hxxps://archive[.]org/download/optimized_msi_20250821/optimized_MSI.pngURL

Reported by 1 independent source · first reported 16 Dec 2025 by Zscaler ThreatLabz · last reported 16 Dec 2025

Last reported 10 months ago

What the reports say

1 report, newest first · the exact sentence from each

“…stance.e7666af17732e9a3954f6308bc52866b937ac67099faa212518d5592baca5d44SHA256 hash of the DCRAT instance.hxxps://archive[.]org/download/optimized_msi_20250821/optimized_MSI.png'Download URL for the PNG image.startmenuexperiencehost.ydns.euDCRAT C2 domain.”

Zscaler ThreatLabzVendor16 Dec 2025
BlindEagle Targets Colombian Government Agency with Caminho and DCRAT

Indicators reported together

named in the same reports

detection[.]inin 1 report
ydns[.]euin 1 report
family[.]inin 1 report
hxxps://cdn.discordapp[.]com/attachments/1402685029678579857/1410251798123511808/AGT27.txt?ex=68b056d5&is=68af0555&hm=3ef2cf8f65a9a6f4955ecd0292af0cd68e65864907d07543c416ab28a2acfa6d&Thein 1 report

Copy these 4 indicators · defanged

4 indicators, defanged, one per line

detection[.]in
ydns[.]eu
family[.]in
hxxps://cdn.discordapp[.]com/attachments/1402685029678579857/1410251798123511808/AGT27.txt?ex=68b056d5&amp;is=68af0555&amp;hm=3ef2cf8f65a9a6f4955ecd0292af0cd68e65864907d07543c416ab28a2acfa6d&amp;The

Thanks — we review every report.

Report a wrong value