Indicators of Compromise
Every IOC SafeDep has linked to a malicious package or campaign — domains, IPs, emails, hashes, and crypto wallets.
Every IOC SafeDep has linked to a malicious package or campaign — domains, IPs, emails, hashes, and crypto wallets.
| value | context | campaigns | Copy |
|---|---|---|---|
| sha25601d2afea0f2201a3b59765a1a60ba324ff4b8fdd25f23a0e05824b97f195b27c | SHA-256 of gtaobus.pyc entry module (PyArmor-protected) inside pepesoft.exe for generic trigger-bot. | 1 | |
| sha256a2a5e473dba85959b21b7e8a184bc255d5f2dacdf7411b91d212fb1217d2518b | SHA-256 of second-stage pepesoft.exe PyInstaller payload for generic trigger-bot. | 1 | |
| sha256ba7fc544994f126cb7485ce52d265d2f32e93c4f1ea1fcd6fcdee3918f271979 | SHA-256 of 81d243bd2c585b0f4821__mypyc.cp313-win_amd64.pyd, a compiled charset_normalizer dependency identical across the 3 direct-bytecode payloads. BENIGN shared dependency, not malicious itself; recorded for correlation only. | 0 | |
| github repogithub.com/pepegit666/123f53y45ysdf34 | Operator pepegit666 GitHub repo used to stage the pepesoft.exe payload on GitHub Releases. | 1 | |
| domaincalm-voice-9797.888c888x888.workers.dev | Cloudflare Worker URL passed to the payload as AWS_CONFIG_KEY; serves service.json (Google service-account creds + S3 config). | 1 | |
| domains3.ru-3.storage.selcloud.ru | Selectel S3-compatible object storage (bucket "zfile") used as service.json fallback and full read/write client via aiobotocore. | 1 | |
| domainbots.pepesoft.ru | Operator paid-cheat storefront (Pepesoft brand). | 1 | |
| domaindns.google | LEGITIMATE Google DNS-over-HTTPS resolver (dns.google/resolve) abused to resolve any host containing "github" and connect to the returned IP directly, bypassing hosts-file/local DNS sinkholes. Legit service, low IOC value. | 1 | |
| urlhttps://github.com/pepegit666/123f53y45ysdf34/releases/download/<tag>/pepesoft.exe | GitHub Releases payload staging URL (per-game <tag>). Second fallback in the staging chain. | 1 | |
| urlhttps://huggingface.co/buckets/pepegit666/<tag>/resolve/pepesoft.exe?download=true | Hugging Face payload staging URL (per-game <tag>). First choice in the staging chain. | 1 | |
| ipv4196.16.3.71 | Authenticated HTTP proxy (port 9528, user X1U0z7 / pass ZHcUHN) used by the 8 PyArmor payloads to reroute Google Sheets traffic when direct access fails. | 1 | |
| telegram bott.me/pepesoft777 | Operator Telegram channel (Pepesoft brand). | 1 | |
| discord webhookdiscord.com/api/webhooks/1156474517871403078/zuHl6xQzdMcFjNrmm9jTiHvCzNbCiQhkYAIGWNUfj7X4KUIpEATekKlSNna6OvyCKaRw | Discord webhook constant present in direct-bytecode apps. CAVEAT: writeup did NOT confirm an active send path. | 1 | |
| discord webhookdiscord.com/api/webhooks/1156474527874818088/qS5cJuxEbyIA1s3tZX_A2u6YsKtLUARVPvN77_6fK5QHGdGFHb3JSuCUSDhtouEsyJgk | Discord webhook constant present in direct-bytecode apps. CAVEAT: writeup did NOT confirm an active send path. | 1 | |
| file path./libgg/chat_ids.txt | Stores Telegram chat IDs after /start in direct-bytecode aiogram RAT builds. | 1 | |
| file path%LOCALAPPDATA%\Windows Src\key*.txt | Activation-key storage used by pepesoft.exe. | 1 | |
| file path./token.txt | Payload artifact. | 1 | |
| file pathcredentials.txt | Payload artifact. | 1 | |
| file path%APPDATA%\pepesoft | Payload working/state directory (Pepesoft brand). | 1 | |
| file pathpepesoft.exe | Shared PyInstaller (Python 3.13) second-stage host-surveillance payload dropped by all 11 downloaders. | 1 | |
| domaino4510485815754752.ingest.us.sentry.io | Attacker Sentry organization ingest host (org id o4510485815754752, US region). Shared across all 17 click2ai packages; per-namespace project ids segregate beacons for victim attribution. | 1 | |
| emailprivatek3m@protonmail.com | Maintainer email of npm user click2ai, publisher of all 17 dependency-confusion packages. | 0 | |
| urlhttps://o4510485815754752.ingest.us.sentry.io/api/4511632071262208/envelope/ | Per-namespace attacker Sentry envelope beacon endpoint (project id 4511632071262208). @flex-ng namespace. DSN public key: f4e0634481690329cda8e1396ffac3bc. | 1 | |
| urlhttps://o4510485815754752.ingest.us.sentry.io/api/4511630867824640/envelope/ | Per-namespace attacker Sentry envelope beacon endpoint (project id 4511630867824640). @idms-corp namespace. DSN key truncated in source render; project id exact. | 1 | |
| urlhttps://o4510485815754752.ingest.us.sentry.io/api/4511632708141056/envelope/ | Per-namespace attacker Sentry envelope beacon endpoint (project id 4511632708141056). @logdna-web namespace (LogDNA/Mezmo lookalike). DSN key truncated in source render; project id exact. | 1 | |
| urlhttps://o4510485815754752.ingest.us.sentry.io/api/4511630928838656/envelope/ | Per-namespace attacker Sentry envelope beacon endpoint (project id 4511630928838656). tme-* namespace (tme-xca, tme-xca-react). DSN public key: fa678d7e7f5b484dffe4d063d75fae55. | 1 | |
| urlhttps://o4510485815754752.ingest.us.sentry.io/api/4511621197856768/envelope/ | Per-namespace attacker Sentry envelope beacon endpoint (project id 4511621197856768). tme-* namespace (tme-error) — a SECOND, distinct project for the same tme namespace. DSN key not captured; project id only. | 1 | |
| urlhttps://o4510485815754752.ingest.us.sentry.io/api/4511675212038149/envelope/ | Per-namespace attacker Sentry envelope beacon endpoint (project id 4511675212038149). enbd-* namespace (Emirates NBD lookalike) AND box-react-uix — a SHARED project across two namespaces (flagged discrepancy). DSN key truncated (abbfc1...8f4b). | 1 | |
| urlhttps://o4510485815754752.ingest.us.sentry.io/api/4511664042999808/envelope/ | Per-namespace attacker Sentry envelope beacon endpoint (project id 4511664042999808). sams-* namespace. DSN key not captured; project id only. | 1 | |
| urlhttps://o4510485815754752.ingest.us.sentry.io/api/4511709729914880/envelope/ | Per-namespace attacker Sentry envelope beacon endpoint (project id 4511709729914880). chat-adapter-zoom (Zoom chat-adapter lookalike). DSN key truncated (ab3ba4...ee89). | 1 | |
| urlhttps://o4510485815754752.ingest.us.sentry.io/api/4511716882972672/envelope/ | Per-namespace attacker Sentry envelope beacon endpoint (project id 4511716882972672). Salesforce SLDS namespace (salesforce-vscode-slds, slds-lsp-client). DSN key truncated in source render; project id exact. | 1 | |
| sha256fbbcf4d8f98168f78f5c0c47a9ae56d59ec8ac84a7c9ca6b797fedfb8d62d2bd | Linux ELF x86-64 payload extracted from dist/intro.js binary container. Rust-compiled infostealer, dynamically links libbpf.so.1. 4.31 MB decompressed. | 0 | |
| sha256b7ca95d1b23c8e67416a25cedf741de0917c2096bbc9d24649eea7853d054903 | Windows PE x86-64 payload extracted from dist/intro.js binary container. Rust-compiled infostealer targeting Chrome, Chromium, Brave, Edge, Bitwarden extension, Steam sessions. Task Scheduler persistence. 4.92 MB decompressed. | 0 | |
| sha256c8fd47d36bdf7c825378593ab82ed8c24d1dc52e26b507812393e24e1d5201fd | macOS Mach-O arm64 payload extracted from dist/intro.js binary container. Rust-compiled infostealer with LaunchAgent persistence (RunAtLoad, KeepAlive, 30s StartInterval). 3.04 MB decompressed. | 0 | |
| sha2569eeffcb5c3445ef9512f7776045f99ea23f9ebed989f8570bc4634b4e340de5d | Hash embedded within the Windows PE payload binary. Purpose unknown from static analysis; possibly a configuration integrity check or payload identifier. | 0 | |
| sha256a41a523ef9517aab37ed6eea0ec881821bdcb7aefcb5c5f603adc7907f868c86 | dist/intro.js binary payload container (7.8 MB). Byte-identical across all 5 compromised versions (8.14.0, 8.16.0, 8.17.0, 8.18.0, 8.20.0). Custom binary format (magic \x1bCSI\x01) containing gzip-compressed Rust-compiled infostealers for Linux, Windows, and macOS. | 0 | |
| sha256a742de963f14a92d24ebcbc7b44ac867e23a20d31d1b0094a13a4f83287f4e60 | dist/setup.js preinstall dropper script. Byte-identical across 8.14.0, 8.16.0, and 8.17.0. Reads the binary container, decompresses platform-matched payload, spawns detached. | 0 | |
| domainapi.348672-shakepay.com | C2 / exfiltration domain shared across all three exfil paths. Impersonates the 'Shakepay' brand name but is NOT registered infrastructure of the real Shakepay (shakepay.com). Passive DNS shows Cloudflare anycast (104.21.89.51, 172.67.188.32), consistent with attacker origin-hiding behind Cloudflare. All three endpoints use the shared header X-Api-Key: 2523-5235-8564-2683-2386. | 0 | |
| urlhttps://api.348672-shakepay.com/api/card | PAN/CVV/card-data exfiltration endpoint (Braintree.CardOperationLogger). Stored as a PLAINTEXT string constant in Braintree.dll (no obfuscation). POST manually-concatenated JSON with header X-Api-Key: 2523-5235-8564-2683-2386, in an empty catch. | 0 | |
| urlhttps://api.348672-shakepay.com/api/account | Braintree merchant-key exfiltration endpoint (GatewayInput.AddAccountAsync, fired from the PrivateKey setter). Stored as a PLAINTEXT string constant in Braintree.dll. POSTs MerchantId+PublicKey+PrivateKey as JSON with header X-Api-Key: 2523-5235-8564-2683-2386. | 0 | |
| urlhttps://api.348672-shakepay.com/api/analytics/report | Environment/config/cloud-secret exfiltration endpoint (DependencyInjector.Core AnalyticsReporter.ReportAsync). XOR-OBFUSCATED at rest: 52-byte ciphertext blob (hex 220F582D6DB51544FD7D3701497F24BB7D49012E76EE510EEC6C2701192471A22B0B45727FE15B07E579374C09646EE83A145E29) in AnalyticsOptions static ctor, decoded at runtime by EndpointObfuscator.Decode with repeating-key XOR key 4A7B2C5D1E8F3A6B9C0D5E2F7A4B1C8D (recovered from DependencyInjector.Core 1.4.1 net10.0 build). A naive strings/XOR scan of the DLL surfaces only the plaintext /api/card and /api/account endpoints, not this one. | 0 | |
| ipv4104.21.89.51 | Cloudflare anycast address in passive DNS for api.348672-shakepay.com. Source frames this as origin-hiding, NOT the true attacker origin IP. Low value in isolation. | 0 | |
| ipv4172.67.188.32 | Cloudflare anycast address in passive DNS for api.348672-shakepay.com. Source frames this as origin-hiding, NOT the true attacker origin IP. Low value in isolation. | 0 | |
| sha2567a9f19ed663c1d4ee259ba0a10e93e1c9770812ce81f8c945140a452d17cb3c8 | Braintree.dll malicious build (1 of 11 hashes source labels for Braintree.dll). | 0 | |
| sha256f181d57c29364aef01e3f72051ec2dc0da918d346e7e4d1377e13408afb8663a | Braintree.dll malicious build (2 of 11 hashes source labels for Braintree.dll). | 0 | |
| sha256220908e8c23c2332266ba1e984f839b9914c2e40a946b172f6d9b8b36728f98a | Braintree.dll malicious build (3 of 11 hashes source labels for Braintree.dll). | 0 | |
| sha25686d287eafecd542faec21a95522b3425000ae5d8650813a9987b7c10cf90fc7a | Braintree.dll malicious build (4 of 11 hashes source labels for Braintree.dll). | 0 | |
| sha2565cae5ec54f450ef7483e265d289edc3877c17e3ae508c06e1679371aa1c1306f | Braintree.dll malicious build (5 of 11 hashes source labels for Braintree.dll). | 0 | |
| sha256d6fbfada62639578b6a6e91786928705dd22bb14b0f030504ffbc974e23528bc | Braintree.dll malicious build (6 of 11 hashes source labels for Braintree.dll). | 0 | |
| sha256e0c7797e7dba2056bc95bfddb96d9f07afb93988f108bc417c40cd05f7ae49a4 | Braintree.dll malicious build (7 of 11 hashes source labels for Braintree.dll). | 0 |