A new malware operation is leveraging blockchain technology to maintain control servers hidden from sight.
Here are the indicators of compromise (IoCs): Type Indicator Description C2 domain 3262d48df5d75e34[. ]shop Active C2 infrastructure C2 domain ddcd62e16a428c8e[. ]shop Inactive C2 infrastructure C2 domain hivinest[.
]online Active C2 infrastructure C2 domain dsgnfwd[. ]xyz Sibling-contract C2 infrastructure C2 domain hubcreative[. ]shop Sibling-contract C2 infrastructure C2 domain insinght[. ]site Active sibling-contract C2 infrastructure Delivery domain 45a3158594d6ba76[.
]fun Fake CAPTCHA delivery infrastructure Delivery domain 82d35f9b891c987a[. ]fun Fake CAPTCHA delivery infrastructure Delivery domain 9082b2a18f2e00fe[. ]fun Fake CAPTCHA delivery infrastructure Delivery domain 67b3ac3e45812153[. ]fun Fake CAPTCHA delivery infrastructure Delivery domain truieparth[.
]online Fake CAPTCHA delivery infrastructure Delivery domain cleearpeyak[. ]online Fake CAPTCHA delivery infrastructure Delivery domain veruisuealx[. ]xyz Fake CAPTCHA delivery infrastructure Delivery domain folfdighdd[. ]xyz Fake CAPTCHA delivery infrastructure Supporting domain onemm[.
]net Build and staging server IP address 37.27.52[. ]152 Origin IP address for onemm[. ]net Traffic-distribution domain additionalver[. ]com Traffic funnel infrastructure Traffic-distribution domain promo-chatgpt[.
]com Traffic funnel infrastructure Traffic-distribution domain pleasewaitcenter[. ]top Traffic funnel infrastructure Traffic-distribution domain skaybolt[. ]online Traffic funnel infrastructure Traffic-distribution domain lanhd6549tdhse[. ]top Traffic funnel infrastructure Web-inject panel purplepencel[.
]online Banking and cryptocurrency web-inject configuration panel Web-inject panel detsigen[. ]site Banking and cryptocurrency web-inject configuration panel WebSocket endpoint 90happymoney[. ]top:3001/ws Browser-extension command-and-control endpoint Polygon wallet 0xd802C9427ce416B9DAb2db5aDD76EfAA6d9d826a Operator wallet associated with contract deployment Polygon wallet 0x6a6e177dcf992ac16f7367c14b26a3cf4775dfde Operator wallet associated with contract deployment Polygon smart contract 0xde2d34339c279a7a79bc4fc1c4f37d3c055211b7 Primary C2 smart contract Polygon smart contract 0xa982e044217b6bbaa7b3123b670c1c0ca1138a37 Sibling smart contract Polygon smart contract 0x308e9ecc849533a042f13fd77e5c82ec3c62e9f2 First contract attributed to the second operator wallet Blockchain event topic 0x868f5f914e26b486c50b15494d56c6b2f2f17f6514343909bd36a034c19452cc Event signature for monitoring contract updates Polygon RPC endpoint polygon-bor-rpc.publicnode.com Blockchain query endpoint used by the malware Polygon RPC endpoint polygon.publicnode.com Blockchain query endpoint used by the malware Polygon RPC endpoint polygon.gateway.tenderly.co Blockchain query endpoint used by the malware Polygon RPC endpoint gateway.tenderly.co/public/polygon Blockchain query endpoint used by the malware Polygon RPC endpoint 1rpc.io/matic Blockchain query endpoint used by the malware Polygon RPC endpoint polygon.api.onfinality.io/public Blockchain query endpoint used by the malware Polygon RPC endpoint polygon.rpc.subquery.network/public Blockchain query endpoint used by the malware Polygon...
