0f9c0d9b77678d7360e492e00a7fa00af9b78331dc926b0747b07299b4e64afdSHA-256 hash

Reported by 1 independent source · first reported 1 Aug 2024 by Elastic Security Labs · last reported 1 Aug 2024

Last reported 2 years ago

What the reports say

1 report, newest first · the exact sentence from each

“| 0f9c0d9b77678d7360e492e00a7fa00af9b78331dc926b0747b07299b4e64afd | SHA-256 | setup_wm.exe | BITSLOTH (VMProtect) |”

Elastic Security LabsVendor1 Aug 2024
BITS and Bytes: Analyzing BITSLOTH, a newly identified backdoor

Indicators reported together

named in the same reports

hxxps://192.168.182[.]130/00-0C-29-0E-29-87/wu.htmin 1 report
hxxp://192.168.182[.]130/00-0C-29-0E-29-87/IF/P.binin 1 report
15.235.132[.]67in 1 report
4a4356faad620bf1…a4c404bf45dfin 1 report
dfb76bcf5a3e2922…525628006d88in 1 report
4fb6dd11e723209d…7e7da1874f50in 1 report
0944b17a4330e1c9…4c8d76ef1507in 1 report
216.238.121[.]132in 1 report
45.116.13[.]178in 1 report
hxxps://github[.]com/SafeBreach-Labs/SimpleBITSServer/tree/masterin 1 report
hxxps://github[.]com/T4y1oR/RingQin 1 report
hxxps://github[.]com/EddieIvan01/ioxin 1 report
hxxps://github[.]com/ph4ntonn/Stowaway/in 1 report

Copy these 13 indicators · defanged

13 indicators, defanged, one per line

hxxps://192.168.182[.]130/00-0C-29-0E-29-87/wu.htm
hxxp://192.168.182[.]130/00-0C-29-0E-29-87/IF/P.bin
15.235.132[.]67
4a4356faad620bf12ff53bcfac62e12eb67783bd22e66bf00a19a4c404bf45df
dfb76bcf5a3e29225559ebbdae8bdd24f69262492eca2f99f7a9525628006d88
4fb6dd11e723209d12b2d503a9fcf94d8fed6084aceca390ac0b7e7da1874f50
0944b17a4330e1c97600f62717d6bae7e4a4260604043f2390a14c8d76ef1507
216.238.121[.]132
45.116.13[.]178
hxxps://github[.]com/SafeBreach-Labs/SimpleBITSServer/tree/master
hxxps://github[.]com/T4y1oR/RingQ
hxxps://github[.]com/EddieIvan01/iox
hxxps://github[.]com/ph4ntonn/Stowaway/

Thanks — we review every report.

Report a wrong value