← Back to Pulse Feed
PULSE DETAIL
PULSE NAME
Iron Cybercrime Group Under The Scope
WHITE AlienVault 2018-05-29 Modified: 2018-05-29
168
IOCs
HIGH VOLUME
In April 2018, while monitoring public data feeds, we noticed an interesting and previously unknown backdoor using HackingTeam’s leaked RCS source code. We discovered that this backdoor was developed by the Iron cybercrime group, the same group behind the Iron ransomware (rip-off Maktub ransomware recently discovered by Bart Parys), which we believe has been active for the past 18 months.
Indicators of Compromise (168)
All URL hostname FileHash-SHA256 domain
TYPEINDICATORDESCRIPTIONCREATED
URL http://down.cacheoffer.tk/d2/xagent6.exe — 2018-05-29
URL http://xmr.enjoytopic.tk/d/rigd32.txt — 2018-05-29
URL http://cs.swb.one/ — 2018-05-29
URL http://swb.one/ — 2018-05-29
URL http://u.swb.one/cracksk — 2018-05-29
URL http://bitcoinwallet8.com/ — 2018-05-29
URL http://bitcoinwallet8.com/podivej-se-do-rozpracovanych — 2018-05-29
URL http://blockchaln.info/ — 2018-05-29
URL http://xmr.enjoytopic.tk/d/rigd64.txt — 2018-05-29
URL http://pool.blockbitcoin.com/processor.js — 2018-05-29
URL https://pool.blockbitcoin.com/lib/ — 2018-05-29
URL https://pool.blockbitcoin.com/processor.js — 2018-05-29
URL https://pool.blockbitcoin.com/proxy — 2018-05-29
URL https://pool.blockbitcoin.com/worker.js — 2018-05-29
URL http://xmr.enjoytopic.tk/d2/Xagent5.exe — 2018-05-29
URL http://xmr.enjoytopic.tk/l/bashd — 2018-05-29
URL http://xmr.enjoytopic.tk/l/bashe — 2018-05-29
URL http://down.cacheoffer.tk/ — 2018-05-29
URL http://down.cacheoffer.tk/d2/ — 2018-05-29
URL http://down.cacheoffer.tk/d2/Xagent6.exe — 2018-05-29
URL http://down.cacheoffer.tk/d2/core.exe — 2018-05-29
URL http://down.cacheoffer.tk/d2/core.txt — 2018-05-29
URL http://down.cacheoffer.tk/d2/gd32.txt — 2018-05-29
URL http://down.cacheoffer.tk/d2/gd64.txt — 2018-05-29
URL http://down.cacheoffer.tk/d2/ps5.sct — 2018-05-29
URL http://down.cacheoffer.tk/d2/reg9.sct — 2018-05-29
URL http://down.cacheoffer.tk/d2/reg99.sct — 2018-05-29
URL http://down.cacheoffer.tk/d2/regxmr00.sct — 2018-05-29
URL http://down.cacheoffer.tk/d2/sp.txt — 2018-05-29
URL http://xmr.enjoytopic.tk/l2/rootv2.sh — 2018-05-29
URL https://down.cacheoffer.tk/d2/ — 2018-05-29
URL https://down.cacheoffer.tk/d2/core.exe — 2018-05-29
URL http://ssl2.blockbitcoin.com/ — 2018-05-29
URL https://ssl2.blockbitcoin.com/ — 2018-05-29
URL https://ssl2.blockbitcoin.com/GYqK — 2018-05-29
URL http://xmr.enjoytopic.tk/l/bashf — 2018-05-29
URL http://xmr.enjoytopic.tk/l/lowerv2.sh — 2018-05-29
URL http://xmr.enjoytopic.tk/l/r88.sh — 2018-05-29
URL http://xmr.enjoytopic.tk/l/rootv2.sh — 2018-05-29
URL http://xmr.enjoytopic.tk/r88.sh — 2018-05-29
URL http://xmr.enjoytopic.tk/ — 2018-05-29
URL http://xmr.enjoytopic.tk/d — 2018-05-29
URL http://xmr.enjoytopic.tk/d/ — 2018-05-29
URL http://xmr.enjoytopic.tk/d/fix.txt — 2018-05-29
URL http://xmr.enjoytopic.tk/d/ps3.txt — 2018-05-29
URL http://xmr.enjoytopic.tk/d/regxmr222.sct — 2018-05-29
URL http://xmr.enjoytopic.tk/d/regxmr3.sct — 2018-05-29
URL http://xmr.enjoytopic.tk/d/regxmr888.sct — 2018-05-29
URL http://xmr.enjoytopic.tk/d/regxmr999.sct — 2018-05-29
hostname u.swb.one — 2018-05-29
hostname cs.swb.one — 2018-05-29
FileHash-SHA256 8e32315bca348c37e9fa2512c45123b3bb1256314b60ec80b3a6ae25c4a6c730 — 2018-05-29
FileHash-SHA256 9c333f0d5b97a88acd97c0a38b41c51ca399e2e3218c3370a277cce91776b0de — 2018-05-29
FileHash-SHA256 e998ac5d1115aaa6089eb459fc3b7a5f6689582adf5f7f7834b782836ad19936 — 2018-05-29
FileHash-SHA256 3ca112b89535f8f92a2e022000553851e0338e204e532e7711c04693da4f51df — 2018-05-29
FileHash-SHA256 3d2d8fd2c15da7ac4d03436a717613316f5e6a371618d4a386d968e3ea0fc267 — 2018-05-29
FileHash-SHA256 6818f885162fc5449571b8a21f28ed3505e43a226f33cb0540f97a7277ae902d — 2018-05-29
domain blockbitcoin.com — 2018-05-29
domain cacheoffer.tk — 2018-05-29
domain enjoytopic.tk — 2018-05-29
domain bitcoinwallet8.com — 2018-05-29
domain blockchaln.info — 2018-05-29
domain swb.one — 2018-05-29
FileHash-SHA256 017bdd6a7870d120bd0db0f75b525ddccd6292a33aee3eecf70746c2d37398bf — 2018-05-29
FileHash-SHA256 042efe5c5226dd19361fb832bdd29267276d7fa7a23eca5ced3c2bb7b4d30f7d — 2018-05-29
FileHash-SHA256 086d989f14e14628af821b72db00d0ef16f23ba4d9eaed2ec03d003e5f3a96a1 — 2018-05-29
FileHash-SHA256 0b8473d3f07a29820f456b09f9dc28e70af75f9dec88668fb421a315eec9cb63 — 2018-05-29
FileHash-SHA256 0df1105cbd7bb01dca7e544fb22f45a7b9ad04af3ffaf747b5ecc2ffcd8c6dee — 2018-05-29
FileHash-SHA256 0f7b9151f5ff4b35761d4c0c755b6918a580fae52182de9ba9780d5a1f1beee8 — 2018-05-29
FileHash-SHA256 194362ce71adcdfa0fe976322a7def8bb2d7fb3d67a44716aa29c2048f87f5bc — 2018-05-29
FileHash-SHA256 1a31e09a2a982a0fedd8e398228918b17e1bde6b20f1faf291316e00d4a89c61 — 2018-05-29
FileHash-SHA256 1cbd51d387561cafddf10699177a267cd5d2d184842bb43755a0626fdc4f0f3c — 2018-05-29
FileHash-SHA256 1d17eb102e75c08ab6f54387727b12ec9f9ee1960c8e5dc7f9925d41a943cabf — 2018-05-29
FileHash-SHA256 1d34a52f9c11d4bf572bf678a95979046804109e288f38dfd538a57a12fc9fd1 — 2018-05-29
FileHash-SHA256 21a83eeff87fba78248b137bfcca378efcce4a732314538d2e6cd3c9c2dd5290 — 2018-05-29
FileHash-SHA256 21f1a867fa6a418067be9c68d588e2eeba816bffcb10c9512f3b7927612a1221 — 2018-05-29
FileHash-SHA256 251345b721e0587f1f08f54a81e26abac075acf3c4473a2c3ba8efcedc3b2459 — 2018-05-29
FileHash-SHA256 2566b0f67522e64a38211e3fe66f340daaadaf3bcc0142f06f252347ebf4dc79 — 2018-05-29
FileHash-SHA256 274717d4a4080a6f2448931832f9eeb91cc0cbe69ff65f2751a9ace86a76e670 — 2018-05-29
FileHash-SHA256 283536c26bb4fd4ea597d59c77a84ab812656f8fe980aa8556d44f9e954b1450 — 2018-05-29
FileHash-SHA256 2886e25a86a57355a8a09a84781a9b032de10c3e40339a9ad0c10b63f7f8e7c7 — 2018-05-29
FileHash-SHA256 2c025f9ffb7d42fcc0dc8d056a444db90661fb6e38ead620d325bee9adc2750e — 2018-05-29
FileHash-SHA256 2f5fb4e1072044149b32603860be0857227ed12cde223b5be787c10bcedbc51a — 2018-05-29
FileHash-SHA256 320bb1efa1263c636702188cd97f68699aebbb88c2c2c92bf97a68e689fa6f89 — 2018-05-29
FileHash-SHA256 36104d9b7897c8b550a9fad9fe2f119e16d82fb028f682d39a73722822065bd3 — 2018-05-29
FileHash-SHA256 3652ea75ce5d8cfa0000a40234ae3d955781bcb327eecfee8f0e2ecae3a82870 — 2018-05-29
FileHash-SHA256 37bea5b0a24fa6fed0b1649189a998a0e51650dd640531fe78b6db6a196917a7 — 2018-05-29
FileHash-SHA256 388c1aecdceab476df8619e2d722be8e5987384b08c7b810662e26c42caf1310 — 2018-05-29
FileHash-SHA256 39a991c014f3093cdc878b41b527e5507c58815d95bdb1f9b5f90546b6f2b1f6 — 2018-05-29
FileHash-SHA256 426bc7ffabf01ebfbcd50d34aecb76e85f69e3abcc70e0bcd8ed3d7247dba76e — 2018-05-29
FileHash-SHA256 42faf3af09b955de1aead2b99a474801b2c97601a52541af59d35711fafb7c6d — 2018-05-29
FileHash-SHA256 45f794304919c8aa9282b0ee84c198703a41cc2254fe93634642ada3511239d2 — 2018-05-29
FileHash-SHA256 484b4cd953c9993090947fbb31626b76d7eee60c106867aa17e408556d27b609 — 2018-05-29
FileHash-SHA256 49cfeb6505f0728290286915f5d593a1707e15effcfb62af1dd48e8b46a87975 — 2018-05-29
FileHash-SHA256 4de16be6a9de62b1ff333dd94e63128e677eb6a52d9fbbe55d8a09a2cab161f1 — 2018-05-29
FileHash-SHA256 506647c5bfad858ff6c34f93c74407782abbac4da572d9f44112fee5238d9ae1 — 2018-05-29
FileHash-SHA256 57daa27e04abfbc036856a22133cbcbd1edb0662617256bce6791e7848a12beb — 2018-05-29
FileHash-SHA256 5831dabe27e0211028296546d4e637770fd1ec5f2c8c5add51d0ea09b6ea3f0d — 2018-05-29
FileHash-SHA256 5977bee625ed3e91c7f30b09be9133c5838c59810659057dcfd1a5e2cf7c1936 — 2018-05-29
FileHash-SHA256 5a5bbc3c2bc2d3975bc003eb5bf9528c1c5bf400fac09098490ea9b5f6da981f — 2018-05-29
FileHash-SHA256 5f2b13cb2e865bb09a220a7c50acc3b79f7046c6b83dbaafd9809ecd00efc49a — 2018-05-29
FileHash-SHA256 6314162df5bc2db1200d20221641abaac09ac48bc5402ec29191fd955c55f031 — 2018-05-29
FileHash-SHA256 6350a42d423d61eb03a33011b6054fb7793108b7e71aee15c198d3480653d8b7 — 2018-05-29
FileHash-SHA256 64f96042ab880c0f2cd4c39941199806737957860387a65939b656d7116f0c7e — 2018-05-29
FileHash-SHA256 654ec27ea99c44edc03f1f3971d2a898b9f1441de156832d1507590a47b41190 — 2018-05-29
FileHash-SHA256 657a3a4a78054b8d6027a39a5370f26665ee10e46673a1f4e822a2a31168e5f9 — 2018-05-29
FileHash-SHA256 692ae8620e2065ad2717a9b7a1958221cf3fcb7daea181b04e258e1fc2705c1e — 2018-05-29
FileHash-SHA256 6c54b73320288c11494279be63aeda278c6932b887fc88c21c4c38f0e18f1d01 — 2018-05-29
FileHash-SHA256 6e0adfd1e30c116210f469d76e60f316768922df7512d40d5faf65820904821b — 2018-05-29
FileHash-SHA256 70e47fdff286fdfe031d05488bc727f5df257eacaa0d29431fb69ce680f6fb0c — 2018-05-29
FileHash-SHA256 729ab4ff5da471f210a8658f4a7b2a30522534a212ac44e4d76f258baab19ccb — 2018-05-29
FileHash-SHA256 74e777af58a8ee2cff4f9f18013e5b39a82a4c4f66ea3e17d06e5356085265b7 — 2018-05-29
FileHash-SHA256 78a07502443145d762536afaabd4d6139b81ca3cc9f8c28427ec724a3107e17b — 2018-05-29
FileHash-SHA256 7e750be346f124c28ddde43e87d0fbc68f33673435dddb98dda48aa3918ce3bd — 2018-05-29
FileHash-SHA256 7f3c07454dab46b27e11fcefd0101189aa31e84f8498dcb85db2b010c02ec190 — 2018-05-29
FileHash-SHA256 85b0d44f3e8fd636a798960476a1f71d6fe040fbe44c92dfa403d0d014ff66cc — 2018-05-29
FileHash-SHA256 8fdec2e23032a028b8bd326dc709258a2f705c605f6222fc0c1616912f246f91 — 2018-05-29
FileHash-SHA256 927e61b57c124701f9d22abbc72f34ebe71bf1cd717719f8fc6008406033b3e9 — 2018-05-29
FileHash-SHA256 92b4eed5d17cb9892a9fe146d61787025797e147655196f94d8eaf691c34be8c — 2018-05-29
FileHash-SHA256 936f4ce3570017ef5db14fb68f5e775a417b65f3b07094475798f24878d84907 — 2018-05-29
FileHash-SHA256 97d41633e74eccf97918d248b344e62431b74c9447032e9271ed0b5340e1dba0 — 2018-05-29
FileHash-SHA256 980a39b6b72a7c8e73f4b6d282fae79ce9e7934ee24a88dde2eead0d5f238bda — 2018-05-29
FileHash-SHA256 9b40a0cd49d4dd025afbc18b42b0658e9b0707b75bb818ab70464d8a73339d52 — 2018-05-29
FileHash-SHA256 9b654fd24a175784e3103d83eba5be6321142775cf8c11c933746d501ca1a5a1 — 2018-05-29
FileHash-SHA256 9d817d77b651d2627e37c01037e13808e1047f9528799a435c7bc04e877d70b3 — 2018-05-29
FileHash-SHA256 9ea69b49b6707a249e001b5f2caaab9ee6f6f546906445a8c51183aafe631e9f — 2018-05-29
FileHash-SHA256 a11bf4e721d58fcf0f44110e17298f6dc6e6c06919c65438520d6e90c7f64d40 — 2018-05-29
FileHash-SHA256 a3c8091d00575946aca830f82a8406cba87aa0b425268fa2e857f98f619de298 — 2018-05-29
FileHash-SHA256 a4faaa0019fb63e55771161e34910971fd8fe88abda0ab7dd1c90cfe5f573a23 — 2018-05-29
FileHash-SHA256 a8ab5be12ca80c530e3ef5627e97e7e38e12eaf968bf049eb58ccc27f134dc7f — 2018-05-29
FileHash-SHA256 aaa6ee07d1c777b8507b6bd7fa06ed6f559b1d5e79206c599a8286a0a42fe847 — 2018-05-29
FileHash-SHA256 ac89400597a69251ee7fc208ad37b0e3066994d708e15d75c8b552c50b57f16a — 2018-05-29
FileHash-SHA256 ae366fa5f845c619cacd583915754e655ad7d819b64977f819f3260277160141 — 2018-05-29
FileHash-SHA256 afd7ab6b06b87545c3a6cdedfefa63d5777df044d918a505afe0f57179f246e9 — 2018-05-29
FileHash-SHA256 b0442643d321003af965f0f41eb90cff2a198d11b50181ef8b6f530dd22226a7 — 2018-05-29
FileHash-SHA256 b1fe223cbb01ff2a658c8ff51d386b5df786fd36278ee081c714adf946145047 — 2018-05-29
FileHash-SHA256 b638dcce061ed2aa5a1f2d56fc5e909aa1c1a28636605a3e4c0ad72d49b7aec6 — 2018-05-29
FileHash-SHA256 b8107197469839a82cae25c3d3b5c25b5c0784736ca3b611eb3e8e3ced8ec950 — 2018-05-29
FileHash-SHA256 b8d548ab2a1ce0cf51947e63b37fe57a0c9b105b2ef36b0abc1abf26d848be00 — 2018-05-29
FileHash-SHA256 ba644e050d1b10b9fd61ac22e5c1539f783fe87987543d76a4bb6f2f7e9eb737 — 2018-05-29
FileHash-SHA256 bd56db8d304f36af7cb0380dcbbc3c51091e3542261affb6caac18fa6a6988ec — 2018-05-29
FileHash-SHA256 bf2984b866c449a8460789de5871864eec19a7f9cadd7d883898135a4898a38a — 2018-05-29
FileHash-SHA256 ca0df32504d3cf78d629e33b055213df5f71db3d5a0313ebc07fe2c05e506826 — 2018-05-29
FileHash-SHA256 cd4d1a6b3efb3d280b8d4e77e306e05157f6ef8a226d7db08ac2006cce95997c — 2018-05-29
FileHash-SHA256 ce7161381a0a0495ef998b5e202eb3e8fa2945dfdba0fd2a612d68b986c92678 — 2018-05-29
FileHash-SHA256 d020ea8159bb3f99f394cd54677e60fadbff2b91e1a2e91d1c43ba4d7624244d — 2018-05-29
FileHash-SHA256 d20cd3e579a04c5c878b87cc7bd6050540c68fdd8e28f528f68d70c77d996b16 — 2018-05-29
FileHash-SHA256 d5a296bac02b0b536342e8fb3b9cb40414ea86aa602353bc2c7be18386b13094 — 2018-05-29
FileHash-SHA256 dbe165a63ed14e6c9bdcd314cf54d173e68db9d36623b09057d0a4d0519f1306 — 2018-05-29
FileHash-SHA256 e302aa06ad76b7e26e7ba2c3276017c9e127e0f16834fb7c8deae2141db09542 — 2018-05-29
FileHash-SHA256 e394b1a1561c94621dbd63f7b8ea7361485a1f903f86800d50bd7e27ad801a5f — 2018-05-29
FileHash-SHA256 e41a805d780251cb591bcd02e5866280f8a99f876cfa882b557951e30dfdd142 — 2018-05-29
FileHash-SHA256 e6c717b06d7ded23408461848ad0ee734f77b17e399c6788e68bc15219f155d7 — 2018-05-29
FileHash-SHA256 ea338755e8104d654e7d38170aaae305930feabf38ea946083bb68e8d76a0af3 — 2018-05-29
FileHash-SHA256 ee5eca8648e45e2fea9dac0d920ef1a1792d8690c41ee7f20343de1927cc88b9 — 2018-05-29
FileHash-SHA256 ee859581b2fcea5d4ff633b5e40610639cd6b11c2b4fc420720198f49fbd1d31 — 2018-05-29
FileHash-SHA256 eea2d72f3c9bed48d4f5c5ad2bef8b0d29509fc9e650655c6c5532cb39e03268 — 2018-05-29
FileHash-SHA256 ef2c384c795d5ca8ce17394e278b5c98f293a76047a06fc672da38bb56756aec — 2018-05-29
FileHash-SHA256 f1cbacea1c6d05cd5aa6fc9532f5ead67220d15008db9fa29afaaf134645e9de — 2018-05-29
FileHash-SHA256 f2e4528049f598bdb25ce109a669a1f446c6a47739320a903a9254f7d3c69427 — 2018-05-29
FileHash-SHA256 f44c3fd546b8c74cc58630ebcb5bea417696fac4bb89d00da42202f40da31354 — 2018-05-29
FileHash-SHA256 f8751a004489926ceb03321ea3494c54d971257d48dadbae9e8a3c5285bd6992 — 2018-05-29
FileHash-SHA256 fc9d150d1a7cbda2600e4892baad91b9a4b8c52d31a41fd686c21c7801d1dd8c — 2018-05-29
FileHash-SHA256 fcb700dbb47e035f5379d9ce1ada549583d4704c1f5531217308367f2d4bd302 — 2018-05-29
hostname down.cacheoffer.tk — 2018-05-29
hostname pool.blockbitcoin.com — 2018-05-29
hostname ssl2.blockbitcoin.com — 2018-05-29
hostname xmr.enjoytopic.tk — 2018-05-29
References (1)
↗ https://www.intezer.com/iron-cybercrime-group-under-the-scope-2/