Kirk Sayre kirk-sayre-work
kirk-sayre-work
/ gist:f3ff9633cea04c7eed5f00962a6a666d
Created
August 31, 2023 18:44
Async RAT JS/PWSH IOCs 6/2023 - 8/2023
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Async RAT JS/PWSH IOCs 6/2023 - 8/2023 | |
| Domains: | |
| asuxtp.fun | |
| docusec.top | |
| easdiv.top | |
| eividsy.top | |
| eovze.fun | |
| euuvua3.top |
kirk-sayre-work
/ gist:fb88bb6c7d0dba92ed8c19c0c1a254b2
Created
August 22, 2023 22:05
Strela Stealer JS IOCs 6/23 - 8/22/2023
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| JS Sample Hashes: | |
| 9b20c63d3f0c1d24e05187f89f281c0b9a606344d6764179198149a405d5bc21 | |
| d01f48387858ae24bd9cb56464a3583d4c63b3ff1429c9dd78b1b5b6fc1ac969 | |
| bbe2297b23e4060abd6351cfdb2a9e043217ad00f9b2349fcc86ca6f8c5cdd6d | |
| 2f7bebbe3db9d041e85723dc4c997279b12dbe44c7d40b286071722f87d5a210 | |
| efeacce1ff64045b4b4f04b54150ef2ed991c0850bc22b6220fc37b69eb3f1e7 | |
| b5511dcb01ed978944b9b7e052ad00832a6d2439a0fea352d9c35eb27427b6ec | |
| 95e0322d029d6cda1d65a9def576455be66a7520f14fd2eabcecf1f5ddeec5e1 | |
| 142dd778e8cb858f0b02bfaa551164fa3ccbea82b280838aaf1696a88ff223ea |
kirk-sayre-work
/ gist:48a31b90e830a57adf5f3cf3726fe0d2
Last active
August 11, 2023 20:04
DarkGate VBS IOCs 8/11/2023
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| 2nd Stage URLs: | |
| http://149.248.0.82:2351/msiaybguqux | |
| http://149.248.0.82:2351/msihlxovvqy | |
| http://149.248.0.82:2351/msikywiobng | |
| http://149.248.0.82:2351/msivwrwqepo | |
| http://149.248.0.82:2351/msilrqozizy | |
| http://45.89.65.198:80/msidkbkejlq | |
| http://45.89.65.198:80/msilrajnmvn | |
| http://reactervnamnat.com:80/msicvmskumh |
kirk-sayre-work
/ gist:0d97bb93244b39b8a0b89c6ce50bd570
Created
July 25, 2023 15:37
Danabot VBS, 9/2022 - 6/2023
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| 29c272e281c77612613122f5ab4a3a02b83081512f945369288a09aefe5878e6 | |
| https://job.goosenecks.sbs/?ntz1hdcu1k1gb3mcx37vinss0nszf | |
| 360154387ae3f1c820d5f03d970c8ec609084d1a85c582bf32354fd96427c475 | |
| https://naagara.top/?nbxzv1myb3rb0v34fizozcuxj3mj | |
| 57008f154c30f7b2e2f2f92be69d7c0fc914382a2566304d1e4ced950bb9b114 | |
| https://naagara.top/?nbxzv1myb3rb0v34fizozcuxj3mj | |
| 5d9b7b6fed87b3a87337b02c820d2253c711fe5f51bc26f632990d48eea7570b |
kirk-sayre-work
/ gist:f9748c3cae156b56a0751679085b3f8e
Created
July 21, 2023 21:07
AsyncRAT 7/21/2023
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Next Stage Download Domains: | |
| asuxtp.fun | |
| bisiv.top | |
| dubpv.top | |
| eovze.fun | |
| fyzyxe.top | |
| igsufb.top | |
| izrvb.top | |
| lvuse.top |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| TwoFace 2nd Stage Domains/IPs: | |
| 159.223.101.65 | |
| 159.203.143.66 | |
| 159.65.42.223 | |
| 46.161.40.72 | |
| vincentnicotra.com | |
| Initial JS Hashes: |
kirk-sayre-work
/ gist:3c327a0c4f57a79fcd23c14dae26d6a6
Created
May 29, 2023 17:06
Hagga VBScript 5/29/2023
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| VBS 2nd Stage URLs (Downloads Powershell Samples) | |
| https://cff66d08-d3f8-42db-911c-ce670399a441.usrfiles.com/ugd/cff66d_474c983f67584a68b9747c126f9d9aa2.txt | |
| https://cff66d08-d3f8-42db-911c-ce670399a441.usrfiles.com/ugd/cff66d_d998ff806b4342ca8768b93e8696a4f0.txt | |
| https://cff66d08-d3f8-42db-911c-ce670399a441.usrfiles.com/ugd/cff66d_b20de016303147c58a0969a0f797cffd.txt | |
| https://cff66d08-d3f8-42db-911c-ce670399a441.usrfiles.com/ugd/cff66d_dbeb9a17fa7043b8baf3001e555e14b0.txt | |
| VBS Sample Hashes | |
| d47b6cd7bfdfc3188cd9188a90e2e6c535e51ef31e6bd2fb0406bb749ee13a9a |
kirk-sayre-work
/ gist:1a7ec92ab9018ffac71ee5826de9aba8
Created
May 16, 2023 20:31
NetSupport RAT 5/16/2023
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| PWSH Download URLs (Hit From JS Samples): | |
| http://193.233.233.92/f2.ps1 | |
| http://91.193.43.96/upl.ps1 | |
| https://alfaisalsweets.com/img/file1.ps1 | |
| https://axenholidays.com/static/media/file4.ps1 | |
| https://batata.bio/f3.ps1 | |
| https://bettamint.com/forms/file3.ps1 | |
| https://bikexiner.lotieneconisiore.com/file1.ps1 | |
| https://carpenteriemancini.com/f2.ps1 |
kirk-sayre-work
/ gist:bcb40d1080f0e541877f1ce331088d7c
Created
May 10, 2023 16:19
JsOutProx RAT 5/10/2023
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| JS Sample Sha256 C2 URL | |
| 9c3912e3030b26e80cc4ed88be01fbc90ed957671c3724fcb722dc5463038d40 http://nipsantorijjex.hopto.org:7991/ | |
| 291d1bf490bd86cc462dcf5522cf06a6df874645d6302475aec3359cb6395dbf http://miklandisander.hopto.org:9094/ | |
| 344c43e01e36758f4b93b6f9550193f2b44f2d1f96b9c10e2e797eccbebaa95c http://mewusengalsety.serveblog.net:8911/ | |
| 4c34f108e408d45175f9101fc0c062a9813b69ae647bbd717267d0e44bd42d66 http://lisdunbaddetuyn.sytes.net:8091/ | |
| 5aef6a599a00c72a367086f866c02e55e0e48122fc412c036b5627e3f84a3bc2 http://lisdunbaddetuyn.sytes.net:8091/ | |
| 6c979c3a943abe8f271cc6b2669905558f5be46e8b791292b9c88afa8782a2d4 http://lisdunbaddetuyn.sytes.net:8091/ | |
| cf989006368139280104e7e7ef302492a59d56f74c3dd6c223c4d593ecfde1db http://jusdintinhoper.servebeer.com:8189/ | |
| 85e69d7163b781f3668b0420c507095800e8ae3d4c6032bf6cf0d357bd387d36 http://jusdintinhoper.servebeer.com:8189/ |
kirk-sayre-work
/ gist:eafc405b65bd51b890a864a1883de44e
Created
March 3, 2023 16:47
Transparent Tribe DOCM Sample IOCs
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Transparent Tribe DOCM Samples | |
| 3/3/2023 | |
| 68b26c871064a770accd63eafb2bcc46d52cbf9f6b3da8602b70cdb9f4c764b2 | |
| GstCil.zip (a440ff5098919d46692ee663a623b9e1d3bc344bb37f80c529d85e52fa05cfaa) | |
| 3/3/2023 | |
| 681f9bc9b2b78c0ef921539d4e382734d5bccd9a045c2fb4016bef5313944c2b | |
| MahTukiu.zip (c61e51e909be63aa56ef9b27df9e507454c040382294d978320dac1238f78c5c) |