Operation Phantom Enigma
A malicious campaign targeting primarily Brazilian residents has been discovered, with attacks detected since early 2025. The attackers employed phishing emails, some sent from compromised company servers, to distribute malware. Two attack chains were identified: one using a malicious browser extension for Google Chrome, Microsoft Edge, and Brave, and another utilizing Mesh Agent or PDQ Connect Agent. The campaign aimed to steal authentication data from victims' bank accounts, particularly targeting Banco do Brasil customers. Over 700 downloads of the malicious extension were recorded, affecting users in Brazil, Colombia, Czech Republic, Mexico, Russia, Vietnam, and other countries. The attackers used sophisticated techniques, including virtualization checks, UAC bypass, and file deletion to evade detection.
AI Analysis
Technical Summary
Operation Phantom Enigma is a malicious cyber campaign first identified in early 2025, primarily targeting Brazilian residents. The attackers leveraged phishing emails, some originating from compromised corporate email servers, to distribute malware designed to steal banking authentication credentials. The campaign employed two main attack vectors: a malicious browser extension compatible with Google Chrome, Microsoft Edge, and Brave browsers, and exploitation of legitimate remote management tools such as Mesh Agent and PDQ Connect Agent. The browser extension was downloaded over 700 times, indicating a significant infection vector. The primary target was Banco do Brasil customers, with the attackers aiming to harvest login credentials and potentially conduct fraudulent transactions. The campaign also affected users in Colombia, Czech Republic, Mexico, Russia, Vietnam, and other countries, demonstrating a broad geographic reach. The attackers used advanced evasion techniques including virtualization environment detection to avoid sandbox analysis, User Account Control (UAC) bypass to escalate privileges without user consent, and file deletion to remove traces of their activities. These tactics suggest a well-resourced adversary focused on stealth and persistence. The use of legitimate remote management tools as part of the attack chain indicates a sophisticated approach to lateral movement and persistence within compromised networks. The campaign’s medium severity rating reflects the targeted nature of the attacks and the moderate scale of infections, but the potential for significant financial theft and data compromise remains high.
Potential Impact
For European organizations, the direct impact of Operation Phantom Enigma may be limited due to its primary focus on Brazilian banking customers. However, the presence of infections in countries such as the Czech Republic and Russia indicates potential spillover or opportunistic targeting beyond South America. European financial institutions and enterprises using remote management tools like Mesh Agent or PDQ Connect Agent could be at risk if targeted by similar tactics. The campaign’s use of phishing and malicious browser extensions highlights ongoing vulnerabilities in user awareness and endpoint security. Successful credential theft could lead to unauthorized access to sensitive financial accounts, resulting in financial loss, reputational damage, and regulatory penalties under GDPR for failure to protect customer data. Additionally, the use of UAC bypass and file deletion techniques could enable attackers to maintain persistence and evade detection within European corporate networks, increasing the risk of prolonged compromise and data exfiltration.
Mitigation Recommendations
European organizations should implement targeted defenses against phishing campaigns by enhancing email filtering with advanced threat detection capabilities and conducting regular user awareness training focused on identifying phishing and malicious attachments. Endpoint protection platforms should be configured to detect and block unauthorized browser extensions, especially those not sourced from official repositories or lacking proper digital signatures. Monitoring and restricting the use of remote management tools like Mesh Agent and PDQ Connect Agent is critical; organizations should enforce strict access controls, regularly audit usage, and apply the principle of least privilege. Employing application whitelisting can prevent unauthorized execution of malicious scripts or binaries. Implementing behavioral analytics to detect unusual privilege escalations, such as UAC bypass attempts, and monitoring for suspicious file deletion activities can help identify ongoing attacks. Regularly updating and patching all software, including browsers and remote management agents, reduces the attack surface. Incident response plans should include procedures for rapid containment and remediation of credential theft incidents. Finally, multi-factor authentication (MFA) should be enforced for all sensitive systems and banking access to mitigate the impact of stolen credentials.
Affected Countries
Brazil, Colombia, Czech Republic, Mexico, Russia, Vietnam
Indicators of Compromise
- hash: 0353a0dbc9f016da09303ee1a3b75d2f
- hash: 0844863f61271a66aa015ad9dcf06e51
- hash: 0906079ea36374150e8d617145021147
- hash: 0a998db008d5a4bb25468eeeeaac8b44
- hash: 170cf97d5b48e63f52a0c5a40034cba4
- hash: 1d0de20947db8cc673a36c3ad2c2c195
- hash: 1dc5fb3e8b3e52ef16eb6e9451634302
- hash: 23eb9468f04b7ad1eb2ead4efa2342ba
- hash: 2769dd3214f6f09866401a5b4df2ec2e
- hash: 2e40ee3587f6a9e7b6e55e2542dd2a15
- hash: 324801048d4cae3613e3461066fbb42c
- hash: 33d04e8a112ad9209b165249f967cfe8
- hash: 3b7904ceacced9c6b27e4b9a622cbb6b
- hash: 43d3a6d7dda4369a9fe93e5689606ae9
- hash: 46f9751a0ed9666b93c115434093eac2
- hash: 4def6fe4b7f7d018377b21b40d2b8600
- hash: 5171cc256dd5725fcb7dc7bbe0965dda
- hash: 531aa37428cd0849af683bc314073189
- hash: 5aa3702095fa1c248968603eb842787f
- hash: 5c433c7e3c60562f8e3af773445d290b
- hash: 60d0ea728a9ffe749025516863e6efed
- hash: 63173c6a611f5c0633c9fe419a6acce2
- hash: 664424672d964a32bf96884dcc636c80
- hash: 6645245c890c880e2a47d9dd0e15cb83
- hash: 666e7765467a3cf0337880c92aa3f085
- hash: 69a61d9f28291f841c79a76828d85187
- hash: 74706fb1c99937bab18d8d1089ffcd96
- hash: 7b0bd22325896fd820246a9025ef0a80
- hash: 7bfc7569ef1db7a12352dee90ca72623
- hash: 830ab96a64f067f40c67fa0438796721
- hash: 83b36297191f3086d16bb5cbab39c44e
- hash: 85f1de2dc7d5ac2f2bd3b2aef021a36c
- hash: 85f95fec7c5c2f36f62a4126e580a13c
- hash: 8f7ea7be4386da8059546cc2a0646de1
- hash: 95dd9909a01a55a946006767b251f3e5
- hash: 97f5939048e0a83f0d6f05600d2f9542
- hash: 98899ba20c86ecf1d64608781de80c3f
- hash: 9a7b784874e343a55dea0ab35183c278
- hash: 9c684af15da207355889fe7d4dbe35ab
- hash: a0a3a22edd7671cf1cefe2a53db6dd3b
- hash: acf1521bc18e24891de6aeca55e61c6d
- hash: b5b88044425ab8994856c9eec5a35cb6
- hash: b969f8d6691a5d74200d52b9bab339c7
- hash: bbdb2d90c80a5a2bfb6f0f0fe86f3559
- hash: c1568382ff7e057efe1c02e3a590e017
- hash: c18827f7f8f6e9652b97e31efde1cc5a
- hash: c7bcc453584c21d5bce55fe2373d41ad
- hash: ceb0177875b90946d08227b18803628d
- hash: d0881696636dd6e4f6f0dd012edb78c5
- hash: d3d01e99862091c639b64a7d1da43f63
- hash: d936130d881c639ecdded9d417804aff
- hash: dbf9108e87a449f4edfb6cd01bd05fba
- hash: ddfb7c83bf37f47f72b9885077ac1081
- hash: e05c634227a36f9ca6e1a1ebca7f38de
- hash: e20139a8689fdde975d91d04b1cdab78
- hash: e67e1ebf2e63bab3198a177c08782ac2
- hash: ef53aa6b9fb3763fc1eaa6bd3af9a0c4
- hash: f56fa78987202b69bd184c8ce3f057dc
- hash: fc0018bcf99793929cbab5a9ee447d4c
- hash: 00000cabc4845ac8f83aef49a8829dcdb2532ffd
- hash: 03424d93a4b7ef8215cc400b9592b1e4531d4771
- hash: 170a5d58c8dd577340d340982a690f70646828e1
- hash: 188c7649f2a0afdc9c53404fad7042cf37bedfef
- hash: 18faefd144e4059485451b0de206994218c5ca61
- hash: 19f0fa67b474429c4eeb0befd7a05ebc70caae94
- hash: 1f0bf6bb09827b1e640bcf6dc3158097c12669cb
- hash: 2b3243c4e1ba593b556835bc13ebda146ff104fd
- hash: 2fccced92ab2b748b84a968f72f59f8e165b14d0
- hash: 2fff70c6670466e2e56817f4ea548dd0f1376430
- hash: 30e463796a79c7694d1bc574f8f4bc2a7943b795
- hash: 32aec47ff33d742d98c8a0f10cd36707397d93ab
- hash: 370b7ba5acad64f1107df448509d26af25a41901
- hash: 37da771c801b2a458dd99b35f8db239504a6bb6e
- hash: 3eeb3c585dfe0344873e7132b1f5d732b64fdb70
- hash: 4594f638b30290c1f8196dc8eae558934cf6b20f
- hash: 4db1b9ddd56173525dc26506832d516dbbb82db0
- hash: 4e0812d11ee4344e599d5c8a5f52e3e0664d2642
- hash: 517176001dc749098aedc7be424eb0de3d8d4bd8
- hash: 519dbbc674182934cd2dda5a229b44a6707e87e7
- hash: 571a6fd38d389e2d812b2c7f8c53370f9862b188
- hash: 5723cfbec0371d08d089017d0fe53906b5354498
- hash: 5db34fb55bbce1bfbe2890ec21dd434ed3882dd7
- hash: 65dc515a91fa57be682874257da817631b7f2cbf
- hash: 66b0392afdef5cf385a749dcd324d6e9c4c211f9
- hash: 67a41cd4eee2b85806227752c18b592f488e7536
- hash: 6ba1af8bc92127be44d18451b9c10d9d94565e0a
- hash: 747c79f9c0f1693709dec3c521995a7af3642515
- hash: 780e7e7243282e164fca585403b8b0d70edee736
- hash: 7bb6681cd789f8640ebb3f448d79fc3a5db1e2ac
- hash: 7ef6997553945792f162f69c060de380c4df2e92
- hash: 8014c678bbf130ef444b76d177679b3183954bfb
- hash: 8191beacc481c122cf8fac490eb0fd2b7553cc44
- hash: 84405c17a5c7b78ed9e637f0c0009295ef0c632b
- hash: 881fd1823fcc67690ec444dd17bb7b68eeb7ef42
- hash: 8f85c35b803ac96091ad8484254b81b828408c5b
- hash: 9089a0ac734c1e61f497ed373cec0dfcd4c4306a
- hash: 91bd1c7b874e5c01daa0b73a6518299d2716e559
- hash: 92af4b4733a7afd979bce1ad9892256a7a76bb87
- hash: 93295d2f085f13b03d6bd8becb5cdf277307249b
- hash: 95d0f18ae7a30a78386e49acd788b3f18da79663
- hash: 97b2717507ffbb5d4abd91fa3d061e952ac0f217
- hash: 9aaa4a515d39feab7aa2b250698a7adbabc4f2c7
- hash: a378c1572202986886faf22bc4ee5be7d347e3a8
- hash: ab03e650e73066a4144ecb0e38e4df31255440e3
- hash: af9c6eb6e4491e8d64eee363fed84185d99cc8b2
- hash: b019a7e35b3707dc2c7951af134ad388ead18e2a
- hash: b176474e39c23603ea87de842645bb389a5caedf
- hash: bbea981ce922497eb28de9399abf55c1fad3f3f6
- hash: bcfb10ac2785dbf06c610e73149725faa2206e83
- hash: c0c7f0662c6fa4798332664f23736eed895cb3ce
- hash: c7cd7e580a8aa8cdb79245f59027d9f281ef6da2
- hash: cdb35be5658164ba8d9f9e9e817b154ef6bf5e24
- hash: d0da6694ee450606cea9a664f8525252788d80e6
- hash: d6e2802d31bb0bf608883c7ab81ec7c56f6dc3be
- hash: dc47f68a835a713715dcc0752deccbf8e74cf606
- hash: df8c7dca4433dea9eb804ff6e30cba16b9152d05
- hash: e3b68a93688f8ff801336cc9d5e46ce4a4822fff
- hash: fffd9d328fbb27285c3e7c1e2c812736985ce482
- hash: 07f7ce55e75afda05241c70710d5c6769909d94193e41b370a29b5dca3ef1f3d
- hash: 09824e2d82d8e9681dcc3196fdc4a14f9074c84eb90571140957359ddb909859
- hash: 12155ad4d117ea2b13131df52de4045e635e100d45bac057d6f5674e894dec99
- hash: 135ddfdd7e252cd35704d378a2aec88e81d013aea418b4c9bb11675259df7a0a
- hash: 14db2e49a5234ae0f49e1df57da2db7c646347c9a5f18dbff35f3c564da48fdf
- hash: 1e87a8c3ce82fa83adbf832d00ebad5cc68ad02ea8f2257f6c4b1b9f996c4e13
- hash: 1f320e9295db50008784a61cb0a85f47a60af5ed874ae9f8720a76caad422708
- hash: 214fdc967fa82756c0a06f984c66920167fcf3b15399d4e890ad708a67ebafe1
- hash: 22ac1595064d31b5b4c816dee72a4a3eb31221661e6ee0cc6a103b5da8d95d1f
- hash: 268087c834f3080122ebd70d9db6353318756507a3c2d168b557be724daac72e
- hash: 333c037c9bb3ca75c92e5e2b3dd884df387a4ab73f8f9c8efc39c27e43b9c317
- hash: 34f4b3b40f4fc5f9489d493aa39d891c8be4f394356ff0a9e4e6a59ca19110ea
- hash: 37e2db3f730694135c02d6420156a58628d773ba467c2e7de534148a91b050ca
- hash: 46ff9565e31f15db54a1e661b5654dade5a0f3d09cabbaa5312a654aef2b6dab
- hash: 4969e5e05eb9d098a9f3dd366dce99c05927ff462b8d2637b7f3975723c325b6
- hash: 499bded154151cb3b4cad7d15de043bec60c8689f70fe8739fafb6aef9c711f1
- hash: 4a6d6670556d735258830be327fc21f1c9b06fa40a720a1a5249dadb8b2c70b7
- hash: 4e8911f412b8bdcd14f3d59a520f3a247881b1e03435314e259152a6cd229a60
- hash: 508a4646dbf7deaa99eee8db6b21e36c14c1570f627b31a264e8fa84e7db063b
- hash: 510db924e0e130ac8d87ba17fce6209a221b549bf4dd8a9b672ccd756e8480f5
- hash: 51f9e59f72549f45d6c77cd9492b24a699ebcfe599a37508d6768f96c69c0013
- hash: 5d0a3e7df85fe3150dbcd9229fa1015701cdb844a68a099f720b6eb18f97a3fd
- hash: 698fb4a365fe8f2798acc10a7fe50ac1d247d96b82935300195358247a4fcdc9
- hash: 721047615331748b04400c7f1d43627f439feba8e17cc14355a6577d9f120988
- hash: 77add700b03756e5c0fc23df8ecb0f298889070260ca2aecb80fedb626379c0e
- hash: 782b9e49b3977748efba0c61c425636d16f1ed20af20c0ddd0af8a2badaf4cf5
- hash: 7838cbf8aa4b64a425aa5df0ef2bc6d17c12a018f085e73c50ac6f3a186553f0
- hash: 79f36a9a16e9af0a3ed438691d1f7b52e8241983dd8faf77ed6e505a62dbeac4
- hash: 7e75683addbb186cb4bd234e754a097bff4d0e529d9b82b7454851f15a859a09
- hash: 84463241f0b57598e336497a4f221f2b2a447eea56ee37a9a14f48a2af800029
- hash: 8446a0e9b9179cca4622fdc739bc65e0626438cecf60a65d99626d44aa0984f2
- hash: 89be5190f71185821d657f9df2c1112f61099ad23c8c668bb4d03ccfbed28430
- hash: 8c9ea06032cd4f0dbed1db51e25df78d681bae2551a1628b6fcdbb00e3e83fa5
- hash: 8f2e76968370ed2fe34f1b5148a06580bd21df426ad960d10c3323885d655fc2
- hash: 9233a51cf93e0c0518cda2d333c6cee03fe62a6ce2f058af88ac295c1281f5a6
- hash: 9e37d6ec758c5e66935ec20e2cef2b1deace37a8b26d52757145cc12ecb61391
- hash: a3d85fad74a24a9fc45b91c82f178a6bf5eb041804ecfb4f2c529622772e8b8f
- hash: a42b08566fefc01c6197bebd8ac25abe5abf8eb1a6390997ebf48b3992791f86
- hash: a6a1987bff904eca067121a8fba91ab50008560fdd39547e720f698ed6516468
- hash: a9c42f11e75c3525d8d0f3f036c2f603e60fe102fc68b8f22a8b4c81779652a2
- hash: af1f0f5907822d9ec734a992880b596205e85b1f13ab219043356520d26c0536
- hash: b13c1c2e5af41bafe7356bc974cdd77bf4aa40ef36001301a240091ab734b6b9
- hash: b31afa0814439a5b080dddcbdced6049d2038656174fc12ea0f8503c7853c372
- hash: bae3cce0cbe6a0227ed33fe566f0e8fe4780f2a57743acc98f6859740d2d254d
- hash: bf1350c7a753ab98533e5937dedadfb8730c885d37acdf074e347e3eb3986f29
- hash: bf4faeebd8873a27d77643e4e7ffcc6d793b396252b5788868886d081203f1a8
- hash: c567f1564602f5c6b24af521900bc6ab0ab15e8edab6f531927891d418df201d
- hash: c9b193708fa1ce5827f716094da04634977a24b5123efba782034bfa9245a33d
- hash: d5d5e9b91321b11103a548729832c4ed3fb6465e9a059ac2ba8365899c1fa864
- hash: d80acee5688ba6f56640f77ab8719b45a3002c98b6b43c79d1d963ec29241b3d
- hash: d9dd2a9d82250bb2860014e8b819e258c1565aaf94a5014a962f3d34bab05697
- hash: dbac753c85a032edd290a03c8556677c6af6ce316afdf29e8b5012aad8e561f0
- hash: e193b19689ac577ee138f1521817906fbb58e15b93563e8d60569ea23caa5c4e
- hash: e1b09ac54179c487b68e25bd938b963b50e037639e4482488ee60ae7752434a7
- hash: ec00a674d55c6bd6907b584090b2bd9ff2eb3433e2276fc2b0e0366cdae63875
- hash: ec6a40e329d3fcb8a751ea92875db161bb983575f5ec9a5c1aedd2a8131df56d
- hash: f349010a752484df873c6b00f9949bd986052e28660fb9da4d50a9fe6546a61f
- hash: fa1292c6996c19849c9a8a74c190276ac655a7f53bbd1dd2a831e1410969dff6
- hash: fd084fcc0405bc255369b7e40276e5076db5fafa0a8c859e46b7c474e37b8f2e
- domain: atual2025.com
- domain: clientepj.com
- domain: computadorpj.com
- domain: financial-executive.com
- domain: hamrah-tejarat.com
- domain: message.data
- domain: nf-eletronica.org
- domain: nfe-fiscal.com
- domain: ranchocentral.com
- domain: servidor2025.com
- domain: syarousi-search.com
- domain: webrelayapi.online
- domain: enota.clientepj.com
- domain: mesh.computadorpj.com
- domain: relay.lombrelone.com
Operation Phantom Enigma
Description
A malicious campaign targeting primarily Brazilian residents has been discovered, with attacks detected since early 2025. The attackers employed phishing emails, some sent from compromised company servers, to distribute malware. Two attack chains were identified: one using a malicious browser extension for Google Chrome, Microsoft Edge, and Brave, and another utilizing Mesh Agent or PDQ Connect Agent. The campaign aimed to steal authentication data from victims' bank accounts, particularly targeting Banco do Brasil customers. Over 700 downloads of the malicious extension were recorded, affecting users in Brazil, Colombia, Czech Republic, Mexico, Russia, Vietnam, and other countries. The attackers used sophisticated techniques, including virtualization checks, UAC bypass, and file deletion to evade detection.
AI-Powered Analysis
Technical Analysis
Operation Phantom Enigma is a malicious cyber campaign first identified in early 2025, primarily targeting Brazilian residents. The attackers leveraged phishing emails, some originating from compromised corporate email servers, to distribute malware designed to steal banking authentication credentials. The campaign employed two main attack vectors: a malicious browser extension compatible with Google Chrome, Microsoft Edge, and Brave browsers, and exploitation of legitimate remote management tools such as Mesh Agent and PDQ Connect Agent. The browser extension was downloaded over 700 times, indicating a significant infection vector. The primary target was Banco do Brasil customers, with the attackers aiming to harvest login credentials and potentially conduct fraudulent transactions. The campaign also affected users in Colombia, Czech Republic, Mexico, Russia, Vietnam, and other countries, demonstrating a broad geographic reach. The attackers used advanced evasion techniques including virtualization environment detection to avoid sandbox analysis, User Account Control (UAC) bypass to escalate privileges without user consent, and file deletion to remove traces of their activities. These tactics suggest a well-resourced adversary focused on stealth and persistence. The use of legitimate remote management tools as part of the attack chain indicates a sophisticated approach to lateral movement and persistence within compromised networks. The campaign’s medium severity rating reflects the targeted nature of the attacks and the moderate scale of infections, but the potential for significant financial theft and data compromise remains high.
Potential Impact
For European organizations, the direct impact of Operation Phantom Enigma may be limited due to its primary focus on Brazilian banking customers. However, the presence of infections in countries such as the Czech Republic and Russia indicates potential spillover or opportunistic targeting beyond South America. European financial institutions and enterprises using remote management tools like Mesh Agent or PDQ Connect Agent could be at risk if targeted by similar tactics. The campaign’s use of phishing and malicious browser extensions highlights ongoing vulnerabilities in user awareness and endpoint security. Successful credential theft could lead to unauthorized access to sensitive financial accounts, resulting in financial loss, reputational damage, and regulatory penalties under GDPR for failure to protect customer data. Additionally, the use of UAC bypass and file deletion techniques could enable attackers to maintain persistence and evade detection within European corporate networks, increasing the risk of prolonged compromise and data exfiltration.
Mitigation Recommendations
European organizations should implement targeted defenses against phishing campaigns by enhancing email filtering with advanced threat detection capabilities and conducting regular user awareness training focused on identifying phishing and malicious attachments. Endpoint protection platforms should be configured to detect and block unauthorized browser extensions, especially those not sourced from official repositories or lacking proper digital signatures. Monitoring and restricting the use of remote management tools like Mesh Agent and PDQ Connect Agent is critical; organizations should enforce strict access controls, regularly audit usage, and apply the principle of least privilege. Employing application whitelisting can prevent unauthorized execution of malicious scripts or binaries. Implementing behavioral analytics to detect unusual privilege escalations, such as UAC bypass attempts, and monitoring for suspicious file deletion activities can help identify ongoing attacks. Regularly updating and patching all software, including browsers and remote management agents, reduces the attack surface. Incident response plans should include procedures for rapid containment and remediation of credential theft incidents. Finally, multi-factor authentication (MFA) should be enforced for all sensitive systems and banking access to mitigate the impact of stolen credentials.
For access to advanced analysis and higher rate limits, contact root@offseq.com
Technical Details
- Author
- AlienVault
- Tlp
- white
- References
- ["https://global.ptsecurity.com/analytics/pt-esc-threat-intelligence/operation-phantom-enigma"]
- Adversary
- null
- Pulse Id
- 6841cb98e410c49919c635cf
- Threat Score
- null
Indicators of Compromise
Hash
| Value | Description | Copy |
|---|---|---|
hash0353a0dbc9f016da09303ee1a3b75d2f | — | |
hash0844863f61271a66aa015ad9dcf06e51 | — | |
hash0906079ea36374150e8d617145021147 | — | |
hash0a998db008d5a4bb25468eeeeaac8b44 | — | |
hash170cf97d5b48e63f52a0c5a40034cba4 | — | |
hash1d0de20947db8cc673a36c3ad2c2c195 | — | |
hash1dc5fb3e8b3e52ef16eb6e9451634302 | — | |
hash23eb9468f04b7ad1eb2ead4efa2342ba | — | |
hash2769dd3214f6f09866401a5b4df2ec2e | — | |
hash2e40ee3587f6a9e7b6e55e2542dd2a15 | — | |
hash324801048d4cae3613e3461066fbb42c | — | |
hash33d04e8a112ad9209b165249f967cfe8 | — | |
hash3b7904ceacced9c6b27e4b9a622cbb6b | — | |
hash43d3a6d7dda4369a9fe93e5689606ae9 | — | |
hash46f9751a0ed9666b93c115434093eac2 | — | |
hash4def6fe4b7f7d018377b21b40d2b8600 | — | |
hash5171cc256dd5725fcb7dc7bbe0965dda | — | |
hash531aa37428cd0849af683bc314073189 | — | |
hash5aa3702095fa1c248968603eb842787f | — | |
hash5c433c7e3c60562f8e3af773445d290b | — | |
hash60d0ea728a9ffe749025516863e6efed | — | |
hash63173c6a611f5c0633c9fe419a6acce2 | — | |
hash664424672d964a32bf96884dcc636c80 | — | |
hash6645245c890c880e2a47d9dd0e15cb83 | — | |
hash666e7765467a3cf0337880c92aa3f085 | — | |
hash69a61d9f28291f841c79a76828d85187 | — | |
hash74706fb1c99937bab18d8d1089ffcd96 | — | |
hash7b0bd22325896fd820246a9025ef0a80 | — | |
hash7bfc7569ef1db7a12352dee90ca72623 | — | |
hash830ab96a64f067f40c67fa0438796721 | — | |
hash83b36297191f3086d16bb5cbab39c44e | — | |
hash85f1de2dc7d5ac2f2bd3b2aef021a36c | — | |
hash85f95fec7c5c2f36f62a4126e580a13c | — | |
hash8f7ea7be4386da8059546cc2a0646de1 | — | |
hash95dd9909a01a55a946006767b251f3e5 | — | |
hash97f5939048e0a83f0d6f05600d2f9542 | — | |
hash98899ba20c86ecf1d64608781de80c3f | — | |
hash9a7b784874e343a55dea0ab35183c278 | — | |
hash9c684af15da207355889fe7d4dbe35ab | — | |
hasha0a3a22edd7671cf1cefe2a53db6dd3b | — | |
hashacf1521bc18e24891de6aeca55e61c6d | — | |
hashb5b88044425ab8994856c9eec5a35cb6 | — | |
hashb969f8d6691a5d74200d52b9bab339c7 | — | |
hashbbdb2d90c80a5a2bfb6f0f0fe86f3559 | — | |
hashc1568382ff7e057efe1c02e3a590e017 | — | |
hashc18827f7f8f6e9652b97e31efde1cc5a | — | |
hashc7bcc453584c21d5bce55fe2373d41ad | — | |
hashceb0177875b90946d08227b18803628d | — | |
hashd0881696636dd6e4f6f0dd012edb78c5 | — | |
hashd3d01e99862091c639b64a7d1da43f63 | — | |
hashd936130d881c639ecdded9d417804aff | — | |
hashdbf9108e87a449f4edfb6cd01bd05fba | — | |
hashddfb7c83bf37f47f72b9885077ac1081 | — | |
hashe05c634227a36f9ca6e1a1ebca7f38de | — | |
hashe20139a8689fdde975d91d04b1cdab78 | — | |
hashe67e1ebf2e63bab3198a177c08782ac2 | — | |
hashef53aa6b9fb3763fc1eaa6bd3af9a0c4 | — | |
hashf56fa78987202b69bd184c8ce3f057dc | — | |
hashfc0018bcf99793929cbab5a9ee447d4c | — | |
hash00000cabc4845ac8f83aef49a8829dcdb2532ffd | — | |
hash03424d93a4b7ef8215cc400b9592b1e4531d4771 | — | |
hash170a5d58c8dd577340d340982a690f70646828e1 | — | |
hash188c7649f2a0afdc9c53404fad7042cf37bedfef | — | |
hash18faefd144e4059485451b0de206994218c5ca61 | — | |
hash19f0fa67b474429c4eeb0befd7a05ebc70caae94 | — | |
hash1f0bf6bb09827b1e640bcf6dc3158097c12669cb | — | |
hash2b3243c4e1ba593b556835bc13ebda146ff104fd | — | |
hash2fccced92ab2b748b84a968f72f59f8e165b14d0 | — | |
hash2fff70c6670466e2e56817f4ea548dd0f1376430 | — | |
hash30e463796a79c7694d1bc574f8f4bc2a7943b795 | — | |
hash32aec47ff33d742d98c8a0f10cd36707397d93ab | — | |
hash370b7ba5acad64f1107df448509d26af25a41901 | — | |
hash37da771c801b2a458dd99b35f8db239504a6bb6e | — | |
hash3eeb3c585dfe0344873e7132b1f5d732b64fdb70 | — | |
hash4594f638b30290c1f8196dc8eae558934cf6b20f | — | |
hash4db1b9ddd56173525dc26506832d516dbbb82db0 | — | |
hash4e0812d11ee4344e599d5c8a5f52e3e0664d2642 | — | |
hash517176001dc749098aedc7be424eb0de3d8d4bd8 | — | |
hash519dbbc674182934cd2dda5a229b44a6707e87e7 | — | |
hash571a6fd38d389e2d812b2c7f8c53370f9862b188 | — | |
hash5723cfbec0371d08d089017d0fe53906b5354498 | — | |
hash5db34fb55bbce1bfbe2890ec21dd434ed3882dd7 | — | |
hash65dc515a91fa57be682874257da817631b7f2cbf | — | |
hash66b0392afdef5cf385a749dcd324d6e9c4c211f9 | — | |
hash67a41cd4eee2b85806227752c18b592f488e7536 | — | |
hash6ba1af8bc92127be44d18451b9c10d9d94565e0a | — | |
hash747c79f9c0f1693709dec3c521995a7af3642515 | — | |
hash780e7e7243282e164fca585403b8b0d70edee736 | — | |
hash7bb6681cd789f8640ebb3f448d79fc3a5db1e2ac | — | |
hash7ef6997553945792f162f69c060de380c4df2e92 | — | |
hash8014c678bbf130ef444b76d177679b3183954bfb | — | |
hash8191beacc481c122cf8fac490eb0fd2b7553cc44 | — | |
hash84405c17a5c7b78ed9e637f0c0009295ef0c632b | — | |
hash881fd1823fcc67690ec444dd17bb7b68eeb7ef42 | — | |
hash8f85c35b803ac96091ad8484254b81b828408c5b | — | |
hash9089a0ac734c1e61f497ed373cec0dfcd4c4306a | — | |
hash91bd1c7b874e5c01daa0b73a6518299d2716e559 | — | |
hash92af4b4733a7afd979bce1ad9892256a7a76bb87 | — | |
hash93295d2f085f13b03d6bd8becb5cdf277307249b | — | |
hash95d0f18ae7a30a78386e49acd788b3f18da79663 | — | |
hash97b2717507ffbb5d4abd91fa3d061e952ac0f217 | — | |
hash9aaa4a515d39feab7aa2b250698a7adbabc4f2c7 | — | |
hasha378c1572202986886faf22bc4ee5be7d347e3a8 | — | |
hashab03e650e73066a4144ecb0e38e4df31255440e3 | — | |
hashaf9c6eb6e4491e8d64eee363fed84185d99cc8b2 | — | |
hashb019a7e35b3707dc2c7951af134ad388ead18e2a | — | |
hashb176474e39c23603ea87de842645bb389a5caedf | — | |
hashbbea981ce922497eb28de9399abf55c1fad3f3f6 | — | |
hashbcfb10ac2785dbf06c610e73149725faa2206e83 | — | |
hashc0c7f0662c6fa4798332664f23736eed895cb3ce | — | |
hashc7cd7e580a8aa8cdb79245f59027d9f281ef6da2 | — | |
hashcdb35be5658164ba8d9f9e9e817b154ef6bf5e24 | — | |
hashd0da6694ee450606cea9a664f8525252788d80e6 | — | |
hashd6e2802d31bb0bf608883c7ab81ec7c56f6dc3be | — | |
hashdc47f68a835a713715dcc0752deccbf8e74cf606 | — | |
hashdf8c7dca4433dea9eb804ff6e30cba16b9152d05 | — | |
hashe3b68a93688f8ff801336cc9d5e46ce4a4822fff | — | |
hashfffd9d328fbb27285c3e7c1e2c812736985ce482 | — | |
hash07f7ce55e75afda05241c70710d5c6769909d94193e41b370a29b5dca3ef1f3d | — | |
hash09824e2d82d8e9681dcc3196fdc4a14f9074c84eb90571140957359ddb909859 | — | |
hash12155ad4d117ea2b13131df52de4045e635e100d45bac057d6f5674e894dec99 | — | |
hash135ddfdd7e252cd35704d378a2aec88e81d013aea418b4c9bb11675259df7a0a | — | |
hash14db2e49a5234ae0f49e1df57da2db7c646347c9a5f18dbff35f3c564da48fdf | — | |
hash1e87a8c3ce82fa83adbf832d00ebad5cc68ad02ea8f2257f6c4b1b9f996c4e13 | — | |
hash1f320e9295db50008784a61cb0a85f47a60af5ed874ae9f8720a76caad422708 | — | |
hash214fdc967fa82756c0a06f984c66920167fcf3b15399d4e890ad708a67ebafe1 | — | |
hash22ac1595064d31b5b4c816dee72a4a3eb31221661e6ee0cc6a103b5da8d95d1f | — | |
hash268087c834f3080122ebd70d9db6353318756507a3c2d168b557be724daac72e | — | |
hash333c037c9bb3ca75c92e5e2b3dd884df387a4ab73f8f9c8efc39c27e43b9c317 | — | |
hash34f4b3b40f4fc5f9489d493aa39d891c8be4f394356ff0a9e4e6a59ca19110ea | — | |
hash37e2db3f730694135c02d6420156a58628d773ba467c2e7de534148a91b050ca | — | |
hash46ff9565e31f15db54a1e661b5654dade5a0f3d09cabbaa5312a654aef2b6dab | — | |
hash4969e5e05eb9d098a9f3dd366dce99c05927ff462b8d2637b7f3975723c325b6 | — | |
hash499bded154151cb3b4cad7d15de043bec60c8689f70fe8739fafb6aef9c711f1 | — | |
hash4a6d6670556d735258830be327fc21f1c9b06fa40a720a1a5249dadb8b2c70b7 | — | |
hash4e8911f412b8bdcd14f3d59a520f3a247881b1e03435314e259152a6cd229a60 | — | |
hash508a4646dbf7deaa99eee8db6b21e36c14c1570f627b31a264e8fa84e7db063b | — | |
hash510db924e0e130ac8d87ba17fce6209a221b549bf4dd8a9b672ccd756e8480f5 | — | |
hash51f9e59f72549f45d6c77cd9492b24a699ebcfe599a37508d6768f96c69c0013 | — | |
hash5d0a3e7df85fe3150dbcd9229fa1015701cdb844a68a099f720b6eb18f97a3fd | — | |
hash698fb4a365fe8f2798acc10a7fe50ac1d247d96b82935300195358247a4fcdc9 | — | |
hash721047615331748b04400c7f1d43627f439feba8e17cc14355a6577d9f120988 | — | |
hash77add700b03756e5c0fc23df8ecb0f298889070260ca2aecb80fedb626379c0e | — | |
hash782b9e49b3977748efba0c61c425636d16f1ed20af20c0ddd0af8a2badaf4cf5 | — | |
hash7838cbf8aa4b64a425aa5df0ef2bc6d17c12a018f085e73c50ac6f3a186553f0 | — | |
hash79f36a9a16e9af0a3ed438691d1f7b52e8241983dd8faf77ed6e505a62dbeac4 | — | |
hash7e75683addbb186cb4bd234e754a097bff4d0e529d9b82b7454851f15a859a09 | — | |
hash84463241f0b57598e336497a4f221f2b2a447eea56ee37a9a14f48a2af800029 | — | |
hash8446a0e9b9179cca4622fdc739bc65e0626438cecf60a65d99626d44aa0984f2 | — | |
hash89be5190f71185821d657f9df2c1112f61099ad23c8c668bb4d03ccfbed28430 | — | |
hash8c9ea06032cd4f0dbed1db51e25df78d681bae2551a1628b6fcdbb00e3e83fa5 | — | |
hash8f2e76968370ed2fe34f1b5148a06580bd21df426ad960d10c3323885d655fc2 | — | |
hash9233a51cf93e0c0518cda2d333c6cee03fe62a6ce2f058af88ac295c1281f5a6 | — | |
hash9e37d6ec758c5e66935ec20e2cef2b1deace37a8b26d52757145cc12ecb61391 | — | |
hasha3d85fad74a24a9fc45b91c82f178a6bf5eb041804ecfb4f2c529622772e8b8f | — | |
hasha42b08566fefc01c6197bebd8ac25abe5abf8eb1a6390997ebf48b3992791f86 | — | |
hasha6a1987bff904eca067121a8fba91ab50008560fdd39547e720f698ed6516468 | — | |
hasha9c42f11e75c3525d8d0f3f036c2f603e60fe102fc68b8f22a8b4c81779652a2 | — | |
hashaf1f0f5907822d9ec734a992880b596205e85b1f13ab219043356520d26c0536 | — | |
hashb13c1c2e5af41bafe7356bc974cdd77bf4aa40ef36001301a240091ab734b6b9 | — | |
hashb31afa0814439a5b080dddcbdced6049d2038656174fc12ea0f8503c7853c372 | — | |
hashbae3cce0cbe6a0227ed33fe566f0e8fe4780f2a57743acc98f6859740d2d254d | — | |
hashbf1350c7a753ab98533e5937dedadfb8730c885d37acdf074e347e3eb3986f29 | — | |
hashbf4faeebd8873a27d77643e4e7ffcc6d793b396252b5788868886d081203f1a8 | — | |
hashc567f1564602f5c6b24af521900bc6ab0ab15e8edab6f531927891d418df201d | — | |
hashc9b193708fa1ce5827f716094da04634977a24b5123efba782034bfa9245a33d | — | |
hashd5d5e9b91321b11103a548729832c4ed3fb6465e9a059ac2ba8365899c1fa864 | — | |
hashd80acee5688ba6f56640f77ab8719b45a3002c98b6b43c79d1d963ec29241b3d | — | |
hashd9dd2a9d82250bb2860014e8b819e258c1565aaf94a5014a962f3d34bab05697 | — | |
hashdbac753c85a032edd290a03c8556677c6af6ce316afdf29e8b5012aad8e561f0 | — | |
hashe193b19689ac577ee138f1521817906fbb58e15b93563e8d60569ea23caa5c4e | — | |
hashe1b09ac54179c487b68e25bd938b963b50e037639e4482488ee60ae7752434a7 | — | |
hashec00a674d55c6bd6907b584090b2bd9ff2eb3433e2276fc2b0e0366cdae63875 | — | |
hashec6a40e329d3fcb8a751ea92875db161bb983575f5ec9a5c1aedd2a8131df56d | — | |
hashf349010a752484df873c6b00f9949bd986052e28660fb9da4d50a9fe6546a61f | — | |
hashfa1292c6996c19849c9a8a74c190276ac655a7f53bbd1dd2a831e1410969dff6 | — | |
hashfd084fcc0405bc255369b7e40276e5076db5fafa0a8c859e46b7c474e37b8f2e | — |
Domain
| Value | Description | Copy |
|---|---|---|
domainatual2025.com | — | |
domainclientepj.com | — | |
domaincomputadorpj.com | — | |
domainfinancial-executive.com | — | |
domainhamrah-tejarat.com | — | |
domainmessage.data | — | |
domainnf-eletronica.org | — | |
domainnfe-fiscal.com | — | |
domainranchocentral.com | — | |
domainservidor2025.com | — | |
domainsyarousi-search.com | — | |
domainwebrelayapi.online | — | |
domainenota.clientepj.com | — | |
domainmesh.computadorpj.com | — | |
domainrelay.lombrelone.com | — |
Threat ID: 6841d3cd182aa0cae2e9066b
Added to database: 6/5/2025, 5:28:45 PM
Last enriched: 7/7/2025, 4:26:45 PM
Last updated: 8/7/2025, 11:34:29 AM
Views: 13
Related Threats
Coordinated Brute Force Campaign Targets Fortinet SSL VPN
MediumSilent Watcher: Dissecting Cmimai Stealer's VBS Payload
MediumCastleLoader Analysis
MediumThe Dark Side of Parental Control Apps
MediumUncovering a Web3 Interview Scam
MediumActions
Updates to AI analysis are available only with a Pro account. Contact root@offseq.com for access.
External Links
Need enhanced features?
Contact root@offseq.com for Pro access with improved analysis and higher rate limits.