FILEMembersNov 7, 2026, 09:35 (UTC+9)DLL sandbox traffic links four hosts to API-shaped indicators
A DLL analysis recorded TCP traffic to four IP addresses that also appear in newly listed, API-shaped network indicators. In that same sandbox report, rundll32.exe was invoked against TmopphDns.dll, with ctfmon.exe appearing beneath it in the process tree. The overlap raises a concrete question: does the file explain how those apparent API endpoints were used?
#DLLanalysis#Sandboxanalysis#API-shapedindicators#TCPtraffic#Networkalerts#WindowsErrorReportingActorsSafePayIOCf1 · i3 · d0 · u8MITRE13RegionsPK
FILEMembersNov 5, 2026, 09:40 (UTC+9)Recurring POST requests met redirects, including a domain-sale page
A Windows executable’s sandbox record contains POST requests to /b3/order.php on two hosts. One returned redirects to the same path; the other directed the client to a domain-sale page. In the same Lastline report, AdobeAcrobat entries appeared under Windows startup registry keys. The combination raises a more useful question than whether the domains are suspicious: what did the executable try to establish locally, and what service actually answered its outbound requests?
#Windowsexecutable#Startupregistrykeys#Persistence#HTTPPOSTrequests#HTTPredirects#SandboxanalysisActorsRATicateIOCf1 · i0 · d7 · u0MITRE24RegionsMYIndustriesGovernment
FILEMembersNov 4, 2026, 17:36 (UTC+9)Excel launches an executable; a separate payload request lacks delivery proof
An Excel spreadsheet’s sandbox record contains a request for an executable at www.bagsrad.com and traffic to a different host’s configured TCP endpoint on port 5203. Are these two parts of one delivery-and-control sequence? The evidence establishes distinct roles for the destinations, but not every link between them. CTX Threat Intelligence’s records show Excel launching a local executable, a matching executable appearing under another name, and a logon launch setting pointing to that second…
#maliciousspreadsheet#executablerequest#processexecution#Runkeypersistence#Warzone-familyconfiguration#DNStraffic#TCPtrafficActorsMuddyWater · TEMP.ZagrosIOCf1 · i0 · d1 · u2RegionsAU · CH · DE · DKIndustriesBusiness Associations · Energy · Retail
FILEMembersNov 4, 2026, 02:12 (UTC+9)Executable imports reveal a shared DLL architecture, not verified execution
A Windows executable submitted as spoolsrv.exe names three unusually specific dependencies: coli-0.dll.coli_setID, trch-1.dll.Parameter_hasValue and tucl-1.dll.TcLog. A second executable, submitted as svschost.exe, requests the same DLLs alongside several others. Those names recur among the files profiled by CTX Threat Intelligence. The question is not simply whether the files have similar malware labels, but whether their internal references reveal a connected software design.
#Windowsexecutables#DLLimports#Modulartoolset#Softwarepacking#UPX#PEanalysisActorsRaspite · LeafminerIOCf47 · i0 · d1 · u2MITRE11RegionsUSIndustriesRetail
FILEMembersNov 3, 2026, 09:41 (UTC+9)Uninstall request carries an identifier matching local registry state
A signed uninst.exe sent an HTTP request announcing type=uninstall&action=start&app=c_disk_clean. The request also carried an opaque identifier that exactly matched a value recorded in the Windows registry during the same sandbox analysis. That combination raises a more useful question than whether the executable contacted the internet: what local state was being represented in the uninstall report, and how does that help explain the destination’s role?
#uninstaller#HTTPreporting#registryidentifiers#sandboxanalysis#signedexecutable#cleaningutilityActorsFIN6 · Skeleton SpiderIOCf24 · i0 · d0 · u0MITRE15RegionsCN · HK · SGIndustriesFinancial Services
FILEMembersNov 2, 2026, 17:42 (UTC+9)Activation sample sought a Defender exclusion for its own executable
An executable running as program.exe launched cmd.exe, which launched WMIC with a request to add that same executable to Windows Defender’s exclusion list. The parent-child relationship is recorded in a CAPE Sandbox report—not merely inferred from a detection label. Other matched process events associated with the sample requested exclusions for an AAct_files directory and named executables and a DLL. The concrete finding is an attempt to change what Defender would inspect.
#Defenderexclusions#WMIC#processcreation#activationsoftware#remoteadministration#serviceregistryartifactActorsGamaredon Group · CTIGIOCf4 · i0 · d0 · u0MITRE22IndustriesGovernment
FILEMembersNov 2, 2026, 01:48 (UTC+9)AppData file write leads to an observed child process
A sandbox report places an executable under %APPDATA% and shows a process at that same path as a child of the file being tested. The input is a .NET program just 7,168 bytes long. Is that small executable the program investigators need to understand, or is its more consequential role to start something else? The records assembled by CTX Threat Intelligence support the second reading: the sample participates in a concrete handoff to another executable, which in turn has a temporary-file process…
#maliciousfile#.NETexecutable#AppDataexecution#childprocess#installer-likebehavior#sandboxanalysis#HTTPrequestActorsPromethium · StrongPityIOCf81 · i0 · d1 · u3MITRE14RegionsUS
FILEMembersNov 1, 2026, 09:49 (UTC+9)Three configured domains overlap with Remcos network alerts at the IP level
Three port-443 destinations in a Windows executable’s network alerts also appear in DNS records for domains listed in its extracted command-and-control configuration. That overlap raises a more useful question than whether the domains look suspicious: how much of the file’s configured network has evidence of actual use? CTX Threat Intelligence’s records connect the executable to eleven distinct configured domains, spanning names under africa.com, hk.com, radio.am and .blog.
#Remcos#Windowsexecutable#C2configuration#Networkalerts#DNSrecords#RegistrywriteActorsGorgon Group · SubaatIOCf1 · i0 · d11 · u6RegionsUSIndustriesRetail
FILEMembersOct 31, 2026, 01:45 (UTC+9)Date Manager and PrecisionTime share a registry structure with distinct settings
In separate sandbox reports, Date Manager and PrecisionTime recorded their executable locations under the same Gator.com registry structure. Each used a product-specific branch with entries named event, lockfiles and restart. The paths pointed back to the executables represented in the respective reports. What does that establish: a shared application-management mechanism, automatic persistence, or a connection to the similarly named date-manager.com domain? The strongest finding is local.
#DateManager#PrecisionTime#registryconfiguration#sandboxanalysis#executablepaths#DNSrecordsActorsSnowglobe · Animal FarmIOCf18 · i1 · d1 · u0MITRE21RegionsDE
FILEMembersOct 30, 2026, 09:32 (UTC+9)Matching script hash links executable drop to separate analysis
A Windows executable’s sandbox report records a VBScript file in the Startup folder and a wscript.exe process beneath the executable. The script’s hash matches a separately analysed file whose own reports show JavaScript placement, logon-launch settings and HTTP exchanges with an external endpoint. The question is not simply whether the executable is malicious: how much of its activity continues through scripts, and which connections between those components can actually be demonstrated?
#Windowsexecutable#VBScript#JavaScript#Startupfolder#Runkeys#scriptexecution#HTTPrequestsActorsTA2541 · Operation LayoverIOCf12 · i1 · d1 · u3RegionsCN · PK
FILEMembersOct 29, 2026, 17:37 (UTC+9)Same external host appears in two browser sandbox reports
Two browser sandbox reports for the same local HTML file record a lookup of www.webzdarma.cz and a TCP connection to its resolved address, 185.64.219.22, on port 443. One report opened the file in Microsoft Edge; the other used Google Chrome. The repeated destination raises a concrete question: what role did that external host play when the local page was opened? The records reviewed by CTX Threat Intelligence establish a useful hostname-to-address connection in both environments.
#HTMLdocument#browsersandbox#DNSlookup#externalresources#certificateretrieval#browsermaintenanceActorsSalty Spider · KuKuIOCf31 · i0 · d1 · u2MITRE58RegionsBDIndustriesConsulting
FILEMembersOct 28, 2026, 11:10 (UTC+9)Spreadsheet analysis links executable launch to matching local files
Excel launched an executable from a user’s Windows Templates directory while analysis of the same spreadsheet recorded a request for an .exe file on www.bagsrad.com. But the remote endpoint recovered from memory was elsewhere: mirrowingviewnet.ydns.eu:5203. Which address supplied the program, and which was intended to control it? The evidence supports different roles, with different levels of certainty.
#Warzone#maliciousspreadsheet#executablelaunch#Run-keypersistence#command-and-control#executablerequestActorsMuddyWater · TEMP.ZagrosIOCf1 · i0 · d1 · u2RegionsCH · DE · TR · USIndustriesConstruction · Education & Research · Hospitality & Leisure
FILEMembersOct 27, 2026, 10:57 (UTC+9)Shared DNS settings link two domains; a TLS match links a different pair
mrodularmall.top shares its recorded nameserver set and SPF text with crosshairc.life, but its recorded TLS service fingerprint matches a different domain: gunlovers.top. Does that make the three hosts one infrastructure cluster? CTX Threat Intelligence’s records support a narrower, more useful finding: mrodularmall.top is a pivot between two distinct infrastructure comparisons, not a demonstrated link in a command-and-control network.
#DNSconfiguration#SPFrecords#MXrecords#TLSfingerprinting#JARM#InfrastructurecomparisonIOCf25 · i0 · d4 · u8MITRE29RegionsPK
FILEMembersOct 26, 2026, 10:20 (UTC+9)Installer turns an obscure resource file into PowerShell input
The executable’s PowerShell child did not launch a conventional .ps1 file. Its command read Amnesias.Und from a directory under the user’s roaming profile, extracted three characters from the file’s contents and used the resulting string as a command name. That raises a more useful question than whether the installer used PowerShell: was this obscurely named file a passive resource, or part of the execution mechanism? The records establish the latter.
#PowerShell#installerexecutable#scriptexecution#filedrop#processinspection#WindowsErrorReportingActorsKimsuky · Velvet ChollimaIOCf8 · i0 · d0 · u1MITRE27RegionsPK
FILEMembersOct 25, 2026, 17:39 (UTC+9)Dropped executable’s hash links dayroc.exe to a csrss.exe mimic
C:\Windows\rss\csrss.exe appears as a process image, a scheduled-task target and a Run-key value in the supplied sandbox evidence. A firewall command also names that same executable. The convergence raises a more useful question than whether a suspicious file borrowed a Windows process name: what placed this component within the case, and what role were the surrounding settings intended to give it? CTX Threat Intelligence’s review identifies a concrete connection.
#Stealc#droppedexecutable#system-processmimicry#logonpersistence#scheduledtask#Runkey#firewallruleActorsBarium · Wicked SpiderIOCf14 · i4 · d0 · u8MITRE25RegionsPK
FILEMembersOct 25, 2026, 08:41 (UTC+9)BR.exe launches an AutoIt script, clarifying the package’s role
A process named BR.exe launched AutoIt3.exe with Waters.a3x as its argument. That parent-child relationship, recorded in a CAPE sandbox report, answers a question the executable’s “Internet Explorer” product metadata cannot: what was this package actually running? The evidence reviewed by CTX Threat Intelligence identifies a wrapper-and-script execution mechanism.
#AutoIt#scriptexecution#executablewrapper#sandboxanalysis#HTTPPOSTActorsAPT28 · StrontiumIOCf8 · i1 · d2 · u1MITRE38
FILEMembersOct 24, 2026, 11:11 (UTC+9)Dropped-file hashes reveal nested execution behind a shared endpoint
A Wextract-marked executable launched a program from one temporary directory, which in turn launched executables from another. In the same VMRay sandbox report, TCP traffic went to 185.161.248.73:4164—the exact destination found in extracted configurations for both the original file and one of its hash-identified components. The question is no longer simply whether the file is suspicious, but how its packaging behavior connects to that network destination.
#RedLine#Wextract#.NETexecutable#nestedexecution#C2traffic#RunOncecleanup#DefenderpolicychangesActorsSmoky SpiderIOCf6 · i1 · d0 · u1MITRE25RegionsPK
FILEMembersOct 23, 2026, 19:07 (UTC+9)Hash match links mining-configured executable to dropped payload
An executable that configured Windows-update-themed launch settings also left a second program in a temporary cache directory. In two sandbox reports, that file—WinInetCache\g3.exe—had the exact SHA-256 of a separately analyzed executable with SalatStealer configuration. The relationship raises a more consequential question than either malware label alone: was this merely a mining-related program, or did its activity extend to placing another malware component on the host?
#maliciousexecutable#payloaddelivery#miningconfiguration#logonpersistence#scheduledtask#configuredC2#securitypolicychangesActorsSnowglobe · Animal FarmIOCf31 · i3 · d0 · u1RegionsDE
FILEMembersOct 23, 2026, 06:22 (UTC+9)Updater’s `.cln` child matches the submitted file’s content
A PangYa-branded updater launched a child process named updater_signed.cln. The unusual extension triggered a suspicious-file-type rule, but the process record contains a more revealing detail: the child’s SHA-256 matches the submitted updater sample. What appears at first to be an unexplained extra executable is the known file’s content running under another name. That raises a more useful question than whether .cln looks suspicious: what work does this updater perform?
#softwareupdater#patchingworkflow#nonstandardfileextension#processcreation#HTTPrequests#componentfiles#certificatetrustActorsComment Crew · Byzantine CandorIOCf4 · i7 · d0 · u0MITRE11IndustriesConstruction · Telecommunications
FILEPublicOct 22, 2026, 09:36 (UTC+9)Configured endpoint appears in sandbox POST, beyond Azorult label
A sandbox report for a Windows executable records an HTTP POST to http://ANYIOBA.INFO/index.php—the exact URL identified in the file’s extracted configuration. That match answers a consequential question: was the endpoint merely present in configuration, or did it also appear in recorded network activity? In this case, it appeared in both. CTX Threat Intelligence’s evidence links the configured destination to a request recorded by Rising MOVES, which also logged a DNS lookup for anyioba.info.
#Azorult#Windowsexecutable#sandboxanalysis#HTTPPOST#extractedconfiguration#DNSlookupsActorsGorgon Group · SubaatIOCf1 · i0 · d1 · u2RegionsUSIndustriesRetail
FILEMembersOct 20, 2026, 10:01 (UTC+9)Seven size matches point to possible packaged malware components
A compressed file submitted as launch.exe contains a Windows executable with a reported uncompressed size of 176,386 bytes—the exact size of a separately catalogued executable identified as ntmstart.exe. That would be a modest lead on its own. In the records examined by CTX Threat Intelligence, however, the same relationship appears across seven compressed-file and executable candidates.
#Compressedexecutables#WindowsDLLs#Sandboxanalysis#Filehashmatching#Process-attributedwrites#RegistryRunkeys#AutostartActorsLazarus Group · Hastati GroupIOCf28 · i0 · d0 · u0MITRE27RegionsCN
FILEMembersOct 19, 2026, 18:24 (UTC+9)Registry setting targeted a temporary executable that also ran as a child
A temporary executable launched by bofuv.exe was also the target of a persistence-related registry setting. In the same Zenbox report, that temporary executable dropped and launched another executable. Was the temporary directory merely a staging area, or did it hold the components the sample was arranging to keep running? The evidence supports the second interpretation, with a specific limit: it shows an execution pattern linked to a launch setting, not a demonstrated return after logon.
#Windowsexecutable#registrymodification#persistence-relatedsetting#temporaryexecutables#processtree#TCPtraffic#configuredC2ActorsSpring Dragon · Lotus BlossomIOCf5 · i2 · d0 · u4RegionsUSIndustriesRetail
FILEMembersOct 18, 2026, 09:43 (UTC+9)Dropped-file hash links JavaScript to task-targeted payload
A JavaScript sandbox analysis recorded a file named WindowsUpdate.exe in a user’s temporary directory. Its SHA-256 matched a separately analyzed executable that requested a logon-triggered scheduled task pointing to that same location. The match answers the central question in this case: are the script, the executable and their launch settings merely similar-looking alerts, or do they describe connected components?
#JavaScript#Droppedexecutable#Scheduledtask#Runkey#Logonpersistence#DNSresolution#NetworktrafficActorsTA2541 · Operation LayoverIOCf14 · i0 · d2 · u1MITRE24
FILEMembersOct 17, 2026, 17:38 (UTC+9)Parallel DNS names lead to separate recorded alias targets
Two hostnames with the same yzzcommon prefix point to different CNAME targets under separate .com domains. The records raise a specific question: do the parallel names under tyui54345.xyz and zxcv56745.xyz represent a common destination, or simply a repeated naming scheme? CTX Threat Intelligence’s records establish the naming pattern and distinct DNS alias targets—not a common backend.
#DNSaliases#CNAMErecords#Parallelnaming#Windowsexecutable#MaliciousfiledetectionActorsGold Evergreen · Business ClubIOCf5 · i0 · d7 · u2RegionsUSIndustriesRetail
FILEMembersOct 16, 2026, 23:22 (UTC+9)Image-like archive name masks script staging and Defender exclusion requests
A Windows PowerShell process invoked tar -xf N.jpg -C $env:public: a command to extract an archive, not display a photograph. Why was a file with a JPEG-style name being passed to an archive tool? Records examined by CTX Threat Intelligence provide a concrete explanation. A submitted file named N.jpg is identified as a POSIX TAR archive containing PowerShell and VBScript components, while process events show scripts with corresponding extensions being invoked through Windows interpreters.
#TARarchive#scriptstaging#PowerShell#VBScript#commandobfuscation#DefenderexclusionrequestsActorsOperation Epic ManchegoIOCf23 · i3 · d1 · u3RegionsUSIndustriesTechnology
FILEMembersOct 16, 2026, 07:28 (UTC+9)Child processes link staged executables to logon launch settings
An executable running as software.exe created several other executables in a Windows temporary directory. The process tree placed some of those files directly beneath it, while a registry event identified one child setting a Windows-directory executable as a logon launch target. The question is not simply why so many filenames surround this sample, but what connects their roles: which files were staged, which ran, and which configured another path to run later?
#Windowsmalware#executablestaging#childprocesses#Run-keypersistence#registrychanges#processcreation#sandboxanalysisIOCf22 · i0 · d7 · u6MITRE30RegionsUA
FILEMembersOct 15, 2026, 15:24 (UTC+9)Configured C2 Host Matches Sandbox DNS and Traffic, Not a Proven Session
A Windows executable’s memory-derived configuration names https://sa1atik.cn/sa1at/ as a command-and-control endpoint. In a CAPE sandbox report for the same file, that hostname resolves to two addresses, one of which also appears as a TCP destination on port 443. The relationship raises a more useful question than whether the domain has a malicious reputation: how much of the configured communication route is visible in execution evidence?
#Windowsexecutable#Salat#C2configuration#malwareanalysis#DNSresolution#TLScertificates#sandboxtrafficActorsSnowglobe · Animal FarmIOCf1 · i1 · d1 · u1RegionsBG · DE · PH · PLIndustriesTelecommunications
FILEMembersOct 14, 2026, 23:37 (UTC+9)Sandbox reports pair written files with Windows Run targets
Two sandbox reports recorded HTTP POST requests to spaines.pw/EiDQjNbWEQ/. A third recorded a POST to the identical path on a different domain, vcklmnnejwxx.pw. Alongside those requests, each report contained a written bin.exe path and a Windows Run entry pointing to that report’s corresponding file location. The question is not simply whether these are suspicious names, but how far the recorded relationships establish a mechanism: a program configured to return at logon and communicate…
#WindowsRunkey#AppData#persistence#HTTPPOST#outboundrequests#sandboxanalysisActorsSmoky SpiderIOCf10 · i0 · d3 · u3RegionsRO
FILEMembersOct 14, 2026, 07:14 (UTC+9)Sandbox process chain shows executable launching recovery-disruption commands
A single command shell in a CAPE sandbox report connects an analyzed executable to five Windows recovery-management commands. Its children include tools launched to delete shadow copies, alter boot-recovery settings and remove the backup catalog. The important question is not simply whether this resembles ransomware, but how much of the recovery-disruption mechanism the record actually demonstrates.
#Windowsexecutable#ransomware-orientedactivity#recoverydisruption#shadow-copydeletion#boot-recoverychanges#backup-catalogdeletion#Runkeypersistence#event-logclearingActorsLockbit GangIOCf37 · i0 · d0 · u0MITRE35RegionsRO
FILEMembersOct 13, 2026, 15:19 (UTC+9)AAct sample invokes WMIC to request Defender exclusions for itself and helper paths
An executable running as program.exe launched a command shell, which in turn launched Windows’ WMIC utility with an unusual request: add the executable’s own path to Microsoft Defender’s exclusions. The process tree makes the question concrete. Was this simply an activation utility trying to avoid detection, or evidence of a broader attempt to protect other components from inspection?
#AAct#Defenderexclusions#WMIC#processexecution#KMSemulator#scheduledtasks#servicepersistenceActorsGamaredon Group · CTIGIOCf2 · i0 · d0 · u0MITRE17IndustriesGovernment
FILEMembersOct 12, 2026, 23:27 (UTC+9)Seven size matches point to possible packaged PE counterparts
A compressed object submitted as launch.exe is reported to expand to 176,386 bytes—the exact size of a separately listed Windows executable, ntmstart.exe. The same pattern recurs across six other compressed records and their possible executable or DLL counterparts. Are these additional components, or different representations of the same underlying files?
#ZLIBcompression#PEfiles#filehashes#sandboxanalysis#filewrites#Runkey#WindowsmetadataActorsLazarus Group · Hastati GroupIOCf29 · i0 · d0 · u0MITRE29RegionsSG
FILEMembersOct 12, 2026, 07:22 (UTC+9)Copied executable gains a logon launch setting, but restart is unproven
A Windows executable appears in sandbox output under the name PCSuite.exe, with exactly the same SHA-256 as the submitted sample. The same sample’s analysis records also identify two different executables written to disk. Is this simply a program changing location, or a source of additional execution routes? The evidence assembled by CTX Threat Intelligence supports the second interpretation.
#Windowsmalware#Run-keypersistence#DLLexecution#Batch-fileexecution#Sandboxanalysis#HTTPrequestsIOCf18 · i1 · d13 · u0MITRE48RegionsUSIndustriesRetail
FILEMembersOct 10, 2026, 23:23 (UTC+9)Image-named DLL path set as Remote Desktop service load target
Windows Remote Desktop’s service configuration was pointed at a file named C:\Windows\branding\mediasrv.png. The extension suggests an image, but a separate sandbox report identified a file dropped at that exact path as a 64-bit Windows DLL. Why was an image-named file being selected as a service component? The records reviewed by CTX Threat Intelligence support a concrete answer: the executable under analysis attempted to reconfigure Remote Desktop-related services, including their load target…
#WindowsDLL#RemoteDesktopServices#ServiceDLLconfiguration#PowerShell#Registrymodification#Service-startcommands#PortreconfigurationActorsTA505 · Hive0065IOCf10 · i2 · d3 · u8
FILEMembersOct 9, 2026, 15:34 (UTC+9)Word document’s download loop led to executables with different hashes
A web request in a Word-document sandbox analysis received an HTTP 200 response offering an executable attachment. The same report recorded an artifact under the attachment’s name, identical file content at a different local pathname, and a PowerShell child process bearing that local name. The question is no longer simply whether the document was malicious: how closely can its instructions, network activity and executable output be connected?
#Worddocument#PowerShelldownloader#encodedcommand#HTTPdownload#executableartifact#sandboxanalysisActorsEmotet Group · TA542IOCf4 · i0 · d5 · u3RegionsAUIndustriesTechnology
FILEMembersOct 8, 2026, 23:42 (UTC+9)Security-named program requests logon task to relaunch itself
A program running as Windows Security.exe launched the Windows task utility with a revealing instruction: create a task called “Windows Defender Security,” triggered at logon, that would run the same roaming-profile path as its parent. The security branding raises a practical question: was this a protective component, or a program arranging its own return under a reassuring name? Sandbox events reviewed by CTX Threat Intelligence support the latter interpretation.
#scheduledtasks#Runkey#logonpersistence#Defenderexclusion#roaming-profileexecutables#sandboxanalysisActorsLazyScripterIOCf10 · i2 · d1 · u3MITRE9RegionsZAIndustriesGovernment
FILEMembersOct 8, 2026, 07:32 (UTC+9)Hash-identified XMRig launch shares an IP with separate C2 configuration
A Windows process named sysmgnrsv.exe was created with a command line directing an XMRig miner to 178.16.54.109:6060. In a different file’s memory-extracted configuration, the same IP appeared on TCP port 6000, classified as command-and-control infrastructure. Does that overlap connect mining and malware control into one execution chain?
#XMRig#cryptomining#C2configuration#processcreation#SMTPconnections#infrastructureoverlapIOCf18 · i2 · d37 · u2MITRE19RegionsCN · GB · HK · HUIndustriesRetail
FILEMembersOct 5, 2026, 15:26 (UTC+9)Two distinct Windows files share the same executable URL
The same executable URL, http://propanla.com/77.exe, appears in network-rule matches associated with two distinct Windows files: one carrying 7-Zip self-extractor metadata, the other identifying its product as FarLabUninstaller. The shared address raises a concrete question: does it connect two stages of a delivery chain, or show separate files reaching the same delivery location? CTX Threat Intelligence’s records support the second, narrower finding.
#Windowsexecutables#self-extractingpackages#executabledelivery#HTTPrequests#network-rulematches#DNSrecordsActorsLazarus Group · Hastati GroupIOCf23 · i2 · d7 · u6RegionsUSIndustriesRetail
FILEMembersOct 2, 2026, 14:57 (UTC+9)Upatre Downloader Trips a CryptoLocker Ransomware Rule
A 57-kilobyte Windows executable now flagged by 63 of 77 engines on VirusTotal does something routine for its category and something genuinely odd for its label at the same time. It carries extra data appended past the end of its own executable image — a lightweight, old-school downloader obfuscation trick rather than a packer or custom crypter — while simultaneously tripping a YARA rule written specifically to catch CryptoLocker variants.
#Upatre#CryptoLockerYARArule#Zbot#GoldEvergreen#BusinessClub#retailsectortargeting#downloadermalware#domaininfrastructurereuseActorsGold Evergreen · Business ClubIOCf2 · i0 · d1 · u1MITRE9RegionsUSIndustriesRetail
FILEMembersOct 2, 2026, 06:50 (UTC+9)Fake 'Snapchat Mod APK' Site Serves Hash-Rotating LummaStealer
A domain built around the promise of a "Snapchat mod APK" — the kind of search-bait a mobile user might stumble into while hunting pirated app modifications — is instead handing out Windows desktop executables and batch scripts. thesnapchatmodapk.com, registered on 2025-04-11 and still resolving behind Cloudflare more than a year later, hosts a file list of update1.exe, update2.exe, update3.exe, mine.bat and wdd.bat. None of those are mobile artifacts.
#LummaStealer#crypterrotation#TelegramC2#phishingdomain#sandboxevasion#credentialtheft#cryptocurrencywallettheft#commoditymalwareIOCf11 · i0 · d1 · u5MITRE63RegionsGP · HUIndustriesTechnology
FILEMembersOct 1, 2026, 22:58 (UTC+9)A Decade-Old Driver Disguise Still Fools Two-Thirds of Antivirus
A trojan now resurfacing in a fresh indicator batch presents itself internally as c:\windows\system32\drivers\partmgr.sys — the Windows partition-manager driver — while the file that actually lands on disk carries a randomized name such as 7PLZfYlw8lxGk5pe1evjS.exe or N06A1Oj5m5fsNFiBO.exe. It ships with no code-signing certificate at all.
#Tofsee#Smokeloader#SmokySpider#filenamemasquerading#partmgr.sys#Let'sEncryptcertificateabuse#retailsectortargeting#commoditymalwareActorsSmoky SpiderIOCf2 · i1 · d0 · u1MITRE33RegionsUSIndustriesRetail
FILEMembersOct 1, 2026, 06:44 (UTC+9)Downloader Stalls, Then Runs on a Certificate That Already Expired
A Win32 downloader submitted under the name reader.exe carries a code-signing chain that should never have verified — VeriSign infrastructure revoked and expired before the file was ever signed against it — wrapped around anti-debugging logic and a network fingerprint that ties it, by rule name, to detections built for Operation Cloud Hopper. The sample (d26dae0d8e5c23ec35e8b9cf126cded45b8096fc07560ad1c06585357921eeed) is not new tradecraft.
#RedApollo#APT10#menuPass#ChChes#OperationCloudHopper#code-signingabuse#sandboxevasion#governmenttargetingActorsRed Apollo · PotassiumIOCf1 · i0 · d1 · u5MITRE13RegionsJO · ROIndustriesGovernment
FILEMembersSep 30, 2026, 06:47 (UTC+9)A Bitter Downloader Stalls Before It Beacons, Then Gives Itself Away
A Windows downloader tracked to the Bitter espionage cluster spends its opening moments doing nothing that looks like malware at all — it waits, it checks the clock, it looks for a debugger, and only then does it drop and run its actual payload. That patience is the story. The file (90fd32f8f7b494331ab1429712b1735c3d864c8c8a2461a5ab67b05023821787), a 52KB Win32 executable masquerading under the internal name "Windows," pairs that stalling behavior with a phishing front built on two…
#BitterAPT#APT-C-08#phishinginfrastructure#downloadermalware#governmentsectortargeting#Jordan#Romania#AlibabaClouddomainsActorsBitter · APT-C-08IOCf2 · i0 · d2 · u0MITRE19RegionsJO · ROIndustriesGovernment
FILEMembersSep 27, 2026, 22:59 (UTC+9)KerrDown Loader Disguises DLL as C:\Windows .exe, Splits Sandboxes
A Win32 dynamic-link library carrying the internal path C:\Windows\intkxqhf.exe is, by every technical measure VirusTotal records, not an executable at all — it is a raw PE32 DLL, unsigned, 90 kilobytes, first surfacing on public scanning infrastructure in November 2018 and still being resubmitted as recently as mid-2022. The mismatch between the file's true form and its disguised, exe-shaped alias is not cosmetic.
#KerrDown#OceanLotus#APT32#loadermalware#sandboxevasion#TLScertificatespoofing#governmentsectorespionage#masqueradingActorsOceanLotus · APT32IOCf1 · i0 · d1 · u2MITRE9RegionsJO · ROIndustriesGovernment
FILEMembersSep 25, 2026, 22:33 (UTC+9)Gamaredon's Pterodo Loader Stalls Sandboxes to Hide Its Real Payload
A Pterodo-family loader flagged by 57 of 77 antivirus engines carries something more interesting than its detection score. The binary reads the CPU timer directly to work out whether it is running inside an analysis environment, deliberately stalls for long periods before doing anything else, and only then reaches past the end of its own file to load a second payload that was appended there as raw bytes [T1497.003, T1106].
#Gamaredon#Pterodo#Shuckworm#sandboxevasion#macrodropper#overlaypayload#self-signedcertificate#RussianhostinginfrastructureActorsGamaredon Group · CTIGIOCf3 · i1 · d0 · u2MITRE16RegionsRO
FILEMembersSep 25, 2026, 14:43 (UTC+9)WebMonitor RAT Hides Behind Rotating Pool of Hex-Named .to Domains
Nine domains that look, at first glance, like noise — 81252b01.to, 69385701.to, efe87401.to, 1e517001.to, cf488101.to, 49b56c01.to, bb8c4e01.to, 53fb0701.to, 93319601.to — turn out to share a single, deliberate signature: every one of them exposes an identical subdomain, "stubbzy," and an identical checkin path, "recv3.php." That is not what independently registered infrastructure looks like.
#WebMonitorRAT#RevCode#UPXpacking#DGAdomains#C2infrastructure#Switzerland#Jordan#RomaniaIOCf2 · i0 · d11 · u9MITRE24RegionsCH · JO · ROIndustriesGovernment · Support Services
FILEMembersSep 25, 2026, 06:56 (UTC+9)APT29 Tag Doesn't Fit This Commodity RedLine/ClipBanker Cluster
A DevExpress-branded "patch and keygen" tool for pirated developer software has been circulating for at least four years, and CTX Team's review of the build artefacts shows it was never a one-off release. Two files trading on that exact branding — a 159KB tool named DevExpress_Patch_Keygen_DFoX.exe (c5460701f45d70e8b7255195ee08d15d87aa7847562ca27a6b5cd0c803418f5d) and a 6.4MB dropper named DevExpressPatch.exe (ebe9cb6a4e6bf1285e1cd120ca031e3f8d7fab938e1122579cfb49735d3db81d) — share an…
#APT29#RedLine#ClipBanker#njRAT#DevExpresscracklure#dynamicDNSinfrastructure#clipboardhijacking#commoditycrimewareActorsAPT29 · MinidionisIOCf13 · i0 · d1 · u0MITRE11RegionsIT
FILEMembersSep 24, 2026, 07:05 (UTC+9)A Coin-Miner Wearing svchost's Name
A six-indicator bundle arrived tagged to a named espionage actor and a bespoke malware family, but the only file in the set with a confirmed threat classification, matching rule hits, and a sandbox verdict is not an espionage tool at all — it is a UPX-packed cryptomining dropper that renames itself svchost.exe and trips an IDS signature associated with Tor relay traffic.
#coin-miner#svchostmasquerading#APT-C-35#DonotTeam#cryptojacking#UPXpacking#Torrelaytraffic#malwaremisattributionActorsAPTC35 · Donot TeamIOCf10 · i2 · d0 · u1MITRE38RegionsPLIndustriesManufacturing
FILEMembersSep 22, 2026, 22:34 (UTC+9)Recycled Sectigo Certificate Links Loader and Banking-Trojan Payload
The same revoked leaf certificate — serial 00 8E 3E 9A 2F E7 3C 91 98 5B 4F 90 D5 95 77 CD 6C, issued under the name MASTER LIM LTD and chained through COMODO RSA Code Signing CA up to Sectigo (formerly Comodo CA) — is stamped on two files that sit at opposite ends of a delivery chain: an NSIS self-extracting installer and the banking-trojan DLL it ultimately drops.
#TA505#LDPinchbanker#Sectigocodesigningabuse#NSISinstaller#VBScriptstager#sandboxevasion#DGAdomains#bankingtrojanActorsTA505 · Hive0065IOCf5 · i0 · d2 · u4MITRE37RegionsCH · USIndustriesRetail · Support Services
FILEMembersSep 22, 2026, 14:47 (UTC+9)5KB Fake 'update.exe' Stager Ties to Tomiris/YoroTrooper Espionage
A stager built to pass as nothing more than a routine Windows update file is barely large enough to hold its own icon — five kilobytes of packed .NET code, unsigned, dropped straight into C:\Windows\Temp\update.exe. Despite the size, 55 of 76 antivirus engines flag it, and the record ties the sample (4f237b5a…) to the espionage-focused Tomiris and YoroTrooper clusters.
#Tomiris#YoroTrooper#AgentTesla#.NETstager#anti-debuggingevasion#Let'sEncryptcertificateabuse#VDSINAVPShosting#espionagemalwareActorsTomiris · YoroTrooperIOCf1 · i1 · d0 · u1MITRE12RegionsCH · JO · USIndustriesGovernment · Retail · Support Services
FILEMembersSep 21, 2026, 14:31 (UTC+9)One 2009 Compile Job Is the Only Real Link in 'Klovbot' Cluster
Everything else in this record is décor around one hard fact: two of the five files carried under a shared feed label share not just a detection verdict but an identical import table hash, an identical rich-header fingerprint, and an identical PE compile timestamp of January 14, 2009. That is not coincidence — it is proof that whoever built the Hiloti/Mufanom downloader compiled it once and shipped it out twice, once packaged as a standalone executable and once as a dynamic-link library, both…
#Klovbot#Hiloti#Mufanom#Buzus#Prolaco#Renos#commoditymalware#malwareclusteringIOCf46 · i1 · d6 · u2MITRE48RegionsUSIndustriesEngineering