Indicators of compromise
4,251 indicators auto-extracted from article text · hashes, IPs, domains, URLs · verify before use
| Type | Indicator | Context | Article | First seen |
|---|---|---|---|---|
| domain | baoxis.cc | top invoice.msopsa[.]top qse.shoppes[.]help shaaslong[.]one baoxis[.]cc baolongwes.oss-ap-southeast-1.aliyuncs[.]com sdcwww.oss-a | An unknown actor distributes malicious VBS scripts via WhatsApp Kaspersky Securelist | · Jun 22, 2026 |
| domain | baskwms.top | d0d01b75e04e784953c5e2b sleestak_payload_1.vbs Domains temu.baskwms[.]top invoice.msopsa[.]top qse.shoppes[.]help shaaslong[.]one b | An unknown actor distributes malicious VBS scripts via WhatsApp Kaspersky Securelist | · Jun 22, 2026 |
| domain | msopsa.top | b sleestak_payload_1.vbs Domains temu.baskwms[.]top invoice.msopsa[.]top qse.shoppes[.]help shaaslong[.]one baoxis[.]cc baolongwes | An unknown actor distributes malicious VBS scripts via WhatsApp Kaspersky Securelist | · Jun 22, 2026 |
| domain | shaaslong.one | temu.baskwms[.]top invoice.msopsa[.]top qse.shoppes[.]help shaaslong[.]one baoxis[.]cc baolongwes.oss-ap-southeast-1.aliyuncs[.]com | An unknown actor distributes malicious VBS scripts via WhatsApp Kaspersky Securelist | · Jun 22, 2026 |
| domain | shoppes.help | d_1.vbs Domains temu.baskwms[.]top invoice.msopsa[.]top qse.shoppes[.]help shaaslong[.]one baoxis[.]cc baolongwes.oss-ap-southeast-1 | An unknown actor distributes malicious VBS scripts via WhatsApp Kaspersky Securelist | · Jun 22, 2026 |
| md5 | 02bb20455cc592a69c080abac770ce90 | 0ba93109757776a44de9d8c88baa4963 Financial Reports(C1).vbs 02bb20455cc592a69c080abac770ce90 Le formulaire de demande le plus récent .vbs 6c39900d77dcba | An unknown actor distributes malicious VBS scripts via WhatsApp Kaspersky Securelist | · Jun 22, 2026 |
| md5 | 05d188f071d097f5b6bd8138749b4b14 | 708e050632a4280cabf98ac1376b7 Outstanding Balance Sheet.vbs 05d188f071d097f5b6bd8138749b4b14 Penyata bank.vbs 2c6f05f1f309d89b2236e6c8b59c88f9 Account S | An unknown actor distributes malicious VBS scripts via WhatsApp Kaspersky Securelist | · Jun 22, 2026 |
| md5 | 0ba93109757776a44de9d8c88baa4963 | s 20209b3a32769afc6a75694b8d8839dd Statement of Debt(A).vbs 0ba93109757776a44de9d8c88baa4963 Financial Reports(C1).vbs 02bb20455cc592a69c080abac770ce90 | An unknown actor distributes malicious VBS scripts via WhatsApp Kaspersky Securelist | · Jun 22, 2026 |
| md5 | 1a3cc75466ffb1971482f7abf7aabc3f | cf iowepv.vbs 8c6d9fc389ad3f20ccbc71d77eb39bfa btksfmsi.vbs 1a3cc75466ffb1971482f7abf7aabc3f home3.vbs 1c47c63e5ed25060d95359c57c77b107 zipats.vbs 31037 | An unknown actor distributes malicious VBS scripts via WhatsApp Kaspersky Securelist | · Jun 22, 2026 |
| md5 | 1c47c63e5ed25060d95359c57c77b107 | bfa btksfmsi.vbs 1a3cc75466ffb1971482f7abf7aabc3f home3.vbs 1c47c63e5ed25060d95359c57c77b107 zipats.vbs 31037a42ca048e06e69a78f55bc2eff5 1122.vbs 7f1644 | An unknown actor distributes malicious VBS scripts via WhatsApp Kaspersky Securelist | · Jun 22, 2026 |
| md5 | 1d94fbe9cab21278cc3f104bea334d08 | .vbs 993f4c0cadbc769a4b0ed62a918db58d FinancialReportsS.vbs 1d94fbe9cab21278cc3f104bea334d08 Promissory_Note(b).vbs 9d9ac85765e4a818a3ccabe2cf4fef82 Deb | An unknown actor distributes malicious VBS scripts via WhatsApp Kaspersky Securelist | · Jun 22, 2026 |
| md5 | 20209b3a32769afc6a75694b8d8839dd | 4044e4b6471c9de7b0a4ba37d9d9df9a billing statement (2).vbs 20209b3a32769afc6a75694b8d8839dd Statement of Debt(A).vbs 0ba93109757776a44de9d8c88baa4963 F | An unknown actor distributes malicious VBS scripts via WhatsApp Kaspersky Securelist | · Jun 22, 2026 |
| md5 | 2c6f05f1f309d89b2236e6c8b59c88f9 | Sheet.vbs 05d188f071d097f5b6bd8138749b4b14 Penyata bank.vbs 2c6f05f1f309d89b2236e6c8b59c88f9 Account Statement（13K） (2).vbs 3b1aba44dd3d9b6339b6f56e2f42 | An unknown actor distributes malicious VBS scripts via WhatsApp Kaspersky Securelist | · Jun 22, 2026 |
| md5 | 31037a42ca048e06e69a78f55bc2eff5 | abc3f home3.vbs 1c47c63e5ed25060d95359c57c77b107 zipats.vbs 31037a42ca048e06e69a78f55bc2eff5 1122.vbs 7f16449cd0c4862d1eadf8a5742bf09a payload_1.vbs 79e | An unknown actor distributes malicious VBS scripts via WhatsApp Kaspersky Securelist | · Jun 22, 2026 |
| md5 | 3b1aba44dd3d9b6339b6f56e2f42034b | 05f1f309d89b2236e6c8b59c88f9 Account Statement（13K） (2).vbs 3b1aba44dd3d9b6339b6f56e2f42034b Statement of Account.txt d43fdaa1f0ee09d7e5f0f94ee9df7b6c B | An unknown actor distributes malicious VBS scripts via WhatsApp Kaspersky Securelist | · Jun 22, 2026 |
| md5 | 4044e4b6471c9de7b0a4ba37d9d9df9a | 0593e8e0e8fac49429e9b45ebf7fa1 Outstanding Payment List.vbs 4044e4b6471c9de7b0a4ba37d9d9df9a billing statement (2).vbs 20209b3a32769afc6a75694b8d8839dd | An unknown actor distributes malicious VBS scripts via WhatsApp Kaspersky Securelist | · Jun 22, 2026 |
| md5 | 4f0593e8e0e8fac49429e9b45ebf7fa1 | 5002eca748205d544618e3bd2dedc223 Statement of Debt(29K).vbs 4f0593e8e0e8fac49429e9b45ebf7fa1 Outstanding Payment List.vbs 4044e4b6471c9de7b0a4ba37d9d9df | An unknown actor distributes malicious VBS scripts via WhatsApp Kaspersky Securelist | · Jun 22, 2026 |
| md5 | 5002eca748205d544618e3bd2dedc223 | 5b6bbcc06cf08cc99e1afeda486d42fb Extrato de Conciliação.vbs 5002eca748205d544618e3bd2dedc223 Statement of Debt(29K).vbs 4f0593e8e0e8fac49429e9b45ebf7fa1 | An unknown actor distributes malicious VBS scripts via WhatsApp Kaspersky Securelist | · Jun 22, 2026 |
| md5 | 5b6bbcc06cf08cc99e1afeda486d42fb | ).vbs 6359e6236471cbe434d0ef4c42b7f879 Applicationform1.vbs 5b6bbcc06cf08cc99e1afeda486d42fb Extrato de Conciliação.vbs 5002eca748205d544618e3bd2dedc223 | An unknown actor distributes malicious VBS scripts via WhatsApp Kaspersky Securelist | · Jun 22, 2026 |
| md5 | 6359e6236471cbe434d0ef4c42b7f879 | 66442f2457eca8f47385b1fb2c6fcab8 Statement of Debt(30K).vbs 6359e6236471cbe434d0ef4c42b7f879 Applicationform1.vbs 5b6bbcc06cf08cc99e1afeda486d42fb Extra | An unknown actor distributes malicious VBS scripts via WhatsApp Kaspersky Securelist | · Jun 22, 2026 |
| md5 | 63ac85195b73753333316a889cf5880f | .vbs df4fa0369eaca5cec348be293890d4af Account Statement.vbs 63ac85195b73753333316a889cf5880f Statement of Account(O).vbs 74fd9f91fc93b6288b4fc253ea5b3e2 | An unknown actor distributes malicious VBS scripts via WhatsApp Kaspersky Securelist | · Jun 22, 2026 |
| md5 | 66442f2457eca8f47385b1fb2c6fcab8 | (4).vbs 68c16c46f8afb9e00bbaba0207fb0a46 Debt Note (2).vbs 66442f2457eca8f47385b1fb2c6fcab8 Statement of Debt(30K).vbs 6359e6236471cbe434d0ef4c42b7f879 | An unknown actor distributes malicious VBS scripts via WhatsApp Kaspersky Securelist | · Jun 22, 2026 |
| md5 | 66705384a7ad81d14c34fc6c054a0ecf | 58e5c0 dfjieya.vbs 8c3322009b8982663c0cbecd9492e7eb 0lf.vbs 66705384a7ad81d14c34fc6c054a0ecf iowepv.vbs 8c6d9fc389ad3f20ccbc71d77eb39bfa btksfmsi.vbs 1a | An unknown actor distributes malicious VBS scripts via WhatsApp Kaspersky Securelist | · Jun 22, 2026 |
| md5 | 68c16c46f8afb9e00bbaba0207fb0a46 | 7403cbcc5a9c32384d431856dc48fcc9 Statement of debt (4).vbs 68c16c46f8afb9e00bbaba0207fb0a46 Debt Note (2).vbs 66442f2457eca8f47385b1fb2c6fcab8 Statemen | An unknown actor distributes malicious VBS scripts via WhatsApp Kaspersky Securelist | · Jun 22, 2026 |
| md5 | 6c39900d77dcba158e1d27c7619cb06d | 080abac770ce90 Le formulaire de demande le plus récent .vbs 6c39900d77dcba158e1d27c7619cb06d Outstanding Balance Sheet(A).vbs dad708e050632a4280cabf98ac | An unknown actor distributes malicious VBS scripts via WhatsApp Kaspersky Securelist | · Jun 22, 2026 |
| md5 | 6fb6a55424adfb61e31f06aef33273e5 | (b).vbs 9d9ac85765e4a818a3ccabe2cf4fef82 Debt Statement.vbs 6fb6a55424adfb61e31f06aef33273e5 dfjieya.vbs f90ed4b2d0b67114aa89ddfed658e5c0 dfjieya.vbs 8c | An unknown actor distributes malicious VBS scripts via WhatsApp Kaspersky Securelist | · Jun 22, 2026 |
| md5 | 7403cbcc5a9c32384d431856dc48fcc9 | 81c1bc8cfd588e8998968e2621456e Outstanding Payment List.vbs 7403cbcc5a9c32384d431856dc48fcc9 Statement of debt (4).vbs 68c16c46f8afb9e00bbaba0207fb0a46 | An unknown actor distributes malicious VBS scripts via WhatsApp Kaspersky Securelist | · Jun 22, 2026 |
| md5 | 74fd9f91fc93b6288b4fc253ea5b3e20 | 3ac85195b73753333316a889cf5880f Statement of Account(O).vbs 74fd9f91fc93b6288b4fc253ea5b3e20 Sila semak bil anda.vbs d06333c360b51456f427e616c3c5f8bd Si | An unknown actor distributes malicious VBS scripts via WhatsApp Kaspersky Securelist | · Jun 22, 2026 |
| md5 | 7849061c536a3efb05a56d504694e7e7 | 09a payload_1.vbs 79ecd61b09b0f2d54b34586c916c4ec9 sac8.vbs 7849061c536a3efb05a56d504694e7e7 6oy.vbs ddaffe9849f7f3c79f8804adb9a6b3d5 kof.vbs d01cad98dd | An unknown actor distributes malicious VBS scripts via WhatsApp Kaspersky Securelist | · Jun 22, 2026 |
| md5 | 79ecd61b09b0f2d54b34586c916c4ec9 | ff5 1122.vbs 7f16449cd0c4862d1eadf8a5742bf09a payload_1.vbs 79ecd61b09b0f2d54b34586c916c4ec9 sac8.vbs 7849061c536a3efb05a56d504694e7e7 6oy.vbs ddaffe984 | An unknown actor distributes malicious VBS scripts via WhatsApp Kaspersky Securelist | · Jun 22, 2026 |
| md5 | 7f16449cd0c4862d1eadf8a5742bf09a | 77b107 zipats.vbs 31037a42ca048e06e69a78f55bc2eff5 1122.vbs 7f16449cd0c4862d1eadf8a5742bf09a payload_1.vbs 79ecd61b09b0f2d54b34586c916c4ec9 sac8.vbs 784 | An unknown actor distributes malicious VBS scripts via WhatsApp Kaspersky Securelist | · Jun 22, 2026 |
| md5 | 7f81c1bc8cfd588e8998968e2621456e | s 993f4c0cadbc769a4b0ed62a918db58d Financial Reports(s).vbs 7f81c1bc8cfd588e8998968e2621456e Outstanding Payment List.vbs 7403cbcc5a9c32384d431856dc48fc | An unknown actor distributes malicious VBS scripts via WhatsApp Kaspersky Securelist | · Jun 22, 2026 |
| md5 | 8c3322009b8982663c0cbecd9492e7eb | e5 dfjieya.vbs f90ed4b2d0b67114aa89ddfed658e5c0 dfjieya.vbs 8c3322009b8982663c0cbecd9492e7eb 0lf.vbs 66705384a7ad81d14c34fc6c054a0ecf iowepv.vbs 8c6d9fc | An unknown actor distributes malicious VBS scripts via WhatsApp Kaspersky Securelist | · Jun 22, 2026 |
| md5 | 8c6d9fc389ad3f20ccbc71d77eb39bfa | 492e7eb 0lf.vbs 66705384a7ad81d14c34fc6c054a0ecf iowepv.vbs 8c6d9fc389ad3f20ccbc71d77eb39bfa btksfmsi.vbs 1a3cc75466ffb1971482f7abf7aabc3f home3.vbs 1c4 | An unknown actor distributes malicious VBS scripts via WhatsApp Kaspersky Securelist | · Jun 22, 2026 |
| md5 | 993f4c0cadbc769a4b0ed62a918db58d | f13c7b8ba391b2f597874e54d310648 Electronic statement(A).vbs 993f4c0cadbc769a4b0ed62a918db58d Financial Reports(s).vbs 7f81c1bc8cfd588e8998968e2621456e O | An unknown actor distributes malicious VBS scripts via WhatsApp Kaspersky Securelist | · Jun 22, 2026 |
| md5 | 9d9ac85765e4a818a3ccabe2cf4fef82 | vbs 1d94fbe9cab21278cc3f104bea334d08 Promissory_Note(b).vbs 9d9ac85765e4a818a3ccabe2cf4fef82 Debt Statement.vbs 6fb6a55424adfb61e31f06aef33273e5 dfjieya | An unknown actor distributes malicious VBS scripts via WhatsApp Kaspersky Securelist | · Jun 22, 2026 |
| md5 | 9f13c7b8ba391b2f597874e54d310648 | .vbs b7cd06c71465038b658a6dc1f273a507 Debt confirmation.vbs 9f13c7b8ba391b2f597874e54d310648 Electronic statement(A).vbs 993f4c0cadbc769a4b0ed62a918db58 | An unknown actor distributes malicious VBS scripts via WhatsApp Kaspersky Securelist | · Jun 22, 2026 |
| md5 | b7cd06c71465038b658a6dc1f273a507 | ript c7f38cbb99c8b74fa0465293feeba700 Financial Reports.vbs b7cd06c71465038b658a6dc1f273a507 Debt confirmation.vbs 9f13c7b8ba391b2f597874e54d310648 Elec | An unknown actor distributes malicious VBS scripts via WhatsApp Kaspersky Securelist | · Jun 22, 2026 |
| md5 | c7f38cbb99c8b74fa0465293feeba700 | r legitimacy has been independently verified. IOCs VBScript c7f38cbb99c8b74fa0465293feeba700 Financial Reports.vbs b7cd06c71465038b658a6dc1f273a507 Debt | An unknown actor distributes malicious VBS scripts via WhatsApp Kaspersky Securelist | · Jun 22, 2026 |
| md5 | d01cad98dd0d01b75e04e784953c5e2b | 504694e7e7 6oy.vbs ddaffe9849f7f3c79f8804adb9a6b3d5 kof.vbs d01cad98dd0d01b75e04e784953c5e2b sleestak_payload_1.vbs Domains temu.baskwms[.]top invoice.m | An unknown actor distributes malicious VBS scripts via WhatsApp Kaspersky Securelist | · Jun 22, 2026 |
| md5 | d06333c360b51456f427e616c3c5f8bd | bs 74fd9f91fc93b6288b4fc253ea5b3e20 Sila semak bil anda.vbs d06333c360b51456f427e616c3c5f8bd Sila semak bil anda.vbs 993f4c0cadbc769a4b0ed62a918db58d Fi | An unknown actor distributes malicious VBS scripts via WhatsApp Kaspersky Securelist | · Jun 22, 2026 |
| md5 | d43fdaa1f0ee09d7e5f0f94ee9df7b6c | s 3b1aba44dd3d9b6339b6f56e2f42034b Statement of Account.txt d43fdaa1f0ee09d7e5f0f94ee9df7b6c Bitte füllen Sie das Formular für Umsatzsteuer-Nullsatz-Ver | An unknown actor distributes malicious VBS scripts via WhatsApp Kaspersky Securelist | · Jun 22, 2026 |
| md5 | dad708e050632a4280cabf98ac1376b7 | 0d77dcba158e1d27c7619cb06d Outstanding Balance Sheet(A).vbs dad708e050632a4280cabf98ac1376b7 Outstanding Balance Sheet.vbs 05d188f071d097f5b6bd8138749b4 | An unknown actor distributes malicious VBS scripts via WhatsApp Kaspersky Securelist | · Jun 22, 2026 |
| md5 | ddaffe9849f7f3c79f8804adb9a6b3d5 | c916c4ec9 sac8.vbs 7849061c536a3efb05a56d504694e7e7 6oy.vbs ddaffe9849f7f3c79f8804adb9a6b3d5 kof.vbs d01cad98dd0d01b75e04e784953c5e2b sleestak_payload_1 | An unknown actor distributes malicious VBS scripts via WhatsApp Kaspersky Securelist | · Jun 22, 2026 |
| md5 | df4fa0369eaca5cec348be293890d4af | Sie das Formular für Umsatzsteuer-Nullsatz-Verkäufe aus.vbs df4fa0369eaca5cec348be293890d4af Account Statement.vbs 63ac85195b73753333316a889cf5880f Stat | An unknown actor distributes malicious VBS scripts via WhatsApp Kaspersky Securelist | · Jun 22, 2026 |
| md5 | f90ed4b2d0b67114aa89ddfed658e5c0 | Statement.vbs 6fb6a55424adfb61e31f06aef33273e5 dfjieya.vbs f90ed4b2d0b67114aa89ddfed658e5c0 dfjieya.vbs 8c3322009b8982663c0cbecd9492e7eb 0lf.vbs 667053 | An unknown actor distributes malicious VBS scripts via WhatsApp Kaspersky Securelist | · Jun 22, 2026 |
| domain | ajb8.com | s to AryStinger’s C2 and download infrastructure, primarily ajb8.com , dataexplore.cc , and dataexplore.co hostnames. Check /tmp | 4,300+ Outdated Routers Hijacked in Stealthy Spy Infrastructure by AryStinger malware Security Affairs | · Jun 22, 2026 |
| domain | dataexplore.cc | nger’s C2 and download infrastructure, primarily ajb8.com , dataexplore.cc , and dataexplore.co hostnames. Check /tmp/bin for binaries | 4,300+ Outdated Routers Hijacked in Stealthy Spy Infrastructure by AryStinger malware Security Affairs | · Jun 22, 2026 |
| domain | dataexplore.co | d infrastructure, primarily ajb8.com , dataexplore.cc , and dataexplore.co hostnames. Check /tmp/bin for binaries you didn’t put there | 4,300+ Outdated Routers Hijacked in Stealthy Spy Infrastructure by AryStinger malware Security Affairs | · Jun 22, 2026 |
| ipv4 | 107.150.106.14 | s XLab threat detection system flagged a single IP address, 107.150.106.14, spreading a Linux binary through two vulnerabilities that | 4,300+ Outdated Routers Hijacked in Stealthy Spy Infrastructure by AryStinger malware Security Affairs | · Jun 22, 2026 |
| domain | ajb8.com | nd connections to AryStinger's C2 and download domains (the ajb8.com and related hosts in XLab's IOC list ), check /tmp/bin for | AryStinger Malware Infects 4,300 Legacy Routers to Build Reconnaissance Proxy Network The Hacker News | · Jun 22, 2026 |
Extraction is regex-based (SHA-256/SHA-1/MD5, public IPv4, defanged hxxp/[.] indicators, and bare domains/emails only from malware, actor, exploit, phishing, ransomware and breach articles with a nearby indicator context word). Treat confidence as low until you verify against the source article.