Pulse Detail — Threat Intelligence

PULSE NAME

Unveiling EncryptHub: Analysis of a multi-stage malware campaign

WHITE CyberHunter_NL 2025-03-11 Modified: 2025-04-10

IOCs

HIGH VOLUME

Outpost24’s products and services help businesses improve their security posture and reduce the risk of being targeted by cybercriminals such as the so-called "dark web” EncryptHub.

MITRE ATT&CK & Malware Families

ATT&CK TECHNIQUES

T1005 T1027 T1041 T1059 T1071 T1082 T1210 T1213 T1219 T1555 T1562 T1567 T1608 T1113 T1074 T1218 T1072 T1055

MALWARE FAMILIES

Kematian

Indicators of Compromise (17 / 89 total)

All domain FileHash-MD5 FileHash-SHA1 FileHash-SHA256 URL

TYPE	INDICATOR	DESCRIPTION	CREATED
URL	http://185.215.113.39/files/5094364719/7GVy9sB.ps1	—	2025-03-11
URL	http://185.215.113.39/files/5094364719/RNsgUnN.ps1	—	2025-03-11
URL	http://185.215.113.39/files/5094364719/fpEu4ir.ps1	—	2025-03-11
URL	http://185.215.113.39/files/5094364719/pcuy9xE.ps1	—	2025-03-11
URL	http://185.215.113.97/files/5094364719/LR8QUOU.ps1	3c8cc37a98346bd0123b35e5ccd87bd07d69914dae04f8b49f61c150d96e9d1f	2025-03-11
URL	http://31.41.244.11/files/5094364719/RRFd0ev.ps1	—	2025-03-11
URL	http://31.41.244.11/files/5094364719/T5NHWKA.ps1	—	2025-03-11
URL	http://31.41.244.11/files/5094364719/WClchuE.ps1	—	2025-03-11
URL	http://31.41.244.11/files/5094364719/rrfd0ev.ps1	—	2025-03-11
URL	http://31.41.244.11/files/5094364719/wVjWGck.ps1	—	2025-03-11
URL	http://31.41.244.11/files/5094364719/wclchue.ps1	—	2025-03-11
URL	http://31.41.244.11/files/5094364719/wvjwgck.ps1	—	2025-03-11
URL	https://85.234.100.177/b97c5970b3a1f0ccc/iwbsn37q.xl2a8	—	2025-03-11
URL	https://encrypthub.us/encrypthub/fickle/payload.xn--ps1-to0a	—	2025-03-11
URL	https://encrypthub.us/encrypthub/ram/	—	2025-03-11
URL	https://encrypthub.us/encrypthub/ram/ram.exe	—	2025-03-11
URL	https://encrypthub.us/encrypthub/ram/ram.ps1	—	2025-03-11

References (1)

↗ https://outpost24.com/blog/unveiling-encrypthub-multi-stage-malware/#indicators-of-compromise-iocs