PFCloud · Bulletproof Hosting · Datacarry Ransomware
Source CIRCL OSINT Feed
0
TLP:WHITE, disclosure is not limited
Description
PFCloud · Bulletproof Hosting · Datacarry Ransomware
Indicators of compromise
IP addresses 12
- 185.216.70.170
- 77.90.38.170
- 154.216.19.224
- 154.216.17.157
- 176.65.141.201
- 176.65.141.232
- 206.123.145.13
- 154.216.19.224
- 154.216.17.157
- 176.65.141.201
Hashes 6
Link 1
- https://www.ccitic.org/assets/reports/CCITIC_CASE-RANS-01_TLP-CLEAR_EN.pdf
Text 17
- PFCloud · Bulletproof Hosting · Datacarry Ransomware
- Report
- CCITIC : CASE-RANS-01 — TLP:CLEAR
- SHELL-CN-1
- SHELL-CN-1
- SHELL-CN-1
- SHELL-CN-1
- SHELL-UK-2
- SHELL-UK-2
- SHELL-UK-3
Vulnerability 1
- CVE-2023-48788
As 12
- 135357
- 135357
- 135357
- 135357
- 214717
- 214717
- 207184
- 135357
- 135357
- 214717
Datetime 7
- 2024-06-19T00:00:00+00:00
- 2024-08-01T00:00:00+00:00
- 2024-11-15T00:00:00+00:00
- 2025-01-19T00:00:00+00:00
- 2025-05-18T00:00:00+00:00
- 2025-05-18T00:00:00+00:00
- 2025-06-13T00:00:00+00:00
File 6
- sos.exe
- sos.exe
- audiodg.exe
- audiofg.exe
- audiodg.exe
- KB332.ps1
Yara 1
- rule Datacarry_Chisel_Tunneling {meta:author = "CCITIC ASBL" date = "2025-11-21" description = "Chisel tunneling Datacarry detection" tlp = "TLP:CLEAR" confidence = "A1" strings: $s1 = "server34787" ascii wide $s2 = "GenuineIntel" ascii wide $s3 = "chisel" ascii wide nocase condition: uint16(0) == 0x5A4D and filesize < 50MB and 2 of them }
Sigma 1
- title: Datacarry - RDP Backdoor KB332.ps1 id: ccitic-case-rans-01-rdp status: experimental description: Unauthorized RDP activation author: CCITIC ASBL date: 2025-11-21 tags: - attack.t1021.001 - attack.t1059.001 logsource: category: process_creation product: windows detection: selection: CommandLine|contains: - 'Set-ExecutionPolicy Unrestricted' - 'fDenyTSConnections' - 'Allow RDP' condition: selection level: critical
Community reviews
Loading reviews…