Indicators of Compromise
Every IOC SafeDep has linked to a malicious package or campaign — domains, IPs, emails, hashes, and crypto wallets.
Every IOC SafeDep has linked to a malicious package or campaign — domains, IPs, emails, hashes, and crypto wallets.
| value | context | campaigns | Copy |
|---|---|---|---|
| file pathC:\ProgramData\zipathh\7zrr.exe | Staged 7-Zip extractor used to unpack the password-protected Quixo.7z. | 0 | |
| file pathC:\ProgramData\Windows.Microsoft.Photos\current\Microsoft.exe | Electron/Squirrel masquerade launcher (reported signed 'Exodus Movement, Inc.') launched hidden from a Photos-app masquerade directory. | 0 | |
| sha256129de16fe69763f767d8249279a2c4a1a6deafadd1a84563bd84b258ea010bff | Layer 1 encrypted PowerShell blob. | 1 | |
| sha25686819efe7319b664920ba2e1fd4b079a4e6b5eaaebeeb1adb2c1c8dc3c81ee0c | Layer 1 decrypted PowerShell script. | 1 | |
| sha25657e0449fb13766b0b2f7c057b1f89911e9ed23cac7e71d5d69fde47571239629 | Layer 2 encrypted PowerShell blob. | 1 | |
| sha256e576a61e1a2ba71e764647bb2f0883c2f8fa4d591799c60d21a84230ee7a5b63 | Final visible decoded PowerShell loader logic. | 1 | |
| sha25651cada347262d7b2bcde70552fcdae221625ad75435cee8a9c3e7b67cc47a807 | Encrypted payload-location blob (dead-drop, decrypted with key UIA14fogylw8ogL82FntOFGp6). | 1 | |
| sha256969b0bfd605aa2cddf353f3638b0dee26b1c2305600231e055fa6d7786a879fe | Decoded PowerShell stage associated by Socket with AsyncRAT/Quasar detections + spyware/infostealer/trojan/persistence/defense-evasion/discovery/execution activity. | 1 | |
| sha25673c807df26427d6631088a822fa54c30975afbe681a9d83eff5d19e5b075d6c2 | Recovered Quixo.7z payload archive. | 1 | |
| sha256a628ad47fe93ee7413cca90aeca8f9540bfcd5ccdbeb4d9914670b3ef66247f4 | Related GitHub-hosted Quixo.7z sample mapping to Remcos-style RAT activity. | 1 | |
| sha2564ea1c577247b149489506b230e7aa203e1a2fa124109c6056d1986e944f520a4 | Recovered current\Microsoft.exe Electron masquerade launcher. | 1 | |
| sha256235a64e3520b1c2c27763122b303f78aee8d7c083dfd9f1eb936cd5174383609 | Malware sample from a threat-actor-controlled GitHub lure repo. | 1 | |
| sha2562f416aac027f19f563cc45e3b4b72e992aaafb63da27f968b9a76a391134dc7d | Malware sample from a threat-actor-controlled GitHub lure repo. | 1 | |
| sha25633497c69c21fa96bbc96f1d7f09608e462f8ab22555364977c0bd35fef27bc29 | Malware sample from a threat-actor-controlled GitHub lure repo. | 1 | |
| sha25645126b353f1636103da356121cd00b229b635b41b99d91166e6d7d9037482242 | Malware sample from a threat-actor-controlled GitHub lure repo. | 1 | |
| sha256810614290bdb14d2ddf10f65f8adc988a8272764f2a9e2c378e52fad162da344 | Malware sample from a threat-actor-controlled GitHub lure repo. | 1 | |
| sha256938054c6bb7dc737fce16513b2882808f199c2f892f808d439525a1650d49089 | Malware sample from a threat-actor-controlled GitHub lure repo. | 1 | |
| sha2569df11356c5ac61d2aa7b5425e6322fc016b0ed5790dacb201396500b3eee03f7 | Malware sample from a threat-actor-controlled GitHub lure repo. | 1 | |
| sha256a2e7989742c6b6436ebb47507881946e4f662080dff71d104eb9a9554f38af7a | Malware sample from a threat-actor-controlled GitHub lure repo. | 1 | |
| sha256b27f694c974b44fe2f4a8a25680997db574fa35686c30fa4c4dc9dd4ec40005e | Malware sample from a threat-actor-controlled GitHub lure repo. | 1 | |
| sha256d7747e7a3c782009f4ceb6e9c106115876386853929563b509da5258e3968d15 | Malware sample from a threat-actor-controlled GitHub lure repo. | 1 | |
| sha256d95bba20f04687b0b821d4fc0a17137db8b9eda5fe3fb34da319abefc45fe0d1 | Malware sample from a threat-actor-controlled GitHub lure repo. | 1 | |
| sha256e73491065d86b1ad69229bb5d2019e08b947e11a2a57adf5c2d9a2b5d8f4acad | Malware sample from a threat-actor-controlled GitHub lure repo. | 1 | |
| sha256ec1cac2ada6726623b4bafb94c204c359ce7cdf5325909137fc0e6aef506783f | Malware sample from a threat-actor-controlled GitHub lure repo. | 1 | |
| sha256f245956c930f220f0bedf355a751a5cd738b4ec6bb6c5d584199ab3fa6c0a1c4 | Malware sample from a threat-actor-controlled GitHub lure repo. | 1 | |
| github repokaleidora/dnsub-scanning-tool | GitHub repo backing the malicious Go module; entry point of the operation. | 1 | |
| github repotb78/expresso | Hosts the resolved Quixo.7z payload as a GitHub release asset. | 1 | |
| github reponrevv1lad/Pubg-DESYNC-Menu | Named example lure repo: fake external PUBG cheat hosting Loader.exe in source tree, associated with Vidar infostealer. One of 222 confirmed threat-actor-workflow repos. | 1 | |
| domaincaliber-spinner-finishing.ngrok-free.dev | ngrok tunnel hostname used as C2 / exfiltration endpoint. Recovered at runtime via three-step decode (base64 XOR + per-char subtract-17 + string reverse). The backing IP (not published in source) reportedly carried prior reputation as C2 for other stealers including NjRAT (per Socket). | 0 | |
| urlhttps://caliber-spinner-finishing.ngrok-free.dev:443/ | Full C2 URL. Harvested env vars + host metadata POSTed here as application/json over HTTPS. | 0 | |
| sha256ce09810adca70ebec87bc455380ef629ceaa2a0d926149d9115604060167682c | npm index.js payload build variant (per-file rotated obfuscation key). Source published 50 index.js hashes across the 13 npm packages / ~4 versions each without a per-package/version mapping. | 0 | |
| sha256b2ea8d69f6792a87327ffde2ee4551bb6b99617f53e1ba71bf9a70f45dbc57ea | npm index.js payload build variant (per-file rotated obfuscation key). Source published 50 index.js hashes across the 13 npm packages / ~4 versions each without a per-package/version mapping. | 0 | |
| sha2568a70a5c1075f2dea4db94633ddc64b0d03d0385fdeda7c226acc944331febf43 | npm index.js payload build variant (per-file rotated obfuscation key). Source published 50 index.js hashes across the 13 npm packages / ~4 versions each without a per-package/version mapping. | 0 | |
| sha256c8b4d17c1f0aa7c50f2fa23d7c328482a4ad2c4da4d600f358ebdf200cbefd83 | npm index.js payload build variant (per-file rotated obfuscation key). Source published 50 index.js hashes across the 13 npm packages / ~4 versions each without a per-package/version mapping. | 0 | |
| sha2569fd06d823d54183cc91625fdc6decffe8db2863f6499a955656ebdcc089792cf | npm index.js payload build variant (per-file rotated obfuscation key). Source published 50 index.js hashes across the 13 npm packages / ~4 versions each without a per-package/version mapping. | 0 | |
| sha256615805652b2f006e69512b90d0d63883d7ae1ede69d86384fd77bd46235b2369 | npm index.js payload build variant (per-file rotated obfuscation key). Source published 50 index.js hashes across the 13 npm packages / ~4 versions each without a per-package/version mapping. | 0 | |
| sha2566dc672e3bab8bcf80c66b2f95150067fb47429d4cf65eb95215e5f3abc7cade5 | npm index.js payload build variant (per-file rotated obfuscation key). Source published 50 index.js hashes across the 13 npm packages / ~4 versions each without a per-package/version mapping. | 0 | |
| sha2564a4b5c1bc1e948c853cb0978c07c7b8d1540c7b1ded95f8d5ad25c126cb6c7b0 | npm index.js payload build variant (per-file rotated obfuscation key). Source published 50 index.js hashes across the 13 npm packages / ~4 versions each without a per-package/version mapping. | 0 | |
| sha2569727c804c4354e481d2ff9d4934bd1b2518293a9ca34a14f5c7ae9d0cd30ce94 | npm index.js payload build variant (per-file rotated obfuscation key). Source published 50 index.js hashes across the 13 npm packages / ~4 versions each without a per-package/version mapping. | 0 | |
| sha256313853a82bce61052c00e6a6af85b5069e007a76122c727f31661bc636b12f14 | npm index.js payload build variant (per-file rotated obfuscation key). Source published 50 index.js hashes across the 13 npm packages / ~4 versions each without a per-package/version mapping. | 0 | |
| sha2562cbfc4e4b1de5e68ab81fba7e1b0c711b4d26197b48ea4db6819c9cea223b0ed | npm index.js payload build variant (per-file rotated obfuscation key). Source published 50 index.js hashes across the 13 npm packages / ~4 versions each without a per-package/version mapping. | 0 | |
| sha256a0313822513f9b89479f666888a4784a3fc99b4cc4566213dcda66b03b47120c | npm index.js payload build variant (per-file rotated obfuscation key). Source published 50 index.js hashes across the 13 npm packages / ~4 versions each without a per-package/version mapping. | 0 | |
| sha2563a0dd3479eaf85b65e5abd63d6451f98506faddee47cf4bebd9f91296abb29f0 | npm index.js payload build variant (per-file rotated obfuscation key). Source published 50 index.js hashes across the 13 npm packages / ~4 versions each without a per-package/version mapping. | 0 | |
| sha25639371ac7061168dd3d890061267b3875bc4b30dca5e28d40dbc27a4396439ff1 | npm index.js payload build variant (per-file rotated obfuscation key). Source published 50 index.js hashes across the 13 npm packages / ~4 versions each without a per-package/version mapping. | 0 | |
| sha256c51c0b6c7817443b021aff44d4416c09fd039849db81860b9b5144e789fa3987 | npm index.js payload build variant (per-file rotated obfuscation key). Source published 50 index.js hashes across the 13 npm packages / ~4 versions each without a per-package/version mapping. | 0 | |
| sha2566e251c3d2bde8fff0487c1eecd359c4a544a09fd708755020e4b1c53ad6b8dd1 | npm index.js payload build variant (per-file rotated obfuscation key). Source published 50 index.js hashes across the 13 npm packages / ~4 versions each without a per-package/version mapping. | 0 | |
| sha256cd7255730b6a7a3895d622d37d0e8f984d2d280689acef56ff195d663e7723ad | npm index.js payload build variant (per-file rotated obfuscation key). Source published 50 index.js hashes across the 13 npm packages / ~4 versions each without a per-package/version mapping. | 0 | |
| sha2565c4faef80c83c7ec0925a4aacb4bddabe82b91066ac41305907ba277cd7b3b85 | npm index.js payload build variant (per-file rotated obfuscation key). Source published 50 index.js hashes across the 13 npm packages / ~4 versions each without a per-package/version mapping. | 0 | |
| sha25650cb7550224d8d227a0625e7f53be86924d8e057e403b6b91b83ea20df834048 | npm index.js payload build variant (per-file rotated obfuscation key). Source published 50 index.js hashes across the 13 npm packages / ~4 versions each without a per-package/version mapping. | 0 | |
| sha2561bae9f2fb9866422f07345501fa2cb4c3a99f2652c8c9decdc27ffbf9714e7bc | npm index.js payload build variant (per-file rotated obfuscation key). Source published 50 index.js hashes across the 13 npm packages / ~4 versions each without a per-package/version mapping. | 0 |