Indicators of Compromise
Every IOC SafeDep has linked to a malicious package or campaign — domains, IPs, emails, hashes, and crypto wallets.
Every IOC SafeDep has linked to a malicious package or campaign — domains, IPs, emails, hashes, and crypto wallets.
| value | context | campaigns | Copy |
|---|---|---|---|
| urlhttps://git.disroot.org/git-ecosystem/ | Attacker-controlled Forgejo namespace hosting the dropper payload binaries (some zipped, VirusTotal-flagged). Dropper builds fetch URLs of the form https://git.disroot.org/git-ecosystem/#{product}/raw/branch/main. | 0 | |
| ipv485.137.53.71 | Primary HTTP C2 server. Command server on port 8080, data-exfiltration upload on port 8081 (SafeDep also observed proxy management on 8091). Attacker secp256k1 public key from the decrypted __RT_BAKED__ config: 0432fa4ba871877d94081fe83323fa24dfa1491e9de8725cbab7b734de9e9be3b233ef6742fd6264437c9532223d687b05fa540b70af6a516b8539af84d0eeb48e (beacon signing / encrypted C2). | 1 | |
| wallet0x12c37A86a0Ed0beBe5d1d6a43E42f07860eAc710 | Ethereum mainnet smart contract used as fallback C2 channel for address refresh / payload updates. Queried via public RPC (ethereum-rpc.publicnode.com). | 1 | |
| wallet0x1969ab05d67b67fdcaa26240f738ccb077e1cd84 | Ethereum backup C2 contract (Wiz IOC table). | 1 | |
| wallet0x92d4C5413e4F7B258a114964101F9e1C6d64C6Ba | Ethereum deployer wallet for the C2 contracts (Wiz IOC table). | 1 | |
| domainrentry.co | Dead-drop used to exfiltrate the stolen asyncapi-bot PAT from the GitHub Actions runner. Slug 'elzotebo' matches naming patterns of the separate 'prt-scan' campaign (per Wiz, prt-scan is NOT linked to Miasma). | 1 | |
| domainipfs.io | IPFS gateway used for Stage-2 payload delivery. | 1 | |
| domainrelay.damus.io | Nostr relay used as a fallback C2 channel (miasma-branded tags). From decrypted config nostrRelays array. | 1 | |
| domainrelay.nostr.com | Nostr relay used as a fallback C2 channel. From decrypted config nostrRelays array. | 1 | |
| urlipfs://QmQobZSp1wRPrpSEQ56qnyq7ecZh5Bg5k1fnjt4SUwwHb9 | IPFS CID for the Stage-2 RAT payload delivered to the three generator packages. 8.25 MB AES-256-GCM encrypted JavaScript. SHA-256 of the downloaded file: 24b9ee242f21a73b55f7bb3297eafb33c60840907386b542ed79fc6b72365168. | 1 | |
| urlipfs://Qmet4fhsAaWMBUxNDfREHwgiyDeSWy4YSYs9wiKUW5jGyf | IPFS CID for the Stage-2 RAT payload delivered to @asyncapi/specs. 8.24 MB AES-256-GCM encrypted JavaScript. SHA-256 of downloaded file: e9544a648d8fbaccd01b8477cf68471d48b89bf93eeacbdf5bba20fd296ff7b5. Wiz labels this the 'react-sdk variant'. | 1 | |
| sha122bf76fe317ea6769bd38619bd440e42d119bd6b | Malicious validator.js in @asyncapi/generator (Wiz IOC table). | 1 | |
| sha1a7e18d96efd3cdb127ef4cdcad9e3ad26c482bf2 | Malicious utils.js in @asyncapi/generator-helpers (Wiz IOC table). | 1 | |
| sha19890950adcbc2478e7a080234f053214adbad44e | Malicious ErrorHandling.js in @asyncapi/generator-components (Wiz IOC table). | 1 | |
| sha1c70e105e212ff3c1daa04bb2a62507717f296b0b | Malicious index.js in @asyncapi/specs (Wiz IOC table). | 2 | |
| sha1c8cb3f6d5b90c46686d2bf531dc1a5786e27edc5 | sync.js Stage-2 persisted payload (Wiz IOC table). | 1 | |
| sha256bfaeb987faa6de2b5a5eb63b1233d055215b09b0349a9394f2175fd7cdf385e4 | SHA-256 of @asyncapi/generator-3.3.1.tgz (malicious npm tarball, SafeDep). | 0 | |
| sha25634014776d3d3ff11bc4439b02fd7ac0f02a887eb3a052eeafff236e2f6db8ad1 | SHA-256 of @asyncapi/generator-helpers-1.1.1.tgz (malicious npm tarball, SafeDep). | 0 | |
| sha256082d733db0687dcd768104972b065d4b58cb1e6043688c6c20fa3702337f36ab | SHA-256 of @asyncapi/generator-components-0.7.1.tgz (malicious npm tarball, SafeDep). | 0 | |
| sha2569b2e65db653ca8575c9b10eefb9a80c6006404812c2ec212bf5675e3c690233b | SHA-256 of @asyncapi/specs-6.11.2.tgz (malicious npm tarball, SafeDep). | 0 | |
| file path~/.local/share/NodeJS/sync.js | Linux drop path for the Stage-2 RAT persistence payload. macOS: ~/Library/Application Support/NodeJS/sync.js. Windows: %LOCALAPPDATA%\NodeJS\sync.js. | 0 | |
| file path~/.cache/.sys_cache/.diag.enc | Encrypted activity log written by the RAT payload (200 MB FIFO buffer per decrypted config, SafeDep). | 0 | |
| sha256d5385526f2f3e52c7d96087611c6cd4e479bf61828400efdb3ca09406d981609 | SHA-256 of albion.dll first-stage NuGet downloader assembly (albion-x-x). | 1 | |
| sha256567952daf0ab7b36b017aac9963791188dea0fbf2e99c7cc6f6652ee540f4840 | SHA-256 of gtaobus.pyc entry module (direct bytecode) inside pepesoft.exe for Albion Online. | 1 | |
| sha2569a2091e6625fc11cfd8f39c17aa271604e66322ee045028946274b988103e35b | SHA-256 of amazingrp.dll first-stage NuGet downloader assembly (amazing-x-x). | 1 | |
| sha256774e40046f353e3f916f39e3d13d6499da35705a479cfb89288c21017aaf5461 | SHA-256 of gtaobus.pyc entry module (PyArmor-protected) inside pepesoft.exe for Amazing RP. | 1 | |
| sha256e8c2618565aa31d7ffe909ebc99040bafcc0ea8df7f5d92fa673bb7ffacb14c9 | SHA-256 of second-stage pepesoft.exe PyInstaller payload for Amazing RP. | 1 | |
| sha256900ddb81d27e03967209fee4d17d13deb68eef0e1f10936eb520ca10575cb49e | SHA-256 of calculator.dll first-stage NuGet downloader assembly (calc-x-x). | 1 | |
| sha256cc853b3e4504c890d275ac2327f18acd7e4c5b99ca056181f3f5694781f2cf45 | SHA-256 of gtaobus.pyc entry module (direct bytecode) inside pepesoft.exe for Calculator (GTA5RP calc). | 1 | |
| sha256ab58a90eb3682c6dc3389cd700a64f68a19c0dac3d0fa8e3df97ae041f96d4e1 | SHA-256 of grandrp.dll first-stage NuGet downloader assembly (grandrp-x-x). | 1 | |
| sha25623e4d8af5425dae022793450190c8d30809b2986dd879eb4bff557cdacf49c86 | SHA-256 of gtaobus.pyc entry module (PyArmor-protected) inside pepesoft.exe for GrandRP. | 1 | |
| sha2566eefe9d5f030d403c72bd4e4caf5bbb9dbc2bd5e15ebb07de153494f458e5eb9 | SHA-256 of second-stage pepesoft.exe PyInstaller payload for GrandRP. | 1 | |
| sha256e6e1049158ceb1971c61388349c81fa6047a7aecb4ff2089ef54a50dcc35dbc0 | SHA-256 of gta5rp.dll first-stage NuGet downloader assembly (gta5rp-x-x). | 1 | |
| sha25695577498d23fe750221a5badfc25b5e9f020dcf4d80c79a019b090e3c3b0a32a | SHA-256 of gtaobus.pyc entry module (PyArmor-protected) inside pepesoft.exe for GTA5RP. | 1 | |
| sha2568ab256dd839aec6638cd46374f4a6664e534b9341bbcdfd9b763e5a27c51ddb7 | SHA-256 of second-stage pepesoft.exe PyInstaller payload for GTA5RP. | 1 | |
| sha256d9f7ca9f93a7d188d51db308877b15d0beae932ca0bf4705384fbedf54b454c1 | SHA-256 of lineage2.dll first-stage NuGet downloader assembly (l2-x-x). | 1 | |
| sha2562a4fed04d792b9c2fdf9c1456a08ca23eda5fef50c0b409ab294ad489e12d801 | SHA-256 of gtaobus.pyc entry module (PyArmor-protected) inside pepesoft.exe for Lineage 2. | 1 | |
| sha2566c1f828e4d8395dde8293868c65ba8d86b3b9672ebbbb16e932624706d37d832 | SHA-256 of second-stage pepesoft.exe PyInstaller payload for Lineage 2. | 1 | |
| sha2564d13f1136b13c871c65141b77ec7208488334ac4be511800196adcd328666305 | SHA-256 of majestic.dll first-stage NuGet downloader assembly (majestic-x-x). | 1 | |
| sha2567e42d25e707d29d5d185a4c5dc71019f744e88a30b66bbf06949194ff32dbc48 | SHA-256 of gtaobus.pyc entry module (PyArmor-protected) inside pepesoft.exe for Majestic RP. | 1 | |
| sha2566cbd4bc491deb11040e2b2f91b0b4e129af551a802fc78cb42e0e985297ef44c | SHA-256 of second-stage pepesoft.exe PyInstaller payload for Majestic RP. | 1 | |
| sha256011926de3d0cc2b970627b9bf0de003e731f8576602dff756d2ab54a9de61972 | SHA-256 of rmrp.dll first-stage NuGet downloader assembly (rmrp-x-x). | 1 | |
| sha256d59e1914d76499fa51bf861f418c84bda0b48913dc39bd2e73756e326e4ccbb0 | SHA-256 of gtaobus.pyc entry module (PyArmor-protected) inside pepesoft.exe for RMRP. | 1 | |
| sha2565d9843126db4223dc2a8a9cd4a627286fe1a6345e33b28e9c98b5fe56fe89da6 | SHA-256 of second-stage pepesoft.exe PyInstaller payload for RMRP. | 1 | |
| sha25679c09e1ffb4804c14ff27d41ec08d4390455c92d65717be0aeeec2697297d76a | SHA-256 of rusfish4.dll first-stage NuGet downloader assembly (rusfish4-x-x). | 1 | |
| sha25617b1d836c2f15a97be0350879943b04e14bc076cf09e31df0d73258ee10f7e7c | SHA-256 of gtaobus.pyc entry module (PyArmor-protected) inside pepesoft.exe for Russian Fishing 4. | 1 | |
| sha256c9f3e7766dbe728d84a1243447faa5f5eba0645bf13089074d128ea7663e7f5b | SHA-256 of second-stage pepesoft.exe PyInstaller payload for Russian Fishing 4. | 1 | |
| sha2565f3a9ebf7039097b3cdbca8609b5b68af07eeb1dbf716ba2817a97fc7c543854 | SHA-256 of setup.dll first-stage NuGet downloader assembly (throne-x-x). | 1 | |
| sha256476c6f36a22156e53548a87291989a21d6c905dcbd9e1bf68ff5bc12e5c8bb07 | SHA-256 of gtaobus.pyc entry module (direct bytecode) inside pepesoft.exe for Throne and Liberty. | 1 | |
| sha25623808e7638f7a00b1ef9b9f4ca524f8a46cf63be6f6b79fec8e4a3fd1cc82a1e | SHA-256 of trigger.dll first-stage NuGet downloader assembly (trigger-x-x). | 1 |