Indicators of compromise
53 indicators auto-extracted from article text · hashes, IPs, domains, URLs · verify before use
| Type | Indicator | Context | Article | First seen |
|---|---|---|---|---|
| md5 | 5c92d3b8734b4f498752f735a1ca0987 | n installer payload main-v2 hxxps://granderevolucao[.]store/5c92d3b8734b4f498752f735a1ca0987/{campaignId} .NET PE Injector sub-module hxxps://archive[.] | The extension you never installed: KREMLIN forges Chrome's own integrity checks to steal banking sessions Elastic Security Labs | · 1d ago |
| md5 | 2915b3f8b703eb744fc54c81f4a9c67f | d393e0a4109ae189bc64f1f3e312653dcf317a2bd406f18ffcc507 MD5: 2915b3f8b703eb744fc54c81f4a9c67f Talos Rep: https://talosintelligence.com/talos_file_reputat | We've got one word for it, and it's usually the wrong one Cisco Talos | · 5d ago |
| md5 | 38de5b216c33833af710e88f7f64fc98 | bb5ac1ec5297b4a65be3f647589adf7c37b45f3f7466decd6a4a7f MD5: 38de5b216c33833af710e88f7f64fc98 Talos Rep: https://talosintelligence.com/talos_file_reputat | We've got one word for it, and it's usually the wrong one Cisco Talos | · 5d ago |
| md5 | 9a47c4d379998ade2f8f99e23a630c06 | a076ba24bdd2d0ee532ef991c1ef25a2431a19f850942ba2ab16b2 MD5: 9a47c4d379998ade2f8f99e23a630c06 Talos Rep: https://talosintelligence.com/talos_file_reputat | We've got one word for it, and it's usually the wrong one Cisco Talos | · 5d ago |
| md5 | c2efb2dcacba6d3ccc175b6ce1b7ed0a | e6bc2779ea0b4736ed9a998a71ae37390331b6ba87e389a49d3d59 MD5: c2efb2dcacba6d3ccc175b6ce1b7ed0a Talos Rep: https://talosintelligence.com/talos_file_reputat | We've got one word for it, and it's usually the wrong one Cisco Talos | · 5d ago |
| md5 | f3e82419a43220a7a222fc01b7607adc | 8fe5e1516cba35c85fc03e503bd1b5469113ffa1f1b9e10897f811 MD5: f3e82419a43220a7a222fc01b7607adc Talos Rep: https://talosintelligence.com/talos_file_reputat | We've got one word for it, and it's usually the wrong one Cisco Talos | · 5d ago |
| md5 | 0e39e8d7b641bcda4376ebbfeff7b12e | cluded in the malicious ISO File name / MD5 %TEMP%\find.vbs 0e39e8d7b641bcda4376ebbfeff7b12e Script that displays the fake “license not found” message E | Hackers Use Fake GTA 6 Downloads to Deploy RATs, Infostealers and Data-Wiping Malware Cyber Security News | · 5d ago |
| md5 | 15eca4a3f7350423cf4db0b4c30d1968 | 6ef97a7ada98257b23577bf5e3 60a0f58001ea7be538cd42b651924cc7 15eca4a3f7350423cf4db0b4c30d1968 ea991bc9334b36a6b958f564ee716776 2a385fe7bed9899d77d05cb8e3 | Hackers Use Fake GTA 6 Downloads to Deploy RATs, Infostealers and Data-Wiping Malware Cyber Security News | · 5d ago |
| md5 | 1ec9eff863dc4418d1498bc3d904899d | haos ransomware File name / MD5 %TEMP%\YandexPackLoader.exe 1ec9eff863dc4418d1498bc3d904899d Browser installer included in the malicious ISO File name / | Hackers Use Fake GTA 6 Downloads to Deploy RATs, Infostealers and Data-Wiping Malware Cyber Security News | · 5d ago |
| md5 | 2a0834560ed3770fc33d7a42f8229722 | %\rockstargamescrashfixer.exe , %TEMP%\rockstarservices.exe 2a0834560ed3770fc33d7a42f8229722 57b9c56ef97a7ada98257b23577bf5e3 60a0f58001ea7be538cd42b651 | Hackers Use Fake GTA 6 Downloads to Deploy RATs, Infostealers and Data-Wiping Malware Cyber Security News | · 5d ago |
| md5 | 2a385fe7bed9899d77d05cb8e302d557 | a3f7350423cf4db0b4c30d1968 ea991bc9334b36a6b958f564ee716776 2a385fe7bed9899d77d05cb8e302d557 NJRAT copies and associated launchers IP addresses 35.157.1 | Hackers Use Fake GTA 6 Downloads to Deploy RATs, Infostealers and Data-Wiping Malware Cyber Security News | · 5d ago |
| md5 | 57b9c56ef97a7ada98257b23577bf5e3 | TEMP%\rockstarservices.exe 2a0834560ed3770fc33d7a42f8229722 57b9c56ef97a7ada98257b23577bf5e3 60a0f58001ea7be538cd42b651924cc7 15eca4a3f7350423cf4db0b4c3 | Hackers Use Fake GTA 6 Downloads to Deploy RATs, Infostealers and Data-Wiping Malware Cyber Security News | · 5d ago |
| md5 | 60a0f58001ea7be538cd42b651924cc7 | 560ed3770fc33d7a42f8229722 57b9c56ef97a7ada98257b23577bf5e3 60a0f58001ea7be538cd42b651924cc7 15eca4a3f7350423cf4db0b4c30d1968 ea991bc9334b36a6b958f564ee | Hackers Use Fake GTA 6 Downloads to Deploy RATs, Infostealers and Data-Wiping Malware Cyber Security News | · 5d ago |
| md5 | 6b49f24d5d5b49127476bc385565f8b0 | ecutable File name / MD5 %TEMP%\checkinternetconnection.bat 6b49f24d5d5b49127476bc385565f8b0 Batch file used to confirm internet connectivity File names | Hackers Use Fake GTA 6 Downloads to Deploy RATs, Infostealers and Data-Wiping Malware Cyber Security News | · 5d ago |
| md5 | 8da3fe3664d81226b0fb2a50a0537d4f | at , C:\Users\Default\Local Settings\[RANDOM FILE NAME].exe 8da3fe3664d81226b0fb2a50a0537d4f DCRAT installer components and binary Hosts-file entries 0. | Hackers Use Fake GTA 6 Downloads to Deploy RATs, Infostealers and Data-Wiping Malware Cyber Security News | · 5d ago |
| md5 | a15e280a3fd65dfaa243bbe2dbf45e97 | ype Indicator Description File name / MD5 Gta6installer.exe a15e280a3fd65dfaa243bbe2dbf45e97 Initial fake installation executable File name / MD5 %TEMP% | Hackers Use Fake GTA 6 Downloads to Deploy RATs, Infostealers and Data-Wiping Malware Cyber Security News | · 5d ago |
| md5 | b9648ec8cc806e7661aabcfc91dc836c | %TEMP%\gta6.exe , %USERPROFILE%\AppData\Roaming\svchost.exe b9648ec8cc806e7661aabcfc91dc836c Chaos ransomware binaries File name read_it.txt Note droppe | Hackers Use Fake GTA 6 Downloads to Deploy RATs, Infostealers and Data-Wiping Malware Cyber Security News | · 5d ago |
| md5 | dfdf5e5b78d2ec764c0e5641cf9a0d26 | -control infrastructure File name / MD5 %TEMP%\adminapp.exe dfdf5e5b78d2ec764c0e5641cf9a0d26 Mercurial Grabber infostealer binary URL https://discord[.] | Hackers Use Fake GTA 6 Downloads to Deploy RATs, Infostealers and Data-Wiping Malware Cyber Security News | · 5d ago |
| md5 | ea991bc9334b36a6b958f564ee716776 | 8001ea7be538cd42b651924cc7 15eca4a3f7350423cf4db0b4c30d1968 ea991bc9334b36a6b958f564ee716776 2a385fe7bed9899d77d05cb8e302d557 NJRAT copies and associate | Hackers Use Fake GTA 6 Downloads to Deploy RATs, Infostealers and Data-Wiping Malware Cyber Security News | · 5d ago |
| md5 | 15eca4a3f7350423cf4db0b4c30d1968 | 6ef97a7ada98257b23577bf5e3 60a0f58001ea7be538cd42b651924cc7 15eca4a3f7350423cf4db0b4c30d1968 Ea991bc9334b36a6b958f564ee716776 2a385fe7bed9899d77d05cb8e3 | Fake GTA 6 Installer Steals Browser Passwords, Discord Tokens and Crypto Data From Gamers GBHackers | · 5d ago |
| md5 | 2a0834560ed3770fc33d7a42f8229722 | ckstargamescrashfixer.exe %TEMP%\rockstarservices.exe MD5s: 2a0834560ed3770fc33d7a42f8229722 57b9c56ef97a7ada98257b23577bf5e3 60a0f58001ea7be538cd42b651 | Fake GTA 6 Installer Steals Browser Passwords, Discord Tokens and Crypto Data From Gamers GBHackers | · 5d ago |
| md5 | 2a385fe7bed9899d77d05cb8e302d557 | a3f7350423cf4db0b4c30d1968 Ea991bc9334b36a6b958f564ee716776 2a385fe7bed9899d77d05cb8e302d557 Copies of NJRAT and associated launchers Note: IP addresses | Fake GTA 6 Installer Steals Browser Passwords, Discord Tokens and Crypto Data From Gamers GBHackers | · 5d ago |
| md5 | 57b9c56ef97a7ada98257b23577bf5e3 | rockstarservices.exe MD5s: 2a0834560ed3770fc33d7a42f8229722 57b9c56ef97a7ada98257b23577bf5e3 60a0f58001ea7be538cd42b651924cc7 15eca4a3f7350423cf4db0b4c3 | Fake GTA 6 Installer Steals Browser Passwords, Discord Tokens and Crypto Data From Gamers GBHackers | · 5d ago |
| md5 | 60a0f58001ea7be538cd42b651924cc7 | 560ed3770fc33d7a42f8229722 57b9c56ef97a7ada98257b23577bf5e3 60a0f58001ea7be538cd42b651924cc7 15eca4a3f7350423cf4db0b4c30d1968 Ea991bc9334b36a6b958f564ee | Fake GTA 6 Installer Steals Browser Passwords, Discord Tokens and Crypto Data From Gamers GBHackers | · 5d ago |
| md5 | 6b49f24d5d5b49127476bc385565f8b0 | llation executable %TEMP%\checkinternetconnection.bat MD5 : 6b49f24d5d5b49127476bc385565f8b0 BAT file used to confirm a working internet connection %TEM | Fake GTA 6 Installer Steals Browser Passwords, Discord Tokens and Crypto Data From Gamers GBHackers | · 5d ago |
| md5 | a15e280a3fd65dfaa243bbe2dbf45e97 | -clean media. IOCs Item Description Gta6installer.exe MD5 : a15e280a3fd65dfaa243bbe2dbf45e97 Initial installation executable %TEMP%\checkinternetconnect | Fake GTA 6 Installer Steals Browser Passwords, Discord Tokens and Crypto Data From Gamers GBHackers | · 5d ago |
| md5 | ea991bc9334b36a6b958f564ee716776 | 8001ea7be538cd42b651924cc7 15eca4a3f7350423cf4db0b4c30d1968 Ea991bc9334b36a6b958f564ee716776 2a385fe7bed9899d77d05cb8e302d557 Copies of NJRAT and associ | Fake GTA 6 Installer Steals Browser Passwords, Discord Tokens and Crypto Data From Gamers GBHackers | · 5d ago |
| md5 | 9678f71ea4cccbc3d511dc8d7f24b113 | 25f44db68a MacSync sample hash reported by SEQRITE MD5 hash 9678f71ea4cccbc3d511dc8d7f24b113 MacSync sample MD5 hash SHA-1 hash 59508d071661ea70fa5fcbe6 | Hackers Use Fake Claude and ChatGPT Installers to Infect Mac Users With Password-Stealing Malware Cyber Security News | · 5d ago |
| md5 | de62a2f47d1c7dec2997f931a050a615 | h used for stolen-data uploads HTTP request header api-key: de62a2f47d1c7dec2997f931a050a615 API key observed in MacSync network requests HTTP User-Agen | Hackers Use Fake Claude and ChatGPT Installers to Infect Mac Users With Password-Stealing Malware Cyber Security News | · 5d ago |
| md5 | 9678f71ea4cccbc3d511dc8d7f24b113 | b68aeadc44eeb97c9aab11 Native Mach-O Stager Binary MD5 Hash 9678f71ea4cccbc3d511dc8d7f24b113 Native Mach-O Stager Binary SHA-1 Hash 59508d071661ea70fa5f | Hackers Use ClickFix Lures to Deploy MacSync Stealer and Bypass macOS Security. GBHackers | · 5d ago |
| md5 | 528cd4e69ecfa5191adbcf6ef28667bf | Infrastructure used to execute campaign activity File hash 528cd4e69ecfa5191adbcf6ef28667bf lsa_read.exe — Rust LSA secret reader File hash ce870a91e8d | Hackers Deploy Hundreds of AI Agents to Compromise 440 PaperCut Servers GBHackers | · 5d ago |
| md5 | 974decb9ff4c8f9ccb0937c96d513347 | sa_collect_small.exe — Rust LSA bootkey collector File hash 974decb9ff4c8f9ccb0937c96d513347 certipy.exe — Active Directory Certificate Services abuse t | Hackers Deploy Hundreds of AI Agents to Compromise 440 PaperCut Servers GBHackers | · 5d ago |
| md5 | a6437ac3d6798090a218520985d36a3f | 687abc60b04 save_hives.exe — registry hive dumper File hash a6437ac3d6798090a218520985d36a3f collect_custom.exe — Rust custom collection tool File hash | Hackers Deploy Hundreds of AI Agents to Compromise 440 PaperCut Servers GBHackers | · 5d ago |
| md5 | ce870a91e8d27e8f663f0687abc60b04 | f6ef28667bf lsa_read.exe — Rust LSA secret reader File hash ce870a91e8d27e8f663f0687abc60b04 save_hives.exe — registry hive dumper File hash a6437ac3d67 | Hackers Deploy Hundreds of AI Agents to Compromise 440 PaperCut Servers GBHackers | · 5d ago |
| md5 | fc92dfafa7aa741c5f2b9cbcf75d1d19 | collect_custom.exe — Rust custom collection tool File hash fc92dfafa7aa741c5f2b9cbcf75d1d19 lsa_collect_small.exe — Rust LSA bootkey collector File has | Hackers Deploy Hundreds of AI Agents to Compromise 440 PaperCut Servers GBHackers | · 5d ago |
| md5 | 0e39e8d7b641bcda4376ebbfeff7b12e | 18d1498bc3d904899d Yandex web browser %TEMP%\find.vbs MD5 : 0e39e8d7b641bcda4376ebbfeff7b12e Script that displays a "license not found" message | Grand Theft Auto VI hype leads to malware Huntress | · 6d ago |
| md5 | 15eca4a3f7350423cf4db0b4c30d1968 | 6ef97a7ada98257b23577bf5e3 60a0f58001ea7be538cd42b651924cc7 15eca4a3f7350423cf4db0b4c30d1968 Ea991bc9334b36a6b958f564ee716776 2a385fe7bed9899d77d05cb8e3 | Grand Theft Auto VI hype leads to malware Huntress | · 6d ago |
| md5 | 1ec9eff863dc4418d1498bc3d904899d | ansomware-encrypted files %TEMP%\YandexPackLoader.exe MD5 : 1ec9eff863dc4418d1498bc3d904899d Yandex web browser %TEMP%\find.vbs MD5 : 0e39e8d7b641bcda43 | Grand Theft Auto VI hype leads to malware Huntress | · 6d ago |
| md5 | 2a0834560ed3770fc33d7a42f8229722 | ckstargamescrashfixer.exe %TEMP%\rockstarservices.exe MD5s: 2a0834560ed3770fc33d7a42f8229722 57b9c56ef97a7ada98257b23577bf5e3 60a0f58001ea7be538cd42b651 | Grand Theft Auto VI hype leads to malware Huntress | · 6d ago |
| md5 | 2a385fe7bed9899d77d05cb8e302d557 | a3f7350423cf4db0b4c30d1968 Ea991bc9334b36a6b958f564ee716776 2a385fe7bed9899d77d05cb8e302d557 Copies of NJRAT and associated launchers 35.157.111[.]131 3 | Grand Theft Auto VI hype leads to malware Huntress | · 6d ago |
| md5 | 57b9c56ef97a7ada98257b23577bf5e3 | rockstarservices.exe MD5s: 2a0834560ed3770fc33d7a42f8229722 57b9c56ef97a7ada98257b23577bf5e3 60a0f58001ea7be538cd42b651924cc7 15eca4a3f7350423cf4db0b4c3 | Grand Theft Auto VI hype leads to malware Huntress | · 6d ago |
| md5 | 60a0f58001ea7be538cd42b651924cc7 | 560ed3770fc33d7a42f8229722 57b9c56ef97a7ada98257b23577bf5e3 60a0f58001ea7be538cd42b651924cc7 15eca4a3f7350423cf4db0b4c30d1968 Ea991bc9334b36a6b958f564ee | Grand Theft Auto VI hype leads to malware Huntress | · 6d ago |
| md5 | 6b49f24d5d5b49127476bc385565f8b0 | llation executable %TEMP%\checkinternetconnection.bat MD5 : 6b49f24d5d5b49127476bc385565f8b0 BAT file used to confirm a working internet connection %TEM | Grand Theft Auto VI hype leads to malware Huntress | · 6d ago |
| md5 | 8da3fe3664d81226b0fb2a50a0537d4f | :\Users\Default\Local Settings\[RANDOM FILE NAME].exe MD5 : 8da3fe3664d81226b0fb2a50a0537d4f Copy of DCRAT and associated installation files 0.0.0.0 app | Grand Theft Auto VI hype leads to malware Huntress | · 6d ago |
| md5 | a15e280a3fd65dfaa243bbe2dbf45e97 | Compromise (IOCs) Item Description Gta6installer.exe MD5 : a15e280a3fd65dfaa243bbe2dbf45e97 Initial installation executable %TEMP%\checkinternetconnect | Grand Theft Auto VI hype leads to malware Huntress | · 6d ago |
| md5 | b9648ec8cc806e7661aabcfc91dc836c | MP%\gta6.exe %USERPROFILE%\AppData\Roaming\svchost.exe MD5: b9648ec8cc806e7661aabcfc91dc836c Chaos ransomware binaries read_it.txt Ransomware note left | Grand Theft Auto VI hype leads to malware Huntress | · 6d ago |
| md5 | dfdf5e5b78d2ec764c0e5641cf9a0d26 | IP address that DCRAT connects to %TEMP%\adminapp.exe MD5 : dfdf5e5b78d2ec764c0e5641cf9a0d26 Mercurial Grabber infostealer binary https://discord[.]com/ | Grand Theft Auto VI hype leads to malware Huntress | · 6d ago |
| md5 | ea991bc9334b36a6b958f564ee716776 | 8001ea7be538cd42b651924cc7 15eca4a3f7350423cf4db0b4c30d1968 Ea991bc9334b36a6b958f564ee716776 2a385fe7bed9899d77d05cb8e302d557 Copies of NJRAT and associ | Grand Theft Auto VI hype leads to malware Huntress | · 6d ago |
| md5 | 528cd4e69ecfa5191adbcf6ef28667bf | ute the campaign 45.158.196.75 Used to execute the campaign 528cd4e69ecfa5191adbcf6ef28667bf (lsa_read.exe) Rust LSA secret reader ce870a91e8d27e8f663f0 | Agents Gone Wild: An AI-Orchestrated Global Campaign Against PaperCut NG/MF GreyNoise | · 6d ago |
| md5 | 974decb9ff4c8f9ccb0937c96d513347 | f75d1d19 (lsa_collect_small.exe) Rust LSA bootkey collector 974decb9ff4c8f9ccb0937c96d513347 (certipy.exe) ADCS Abuse Tool Administrator17 Adversary cre | Agents Gone Wild: An AI-Orchestrated Global Campaign Against PaperCut NG/MF GreyNoise | · 6d ago |
| md5 | a6437ac3d6798090a218520985d36a3f | 27e8f663f0687abc60b04 (save_hives.exe) Registry Hive Dumper a6437ac3d6798090a218520985d36a3f (collect_custom.exe) Rust custom collector fc92dfafa7aa741c | Agents Gone Wild: An AI-Orchestrated Global Campaign Against PaperCut NG/MF GreyNoise | · 6d ago |
| md5 | ce870a91e8d27e8f663f0687abc60b04 | fa5191adbcf6ef28667bf (lsa_read.exe) Rust LSA secret reader ce870a91e8d27e8f663f0687abc60b04 (save_hives.exe) Registry Hive Dumper a6437ac3d6798090a2185 | Agents Gone Wild: An AI-Orchestrated Global Campaign Against PaperCut NG/MF GreyNoise | · 6d ago |
| md5 | fc92dfafa7aa741c5f2b9cbcf75d1d19 | a218520985d36a3f (collect_custom.exe) Rust custom collector fc92dfafa7aa741c5f2b9cbcf75d1d19 (lsa_collect_small.exe) Rust LSA bootkey collector 974decb9 | Agents Gone Wild: An AI-Orchestrated Global Campaign Against PaperCut NG/MF GreyNoise | · 6d ago |
Extraction is regex-based (SHA-256/SHA-1/MD5, public IPv4, defanged hxxp/[.] indicators, and bare domains/emails only from malware, actor, exploit, phishing, ransomware and breach articles with a nearby indicator context word). Treat confidence as low until you verify against the source article.