun runtime download URL used by the Miasma worm bootstrapper across all waves (inferred for Wave 5; unconfirmed until payload is reversed) | 1 | |
| file path/var/run/secrets/kubernetes.io/serviceaccount/token | Kubernetes service account token harvested | 1 | |
| file path/var/run/docker.sock | Docker socket abused for container escape | 1 | |
| file path/tmp/p<random>.js | Temp file pattern for decoded worm payload before Bun execution (inherited from prior Miasma waves; unconfirmed for Wave 5 until payload is reversed) | 1 | |
| file path/tmp/b-<random>/bun | runtime artifact (downloaded Bun runtime) | 1 | |
| file path/tmp/kitty-<random> | runtime worm artifact | 1 | |
| domainlogin.microsoftonline.com | Azure managed identity / token endpoint queried | 1 | |
| domaingraph.microsoft.com | Azure Graph API queried for identity data | 1 | |
| emailnath.dr4k3@gmail.com | npm maintainer email for the t-in-one account that published the 12 Wave 2 packages. First email identity tied to the oob-moika-tech campaign (Wave 1 accounts mr.4nd3r50n and pik-libs had no public email). | 1 | |
| file path._t-in-one_init.js | Second-stage dropper written to the OS temp directory (os.tmpdir()) by the Wave 2 postinstall hook, then spawned detached. Follows the same ._<scope>_init.js naming pattern as Wave 1's ._cloudplatform-single-spa_init.js. | 1 | |
| file path~/.cache/._t-in-one_init/ | Run-once de-duplication marker directory created by the Wave 2 payload so a host is beaconed only once. New in Wave 2. | 0 | |
| domainnpm.t-in-one.io | Fabricated internal npm registry domain in the @t-in-one README and .npmrc lure (registry=https://npm.t-in-one.io). Social engineering artifact; not confirmed functional infrastructure. | 1 | |
| domaindocs.t-in-one.io | Fabricated docs domain in @t-in-one README. Social engineering artifact; not confirmed functional. | 0 |