Indicators

32 indicators from 2 posts

• domain
  suvary.net Delivery, wildcard subdomains An IRS-Themed Lure Installing Signed RMM Tooling
• domain
  flawlessresearchers.com Second-stage delivery An IRS-Themed Lure Installing Signed RMM Tooling
• domain
  pronconetydesire.online Relay An IRS-Themed Lure Installing Signed RMM Tooling
• domain
  ollama[.]lnk Installer / initial access (/install.ps1) When "ollama.js" Isn't Ollama
• domain
  eventlogerps1[.]ink Stage 1 loader host (/eventlog/ollama.js) When "ollama.js" Isn't Ollama
• domain
  qweuyquigwebq[.]com WebSocket C2, command and control only When "ollama.js" Isn't Ollama
• domain
  adyitegqbk[.]com HTTP exfil backend (/gate, /filegrabber, /api/config/extensions) When "ollama.js" Isn't Ollama
• domain
  bestgrillde31[.]com Prior exfil backend, commented-out dev artifact When "ollama.js" Isn't Ollama
• file
  C:\Program Files (x86)\ScreenConnect Client (0b0e8475d25de13b)\ Install directory An IRS-Themed Lure Installing Signed RMM Tooling
• file
  %APPDATA%\WsLReports\wsx_component.dll Dropped DLL When "ollama.js" Isn't Ollama
• file
  %APPDATA%\ext\ Browser extension directory (manifest.json, background.js, run.bat, zqpbm.ps1) When "ollama.js" Isn't Ollama
• file
  %LOCALAPPDATA%\deno\remote\https\... Cached remote loader When "ollama.js" Isn't Ollama
• file
  app_edge.pdb PDB string (build user: root) When "ollama.js" Isn't Ollama
• imphash
  86e4d4e85066d9dfbedf093af785490d wsx_component.dll When "ollama.js" Isn't Ollama
• md5
  f2f2fab719f560fdb80f5bcf27a3200c wsx_component.dll When "ollama.js" Isn't Ollama
• mutex
  Local\keybedge Mutex When "ollama.js" Isn't Ollama
• mutex
  Local\keybrave Mutex When "ollama.js" Isn't Ollama
• mutex
  Local\keye Mutex When "ollama.js" Isn't Ollama
• other
  0b0e8475d25de13b ScreenConnect instance ID, derives from relay's RSA keypair An IRS-Themed Lure Installing Signed RMM Tooling
• other
  neikokiahjlchabokkaijchmbhafcdme Chrome extension ID (name: slueuk) When "ollama.js" Isn't Ollama
• other
  com.abcd Native host name When "ollama.js" Isn't Ollama
• path
  /id/official.php Kit landing page path An IRS-Themed Lure Installing Signed RMM Tooling
• path
  /id/dip.php Kit payload path An IRS-Themed Lure Installing Signed RMM Tooling
• registry
  HKLM\SYSTEM\CurrentControlSet\Services\ScreenConnect Client (0b0e8475d25de13b) Service key; ImagePath holds the full launch string An IRS-Themed Lure Installing Signed RMM Tooling
• registry
  HKLM\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall\ScreenConnect Client (0b0e8475d25de13b) Uninstall key An IRS-Themed Lure Installing Signed RMM Tooling
• registry
  HKCU\Software\Google\Chrome\NativeMessagingHosts\com.abcd Native messaging host registration (Edge/Brave equivalents too) When "ollama.js" Isn't Ollama
• sha1
  6c083b73d8d28180a7c1989a718174414577e412 Delivery SFX An IRS-Themed Lure Installing Signed RMM Tooling
• sha256
  1abaf5fd03106d0cc8075d0fb797628323f622a4a2e396982dbda47f59922e07 Delivery SFX (ID.me_IRS_VM_REC_Secure_Verification_Gateway...) An IRS-Themed Lure Installing Signed RMM Tooling
• sha256
  12e3a548d148ebf8175e6ea8d65d39748a183d3600213f1196ccd9cb864b816e Relay RSA public key SHA256 An IRS-Themed Lure Installing Signed RMM Tooling
• sha256
  bfce6aa6d1b49c5ada05bc7254fc64219af63a8bf9c598615e6de77937cb1203 ollama.js When "ollama.js" Isn't Ollama
• sha256
  1fdeaf2fc69208b3a021015971949494a69fbecb6885296df07ace0f08429570 wsx_component.dll When "ollama.js" Isn't Ollama
• url
  relay.pronconetydesire.online:8041 Relay endpoint An IRS-Themed Lure Installing Signed RMM Tooling