Pulse Detail — Threat Intelligence

PULSE NAME

How a Tax Search Leads to Kernel-Mode AV/EDR Kill

WHITE Tr1sa111 2026-03-21 Modified: 2026-03-21

IOCs

MEDIUM VOLUME

MITRE ATT&CK & Malware Families

ATT&CK TECHNIQUES

MALWARE FAMILIES

HwAudKiller FatMalloc

Indicators of Compromise (25)

All FileHash-SHA256 FileHash-SHA1 FileHash-MD5 URL domain hostname

TYPE	INDICATOR	DESCRIPTION	CREATED
FileHash-SHA256	8a4033425d36cd99fe23e6faef9764fbf555f362ebdb5b72379342fbbe4c5531	—	2026-03-21
FileHash-SHA1	0ded1a1eabec8ae0ffb0b512871e7b545878437a	—	2026-03-21
FileHash-MD5	eef8a950952696b018aa9c6da2f5d7ad	—	2026-03-21
FileHash-SHA1	1fa071303fb846308571e64727501fb98b1c2be6	—	2026-03-21
FileHash-SHA256	033f42102362a8d8d4bdba870599eb5e0c893d8fd8dd4bc2a4b446cbbeb59b99	—	2026-03-21
FileHash-SHA256	0821661e715fe64bb39f4fece277737a48fd6839edd40ec8a4a39bf04cea8524	—	2026-03-21
FileHash-SHA256	28278b8c85c832417f9860fe8ea3ddbb9ff1d5860317db4813227a3a52b7c7cc	—	2026-03-21
FileHash-SHA256	2b409a265f571dccde6ef4860831c1b03d5418d1951f97925315dc5b0891da04	—	2026-03-21
FileHash-SHA256	5abe477517f51d81061d2e69a9adebdcda80d36667d0afabe103fda4802d33db	—	2026-03-21
FileHash-SHA256	7509365935fc1bfadba20656698d3a29051031635419043bc2bc45116106e026	—	2026-03-21
URL	http://anukitax.com/forminw9/	—	2026-03-21
URL	http://bringetax.com/humu/	—	2026-03-21
URL	http://grinvan.com/vims/browser/	—	2026-03-21
URL	http://rpc.adspect.net/v2/	—	2026-03-21
URL	https://jcibj.com/pcl.php	—	2026-03-21
domain	anukitax.com	—	2026-03-21
domain	bjtrck.com	—	2026-03-21
domain	bringetax.com	—	2026-03-21
domain	fioclouder.com	—	2026-03-21
domain	friugrime.com	—	2026-03-21
domain	grinvan.com	—	2026-03-21
domain	gripsmonga.sbs	—	2026-03-21
hostname	cdn.justcloakit.com	—	2026-03-21
hostname	client.justcloakit.com	—	2026-03-21
hostname	rpc.adspect.net	—	2026-03-21

References (1)