Created
October 1, 2024 15:04
-
-
Save kirk-sayre-work/354d875086bb533b3095dc06b7537869 to your computer and use it in GitHub Desktop.
10/1/2024 BlindEagle VBS Sample IOCs
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| 10/1/2024 BlindEagle VBS Sample IOCs | |
| ====================================================== | |
| VBS Downloader SHA256: | |
| 01b5377b8e2fd5cc88c57a2115fefc853ddecbf4aff300357391dcd803b7d67d | |
| 05f1bfad1052e82ed6fc8d3348ea86f1958b8d8f39d331967edba843ce1214f7 | |
| 100d33a5d9d11b85a4b1f821a5dce334df5673da75d57ec4061df68d1c1a1a9f | |
| 186313dcc5e093e7997eaa5e1bd8e9d788bcb35537ab3d6741e3b6e37eecfa60 | |
| 2004d59d558983f5d19b914b2b348f75443c81b6f2cf0c76f7735037d376ced1 | |
| 2079acbc8d75560b596c1eecf7dbf545a9b9c6718d3291384a48f17a6bf4b44d | |
| 21d27f29540147603af9a74b194f553342254ee4daea07359e6bd1246442d4f8 | |
| 2302e959d65c30ae1abd47d34d4e421bb629b9ab4a2ec04277170691bb5abefd | |
| 2da99963acf87f71dc500922da2a8510fbb87c7f11bd5c165a602fbc7c76b177 | |
| 35d62ef87119b12931f40ed80b1cf35e8b32097027f77f96d27351fbf9d4501b | |
| 3ca2d0a1abba4f885e740032d2314993fac09ffffe14a4c6a89aacf65684e45b | |
| 404b57d95f283e13341785c6565f1fda78a9645912850491e819f1b047563f9f | |
| 41eb6115196af3892e27dba0a38c0376900f7d96b0e5721e4383b5e75d7379e7 | |
| 42f47186c0417fb3bd467830ef9e3d2170cc63dec914b3ecb8932f6523f40225 | |
| 4f5c3f46cfa283dcfd08911f3e7674d195f7281dc54bc6a224e47a22e9796478 | |
| 524b71c4013215761e79452ecd84fecf4ee101bd2011d2d95e604a566db996af | |
| 5ae8ef220711cf775ea5b5e8a93db4e2a88829709cf68e1a810f47229fdba903 | |
| 6da74e92c740c4443c54a8243037d0a2d9fac8f34764d1a86933063e5790ef2a | |
| 71c7461092c4a0705d5cbe43dab4757a336144a782d667fee8758ffe8380b691 | |
| 79c7020002b461319a5b25a22be2c4fabfcc5bcef788530d380ebd65872f4d9a | |
| 80e7c85eeb0a57e9f50e7d84e0eb1b2f2230837b53080d24696fab7373e9bc03 | |
| 812abce7dbbfa5cff999d623b7af55b890d5e2ffbab510a0b585efb0bf2eb0cb | |
| 8140d8019e144b3998a9fc991c45be89eb5f83c58f04627ce34c49b3f8d5d368 | |
| 8264386f0b6a0e9b2aa5f908dc3909f4b8a61b619edb269baf56bf7112ae100e | |
| 8bbe656dead58060c4150649a4e6fc7d383af419fab01d180f457a3d5e0f1b7d | |
| b2f5a10a8ad2b8107075218a91a0716e351f79a6ba3c05981b650783edef5784 | |
| bb6213db0b43f8b2b12775bf1d35b2ac34a912b53de53f8881a41c2c9a92bda5 | |
| bd0165995a09280cbdcc562067bbb5edfe8fd882c1d519a442c5bf9bbe21d88f | |
| bd33077b081c8b65e10488d40a46db863d21afa331b68f74f332dbb8a4219370 | |
| c0cd406c6c7d40ee1e3441be02224ab4e00394ce5009776c7a6fa49d306c8cac | |
| c2efd467a5a52d2ed84d765cf004c8fab1f4fdf714feae96b7f4b6adaf5bd793 | |
| c7f2358c6d043c69480de7d6bcffb1fc6c6467e21e5b3be0c84b6274d03ba284 | |
| cfe9d1eca804cfb9d54224474dd7e71a2ee2b19d3b721728bd9e8ec326c5594f | |
| d614d0dc69468d27d227cca3f2ea5b9763bd0f6a4581348a94350e0ecfc9b499 | |
| d88b56f3f48a8056d7bb61e6ee59cb3e403d7e15341663b8c40b71c33d4f929b | |
| d9a86e6b0093da1f4253695eb7feb06d6ba29cd58a19e2ed6d3bd8699e9ac3f0 | |
| da78b6a3b5c884402e96f23552ee698fa93eeb0f3f2d5000c4eacceb3e0e9200 | |
| dbe13428633b9203ab613d1e85a1a3968a852599ed94732bcbca94fffd8de452 | |
| dc8376cec72b52f0a7e6ef863740991cad8e2c99d769460e73f0593c4405fce8 | |
| de1451645751580908bbbeebecd43a3c0b985bc5f533cd57b9afc31344a6d2e5 | |
| dfa4dfcb2b8bd8a2f352199a49be86bd7e6440302405b68b11062c25a1c87487 | |
| e2da4bdc8ddb6ea24583b91f20a533ec87de790f22f475e29efc2b86a851c764 | |
| e5550d60a971336699ae2ddf5a88ef9ef0e2ac8d9bae8db9ebadf8e360ad3df1 | |
| e7b6804ad449a92a7f586380c1317391b3969b7ee999d4e183dbe49107f523ee | |
| eb32d01b3eeb25cf31b3cbe7a3ae26eb3e6b6aa1f1936bae80f3fd5b514220c3 | |
| ef18b54b8f37d475de25d891221866bb252f710f141a5107f9ba39fb110fc0d7 | |
| f193bfc26d4a4bf50276a27a873fd0f7941b10b6306ee515bf1f786dce2a4d76 | |
| f47da41573231159283b297aee90e0265ae0b53812d508d59be4fd97e89bdd41 | |
| fa6ef44602cd8b93885484c8408e6155d1747acfa361857cce7fbf8601ab689f | |
| ====================================================== | |
| URLs Hit by VBS Downloaders: | |
| http://104.168.32.148/345/CHPPZA.txt | |
| http://107.172.130.147/500/RSSTT.txt | |
| http://107.172.148.248/130/RMOTH.txt | |
| http://134.19.177.44/20/RFGHTTR.txt | |
| http://134.255.227.248/xampp/kb/KNORKK.txt | |
| http://172.232.184.131/801/SRVVR.txt | |
| http://172.232.189.85/2414/RNCFF.txt | |
| http://172.236.19.6 | |
| http://185.29.10.52/550/RGBV.txt | |
| http://185.29.10.52/55/AUNCC.txt | |
| http://192.3.223.30/200/LODCE.txt | |
| http://192.3.223.30/5456/ERFGD.txt | |
| http://198.23.133.156/775/CNNIO.txt | |
| http://198.46.129.134/450/LDBRR.txt | |
| http://45.79.190.156/560/WRDF.txt | |
| http://72.5.43.53/450/RRCFG.txt | |
| http://72.5.43.53/450/RRCFG.txt | |
| http://91.134.98.142/450/REMOTA.txt | |
| https://35.34.5.27 | |
| https://ia600100.us.archive.org/24/items/detah-note-v/DetahNoteV.txt | |
| https://paste.ee/d/2mlZ9/0 | |
| https://paste.ee/d/82O7E/0 | |
| https://paste.ee/d/82O7E/0oHZ | |
| https://paste.ee/d/AaTNM/0 | |
| https://paste.ee/d/AaTNM/05ev | |
| https://paste.ee/d/BoyxB/0 | |
| https://paste.ee/d/BoyxB/0lNT | |
| https://paste.ee/d/bxzBN/0 | |
| https://paste.ee/d/bxzBN/0pDd | |
| https://paste.ee/d/cnA1I/0 | |
| https://paste.ee/d/FKyid/0IAV | |
| https://paste.ee/d/FKyid/0U3a | |
| https://paste.ee/d/hNcUR/0Nd6 | |
| https://paste.ee/d/JTQTN/0 | |
| https://paste.ee/d/KR4jv/0 | |
| https://paste.ee/d/NGSJp/0 | |
| https://paste.ee/d/NGSJp/0Lgx | |
| https://paste.ee/d/nJcWp/0 | |
| https://paste.ee/d/nJcWp/03wV | |
| https://paste.ee/d/R4jkc/0 | |
| https://paste.ee/d/R5RuT/0 | |
| https://paste.ee/d/tbzjY/0 | |
| https://pub-26ee9be236b54d0cb1b570a203543b93.r2.dev/monday.txt | |
| https://pub-26ee9be236b54d0cb1b570a203543b93.r2.dev/mytx.txt | |
| https://pub-26ee9be236b54d0cb1b570a203543b93.r2.dev/onye.txt | |
| https://pub-4c182737706e41d29aee6cc5517f834d.r2.dev/ecofrdly.txt | |
| https://pub-6346c84860d5480393a1799fb277dfdc.r2.dev/bsnk.txt | |
| https://raw.githubusercontent.com/NoDetectOn/NoDetectOn/refs/heads/main/DetahNoth-V.txt | |
| ====================================================== | |
| Final EXE Payload SHA256: | |
| 05d0e1d9ef7d6eedb53e964344ca53153b5adcd1ebe1b0e646266567741d325e | |
| 12ec76ef2298ac0d535cdb8b61a024446807da02c90c0eebcde86b3f9a04445a | |
| 344eeb88cd808140a7528ef191335bc3a70fd0f29aee682f6febe4b900b03706 | |
| 39d10919a8911e77432ef9b514f5c74dd710ff2f242d3d9e69be6600b7a24907 | |
| 45ba5f7c168cfa2a68d8f8d448ee037d35fca5dbb7e9d4deb55f8e0ba97ceacb | |
| 594953ed201ce315eb73865c1bd5c0732fc5fb42091c71d777f9080b74138d63 | |
| 770696b370c4cf8217613148c2799677957ad0ceb55ffd6a50f594090076b888 | |
| 7dece62c4b406bf4ade0a6c069c09b04360eb2eed54f8f16bd2655674237021d | |
| 9e132562718eeb451808cfb21548977417230874a3e634be1b44962d2cb245ad | |
| a881c1695da8bd2ea1709b87cf1c751e89177ebd4c90e12ff069a15357b967ad | |
| adb52e96a97ee1e1230a180eeda41f5a77344351b4e87f4bbc755745fd099d04 | |
| b947917a3b6e2095295c6073de210611b549e9224b80fe80b257abfaaa162f03 | |
| c3a3e14fe23932fae3b25d5845274b981ca64a465ec56fe2f042dbfe05568d16 | |
| c475957ccf6c69f8d9463bd824c172c9261297bfb77d5404306d68264cb0bbee | |
| d83b5e97ce07a91b3d3d0e1e57e52704e5de787b66d93ab9336b9703554d42c3 | |
| dec4260af64a2b62d74139b2a4c8b6cd04348160b10b2b23bd352352952293ee | |
| fbd8feb952fb3452131ddf54096bcb0c704a3e3f45177aade5751b3395a5bb43 |
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment