fdfc7831e5c24cfa80152860dfe8c056ba079f7df1393bf6bb7b18ed974eda37SHA-256 hash

Reported by 1 independent source · first reported 19 Jun 2026 by Elastic Security Labs · last reported 19 Jun 2026

Last reported 4 months ago

What the reports say

1 report, newest first · the exact sentence from each

“| fdfc7831e5c24cfa80152860dfe8c056ba079f7df1393bf6bb7b18ed974eda37 | SHA-256 | BATPackageBuilderSetup.bat | OXLOADER downloader & launcher |”

Elastic Security LabsVendor19 Jun 2026
Lost in relocation: analysis of a new loader distributing CASTLESTEALER

Indicators reported together

named in the same reports

node-js.prentiva99[.]infoin 1 report
app.miloyannopoulos[.]comin 1 report
rohitab[.]comin 1 report
6e0a1f8f77f7011561f6f9ca96b71b8fin 1 report
956c6128e9362e075f8d006c93616a66in 1 report
hxxps://link.storjshare[.]io/raw/jv5uebuqwzfpmtahj34q753ptykq/node/BATPackageBulderSetup.batin 1 report
link.storjshare[.]ioin 1 report
hxxps://link.storjshare[.]io/raw/jvsmdybqmvwep2oawbobp6ub7aza/node/node-v24.15.0-x64-86.exein 1 report
de4f51649ec1a330…6dd5dfef2615in 1 report
9a9939dff2979977…3d09b7e6c28din 1 report
c85f2765a6c3c3f3…f50666d065fein 1 report
4ec9d9d4d10ad78f…f152313b9741in 1 report
39019279686c820c…0577ace5b5c6in 1 report

Copy these 13 indicators · defanged

13 indicators, defanged, one per line

node-js.prentiva99[.]info
app.miloyannopoulos[.]com
rohitab[.]com
6e0a1f8f77f7011561f6f9ca96b71b8f
956c6128e9362e075f8d006c93616a66
hxxps://link.storjshare[.]io/raw/jv5uebuqwzfpmtahj34q753ptykq/node/BATPackageBulderSetup.bat
link.storjshare[.]io
hxxps://link.storjshare[.]io/raw/jvsmdybqmvwep2oawbobp6ub7aza/node/node-v24.15.0-x64-86.exe
de4f51649ec1a33071854aefe93ffb3fc225e19f802d8dd914676dd5dfef2615
9a9939dff297997732aaade9b243d695632cbd64033c5fbcb9de3d09b7e6c28d
c85f2765a6c3c3f3907c17e57df12f8f68826f74bff3bbfd272af50666d065fe
4ec9d9d4d10ad78fc6d7bda7cb17d52984878ccd2dd4302fd1cef152313b9741
39019279686c820c3af5684012a0085a7e2109f612c9fab886dd0577ace5b5c6

Thanks — we review every report.

Report a wrong value