70ec2e65f77a940fd0b2b5c0a78a83646dec17583611741521e0992c1bf974f1SHA-256 hash

Reported by 1 independent source · first reported 3 Jul 2025 by Elastic Security Labs · last reported 3 Jul 2025

Last reported 15 months ago

What the reports say

1 report, newest first · the exact sentence from each

“| 70ec2e65f77a940fd0b2b5c0a78a83646dec17583611741521e0992c1bf974f1 | 2026-04-17 19:17:24.055000 | 2026-05-16 16:12:09.711057 | 2025-05-16 16:12:09.711057 | UNKNOWN |”

Elastic Security LabsVendor3 Jul 2025
Taking SHELLTER: a commercial evasion framework abused in-the-wild

Indicators reported together

named in the same reports

Copy these 20 indicators · defanged

20 indicators, defanged, one per line

c865f24e4b9b0855b8b559fc3769239b0aa6e8d680406616a13d9a36fbbc2d30
7d0c9855167e7c19a67f800892e974c4387e1004b40efb25a2a1d25a99b03a10
b3e93bfef12678294d9944e61d90ca4aa03b7e3dae5e909c3b2166f122a14dad
da59d67ced88beae618b9d6c805f40385d0301d412b787e9f9c9559d00d2c880
hxxps://www.reddit[.]com/r/PartneredYoutube/comments/1ks2svg/skillshare_sponsorship/
185.156.72[.]80
hxxps://github[.]com/elastic/labs-releases/tree/main/tools/shellter
hxxps://github[.]com/elastic/protections-artifacts/blob/ff154ddf0762a4a030c8832eee7753cb19b950ff/behavior/rules/windows/defense_evasion_shellcode_from_unusual_microsoft_signed_module.toml
hxxps://github[.]com/elastic/protections-artifacts/blob/ff154ddf0762a4a030c8832eee7753cb19b950ff/behavior/rules/windows/defense_evasion_unbacked_shellcode_from_unsigned_module.toml
hxxps://github[.]com/elastic/protections-artifacts/blob/ff154ddf0762a4a030c8832eee7753cb19b950ff/behavior/rules/windows/defense_evasion_shellcode_execution_from_low_reputation_module.toml
hxxps://github[.]com/elastic/protections-artifacts/blob/ff154ddf0762a4a030c8832eee7753cb19b950ff/behavior/rules/windows/defense_evasion_potential_evasion_via_invalid_code_signature.toml
hxxps://github[.]com/elastic/protections-artifacts/blob/ff154ddf0762a4a030c8832eee7753cb19b950ff/behavior/rules/windows/defense_evasion_thread_suspension_from_unbacked_memory.toml
hxxps://github[.]com/elastic/protections-artifacts/blob/ff154ddf0762a4a030c8832eee7753cb19b950ff/behavior/rules/windows/defense_evasion_suspicious_executable_memory_mapping.toml
263ab8c9ec821ae573979ef2d5ad98cda5009a39e17398cd31b0fad98d862892
eaglekl[.]digital
94.141.12[.]182
plotoraus[.]shop
hxxps://www.shellterproject[.]com/shellter-editions-feature-comparison-table/
www.shellterproject[.]com
hxxps://www.shellterproject[.]com/Downloads/ShellterElite/Shellter_Elite_Exclusive_Features.pdf

Thanks — we review every report.

Report a wrong value