Pulse Detail — Threat Intelligence

PULSE NAME

x4k.sh

WHITE dorkingbeauty1 2022-08-05 Modified: 2022-08-05

108

IOCs

HIGH VOLUME

↓ CSV ↓ JSON

MITRE ATT&CK & Malware Families

ATT&CK TECHNIQUES

T1012 T1027 T1057 T1082 T1497

Indicators of Compromise (108)

All FileHash-SHA256 hostname domain URL FileHash-MD5 FileHash-SHA1

TYPE	INDICATOR	DESCRIPTION	CREATED
FileHash-SHA256	1571bcb23e7b2fe4a4997b56a925e704327d1db6741cb2cb8632384317c9611d	—	2022-08-05
FileHash-SHA256	194c570de4203074a0a0a88e00fef9ceeba69280406944058ea146894adaaeda	—	2022-08-05
FileHash-SHA256	1a38e3f8fb102870e6545f43cdcc97d8510699529d399073923084d8ee3d70a2	—	2022-08-05
FileHash-SHA256	1d97bfe0fc8d28f4305941ac93d47a424499d73f84c0f156cf58d85834ec7012	—	2022-08-05
FileHash-SHA256	1fab0fb6de41daf34bda8d136b0dee0867fb068c8361155f73b515cb977a1c36	—	2022-08-05
FileHash-SHA256	43aee9975c363e1c245de892f729426d02763fcc7ded8d81b92065997f4baf09	—	2022-08-05
FileHash-SHA256	5583955f5a7f71f38ad386e6cbcaa4b9e2e894455d509795d4ea8787a88273ef	—	2022-08-05
FileHash-SHA256	65978f5bffc7310a649560e271bb8653901ed335ba65e194f82d7d72519c83c3	—	2022-08-05
FileHash-SHA256	68dd32e4d57c1723118e70db6753dad4c55c1d7ee9b48dbe2d7858eb64567a1c	—	2022-08-05
FileHash-SHA256	71398c1cabe2d30f63da161e0a1f4cd28b2d0f4369e2f75137b172df96bd0738	—	2022-08-05
FileHash-SHA256	7938dd6e6cfd3335846fee4a1386b3194162afbaf742d0aff03fc0c096951555	—	2022-08-05
FileHash-SHA256	7a012ae82ba9cc4bdd3ac1f3aedc36d137acc774ae1644106cb3e6534973fa1b	—	2022-08-05
FileHash-SHA256	8ad6f1270776604ad082dcca55482433c090b46e55a49ad833a05a69b11fed90	—	2022-08-05
FileHash-SHA256	b699fbaa461b5f1183c674304fe666c17d980a2f851cf95ee4ff40656b13e946	—	2022-08-05
FileHash-SHA256	b768846f912249f59b4990aa26f5389041c7abc042510385d5f0e16b4edd9bdc	—	2022-08-05
FileHash-SHA256	c4dcdb591c8d659264a82c7a9eb2fbb1b50f9f11c0304222094ee46c04963caa	—	2022-08-05
FileHash-SHA256	cd65c5d78cb5fd914d31b88ccdc8b550e61fa3efc6495bceedcf3507ddd11796	—	2022-08-05
FileHash-SHA256	d023511df16bd439e8ec2dea589c015f6c3d9680d5c33b8d02fe2275e1d73e9a	—	2022-08-05
FileHash-SHA256	f0d63256e876c0ff7cfb33ceb6a5c2159c0c596c2bc45c8464843d7661a74b4d	—	2022-08-05
FileHash-SHA256	f6dde41dc6c7ff3572f2ddec244b579c6af9f3310f4102f213c932738a542b98	—	2022-08-05
FileHash-SHA256	872eede03ba932953be5db780bbd39128b4b577d0f17611aef1a8ecb39d930e1	—	2022-08-05
FileHash-SHA256	963e15c2392ac7717eb013e7751c6d76131da61a24ab4e329393d3a5e38d1ce4	—	2022-08-05
FileHash-SHA256	aef7db16ca66bc8ab74d9d091cbde4bd4e5d283019be0585489687aef2050635	—	2022-08-05
FileHash-SHA256	dee9e7c8ec5a9dcd30e324b343845528c68eaba70a61c5ecb597795a31422fe1	—	2022-08-05
FileHash-SHA256	eecaf81df59673f2743354e6839492971dad27933a2c52b8980c5ed9dd029a34	—	2022-08-05
FileHash-SHA256	1aa08c42d187485ee71cbb6c033b0fcb83eb53ec3a20754cd9b582bf70ce2ca5	—	2022-08-05
FileHash-SHA256	1e8e09272686d3575c83a27e57e0a57d946c0ecd49138c5007ebd37c25de8163	—	2022-08-05
FileHash-SHA256	2fde162b2531b33a57c93b4e194c0884f68e5531822ec1cbdf196759d9929d68	—	2022-08-05
FileHash-SHA256	5f501621941c770cdd82402f7691fb56bf5b3b3037c9bfb47ad8abee694d762b	—	2022-08-05
FileHash-SHA256	60426beba10e76e08357d8bafa163cdbacbc4f0d02f96d6ae0453048bce8c885	—	2022-08-05
FileHash-SHA256	6a048fa0d3d30a9de7305f2a31ca3924b089478f11b6ede4a8244e37fc9f5907	—	2022-08-05
FileHash-SHA256	6c43ad0de9caf51d987e01632986fe64d1494ba414ace224f1ec92ce0cbfd5c5	—	2022-08-05
FileHash-SHA256	775b8c3ff7e01f05465084266693c994797922c04aa98be6b500c0bbcc9f993f	—	2022-08-05
FileHash-SHA256	7e9a66f757ff0828694f28fbb1c3ca9331e269f36b61554b52267d2bb3abd363	—	2022-08-05
FileHash-SHA256	902e3e1ca2613a2721e6a20cc7546ee9a85b60942fb6315db57a8188ae338f5e	—	2022-08-05
FileHash-SHA256	928ad5bd58c09e8ebe7a177599e02ac4d7085881f6436a5725154ce8a9494e4c	—	2022-08-05
FileHash-SHA256	9611e399b48b8332a04d4369060b7ef1203c0b977d8c303f88618ffd3f4e8a3e	—	2022-08-05
FileHash-SHA256	a51dfd1e5c2db5fc713d322d0029c6bd1bad7e4c1ee4446caebeff1a5966d723	—	2022-08-05
FileHash-SHA256	a8d7d09ef83b55596589c0285236cb7ae8f65e2994ad0269a19915ccb19c56e6	—	2022-08-05
FileHash-SHA256	bde489bab70d2b227dfeeaceb3d5aeb71df51ba2d77873ebc0c981c2d794feb1	—	2022-08-05
FileHash-SHA256	bfa4e5453c2eddab727e9ea4f1e5ea7120755b205c4dee4f0817799613461612	—	2022-08-05
FileHash-SHA256	c87e7824563d2f5a6e17536ab12617c3c20e80d99d02f3b3bc6476e4787b2de9	—	2022-08-05
FileHash-SHA256	c8dae6c6b231f7f8c62309d61b916358af71b7bbbbb7586c975d5bd8cc69ff96	—	2022-08-05
FileHash-SHA256	e7b4a489f5ccf3136c618ac3b293dcd241ac4220d34c5272b5add91ed02d102f	—	2022-08-05
FileHash-SHA256	f0dc8fa1a18901ac46f4448e434c3885a456865a3a309840a1c4ac67fd56895b	—	2022-08-05
hostname	www.crowdstrike.com	—	2022-08-05
domain	golang.org	—	2022-08-05
domain	fontello.com	—	2022-08-05
URL	https://www.crowdstrike.com/endpoint-security-products/falcon-sandbox-malware-analysis/	—	2022-08-05
URL	https://www.crowdstrike.com/endpoint-security-products/falcon-	—	2022-08-05
URL	https://www.crowdstrike.com/endpoint-security-	—	2022-08-05
URL	https://twitter.com/HybridAnalysis	—	2022-08-05
URL	http://fontello.com	—	2022-08-05
hostname	e.value.runtime.name	—	2022-08-05
URL	http://e.value.runtime.name	—	2022-08-05
URL	http://java.runtime.name	—	2022-08-05
URL	https://e.value.runtime.name	—	2022-08-05
URL	https://java.runtime.name	—	2022-08-05
hostname	p1.gopkg.in	—	2022-08-05
hostname	p2.gopkg.in	—	2022-08-05
hostname	p3.gopkg.in	—	2022-08-05
hostname	staging.gopkg.in	—	2022-08-05
URL	http://eq.gopkg.in	—	2022-08-05
URL	http://gopkg.in/square/go-jose%2ev2.JSONWebSignature.computeAuthData	—	2022-08-05
URL	http://gopkg.in/square/go-jose%2ev2.ecEncrypterVerifier.verifyPayload	—	2022-08-05
URL	http://gopkg.in/square/go-jose%2ev2.edEncrypterVerifier.verifyPayload	—	2022-08-05
URL	http://gopkg.in/square/go-jose%2ev2.rawHeader.getSignatureAlgorithm	—	2022-08-05
URL	http://gopkg.in/square/go-jose%2ev2.rsaEncrypterVerifier.verifyPayload	—	2022-08-05
URL	http://gopkg.in/square/go-jose.v2/json.	—	2022-08-05
URL	http://p1.gopkg.in	—	2022-08-05
URL	http://p2.gopkg.in	—	2022-08-05
URL	http://p3.gopkg.in	—	2022-08-05
URL	http://staging.gopkg.in	—	2022-08-05
URL	https://eq.gopkg.in	—	2022-08-05
URL	https://gopkg.in/go	—	2022-08-05
URL	https://gopkg.in/neurosnap/sentences.v1	—	2022-08-05
URL	https://gopkg.in/warnings.v0	—	2022-08-05
URL	https://gopkg.in/yaml.v3	—	2022-08-05
URL	https://p1.gopkg.in	—	2022-08-05
URL	https://p2.gopkg.in	—	2022-08-05
URL	https://p3.gopkg.in	—	2022-08-05
URL	https://staging.gopkg.in	—	2022-08-05
URL	http://repo.x4k.dev/windows/	—	2022-08-05
URL	http://repo.x4k.dev/windows/kms.cmd	—	2022-08-05
URL	https://repo.x4k.dev/windows/pstrap.ps1	—	2022-08-05
URL	https://repo.x4k.dev/windows/windows.jpegidna	—	2022-08-05
URL	https://www.falcon-sandbox.com/sample/8ff79e8070b432354bad483ea5fcf95317e234053816f88b03b5d863be775e13?environmentId=100&lang=de	—	2022-08-05
URL	http://golang.org/x/oauth2	—	2022-08-05
URL	http://golang.org/x/net/bpf	—	2022-08-05
FileHash-MD5	07b5472d347d42780469fb2654b7fc54	—	2022-08-05
FileHash-MD5	1ea7c1c69785c6825ca588348053cfda	—	2022-08-05
FileHash-MD5	2040d24cf25f213b5b0b06726a1acc7f	—	2022-08-05
FileHash-MD5	4035d2883e01d64f3e7a9dccb1d63af5	—	2022-08-05
FileHash-MD5	50004e3d2b9b270e5c1b0f87dd54aaab	—	2022-08-05
FileHash-MD5	996c3eb5c21a20dd13b7ceee6c80b673	—	2022-08-05
FileHash-MD5	a091d41d5bf233c26cfc86988e879949	—	2022-08-05
FileHash-MD5	a109b3f1d646c7f14033447c2e69a116	—	2022-08-05
FileHash-SHA1	39c5459c920e7c0a325e053116713bfd8bc5ddaf	—	2022-08-05
FileHash-SHA256	42ef8fb1eadf609c84262dcfa569ba63c8e31dce25347ab0dd79bb778e7790a1	—	2022-08-05
FileHash-SHA256	6e90d525e170c3d16697227fff9bc2fd17eaefcae6648983e776898e3fa6d524	—	2022-08-05
URL	http://gopkg.in/ini.v1	—	2022-08-05
URL	http://repo.x4k.dev/windows/frph.exe	—	2022-08-05
URL	https://www.falcon-sandbox.com/	—	2022-08-05
domain	gopkg.in	—	2022-08-05
domain	reflect.name	—	2022-08-05
domain	runtime.name	—	2022-08-05
hostname	repo.x4k.dev	—	2022-08-05
hostname	www.falcon-sandbox.com	—	2022-08-05

References (1)

↗ x4k dev second exe scan hybrid.pdf