[ { "id": 3924607148, "indicator": "d845c7b471d9adc14942f95105d5ffcf", "type": "FileHash-MD5", "created": "2024-07-23T17:50:16", "content": "", "title": "", "description": "", "expiration": null, "is_active": 1 }, { "id": 3926408863, "indicator": "1bbb795ce19f4dcc4ac9f8e8c12f3452f1f07c68a53ef631c76e392e1d06ea43", "type": "FileHash-SHA256", "created": "2024-07-23T17:50:16", "content": "", "title": "", "description": "", "expiration": null, "is_active": 1 }, { "id": 3926408860, "indicator": "4491901eff338ab52c85a77a3fbd3ce80fda738046ee3b7da7be468da5b331a3", "type": "FileHash-SHA256", "created": "2024-07-23T17:50:16", "content": "", "title": "", "description": "", "expiration": null, "is_active": 1 }, { "id": 3926716862, "indicator": "70865e5a49b8c270eb8175c36cd2a2032c05445c0daf59dc67e78dad545ff9e4", "type": "FileHash-SHA256", "created": "2024-07-23T17:50:16", "content": "", "title": "", "description": "", "expiration": null, "is_active": 1 }, { "id": 3926408859, "indicator": "96dec6e07229201a02f538310815c695cf6147c548ff1c6a0def2fe38f3dcbc8", "type": "FileHash-SHA256", "created": "2024-07-23T17:50:16", "content": "", "title": "", "description": "", "expiration": null, "is_active": 1 }, { "id": 3924607149, "indicator": "http://hoo.be/crowdstrike", "type": "URL", "created": "2024-07-23T17:50:16", "content": "", "title": "", "description": "", "expiration": null, "is_active": 1 }, { "id": 3924607150, "indicator": "bsodsm8rlixamzgjedu.com", "type": "domain", "created": "2024-07-23T17:50:16", "content": "", "title": "", "description": "", "expiration": null, "is_active": 1 }, { "id": 3924607151, "indicator": "clownstrike.co", "type": "domain", "created": "2024-07-23T17:50:16", "content": "", "title": "", "description": "", "expiration": null, "is_active": 1 }, { "id": 3924607152, "indicator": "clownstrike.co.uk", "type": "domain", "created": "2024-07-23T17:50:16", "content": "", "title": "", "description": "", "expiration": null, "is_active": 1 }, { "id": 3924518757, "indicator": "crashstrike.com", "type": "domain", "created": "2024-07-23T17:50:16", "content": "", "title": "", "description": "", "expiration": null, "is_active": 1 }, { "id": 3924570711, "indicator": "crowdfalcon-immed-update.com", "type": "domain", "created": "2024-07-23T17:50:16", "content": "", "title": "", "description": "", "expiration": null, "is_active": 1 }, { "id": 3925709492, "indicator": "crowdstrike-bluescreen.com", "type": "domain", "created": "2024-07-23T17:50:16", "content": "", "title": "", "description": "", "expiration": null, "is_active": 1 }, { "id": 3924356385, "indicator": "crowdstrike-bsod.com", "type": "domain", "created": "2024-07-23T17:50:16", "content": "", "title": "", "description": "", "expiration": null, "is_active": 1 }, { "id": 3924556575, "indicator": "crowdstrike-falcon.online", "type": "domain", "created": "2024-07-23T17:50:16", "content": "", "title": "", "description": "", "expiration": null, "is_active": 1 }, { "id": 3924518758, "indicator": "crowdstrike-helpdesk.com", "type": "domain", "created": "2024-07-23T17:50:16", "content": "", "title": "", "description": "", "expiration": null, "is_active": 1 }, { "id": 3925709493, "indicator": "crowdstrike-out.com", "type": "domain", "created": "2024-07-23T17:50:16", "content": "", "title": "", "description": "", "expiration": null, "is_active": 1 }, { "id": 3924556624, "indicator": "crowdstrike.black", "type": "domain", "created": "2024-07-23T17:50:16", "content": "", "title": "", "description": "", "expiration": null, "is_active": 1 }, { "id": 3925999103, "indicator": "crowdstrike.com.vc", "type": "domain", "created": "2024-07-23T17:50:16", "content": "", "title": "", "description": "", "expiration": null, "is_active": 1 }, { "id": 3924556669, "indicator": "crowdstrike.es", "type": "domain", "created": "2024-07-23T17:50:16", "content": "", "title": "", "description": "", "expiration": null, "is_active": 1 }, { "id": 3924556673, "indicator": "crowdstrike.fail", "type": "domain", "created": "2024-07-23T17:50:16", "content": "", "title": "", "description": "", "expiration": null, "is_active": 1 }, { "id": 3924356386, "indicator": "crowdstrike0day.com", "type": "domain", "created": "2024-07-23T17:50:16", "content": "", "title": "", "description": "", "expiration": null, "is_active": 1 }, { "id": 3924356387, "indicator": "crowdstrikebluescreen.com", "type": "domain", "created": "2024-07-23T17:50:16", "content": "", "title": "", "description": "", "expiration": null, "is_active": 1 }, { "id": 3924556868, "indicator": "crowdstrikebug.com", "type": "domain", "created": "2024-07-23T17:50:16", "content": "", "title": "", "description": "", "expiration": null, "is_active": 1 }, { "id": 3924435679, "indicator": "crowdstrikeclaim.com", "type": "domain", "created": "2024-07-23T17:50:16", "content": "", "title": "", "description": "", "expiration": null, "is_active": 1 }, { "id": 3925709494, "indicator": "crowdstrikeclaims.com", "type": "domain", "created": "2024-07-23T17:50:16", "content": "", "title": "", "description": "", "expiration": null, "is_active": 1 }, { "id": 3925297889, "indicator": "crowdstrikeclassaction.com", "type": "domain", "created": "2024-07-23T17:50:16", "content": "", "title": "", "description": "", "expiration": null, "is_active": 1 }, { "id": 3924356388, "indicator": "crowdstrikedoomsday.com", "type": "domain", "created": "2024-07-23T17:50:16", "content": "", "title": "", "description": "", "expiration": null, "is_active": 1 }, { "id": 3924356389, "indicator": "crowdstrikedown.site", "type": "domain", "created": "2024-07-23T17:50:16", "content": "", "title": "", "description": "", "expiration": null, "is_active": 1 }, { "id": 3924557175, "indicator": "crowdstrikefail.com", "type": "domain", "created": "2024-07-23T17:50:16", "content": "", "title": "", "description": "", "expiration": null, "is_active": 1 }, { "id": 3924356390, "indicator": "crowdstrikefix.com", "type": "domain", "created": "2024-07-23T17:50:16", "content": "", "title": "", "description": "", "expiration": null, "is_active": 1 }, { "id": 3925709495, "indicator": "crowdstrikefixer.com", "type": "domain", "created": "2024-07-23T17:50:16", "content": "", "title": "", "description": "", "expiration": null, "is_active": 1 }, { "id": 3925297885, "indicator": "crowdstrikeglitch.com", "type": "domain", "created": "2024-07-23T17:50:16", "content": "", "title": "", "description": "", "expiration": null, "is_active": 1 }, { "id": 2825842471, "indicator": "crowdstrikehealthcare.com", "type": "domain", "created": "2024-07-23T17:50:16", "content": "", "title": "", "description": "", "expiration": null, "is_active": 1 }, { "id": 3925297890, "indicator": "crowdstrikelawsuit.com", "type": "domain", "created": "2024-07-23T17:50:16", "content": "", "title": "", "description": "", "expiration": null, "is_active": 1 }, { "id": 3925709496, "indicator": "crowdstrikeold.com", "type": "domain", "created": "2024-07-23T17:50:16", "content": "", "title": "", "description": "", "expiration": null, "is_active": 1 }, { "id": 3925709497, "indicator": "crowdstrikeoops.com", "type": "domain", "created": "2024-07-23T17:50:16", "content": "", "title": "", "description": "", "expiration": null, "is_active": 1 }, { "id": 3924557240, "indicator": "crowdstrikeoopsie.com", "type": "domain", "created": "2024-07-23T17:50:16", "content": "", "title": "", "description": "", "expiration": null, "is_active": 1 }, { "id": 3925297879, "indicator": "crowdstrikeout.com", "type": "domain", "created": "2024-07-23T17:50:16", "content": "", "title": "", "description": "", "expiration": null, "is_active": 1 }, { "id": 3924607153, "indicator": "crowdstrikeoutage.com", "type": "domain", "created": "2024-07-23T17:50:16", "content": "", "title": "", "description": "", "expiration": null, "is_active": 1 }, { "id": 3924518759, "indicator": "crowdstrikeoutage.info", "type": "domain", "created": "2024-07-23T17:50:16", "content": "", "title": "", "description": "", "expiration": null, "is_active": 1 }, { "id": 3925297888, "indicator": "crowdstrikerecovery.com", "type": "domain", "created": "2024-07-23T17:50:16", "content": "", "title": "", "description": "", "expiration": null, "is_active": 1 }, { "id": 2838768108, "indicator": "crowdstrikereport.com", "type": "domain", "created": "2024-07-23T17:50:16", "content": "", "title": "", "description": "", "expiration": null, "is_active": 1 }, { "id": 3925709498, "indicator": "crowdstrikesucks.com", "type": "domain", "created": "2024-07-23T17:50:16", "content": "", "title": "", "description": "", "expiration": null, "is_active": 1 }, { "id": 3925709499, "indicator": "crowdstrikesuporte.com", "type": "domain", "created": "2024-07-23T17:50:16", "content": "", "title": "", "description": "", "expiration": null, "is_active": 1 }, { "id": 3924356391, "indicator": "crowdstriketoken.com", "type": "domain", "created": "2024-07-23T17:50:16", "content": "", "title": "", "description": "", "expiration": null, "is_active": 1 }, { "id": 3924518760, "indicator": "crowdstrikeupdate.com", "type": "domain", "created": "2024-07-23T17:50:16", "content": "", "title": "", "description": "", "expiration": null, "is_active": 1 }, { "id": 3925297887, "indicator": "crowdstrikewindowsoutage.com", "type": "domain", "created": "2024-07-23T17:50:16", "content": "", "title": "", "description": "", "expiration": null, "is_active": 1 }, { "id": 3925709500, "indicator": "crowdstrikezeroday.com", "type": "domain", "created": "2024-07-23T17:50:16", "content": "", "title": "", "description": "", "expiration": null, "is_active": 1 }, { "id": 3924607154, "indicator": "crowdstuck.org", "type": "domain", "created": "2024-07-23T17:50:16", "content": "", "title": "", "description": "", "expiration": null, "is_active": 1 }, { "id": 3290251116, "indicator": "failstrike.com", "type": "domain", "created": "2024-07-23T17:50:16", "content": "", "title": "", "description": "", "expiration": null, "is_active": 1 }, { "id": 3924518763, "indicator": "fix-crowdstrike-apocalypse.com", "type": "domain", "created": "2024-07-23T17:50:16", "content": "", "title": "", "description": "", "expiration": null, "is_active": 1 }, { "id": 3924432729, "indicator": "fix-crowdstrike-bsod.com", "type": "domain", "created": "2024-07-23T17:50:16", "content": "", "title": "", "description": "", "expiration": null, "is_active": 1 }, { "id": 3924557587, "indicator": "isitcrowdstrike.com", "type": "domain", "created": "2024-07-23T17:50:16", "content": "", "title": "", "description": "", "expiration": null, "is_active": 1 }, { "id": 3924557589, "indicator": "microsoftcrowdstrike.com", "type": "domain", "created": "2024-07-23T17:50:16", "content": "", "title": "", "description": "", "expiration": null, "is_active": 1 }, { "id": 3924607155, "indicator": "supportfalconcrowdstrikel.com", "type": "domain", "created": "2024-07-23T17:50:16", "content": "", "title": "", "description": "", "expiration": null, "is_active": 1 }, { "id": 3924557602, "indicator": "whatiscrowdstrike.com", "type": "domain", "created": "2024-07-23T17:50:16", "content": "", "title": "", "description": "", "expiration": null, "is_active": 1 }, { "id": 3924607156, "indicator": "winsstrike.com", "type": "domain", "created": "2024-07-23T17:50:16", "content": "", "title": "", "description": "", "expiration": null, "is_active": 1 }, { "id": 3926716863, "indicator": "update@crowdstrike.com.vc", "type": "email", "created": "2024-07-23T17:50:16", "content": "", "title": "", "description": "", "expiration": null, "is_active": 1 }, { "id": 3924607157, "indicator": "crowdstrike.orora.group", "type": "hostname", "created": "2024-07-23T17:50:16", "content": "", "title": "", "description": "", "expiration": null, "is_active": 1 }, { "id": 3924726692, "indicator": "crowdstrike.phpartners.org", "type": "hostname", "created": "2024-07-23T17:50:16", "content": "", "title": "", "description": "", "expiration": null, "is_active": 1 }, { "id": 3924607158, "indicator": "crowdstrike.woccpa.com", "type": "hostname", "created": "2024-07-23T17:50:16", "content": "", "title": "", "description": "", "expiration": null, "is_active": 1 }, { "id": 3924607159, "indicator": "sinkhole-d845c7b471d9adc14942f95105d5ffcf.crowdstrikeupdate.com", "type": "hostname", "created": "2024-07-23T17:50:16", "content": "", "title": "", "description": "", "expiration": null, "is_active": 1 }, { "id": 3926492771, "indicator": "803727ccdf441e49096f3fd48107a5fe55c56c080f46773cd649c9e55ec1be61", "type": "FileHash-SHA256", "created": "2024-07-23T17:50:16", "content": "", "title": "New_Recovery_Tool_to_help_with_CrowdStrike_issue_impacting_Windows.docm", "description": "This is a file that has been observed containing malicous macros that execute DLLs from the URL http[:]//172.104.160[.]126:8099/payload2.txt. This file is typically", "expiration": null, "is_active": 1 }, { "id": 3926492770, "indicator": "5eaf0f1c1d23f4372e24eb15ee969552c416a38dbc45e4f2b4af283e3bfb8721", "type": "FileHash-SHA256", "created": "2024-07-23T17:50:16", "content": "", "title": "Txt.File.EXEinPEM-7099209-0", "description": "", "expiration": null, "is_active": 1 }, { "id": 3926716864, "indicator": "9f28eef343b1a1c3639446b98b365cc9", "type": "FileHash-MD5", "created": "2024-07-23T17:50:16", "content": "", "title": "", "description": "MD5 of 3a9323a939fbecbc6d0ceb5c1e1f3ebde91e9f186b46fdf3ba1aee03d1d41cd8", "expiration": null, "is_active": 1 }, { "id": 3926716865, "indicator": "d67ea3b362d4e9b633216e85ac643d1f", "type": "FileHash-MD5", "created": "2024-07-23T17:50:16", "content": "", "title": "Txt.File.EXEinPEM-7099209-0", "description": "MD5 of 5eaf0f1c1d23f4372e24eb15ee969552c416a38dbc45e4f2b4af283e3bfb8721", "expiration": null, "is_active": 1 }, { "id": 3926716866, "indicator": "dd2100dfa067caae416b885637adc4ef", "type": "FileHash-MD5", "created": "2024-07-23T17:50:16", "content": "", "title": "#Lowfi:Lua:Mampa:99!ml", "description": "MD5 of 803727ccdf441e49096f3fd48107a5fe55c56c080f46773cd649c9e55ec1be61", "expiration": null, "is_active": 1 }, { "id": 3926716867, "indicator": "eb29329de4937b34f218665da57bcef4", "type": "FileHash-MD5", "created": "2024-07-23T17:50:16", "content": "", "title": "", "description": "MD5 of 4ad9845e691dd415420e0c253ba452772495c0b971f48294b54631e79a22644a", "expiration": null, "is_active": 1 }, { "id": 3926716868, "indicator": "1ba68f4e998ee1e405dac983084e7ef5b2d08664", "type": "FileHash-SHA1", "created": "2024-07-23T17:50:16", "content": "", "title": "", "description": "SHA1 of 4ad9845e691dd415420e0c253ba452772495c0b971f48294b54631e79a22644a", "expiration": null, "is_active": 1 }, { "id": 3926716869, "indicator": "499f8881f4927e7b4a1a0448f62c60741ea6d44b", "type": "FileHash-SHA1", "created": "2024-07-23T17:50:16", "content": "", "title": "#Lowfi:Lua:Mampa:99!ml", "description": "SHA1 of 803727ccdf441e49096f3fd48107a5fe55c56c080f46773cd649c9e55ec1be61", "expiration": null, "is_active": 1 }, { "id": 3926716870, "indicator": "4ca0ecbbb4048e52e409f6f09562761dcc22d05f", "type": "FileHash-SHA1", "created": "2024-07-23T17:50:16", "content": "", "title": "", "description": "SHA1 of 3a9323a939fbecbc6d0ceb5c1e1f3ebde91e9f186b46fdf3ba1aee03d1d41cd8", "expiration": null, "is_active": 1 }, { "id": 3926716871, "indicator": "53d1c13de6e049a5b41fd3b6e5876060f73d28eb", "type": "FileHash-SHA1", "created": "2024-07-23T17:50:16", "content": "", "title": "Txt.File.EXEinPEM-7099209-0", "description": "SHA1 of 5eaf0f1c1d23f4372e24eb15ee969552c416a38dbc45e4f2b4af283e3bfb8721", "expiration": null, "is_active": 1 }, { "id": 3926716872, "indicator": "00199b4784533a124da96be5d5e472195b0e27be15007dcbd573c0fb29941d99", "type": "FileHash-SHA256", "created": "2024-07-23T17:50:16", "content": "", "title": "", "description": "", "expiration": null, "is_active": 1 }, { "id": 3926492768, "indicator": "3a9323a939fbecbc6d0ceb5c1e1f3ebde91e9f186b46fdf3ba1aee03d1d41cd8", "type": "FileHash-SHA256", "created": "2024-07-23T17:50:16", "content": "", "title": "", "description": "", "expiration": null, "is_active": 1 }, { "id": 3926492769, "indicator": "4ad9845e691dd415420e0c253ba452772495c0b971f48294b54631e79a22644a", "type": "FileHash-SHA256", "created": "2024-07-23T17:50:16", "content": "", "title": "", "description": "", "expiration": null, "is_active": 1 }, { "id": 3926716873, "indicator": "1f7e214c86e4133c96143c403f9e60315c5ca4b0", "type": "YARA", "created": "2024-07-23T17:50:16", "content": "rule CrowdStrike_CSA_240838_01 : daolpu stealer \n { \n meta: \n copyright = \"(c) 2024 CrowdStrike Inc.\" \n description = \"C++ stealer delivered via Word documents with macros impersonating CS\" \n reports = \"CSA-240838\" \n version = \"202407221342\" \n last_modified = \"2024-07-22\" \n malware_family = \"Daolpu\" \n strings: \n $ = \"C:\\\\Windows\\\\Temp\\\\result.txt\" \n $ = \"D:\\\\c++\\\\Mal_Cookie_x64\\\\x64\\\\Release\\\\mscorsvc.pdb\" \n condition: \n all of them \n }", "title": "", "description": "C++ stealer delivered via Word documents with macros impersonating CS", "expiration": null, "is_active": 1 } ]