Indicators of Compromise
Every IOC SafeDep has linked to a malicious package or campaign — domains, IPs, emails, hashes, and crypto wallets.
Every IOC SafeDep has linked to a malicious package or campaign — domains, IPs, emails, hashes, and crypto wallets.
| value | context | campaigns | Copy |
|---|---|---|---|
| sha256064653872c1b4c3d5b5242627cda259056fed7159fcd2cc5a448981c9f81aeda | Braintree.dll malicious build (8 of 11 hashes source labels for Braintree.dll). | 0 | |
| sha2562547382cd5151e2210c6349f17230ae3d1a59935e3b8d1757d72d9abd30ac858 | Braintree.dll malicious build (9 of 11 hashes source labels for Braintree.dll). | 0 | |
| sha25652aeb64f4199235704d0e4a6908c501c3b4bdd4a004a766a5ca55b9655b24775 | Braintree.dll malicious build (10 of 11 hashes source labels for Braintree.dll). | 0 | |
| sha2569dff477e6d30872669bb6186c67147a945d9de7e947eb7906afdb03c93901ead | Braintree.dll malicious build (11 of 11 hashes source labels for Braintree.dll). | 0 | |
| sha256efec1e537445170a9aac11781c597cba5bd5d25b79ac3d65467d84f109d86fd4 | DependencyInjector.Core.dll malicious build (1 of 12 hashes source labels for DependencyInjector.Core.dll). | 0 | |
| sha2567c30f007af910886b46f6022dd724dd303ad2d5f983376d0547293f484d6ae71 | DependencyInjector.Core.dll malicious build (2 of 12 hashes source labels for DependencyInjector.Core.dll). | 0 | |
| sha2569d8d79000f6413668429d851f7d8ce94cd1b61c3a421939cf34cec8d668f5388 | DependencyInjector.Core.dll malicious build (3 of 12 hashes source labels for DependencyInjector.Core.dll). | 0 | |
| sha256c9564621abec9bdb7ceb38bb1a2895a119772b7f830351272c13a3f4cd606b97 | DependencyInjector.Core.dll malicious build (4 of 12 hashes source labels for DependencyInjector.Core.dll). | 0 | |
| sha256f53359313ce9a9433651202a7ffbf155dc1379103796a45492a50edbf044d59d | DependencyInjector.Core.dll malicious build (5 of 12 hashes source labels for DependencyInjector.Core.dll). | 0 | |
| sha256b4a5bcf4ce8c9cc844c06f436d4c26b28cb408f7e4fd8990681336445493acc1 | DependencyInjector.Core.dll malicious build (6 of 12 hashes source labels for DependencyInjector.Core.dll). | 0 | |
| sha256531302fe3b8a8624aa468ee83707448fbd1db2eaa3f8d587331db2b17890f8ad | DependencyInjector.Core.dll malicious build (7 of 12 hashes source labels for DependencyInjector.Core.dll). | 0 | |
| sha256bfdaf869a3956b37bf416dcdafdad314e8de0215cfd8fd8b2bc7a4e5cd15a349 | DependencyInjector.Core.dll malicious build (8 of 12 hashes source labels for DependencyInjector.Core.dll). | 0 | |
| sha2565138ea25563be4ae8143b7a46c6bc42af00344678e6d4451ac596b5b5587c70e | DependencyInjector.Core.dll malicious build (9 of 12 hashes source labels for DependencyInjector.Core.dll). | 0 | |
| sha256eceab1132aacd803962fa173d1b2c43e225fcfa8b5d26d3efadad1b4de33d8ec | DependencyInjector.Core.dll malicious build (10 of 12 hashes source labels for DependencyInjector.Core.dll). | 0 | |
| sha256de6384e853dfc007205abb7b15b49eded2e3e977058600dece2c2e9190a5191a | DependencyInjector.Core.dll malicious build (11 of 12 hashes source labels for DependencyInjector.Core.dll). | 0 | |
| sha256c3be125753aea85728a082823db77d833377d7e3eb199364aa49d1ff2535f53e | DependencyInjector.Core.dll malicious build (12 of 12 hashes source labels for DependencyInjector.Core.dll). | 0 | |
| domaintestnet.archival.chain.grpc-web.injective.network | Exfiltration endpoint. A LEGITIMATE Injective Labs public infrastructure hostname abused so exfil traffic blends with normal SDK usage and evades network-based detection. Character-obfuscated in the on-disk payload, reconstructed at runtime. No backing IP given by source. | 0 | |
| urlhttps://testnet.archival.chain.grpc-web.injective.network | HTTPS POST target. base64-encoded wallet mnemonic / private-key material sent here. | 0 | |
| sha256103c4e6181151c1bcfedc41506cd1815458c38375d08a8fcd9981dbe0b965ce0 | Bundled build output /dist/cjs/accounts-Cy0p4lLW.cjs inside @injectivelabs/sdk-ts@1.20.21 (CommonJS build of the stealer). Not the package tarball hash (source did not publish a tarball hash). | 0 | |
| sha2569a59eb454f3ca3fe91214136ee5edd417cc47a80e6f169b52099d6561944baf9 | Bundled build output /dist/esm/accounts-jQ1GSgaW.js inside @injectivelabs/sdk-ts@1.20.21 (ESM build of the same stealer). Not the package tarball hash. | 0 | |
| file path/dist/cjs/accounts-Cy0p4lLW.cjs | CommonJS build output carrying the injected trackKeyDerivation stealer. | 0 | |
| file path/dist/esm/accounts-jQ1GSgaW.js | ESM build output carrying the injected trackKeyDerivation stealer. | 0 | |
| domainpeach-eligible-penguin-917.mypinata.cloud | Pinata IPFS gateway, stage-2 host fetched by tslint-conf lib/caller.js (same CID shared with first-pair nodemon-node per SafeDep) | 1 | |
| urlhttps://peach-eligible-penguin-917.mypinata.cloud/ipfs/bafkreigjnxn5vnn34rc5r43ajwwkmk4akqpm4awmq5gdhakgszpeqiffsu | Full stage-2 URL; IPFS CID bafkreigjnxn5vnn34rc5r43ajwwkmk4akqpm4awmq5gdhakgszpeqiffsu. GET with header x-secret-key: _, response .cookie eval'd via Function.constructor. Stage-2 deliberately NOT fetched. | 1 | |
| urlhttps://jsonkeeper.com/b/XRGF3 | Active dead-drop in tslint-conf lib/caller.js; SafeDep: same dead-drop referenced by first-pair nodemon-node | 1 | |
| urlhttps://jsonkeeper.com/b/4NAKK | Orphaned base64 dead-drop in tslint-conf lib/const.js (unreferenced); reused tooling linking the new pair to the first pair | 1 | |
| domainjsonspack.com | Forged-author domain on tslint-conf (author Alexus111 <hello@jsonspack.com>, bugs URL jsonspack.com/issues); campaign namesake | 1 | |
| emailcoxhazelqja151@outlook.com | npm maintainer email for account conodeeth, publisher of all four packages | 1 | |
| emailhello@jsonspack.com | Forged author email (Alexus111) on tslint-conf@7.2.1 | 1 | |
| sha256aa9b9847e4ffd894a19ec9712848651882b0195de5f4953eef9b47791adddabf | nodemon-sudo@3.1.16 npm tarball (registry.npmjs.org/nodemon-sudo/-/nodemon-sudo-3.1.16.tgz) | 1 | |
| sha256d4b7add83e5c716b5e52082f713d71ec9d7bfd93e358d500d77c2393302dd004 | tslint-conf@7.2.1 npm tarball (registry.npmjs.org/tslint-conf/-/tslint-conf-7.2.1.tgz) | 1 | |
| sha2562956b023858d706a5e241cd28b845088e5f414c5f70bd5d8cb73cb427d081065 | tslint-conf index.js (fake pino/express middleware main) | 1 | |
| sha256541c35bd90653c9d7f93cdadb7f52c281d7a1375ffc9c0e118cf1d9df977dea7 | tslint-conf lib/caller.js (stage-2 fetch + Function.constructor RCE) | 1 | |
| sha256d10853dde92fdc48d8cb5505d89e0030fd35e1416a16a820fe5ec4aceef01c4f | tslint-conf lib/const.js (orphaned; carries jsonkeeper b/4NAKK dead-drop) | 1 | |
| domainmuckcoding.com | Initial hidden-PowerShell Invoke-WebRequest host (Api-Certificate) and dead-drop-adjacent Muck infrastructure. | 1 | |
| domainmuckdeveloper.com | Primary dead-drop payload-location source (LGTV/MicrosoftCur). | 1 | |
| urlhttps://muckcoding.com/LG-LW/Api-Certificate | First-stage: fetched by hidden PowerShell, saved to C:\Users\Public\Pictures\api.db then certutil-decoded to L.ps1. | 1 | |
| urlhttps://muckdeveloper.com/LGTV/MicrosoftCur | Primary dead-drop source read by the L.ps1 resolver. | 1 | |
| urlhttps://pastebin.com/raw/xy32SJgf | Primary dead-drop source (Pastebin raw). | 1 | |
| urlhttps://rlim.com/MicrosoftCur/raw | Primary dead-drop source (Rlim raw). | 1 | |
| urlhttps://youtu.be/GAS67zAOssc | Fallback dead-drop source (YouTube). | 1 | |
| urlhttps://www.instagram.com/p/DG20Zt9Mj4P/ | Fallback dead-drop source (Instagram post). | 1 | |
| urlhttps://t.me/s/dwmic | Fallback dead-drop source (Telegram channel preview). | 1 | |
| urlhttps://docs.google.com/document/d/1PnogKWvfa3ZcCnmKfnb3pJYXMBmcQe5k_6bBuPUailQ/export?format=txt | Fallback dead-drop source (Google Docs text export). | 1 | |
| urlhttps://gitcode.com/LastWer/MicrosoftCur/raw | Fallback dead-drop source (GitCode raw). | 1 | |
| urlhttps://github.com/tb78/expresso/releases/download/Release/Quixo.7z | Resolved next-stage payload: password-protected 7z (r8NnX1b8Xn) hosted as a GitHub release asset. | 1 | |
| emailischhfd83@rambler.ru | Threat-actor git commit email; constant across the 222 lure repos and the shared pivot with Sophos's prior ischhfd83 cluster. | 1 | |
| file pathC:\Users\Public\Pictures\api.db | certutil-encoded first-stage blob saved by the initial hidden PowerShell. | 0 | |
| file pathC:\Users\Public\Pictures\L.ps1 | Decoded multi-layer PowerShell loader, executed with -ExecutionPolicy Bypass and a hidden window. | 0 | |
| file pathC:\Users\Public\Documents\umun\ | Download directory for the resolved Quixo.7z payload archive. | 0 |