Sealed Chain of Deception: Actors leveraging Node.JS to Launch JSCeal
A sophisticated malware campaign called JSCEAL is targeting cryptocurrency users through fake apps impersonating popular trading platforms. The attackers use malicious ads to lure victims into downloading installers that deploy a multi-stage infection chain. This includes PowerShell scripts for profiling and a final payload of compiled JavaScript (JSC) files executed via Node.js. The JSCEAL malware steals crypto-related data and credentials while employing advanced evasion techniques. The campaign has potentially reached millions of users across multiple countries, primarily targeting the cryptocurrency and financial sectors.
AI Analysis
Technical Summary
The JSCEAL malware campaign represents a sophisticated multi-stage attack targeting cryptocurrency users by leveraging fake applications that impersonate legitimate and popular cryptocurrency trading platforms. The attackers employ malvertising techniques to distribute malicious installers, which initiate a complex infection chain. This chain begins with PowerShell scripts used for system profiling and reconnaissance, gathering detailed information about the victim's environment. The final payload consists of compiled JavaScript files executed via Node.js, a runtime environment that allows JavaScript to run outside a browser. This approach enables the malware to perform stealthy operations and evade traditional detection mechanisms. JSCEAL is designed to steal sensitive cryptocurrency-related data, including wallet credentials and private keys, thereby compromising the confidentiality and integrity of users' digital assets. The malware also incorporates advanced evasion techniques such as obfuscation, anti-debugging, and persistence mechanisms to maintain long-term access and avoid detection. Although no known exploits are currently reported in the wild, the campaign has potentially affected millions of users worldwide, primarily focusing on the cryptocurrency and financial sectors. The use of Node.js for executing malicious JavaScript payloads is notable, as it allows attackers to blend in with legitimate development environments and complicates detection efforts. The campaign's reliance on fake apps and malvertising highlights the importance of user vigilance and robust application vetting processes.
Potential Impact
For European organizations, especially those involved in cryptocurrency trading, financial services, and fintech, the JSCEAL campaign poses significant risks. The theft of cryptocurrency credentials can lead to direct financial losses and undermine trust in digital asset platforms. Additionally, compromised systems may serve as footholds for further attacks, including lateral movement within corporate networks, data exfiltration, and disruption of services. The multi-stage infection chain and use of PowerShell scripts increase the likelihood of successful infiltration in environments with insufficient endpoint protection or monitoring. The campaign's evasion techniques may delay detection and response, exacerbating potential damage. Given Europe's growing cryptocurrency market and increasing adoption of Node.js in enterprise environments, the threat could impact both individual users and organizations, potentially leading to regulatory scrutiny, reputational damage, and financial penalties under frameworks like GDPR if personal data is compromised.
Mitigation Recommendations
To mitigate the JSCEAL threat, European organizations should implement a layered defense strategy tailored to the campaign's specific tactics. First, enhance endpoint detection and response (EDR) capabilities to identify suspicious PowerShell activity and Node.js execution patterns, including monitoring for unusual script execution and network connections. Employ application whitelisting to prevent unauthorized installers and executables from running, particularly those originating from untrusted sources or malvertising campaigns. Strengthen user awareness programs focusing on the risks of downloading apps from unofficial sources and recognizing malvertising. Implement strict controls on software installation privileges to limit the ability of malware to deploy multi-stage payloads. Network segmentation and monitoring can help contain infections and detect lateral movement. Additionally, enforce multi-factor authentication (MFA) for cryptocurrency platform access to reduce the impact of credential theft. Regularly audit and update security policies to include detection of obfuscated JavaScript and Node.js-based threats. Finally, collaborate with threat intelligence providers to stay informed about emerging indicators of compromise related to JSCEAL.
Affected Countries
Germany, United Kingdom, France, Netherlands, Switzerland, Sweden, Estonia
Indicators of Compromise
- url: https://pdax.ph/
- hash: 0f55270d67513ffed2e0415e12005920
- hash: 1e1a1f4d4ac004d8bbf752550d68ffde
- hash: 26b6df9c536e6684c5d7b26e4ca07908
- hash: 3ec72215746ee41fb60b4dc0d6157644
- hash: 49050020b62b4a1f72e4f04f0ebf5405
- hash: 4acd3f62656c25ae62b154eb4457b46c
- hash: 4b81d938f3dc6e5774cd914a90df8d48
- hash: 4ebdd18bd7878c60183cff89ca8c5e95
- hash: 6052c6a445948fc471f2cb9c3f1c5c30
- hash: 618eaf1c0a9ffae11717c861ff787395
- hash: 6557b0c60f7bfd1fec9ffa10fb4dce9e
- hash: 8388d3383a87616ccee938cbfbda6e1c
- hash: 86d14ae79d667bf8c21905cdfed18650
- hash: 88826231c6f0dfe43ce86cacaf98a997
- hash: 950bb5366d1d468a5a5653c0db0ed0a1
- hash: 9875429d727e366a10774afdad5e9c13
- hash: 9d47ab3a39b4216e25a208bcc6f63879
- hash: a1540b1f5b1bc2c47af753c53a1c83f6
- hash: abfd68ed409f0a4759ab04bff972b400
- hash: b55b683770c03b511ac195ff58f36381
- hash: c67c34a68be039529acfec28cbb439d3
- hash: d2d9ca5ea7c824132f2cb7d4959fa77c
- hash: db9d84d3b7a234d5ed13d6ae03a3fdac
- hash: efbc1161c875bb228427f8c7dfac1670
- hash: f08d6b6d012e0ce963b113e77460059e
- hash: f39b291beb753b162072917ab8c5afeb
- hash: f6caea305dcb9601dc79e3f429bec370
- hash: 0288e840ec15cd9119fbeea91b297a8517d14060
- hash: 02a9cc3919cc2dcf64f82f99deb3db31c4209a0a
- hash: 05dca4eb3cf0a890458b9be6f060781d0e8f972f
- hash: 08db30e7c0250bfadfd3d5612a27c426ccaa1c1a
- hash: 0b8f426c645c80e50a1ea9d50d490f488d46e749
- hash: 1fbda05adb0a6f650e9b51a15663066d74b31ce2
- hash: 20eca9473792b4c175bc563aa1783c92f555420c
- hash: 28be3f5fc34a2001f92952b9def180870cf6b517
- hash: 2f1015b309dd8b5c1746e37139110ab9fbb5dcff
- hash: 36282d52dc38c8a087ab5a823800b58ee4ab2856
- hash: 4dd68f317e1f23bb1839f237ba01d7b07693708b
- hash: 5392ebf217532d0366603cb86ab71b274002f03e
- hash: 5959b54019a549c359e9852461360f180152273c
- hash: 5dddf3292e68c8baca4bf24a34bf0aac30d8d1d5
- hash: 6e3846e4aa8242caaf3102caae24c35c24a1d2a0
- hash: 7cd8a2e9637068b4c61b3ef708a5b119ca243fb1
- hash: 94f75e23ac65b0df442dba61ced44448472f1cd5
- hash: 96db175831c576fda05c26410ce33d613587496e
- hash: a339213acbb8ab9fc40d3a01f30a34c6ad2f5d7f
- hash: a5228797c09cee8cccfcddc5a2ace144d5302cc2
- hash: ac7a5aee9f928e0cd529e5edccff0f8b075fe1f0
- hash: cf52bfeb65d7253393af064d3c996eeef2377b76
- hash: cf581e8bf451d77d332139bd6588a1dee6d42a42
- hash: f27ad93a2cb8fd8a4539392b65f06495054d692c
- hash: f5aeabf7522837e5f2f1bd168778787d38690017
- hash: f8a39da59183eab03f2921e0dd246801f57e0dc5
- hash: fa1ef167f8de956f20370f94c3e5769d4fa1ee43
- hash: 008ebf99c5d6ba123da31e70d342615b902b62d948e7e391fa14c12401367531
- hash: 012c29675f4680830380c13ab008d8275e7b767d99cf1bde6f07048f8af60753
- hash: 01c3b49ff55dfbe738b6c9370681b1985abd34641a75803fea1468e102b726c9
- hash: 0207f65982931abbd6984c61dc0ae183de6ecd3a2142899bc6df37a1b21c591e
- hash: 0265572bc65a4b9c9df8ce5396b3eb0f5050e677c83cc33427f168111cadd270
- hash: 03f3b378e78df66df0ffdaa37e286c71b8ae0da7893112125c3fee29b76b1db9
- hash: 040aca668b27bb12a083e4fd81e2e8ee5e48b5a87ecfac12196a855181e1fac6
- hash: 044e8525eff98c030632fb52cd145c404f7f1fe22c99f74afd3f9b14e38f2375
- hash: 058ae4136e241f116d8c5b1a1cad15b53090797154539faa35706568fbd85d9b
- hash: 05bb24fc76e97ae16d5d34d060cbcb015d8d89fee5fb2d2627600c86c7b9df47
- hash: 05db78bff1a48a674e70368b96a550a5f9f93271eb261ab63b36ee37e0e8b9f8
- hash: 09f803f69bde280adbd4e584ed26a01affac9721db8c5730275d385f084b422a
- hash: 0a3cb06b5ac5ad76105605ac88936966fe5f804488e6bd1882de1f27e30b6246
- hash: 0a5e5d64c5af3c26e35af64f8ba5b5f022a53a6a15b46dfe24c9cb0e2b06cbb1
- hash: 0c31453e74a3b763c7aea550b4f5f194e7656226012b243221eb93fa22da118e
- hash: 0e5343b83417b68521711acfa06375ebc8340750cf1a33d6709b2dd64704bd10
- hash: 0f6357f4dbc36dcf73b4e83f9af5a796e81742a1aab11c2c2ecdc0ea2691df41
- hash: 111fc7d7dd1f4ba3a87927b1754a9b67d2c60d58feb1cd6cc28d6c0b4057184f
- hash: 146173888f2910ab7e5a8bfb096af6e2b245f049f5b89f53052d509dee2422e5
- hash: 15d80a960ca81969063e1ef6181bc91fc2a1198a3065eb3eac4cafff49927ab5
- hash: 1773359f8c24fdbe6aa5ae94ea3988164c62a5ff5f1f28ca4ea0b04aab8f5a69
- hash: 18347a39f174c97947649b3f1de55e8409ff805e808f2101e5953a956e9ee99f
- hash: 1835390a86dc9da1ed4da909f1ba7a9c21448bd2d19858491ab9aaefdcf50fcc
- hash: 1b757be18092f64e50127d80dff35d0da3d4e2d99ed199a6df134a86461a727f
- hash: 1c03556d7d881f037714ec5186da327467d3cd16c1ce9dfb16dd7fea736f2001
- hash: 1d9945ac1a06f5ecef58d75452c898f39c6fa71f91274baf70404104bea63f36
- hash: 1e17595baf62c026c6a44c2b8d6ea8de501c2d8eda3adc6f2812ec01794e8a81
- hash: 1f874d70bafdad4f62ce21e416466513d9e681c70f87a4ad3acc7a9851cdcbf3
- hash: 1fb0b09c0a88665a3f2176555f58aa5ca5944d216f95143584f070468e184723
- hash: 209639849f74bf2736ede28b0a90a8f5799a14fb6a3fc79833ccc2144aa49b2d
- hash: 22c9540bf90fa46e35ebe978406214560f8e71c4e652bfd079c8e6ee2347bae7
- hash: 2339d4df537806bad1a503831c90f45174fe3700afb214d85a4e3a2e0007b0c8
- hash: 257201487770ac57345a1abdc90599bc78f5a9ab95b4ca0b9ff2cb699ddccf7d
- hash: 2701e53ba45d9b87fecd02e14609a87531d34b1503c2616c5fa2bb3fb45bf292
- hash: 27867b97cd0228c773e10c63859c39afcb24966b7b662542a31a24fbb212c754
- hash: 2b647bde846907c875504a3bf9df1ad12bf3a904130dd481ee8cac2effc9aa3c
- hash: 2ba5fdec63b23d7578bbb5c0a07bcae7fdcbb339acfff4fb4b2edd6e48a1ba62
- hash: 3228733606853dbff40f8874c88865f23b4cb0f07aebe746a77245a353c1f519
- hash: 3545b3debcfc385f169c92edca55dc5c9d394580fac1482a8394af5806b996b8
- hash: 3bcc05127c22b70f84ab4d252321fb35ec77a5db23764f4888094882dc4f9554
- hash: 4188868248e8f74ecd2f2868605a77f1986dbbf74d3bf741135c69931673ad38
- hash: 4297fccd1a4d3508ba166c3d32eaf6ac47a6267d2743eed2793de66d9c16a154
- hash: 43d80f600ebd0c2ba4768ea0600a6952e76fdcc659e7527f95dd89ca07d0a398
- hash: 43e385e3ce0f4d50b506829c3c42fcc680f1a47a495ee44aa995556ca8cde0de
- hash: 4705b21127e818572957d71cecda5c63b4f65cc59d00e9c1c9a226b595c5afe2
- hash: 484da78b0fef35711f86876f7c1c77264b8e4295d7393369379c384c05337ec5
- hash: 4889dda77ff5e7871e261d74b2ed83d987d3066471937b496e3b45101d3ddb93
- hash: 498269312a98583200ffc3a376ef909e15f4a67096bac218c849928ad7eebc92
- hash: 4e8dcef6a5c8c44a2910d0dc0b300f4d88ee5d4c71c9e5a710564062ca1c5f9f
- hash: 4ec7fbeedbad503e91d7d564803f608982eb091f091c24bef88f1ce5b4bddf2b
- hash: 4fbebb8e16bb4c9221c547656fa9f18f533ed8036d7604fef889c6409daf7e54
- hash: 4ff0bb65fb61bd59ab3fce204686a9e144989c65a1b92849bba5a144f9a23e77
- hash: 521e82117dc6d8d1a086f6094a31b3714677bdf5b8b27a40235e2d0d2ece3487
- hash: 52c0ebf80ba046488b988d32d8dc35eff170e44b29d06a0012c092f5f1ca7b50
- hash: 535bfac9fc9efd2d3abad5050a1c0165acedfbbd55ea9b701dbd9717cc387a9a
- hash: 54c0ef7cca1112e75bff0ebca5da91a1ca66c531e0b6a47b1e85907e21cc8623
- hash: 570408c97419092992370a1bf9b21e310b04ec3b56baa0ba0dfecccb5b1105ad
- hash: 58ffc7ad61b7d8038b45e1e2162b98d7e011b29fec1601068a98f6a272611b3e
- hash: 5a024ae97242be3b1b954f845f7a87a1411c47830f81a2b54f47ec2cf741e2a0
- hash: 5f071a36c0a79ddce92824a49fd8e9bd048b87cabb635671073402365afc342a
- hash: 5fe810cb5b34c8fd07c7eca301b32ef2d3b86290828d67edaad8444db811f20b
- hash: 62ba626bce09db5f8750938edced3768b401084a7d6584cd6ff9d53d2517781d
- hash: 62f74adf117bf42d3b6a1bf661a301e29c921bd229aab384ffe3f582040a754c
- hash: 66171f98e42211b0aa0e8b75bf57facb7940925358f493a0c18674e87dacc1c0
- hash: 67e3d7bcdf4cfd25750425ac0682e0ed98b3cb473448696fb79bf311fcdb18cd
- hash: 680da0b4d9f0c553dcdacdbbf516f59fcedd3a87f24aa1b59e9858b089d14329
- hash: 684aabefe516539cda48c65cb08014e6eb645b4f1e668d159fe0c18cf74eb407
- hash: 6a3cd43d6ee7744631efb49d40ed38dcd88f8801f85992c703e2a44f13291243
- hash: 6b498ec73d32860202b6a6ff8d21f8b5216c3903e066136f9d69ef2969955a78
- hash: 6e885af1b4b884c264f29253b80bfa47b29af7ac0757e5148e8cb3c342cd3183
- hash: 7084b80c30b30679ccbb42014f60a079f2de8e31daeaf0b7463ab305916d52b9
- hash: 72feb1a5349d6de289ba46509ab8b85fd91179fb533b607150d977914e924136
- hash: 7423a2a11a00a2d43adf583f9465e776a69ceafe17d5a1c756b8160b243a9210
- hash: 74c9175036bcaa239f433a98606df3a3be60ab9246f2067f500cea4b2be09a8f
- hash: 75e03884bf2f630c41ca04148cb28b7163945e146287fd1d2aafb10d3dd9b9d9
- hash: 7a6beb95d6c5c790cdfe04d4634f5ebf24707f80ed75ba20c09b1b78e4f448a5
- hash: 7af6c284b3bd701476929e8888b13015c31def1039bef91c63ba15368d9771ba
- hash: 7d2c797e363d45c74d90ad23438072c4e80ee2a1aa3aa8ea7f4d414b264d91cd
- hash: 7e1c82cdcff73ac69fee3ba71d67353a062103f1bfae4f263d03b3b84e48d782
- hash: 7ec75e7bbb70ae4eae79e0951231e479d28490ba090b628f2d252041370b2da5
- hash: 7ee0db8bade12d9861ccf8f43334a217c587d97bc0828238a98a325aaff75f8e
- hash: 825ece5c2dc6fb79a8afdf15daa32868a3cba71e726e2171025017fed1f2d606
- hash: 833841da3f61be8ec8eb6c660f592772fa6085563a4ce9bc8ea33dbc646cef24
- hash: 84174151afe82a85b035f66f99e6a47aa0f7ccdc32414371a434551a6ba9d216
- hash: 84195ae96768bc312b7494a8ba0493a772042bed068bc019c8d3dd9daf39bbf6
- hash: 84db0663b6aa8df2ac04470288fd5528f5537fb89d78a2e01cabdce371a686e8
- hash: 86610f1a2c87b80c898ec485681193f0788c017f2d0f73fad26b259655c6a8a5
- hash: 869ab661ae67d16d91da2e9edd9a4db7fb5a342043336e62ace5ff54738c8926
- hash: 86ca0cac017def21fcf74ecae8a00aa8830d825cad4f694d89a5af9954ce0234
- hash: 86dbef518d357a9b1517cd9dfdcf1b611f2c1afcf4496cefa99a4f2c3dff21e4
- hash: 8a7cf380772eabbe54d60dd713b0c733de67e82f4295b6638b81aaa76037e111
- hash: 8a9b2c59cfa1f332c12b430e0e7f367ea812871bb6825e172b85bb479068010d
- hash: 8abffe0d13d3b93ca3469045e4cebbee25b3631e6bba13880f04b7c8acac2536
- hash: 8acc2c1e5b6cb4266bfa926972b03d4b5bb4fad6f2a65adb78acf47cf0225404
- hash: 8d389f56c5b71d194bddd5b6ce5906e7e22730034ad882606cc8ae701011bf8c
- hash: 8e7a3c7d6e0b0569f4d521482935d9627be10cfef10e4ba17e59b2167d258fac
- hash: 95b39a0bad021f33e08df042b02d3267faee7bbc3e3080dda295c35b464dd607
- hash: 9667c18082a1d40b9b28b8eacf92df97226be3be93090eb599ef247eb50e1176
- hash: 99b8124c2a64d26567f19a44618144b1d6a7501a5892918f0120a496f983a0f2
- hash: 99f9f2701ef2302072e77433a055db3ffece476f0a4aef91099ecdaefaf9bac0
- hash: 9bfe57d6f74fd822c7431ee3fedb0ef36c6841634f015aa8a364006a68d45310
- hash: 9ce4d4e97956c190d384837d42274d8db33ae6073ab318f1e55f3e03da62507d
- hash: 9e56b950de6ef2e38f866921e7c311f074b7edb9735257c2d0d57cd3d2067d5b
- hash: a02f1d868e1d18c8b8159d4fa915bc238d35824ac553cd835ef9702e28b1ebb7
- hash: a05f029c644f8ad912994a364aa4a6c1d64da0a894f7856bc9be251e598404f9
- hash: a22d15afdeeb983d73255e274a8b62b76d267ca1cf943228d17992ceb6fd1643
- hash: a2b4413d9280aa2662643305ef7e624719e4e8c9dd7bfed15bf2867bea08901f
- hash: a4a0b3ab214a2d32703c1398819372aa7b491d195d1845f2d9f4f0dffc7fadf2
- hash: a5b97ec3fee224213eebd1c762e0f874481af46bfcd521cbf3baba4b1c1b6037
- hash: a696d03aeb1bde633b674bdd640a1a313cae7da711d99cfba3fd06f02d3864de
- hash: a817fba621e90c631d3ed9d062d12c34e4ef211385dede672a7eda4b5543e533
- hash: a9528e99a5b0a288855fca1d3a03975fe99ad6c5b8702a27d12e94c9a7a5367d
- hash: abcbbaf9e5b34d59c9caa015a0276a457e0de2b403a5a8aff37617f141f1bb96
- hash: acdaba94e9975e8e03fa13bae7f0f93f165f42226aeecea3af5a4e0111bdfb7e
- hash: ad558fb6438fc5d7b1a6af482646ea9d7a344221fa9f077d21f5ebdee2e223c8
- hash: af8fafea328954d50c459e3da9bcb0df2fa468e4e9df1cdbf827aa99bc1a9378
- hash: b1b608c7f0d943b48102237347754e593ac09715f0deda6a4a61730ece03a942
- hash: b6e4075d371dfaa63c8a78fc4c03cfb6051202d347e6c803c6d8962b24d0b6e8
- hash: b90e3aaae14e7787e5ea4a6d4beee672049bd5eb05427f2c80b64f605860d2b8
- hash: bc5d17555db59898dd15f43c8362d4f3c4013d80d64442d25d05f50caca00655
- hash: c320e4d29fb661273e0cda16c756d962a62b2ad3d76ab13c4d1aa7dcb6168449
- hash: c3bca61beb2a6027bc5f15cf93f47749c9406bee22ee0b579a7ffb0511e6c054
- hash: c417e37fb42f8b7fa282992a11b1d75840b035b92e0e39891cf153cc373c0c4e
- hash: c50fe7a338e7e2edb430688c87c65f92a0efd2115a8fab2e4e9776893d28db86
- hash: c65fdb27d1b478a4926c2e283f8c50e827d522c13ba56da67e1fb436548a4454
- hash: c7edcad8b139961ff93aba148b16227147b019b036cdce58522979c9b833a0bf
- hash: c7eedf31cf9e456cc9eb419edf30573f9ba03e80faccce9e86373e935f6c1b93
- hash: c9b14e41443d3d43907352f5c6cf46c53e7c9b69bf9299f8d61081e314e5ad4f
- hash: caf8bfc90e4300b8a18c3fe3a4badbe44c106830e7432d8eea227857a790ec91
- hash: cd6785e9690349d95ce34d30befe8b472f304e7c1129a0824c6e7a909aab7805
- hash: d17a330bb7c929efffb8a42d6ca224f839548560603f88e432043735d392bc85
- hash: d4bd8ba1ca7643016e324cdee81f46b2c5a49508fdc9011d71abeeea672e35fa
- hash: d7cbdc2b5c57b1f61c771be74e56aefc05ebd8faeb0d9a7b02daff6946248dbb
- hash: d7dba181b322bc6f51b7e530e924ba4f60b7334a72be7c5d92fd219502bb252e
- hash: d8ebbee135dba28a08fd975366ddf62d3ab2ed10f2b339b867ba6800cbb9321e
- hash: dc561df51d27ed3a99cb916bf08452c901956778c26709e69705cbdf77f74816
- hash: dce4294fb041c22de81d3eb4c4a178b5bdf6d9fb48b348556a51582553b3fb52
- hash: dd2bb7316be55446aebfa31d05e57e936eb9a18d5d9c20d60d87493100d05fe6
- hash: de213ebc44c614d0b2324787e267183dbbbbb19e1ad866435a322ee00e24e7b6
- hash: df93e348cc67d04318c0e439f5dbca681a3c1112924f57393cb57fc6a3d121d6
- hash: e14f1f80f192f1c36854474e7da7e660d06eca0a199df08c2aa6e34eb4847953
- hash: e48eba9d41a2d46d963c1117604005f53afce3e7e1ac5e0a7cca3b642720e7c2
- hash: e51855ae6e8e69f66c2af6d939769385f53e57445b9734b1b4811c09bfc80c97
- hash: e7945eee02f90a9a03eb82e64fcc8ed07fd1d6d528afe0f8f948699b0497c5f0
- hash: e881682b59640c05cd540696955a849610260415e576f79b62383108c1aa3354
- hash: ed6746a55f2160c586fdc66cd2c1db69f7fd0a73e6c2f1d83dd240c43828ba58
- hash: f1c3e6e5e7b63db19da86914726389b058a085830e0496173defe01d07849b9b
- hash: f5196deca103fba2b4de772a1415bafc616e5baa3fc6a388d0f8ee79d6f350f8
- hash: f6c670e65765d10a5ca0205a6ece3a3e6c7c730b0a8534c5adef4a3cbf06eb9c
- hash: f720d6f6baebd4ef76df978f2678387385ee2d20a37423e7957c2341fe46f9ca
- hash: f8d598d28dbb8294a5c709ab23d51e29e652ab47d5a317aa31f6302481159458
- hash: f97b286d61b26c98b900bb842fb7a5ccd781162bbeca8032f9c0ed81fe93fb7d
- hash: fb35436322e9429a498f79b9abea24ca419fafab93117582c3e97f9beab3a034
- url: https://app.akka.finance
- url: https://app.daomaker.com/
- url: https://bitcoinvn.io/
- url: https://bithumbcorp.com/en/
- url: https://gmgn.ai/
- url: https://kfc.global
- url: https://lutianwl.com
- url: https://remitano.com/
- url: https://vindax.com/
- url: https://wowbit.com/
- url: https://www.bee.com/
- url: https://www.bitazza.com/
- url: https://www.bitkub.com/
- url: https://www.coinhub.mn/
- url: https://www.mercadobitcoin.com.br/
- url: https://www.solflare.com/
- url: https://www.tokenmetrics.com/
- url: https://www.topshare.com.au/
- url: https://www.twex.exchange/
- domain: 18-22-59.com
- domain: 87-899.help
- domain: app-desktop-download.com
- domain: app-desktop.com
- domain: app-desktops-downloads.com
- domain: app-desktops-pc.com
- domain: app-downloads-desktops.com
- domain: app-pc-desktops.com
- domain: app-pc-download.com
- domain: app-pc-downloads.com
- domain: app-pc-windows.com
- domain: app-pc.com
- domain: app-windows.com
- domain: apps-desktop-download.com
- domain: apps-desktop-downloads.com
- domain: apps-desktop.com
- domain: apps-desktops-download.com
- domain: apps-desktops-downloads.com
- domain: apps-desktops-pc.com
- domain: apps-download-desktops.com
- domain: apps-downloads-desktop.com
- domain: apps-downloads-pc.com
- domain: apps-pc-download.com
- domain: apps-pc-downloads.com
- domain: bitcoinvn.io
- domain: bithumbcorp.com
- domain: csgo-play-de.com
- domain: desktop-app-download.com
- domain: desktop-app-pc.com
- domain: desktop-apps.com
- domain: desktop-downloads.com
- domain: desktop-pc-download.com
- domain: desktops-download-app.com
- domain: desktops-download-pc.com
- domain: desktops-downloads-app.com
- domain: desktops-pc-download.com
- domain: dockmilk.com
- domain: download-app-pc.com
- domain: download-apps-desktop.com
- domain: download-apps-pc.com
- domain: download-apps-windows.com
- domain: download-desktop.com
- domain: download-desktops-app.com
- domain: download-desktops-pc.com
- domain: download-desktops.com
- domain: download-pc-app.com
- domain: download-windows-desktops.com
- domain: downloads-app-pc.com
- domain: downloads-app.com
- domain: downloads-apps-windows.com
- domain: downloads-apps.com
- domain: downloads-desktop-windows.com
- domain: downloads-desktop.com
- domain: downloads-pc-desktop.com
- domain: downloads-windows-app.com
- domain: downloads-windows-apps.com
- domain: experimental-tech.com
- domain: external-sex.com
- domain: firewall-813.com
- domain: foo-foo.bar
- domain: grpc-test.me
- domain: local-mailer.com
- domain: lovely-race.com
- domain: luiowitz.cfd
- domain: lutianwl.com
- domain: paid-rewards.lol
- domain: pc-app-desktops.com
- domain: pc-app-download.com
- domain: pc-app-downloads.com
- domain: pc-app.com
- domain: pc-apps-download.com
- domain: pc-apps-downloads.com
- domain: pc-desktops-apps.com
- domain: pc-download-app.com
- domain: pc-download-desktop.com
- domain: pc-download-desktops.com
- domain: pc-downloads-app.com
- domain: pc-downloads-desktop.com
- domain: pc-downloads.com
- domain: pffffer.icu
- domain: printscreen.lol
- domain: runt.monster
- domain: schilllr.icu
- domain: supercharming.com
- domain: supernegro.mom
- domain: taylor-convert.com
- domain: timing-kings.com
- domain: twisted.mom
- domain: windows-downloads-app.com
- domain: llr.experimental-tech.com
- domain: r2.ohyoulookstupid.win
- domain: www.bitazza.com
- domain: www.coinhub.mn
- domain: www.topshare.com.au
- domain: www.twex.exchange
- domain: xhab.grpc-test.me
Sealed Chain of Deception: Actors leveraging Node.JS to Launch JSCeal
Description
A sophisticated malware campaign called JSCEAL is targeting cryptocurrency users through fake apps impersonating popular trading platforms. The attackers use malicious ads to lure victims into downloading installers that deploy a multi-stage infection chain. This includes PowerShell scripts for profiling and a final payload of compiled JavaScript (JSC) files executed via Node.js. The JSCEAL malware steals crypto-related data and credentials while employing advanced evasion techniques. The campaign has potentially reached millions of users across multiple countries, primarily targeting the cryptocurrency and financial sectors.
AI-Powered Analysis
Technical Analysis
The JSCEAL malware campaign represents a sophisticated multi-stage attack targeting cryptocurrency users by leveraging fake applications that impersonate legitimate and popular cryptocurrency trading platforms. The attackers employ malvertising techniques to distribute malicious installers, which initiate a complex infection chain. This chain begins with PowerShell scripts used for system profiling and reconnaissance, gathering detailed information about the victim's environment. The final payload consists of compiled JavaScript files executed via Node.js, a runtime environment that allows JavaScript to run outside a browser. This approach enables the malware to perform stealthy operations and evade traditional detection mechanisms. JSCEAL is designed to steal sensitive cryptocurrency-related data, including wallet credentials and private keys, thereby compromising the confidentiality and integrity of users' digital assets. The malware also incorporates advanced evasion techniques such as obfuscation, anti-debugging, and persistence mechanisms to maintain long-term access and avoid detection. Although no known exploits are currently reported in the wild, the campaign has potentially affected millions of users worldwide, primarily focusing on the cryptocurrency and financial sectors. The use of Node.js for executing malicious JavaScript payloads is notable, as it allows attackers to blend in with legitimate development environments and complicates detection efforts. The campaign's reliance on fake apps and malvertising highlights the importance of user vigilance and robust application vetting processes.
Potential Impact
For European organizations, especially those involved in cryptocurrency trading, financial services, and fintech, the JSCEAL campaign poses significant risks. The theft of cryptocurrency credentials can lead to direct financial losses and undermine trust in digital asset platforms. Additionally, compromised systems may serve as footholds for further attacks, including lateral movement within corporate networks, data exfiltration, and disruption of services. The multi-stage infection chain and use of PowerShell scripts increase the likelihood of successful infiltration in environments with insufficient endpoint protection or monitoring. The campaign's evasion techniques may delay detection and response, exacerbating potential damage. Given Europe's growing cryptocurrency market and increasing adoption of Node.js in enterprise environments, the threat could impact both individual users and organizations, potentially leading to regulatory scrutiny, reputational damage, and financial penalties under frameworks like GDPR if personal data is compromised.
Mitigation Recommendations
To mitigate the JSCEAL threat, European organizations should implement a layered defense strategy tailored to the campaign's specific tactics. First, enhance endpoint detection and response (EDR) capabilities to identify suspicious PowerShell activity and Node.js execution patterns, including monitoring for unusual script execution and network connections. Employ application whitelisting to prevent unauthorized installers and executables from running, particularly those originating from untrusted sources or malvertising campaigns. Strengthen user awareness programs focusing on the risks of downloading apps from unofficial sources and recognizing malvertising. Implement strict controls on software installation privileges to limit the ability of malware to deploy multi-stage payloads. Network segmentation and monitoring can help contain infections and detect lateral movement. Additionally, enforce multi-factor authentication (MFA) for cryptocurrency platform access to reduce the impact of credential theft. Regularly audit and update security policies to include detection of obfuscated JavaScript and Node.js-based threats. Finally, collaborate with threat intelligence providers to stay informed about emerging indicators of compromise related to JSCEAL.
Affected Countries
For access to advanced analysis and higher rate limits, contact root@offseq.com
Technical Details
- Author
- AlienVault
- Tlp
- white
- References
- ["https://research.checkpoint.com/2025/jsceal-targets-crypto-apps/"]
- Adversary
- null
- Pulse Id
- 688b3d58e80e0edcd1cb1e22
- Threat Score
- null
Indicators of Compromise
Url
| Value | Description | Copy |
|---|---|---|
urlhttps://pdax.ph/ | — | |
urlhttps://app.akka.finance | — | |
urlhttps://app.daomaker.com/ | — | |
urlhttps://bitcoinvn.io/ | — | |
urlhttps://bithumbcorp.com/en/ | — | |
urlhttps://gmgn.ai/ | — | |
urlhttps://kfc.global | — | |
urlhttps://lutianwl.com | — | |
urlhttps://remitano.com/ | — | |
urlhttps://vindax.com/ | — | |
urlhttps://wowbit.com/ | — | |
urlhttps://www.bee.com/ | — | |
urlhttps://www.bitazza.com/ | — | |
urlhttps://www.bitkub.com/ | — | |
urlhttps://www.coinhub.mn/ | — | |
urlhttps://www.mercadobitcoin.com.br/ | — | |
urlhttps://www.solflare.com/ | — | |
urlhttps://www.tokenmetrics.com/ | — | |
urlhttps://www.topshare.com.au/ | — | |
urlhttps://www.twex.exchange/ | — |
Hash
| Value | Description | Copy |
|---|---|---|
hash0f55270d67513ffed2e0415e12005920 | — | |
hash1e1a1f4d4ac004d8bbf752550d68ffde | — | |
hash26b6df9c536e6684c5d7b26e4ca07908 | — | |
hash3ec72215746ee41fb60b4dc0d6157644 | — | |
hash49050020b62b4a1f72e4f04f0ebf5405 | — | |
hash4acd3f62656c25ae62b154eb4457b46c | — | |
hash4b81d938f3dc6e5774cd914a90df8d48 | — | |
hash4ebdd18bd7878c60183cff89ca8c5e95 | — | |
hash6052c6a445948fc471f2cb9c3f1c5c30 | — | |
hash618eaf1c0a9ffae11717c861ff787395 | — | |
hash6557b0c60f7bfd1fec9ffa10fb4dce9e | — | |
hash8388d3383a87616ccee938cbfbda6e1c | — | |
hash86d14ae79d667bf8c21905cdfed18650 | — | |
hash88826231c6f0dfe43ce86cacaf98a997 | — | |
hash950bb5366d1d468a5a5653c0db0ed0a1 | — | |
hash9875429d727e366a10774afdad5e9c13 | — | |
hash9d47ab3a39b4216e25a208bcc6f63879 | — | |
hasha1540b1f5b1bc2c47af753c53a1c83f6 | — | |
hashabfd68ed409f0a4759ab04bff972b400 | — | |
hashb55b683770c03b511ac195ff58f36381 | — | |
hashc67c34a68be039529acfec28cbb439d3 | — | |
hashd2d9ca5ea7c824132f2cb7d4959fa77c | — | |
hashdb9d84d3b7a234d5ed13d6ae03a3fdac | — | |
hashefbc1161c875bb228427f8c7dfac1670 | — | |
hashf08d6b6d012e0ce963b113e77460059e | — | |
hashf39b291beb753b162072917ab8c5afeb | — | |
hashf6caea305dcb9601dc79e3f429bec370 | — | |
hash0288e840ec15cd9119fbeea91b297a8517d14060 | — | |
hash02a9cc3919cc2dcf64f82f99deb3db31c4209a0a | — | |
hash05dca4eb3cf0a890458b9be6f060781d0e8f972f | — | |
hash08db30e7c0250bfadfd3d5612a27c426ccaa1c1a | — | |
hash0b8f426c645c80e50a1ea9d50d490f488d46e749 | — | |
hash1fbda05adb0a6f650e9b51a15663066d74b31ce2 | — | |
hash20eca9473792b4c175bc563aa1783c92f555420c | — | |
hash28be3f5fc34a2001f92952b9def180870cf6b517 | — | |
hash2f1015b309dd8b5c1746e37139110ab9fbb5dcff | — | |
hash36282d52dc38c8a087ab5a823800b58ee4ab2856 | — | |
hash4dd68f317e1f23bb1839f237ba01d7b07693708b | — | |
hash5392ebf217532d0366603cb86ab71b274002f03e | — | |
hash5959b54019a549c359e9852461360f180152273c | — | |
hash5dddf3292e68c8baca4bf24a34bf0aac30d8d1d5 | — | |
hash6e3846e4aa8242caaf3102caae24c35c24a1d2a0 | — | |
hash7cd8a2e9637068b4c61b3ef708a5b119ca243fb1 | — | |
hash94f75e23ac65b0df442dba61ced44448472f1cd5 | — | |
hash96db175831c576fda05c26410ce33d613587496e | — | |
hasha339213acbb8ab9fc40d3a01f30a34c6ad2f5d7f | — | |
hasha5228797c09cee8cccfcddc5a2ace144d5302cc2 | — | |
hashac7a5aee9f928e0cd529e5edccff0f8b075fe1f0 | — | |
hashcf52bfeb65d7253393af064d3c996eeef2377b76 | — | |
hashcf581e8bf451d77d332139bd6588a1dee6d42a42 | — | |
hashf27ad93a2cb8fd8a4539392b65f06495054d692c | — | |
hashf5aeabf7522837e5f2f1bd168778787d38690017 | — | |
hashf8a39da59183eab03f2921e0dd246801f57e0dc5 | — | |
hashfa1ef167f8de956f20370f94c3e5769d4fa1ee43 | — | |
hash008ebf99c5d6ba123da31e70d342615b902b62d948e7e391fa14c12401367531 | — | |
hash012c29675f4680830380c13ab008d8275e7b767d99cf1bde6f07048f8af60753 | — | |
hash01c3b49ff55dfbe738b6c9370681b1985abd34641a75803fea1468e102b726c9 | — | |
hash0207f65982931abbd6984c61dc0ae183de6ecd3a2142899bc6df37a1b21c591e | — | |
hash0265572bc65a4b9c9df8ce5396b3eb0f5050e677c83cc33427f168111cadd270 | — | |
hash03f3b378e78df66df0ffdaa37e286c71b8ae0da7893112125c3fee29b76b1db9 | — | |
hash040aca668b27bb12a083e4fd81e2e8ee5e48b5a87ecfac12196a855181e1fac6 | — | |
hash044e8525eff98c030632fb52cd145c404f7f1fe22c99f74afd3f9b14e38f2375 | — | |
hash058ae4136e241f116d8c5b1a1cad15b53090797154539faa35706568fbd85d9b | — | |
hash05bb24fc76e97ae16d5d34d060cbcb015d8d89fee5fb2d2627600c86c7b9df47 | — | |
hash05db78bff1a48a674e70368b96a550a5f9f93271eb261ab63b36ee37e0e8b9f8 | — | |
hash09f803f69bde280adbd4e584ed26a01affac9721db8c5730275d385f084b422a | — | |
hash0a3cb06b5ac5ad76105605ac88936966fe5f804488e6bd1882de1f27e30b6246 | — | |
hash0a5e5d64c5af3c26e35af64f8ba5b5f022a53a6a15b46dfe24c9cb0e2b06cbb1 | — | |
hash0c31453e74a3b763c7aea550b4f5f194e7656226012b243221eb93fa22da118e | — | |
hash0e5343b83417b68521711acfa06375ebc8340750cf1a33d6709b2dd64704bd10 | — | |
hash0f6357f4dbc36dcf73b4e83f9af5a796e81742a1aab11c2c2ecdc0ea2691df41 | — | |
hash111fc7d7dd1f4ba3a87927b1754a9b67d2c60d58feb1cd6cc28d6c0b4057184f | — | |
hash146173888f2910ab7e5a8bfb096af6e2b245f049f5b89f53052d509dee2422e5 | — | |
hash15d80a960ca81969063e1ef6181bc91fc2a1198a3065eb3eac4cafff49927ab5 | — | |
hash1773359f8c24fdbe6aa5ae94ea3988164c62a5ff5f1f28ca4ea0b04aab8f5a69 | — | |
hash18347a39f174c97947649b3f1de55e8409ff805e808f2101e5953a956e9ee99f | — | |
hash1835390a86dc9da1ed4da909f1ba7a9c21448bd2d19858491ab9aaefdcf50fcc | — | |
hash1b757be18092f64e50127d80dff35d0da3d4e2d99ed199a6df134a86461a727f | — | |
hash1c03556d7d881f037714ec5186da327467d3cd16c1ce9dfb16dd7fea736f2001 | — | |
hash1d9945ac1a06f5ecef58d75452c898f39c6fa71f91274baf70404104bea63f36 | — | |
hash1e17595baf62c026c6a44c2b8d6ea8de501c2d8eda3adc6f2812ec01794e8a81 | — | |
hash1f874d70bafdad4f62ce21e416466513d9e681c70f87a4ad3acc7a9851cdcbf3 | — | |
hash1fb0b09c0a88665a3f2176555f58aa5ca5944d216f95143584f070468e184723 | — | |
hash209639849f74bf2736ede28b0a90a8f5799a14fb6a3fc79833ccc2144aa49b2d | — | |
hash22c9540bf90fa46e35ebe978406214560f8e71c4e652bfd079c8e6ee2347bae7 | — | |
hash2339d4df537806bad1a503831c90f45174fe3700afb214d85a4e3a2e0007b0c8 | — | |
hash257201487770ac57345a1abdc90599bc78f5a9ab95b4ca0b9ff2cb699ddccf7d | — | |
hash2701e53ba45d9b87fecd02e14609a87531d34b1503c2616c5fa2bb3fb45bf292 | — | |
hash27867b97cd0228c773e10c63859c39afcb24966b7b662542a31a24fbb212c754 | — | |
hash2b647bde846907c875504a3bf9df1ad12bf3a904130dd481ee8cac2effc9aa3c | — | |
hash2ba5fdec63b23d7578bbb5c0a07bcae7fdcbb339acfff4fb4b2edd6e48a1ba62 | — | |
hash3228733606853dbff40f8874c88865f23b4cb0f07aebe746a77245a353c1f519 | — | |
hash3545b3debcfc385f169c92edca55dc5c9d394580fac1482a8394af5806b996b8 | — | |
hash3bcc05127c22b70f84ab4d252321fb35ec77a5db23764f4888094882dc4f9554 | — | |
hash4188868248e8f74ecd2f2868605a77f1986dbbf74d3bf741135c69931673ad38 | — | |
hash4297fccd1a4d3508ba166c3d32eaf6ac47a6267d2743eed2793de66d9c16a154 | — | |
hash43d80f600ebd0c2ba4768ea0600a6952e76fdcc659e7527f95dd89ca07d0a398 | — | |
hash43e385e3ce0f4d50b506829c3c42fcc680f1a47a495ee44aa995556ca8cde0de | — | |
hash4705b21127e818572957d71cecda5c63b4f65cc59d00e9c1c9a226b595c5afe2 | — | |
hash484da78b0fef35711f86876f7c1c77264b8e4295d7393369379c384c05337ec5 | — | |
hash4889dda77ff5e7871e261d74b2ed83d987d3066471937b496e3b45101d3ddb93 | — | |
hash498269312a98583200ffc3a376ef909e15f4a67096bac218c849928ad7eebc92 | — | |
hash4e8dcef6a5c8c44a2910d0dc0b300f4d88ee5d4c71c9e5a710564062ca1c5f9f | — | |
hash4ec7fbeedbad503e91d7d564803f608982eb091f091c24bef88f1ce5b4bddf2b | — | |
hash4fbebb8e16bb4c9221c547656fa9f18f533ed8036d7604fef889c6409daf7e54 | — | |
hash4ff0bb65fb61bd59ab3fce204686a9e144989c65a1b92849bba5a144f9a23e77 | — | |
hash521e82117dc6d8d1a086f6094a31b3714677bdf5b8b27a40235e2d0d2ece3487 | — | |
hash52c0ebf80ba046488b988d32d8dc35eff170e44b29d06a0012c092f5f1ca7b50 | — | |
hash535bfac9fc9efd2d3abad5050a1c0165acedfbbd55ea9b701dbd9717cc387a9a | — | |
hash54c0ef7cca1112e75bff0ebca5da91a1ca66c531e0b6a47b1e85907e21cc8623 | — | |
hash570408c97419092992370a1bf9b21e310b04ec3b56baa0ba0dfecccb5b1105ad | — | |
hash58ffc7ad61b7d8038b45e1e2162b98d7e011b29fec1601068a98f6a272611b3e | — | |
hash5a024ae97242be3b1b954f845f7a87a1411c47830f81a2b54f47ec2cf741e2a0 | — | |
hash5f071a36c0a79ddce92824a49fd8e9bd048b87cabb635671073402365afc342a | — | |
hash5fe810cb5b34c8fd07c7eca301b32ef2d3b86290828d67edaad8444db811f20b | — | |
hash62ba626bce09db5f8750938edced3768b401084a7d6584cd6ff9d53d2517781d | — | |
hash62f74adf117bf42d3b6a1bf661a301e29c921bd229aab384ffe3f582040a754c | — | |
hash66171f98e42211b0aa0e8b75bf57facb7940925358f493a0c18674e87dacc1c0 | — | |
hash67e3d7bcdf4cfd25750425ac0682e0ed98b3cb473448696fb79bf311fcdb18cd | — | |
hash680da0b4d9f0c553dcdacdbbf516f59fcedd3a87f24aa1b59e9858b089d14329 | — | |
hash684aabefe516539cda48c65cb08014e6eb645b4f1e668d159fe0c18cf74eb407 | — | |
hash6a3cd43d6ee7744631efb49d40ed38dcd88f8801f85992c703e2a44f13291243 | — | |
hash6b498ec73d32860202b6a6ff8d21f8b5216c3903e066136f9d69ef2969955a78 | — | |
hash6e885af1b4b884c264f29253b80bfa47b29af7ac0757e5148e8cb3c342cd3183 | — | |
hash7084b80c30b30679ccbb42014f60a079f2de8e31daeaf0b7463ab305916d52b9 | — | |
hash72feb1a5349d6de289ba46509ab8b85fd91179fb533b607150d977914e924136 | — | |
hash7423a2a11a00a2d43adf583f9465e776a69ceafe17d5a1c756b8160b243a9210 | — | |
hash74c9175036bcaa239f433a98606df3a3be60ab9246f2067f500cea4b2be09a8f | — | |
hash75e03884bf2f630c41ca04148cb28b7163945e146287fd1d2aafb10d3dd9b9d9 | — | |
hash7a6beb95d6c5c790cdfe04d4634f5ebf24707f80ed75ba20c09b1b78e4f448a5 | — | |
hash7af6c284b3bd701476929e8888b13015c31def1039bef91c63ba15368d9771ba | — | |
hash7d2c797e363d45c74d90ad23438072c4e80ee2a1aa3aa8ea7f4d414b264d91cd | — | |
hash7e1c82cdcff73ac69fee3ba71d67353a062103f1bfae4f263d03b3b84e48d782 | — | |
hash7ec75e7bbb70ae4eae79e0951231e479d28490ba090b628f2d252041370b2da5 | — | |
hash7ee0db8bade12d9861ccf8f43334a217c587d97bc0828238a98a325aaff75f8e | — | |
hash825ece5c2dc6fb79a8afdf15daa32868a3cba71e726e2171025017fed1f2d606 | — | |
hash833841da3f61be8ec8eb6c660f592772fa6085563a4ce9bc8ea33dbc646cef24 | — | |
hash84174151afe82a85b035f66f99e6a47aa0f7ccdc32414371a434551a6ba9d216 | — | |
hash84195ae96768bc312b7494a8ba0493a772042bed068bc019c8d3dd9daf39bbf6 | — | |
hash84db0663b6aa8df2ac04470288fd5528f5537fb89d78a2e01cabdce371a686e8 | — | |
hash86610f1a2c87b80c898ec485681193f0788c017f2d0f73fad26b259655c6a8a5 | — | |
hash869ab661ae67d16d91da2e9edd9a4db7fb5a342043336e62ace5ff54738c8926 | — | |
hash86ca0cac017def21fcf74ecae8a00aa8830d825cad4f694d89a5af9954ce0234 | — | |
hash86dbef518d357a9b1517cd9dfdcf1b611f2c1afcf4496cefa99a4f2c3dff21e4 | — | |
hash8a7cf380772eabbe54d60dd713b0c733de67e82f4295b6638b81aaa76037e111 | — | |
hash8a9b2c59cfa1f332c12b430e0e7f367ea812871bb6825e172b85bb479068010d | — | |
hash8abffe0d13d3b93ca3469045e4cebbee25b3631e6bba13880f04b7c8acac2536 | — | |
hash8acc2c1e5b6cb4266bfa926972b03d4b5bb4fad6f2a65adb78acf47cf0225404 | — | |
hash8d389f56c5b71d194bddd5b6ce5906e7e22730034ad882606cc8ae701011bf8c | — | |
hash8e7a3c7d6e0b0569f4d521482935d9627be10cfef10e4ba17e59b2167d258fac | — | |
hash95b39a0bad021f33e08df042b02d3267faee7bbc3e3080dda295c35b464dd607 | — | |
hash9667c18082a1d40b9b28b8eacf92df97226be3be93090eb599ef247eb50e1176 | — | |
hash99b8124c2a64d26567f19a44618144b1d6a7501a5892918f0120a496f983a0f2 | — | |
hash99f9f2701ef2302072e77433a055db3ffece476f0a4aef91099ecdaefaf9bac0 | — | |
hash9bfe57d6f74fd822c7431ee3fedb0ef36c6841634f015aa8a364006a68d45310 | — | |
hash9ce4d4e97956c190d384837d42274d8db33ae6073ab318f1e55f3e03da62507d | — | |
hash9e56b950de6ef2e38f866921e7c311f074b7edb9735257c2d0d57cd3d2067d5b | — | |
hasha02f1d868e1d18c8b8159d4fa915bc238d35824ac553cd835ef9702e28b1ebb7 | — | |
hasha05f029c644f8ad912994a364aa4a6c1d64da0a894f7856bc9be251e598404f9 | — | |
hasha22d15afdeeb983d73255e274a8b62b76d267ca1cf943228d17992ceb6fd1643 | — | |
hasha2b4413d9280aa2662643305ef7e624719e4e8c9dd7bfed15bf2867bea08901f | — | |
hasha4a0b3ab214a2d32703c1398819372aa7b491d195d1845f2d9f4f0dffc7fadf2 | — | |
hasha5b97ec3fee224213eebd1c762e0f874481af46bfcd521cbf3baba4b1c1b6037 | — | |
hasha696d03aeb1bde633b674bdd640a1a313cae7da711d99cfba3fd06f02d3864de | — | |
hasha817fba621e90c631d3ed9d062d12c34e4ef211385dede672a7eda4b5543e533 | — | |
hasha9528e99a5b0a288855fca1d3a03975fe99ad6c5b8702a27d12e94c9a7a5367d | — | |
hashabcbbaf9e5b34d59c9caa015a0276a457e0de2b403a5a8aff37617f141f1bb96 | — | |
hashacdaba94e9975e8e03fa13bae7f0f93f165f42226aeecea3af5a4e0111bdfb7e | — | |
hashad558fb6438fc5d7b1a6af482646ea9d7a344221fa9f077d21f5ebdee2e223c8 | — | |
hashaf8fafea328954d50c459e3da9bcb0df2fa468e4e9df1cdbf827aa99bc1a9378 | — | |
hashb1b608c7f0d943b48102237347754e593ac09715f0deda6a4a61730ece03a942 | — | |
hashb6e4075d371dfaa63c8a78fc4c03cfb6051202d347e6c803c6d8962b24d0b6e8 | — | |
hashb90e3aaae14e7787e5ea4a6d4beee672049bd5eb05427f2c80b64f605860d2b8 | — | |
hashbc5d17555db59898dd15f43c8362d4f3c4013d80d64442d25d05f50caca00655 | — | |
hashc320e4d29fb661273e0cda16c756d962a62b2ad3d76ab13c4d1aa7dcb6168449 | — | |
hashc3bca61beb2a6027bc5f15cf93f47749c9406bee22ee0b579a7ffb0511e6c054 | — | |
hashc417e37fb42f8b7fa282992a11b1d75840b035b92e0e39891cf153cc373c0c4e | — | |
hashc50fe7a338e7e2edb430688c87c65f92a0efd2115a8fab2e4e9776893d28db86 | — | |
hashc65fdb27d1b478a4926c2e283f8c50e827d522c13ba56da67e1fb436548a4454 | — | |
hashc7edcad8b139961ff93aba148b16227147b019b036cdce58522979c9b833a0bf | — | |
hashc7eedf31cf9e456cc9eb419edf30573f9ba03e80faccce9e86373e935f6c1b93 | — | |
hashc9b14e41443d3d43907352f5c6cf46c53e7c9b69bf9299f8d61081e314e5ad4f | — | |
hashcaf8bfc90e4300b8a18c3fe3a4badbe44c106830e7432d8eea227857a790ec91 | — | |
hashcd6785e9690349d95ce34d30befe8b472f304e7c1129a0824c6e7a909aab7805 | — | |
hashd17a330bb7c929efffb8a42d6ca224f839548560603f88e432043735d392bc85 | — | |
hashd4bd8ba1ca7643016e324cdee81f46b2c5a49508fdc9011d71abeeea672e35fa | — | |
hashd7cbdc2b5c57b1f61c771be74e56aefc05ebd8faeb0d9a7b02daff6946248dbb | — | |
hashd7dba181b322bc6f51b7e530e924ba4f60b7334a72be7c5d92fd219502bb252e | — | |
hashd8ebbee135dba28a08fd975366ddf62d3ab2ed10f2b339b867ba6800cbb9321e | — | |
hashdc561df51d27ed3a99cb916bf08452c901956778c26709e69705cbdf77f74816 | — | |
hashdce4294fb041c22de81d3eb4c4a178b5bdf6d9fb48b348556a51582553b3fb52 | — | |
hashdd2bb7316be55446aebfa31d05e57e936eb9a18d5d9c20d60d87493100d05fe6 | — | |
hashde213ebc44c614d0b2324787e267183dbbbbb19e1ad866435a322ee00e24e7b6 | — | |
hashdf93e348cc67d04318c0e439f5dbca681a3c1112924f57393cb57fc6a3d121d6 | — | |
hashe14f1f80f192f1c36854474e7da7e660d06eca0a199df08c2aa6e34eb4847953 | — | |
hashe48eba9d41a2d46d963c1117604005f53afce3e7e1ac5e0a7cca3b642720e7c2 | — | |
hashe51855ae6e8e69f66c2af6d939769385f53e57445b9734b1b4811c09bfc80c97 | — | |
hashe7945eee02f90a9a03eb82e64fcc8ed07fd1d6d528afe0f8f948699b0497c5f0 | — | |
hashe881682b59640c05cd540696955a849610260415e576f79b62383108c1aa3354 | — | |
hashed6746a55f2160c586fdc66cd2c1db69f7fd0a73e6c2f1d83dd240c43828ba58 | — | |
hashf1c3e6e5e7b63db19da86914726389b058a085830e0496173defe01d07849b9b | — | |
hashf5196deca103fba2b4de772a1415bafc616e5baa3fc6a388d0f8ee79d6f350f8 | — | |
hashf6c670e65765d10a5ca0205a6ece3a3e6c7c730b0a8534c5adef4a3cbf06eb9c | — | |
hashf720d6f6baebd4ef76df978f2678387385ee2d20a37423e7957c2341fe46f9ca | — | |
hashf8d598d28dbb8294a5c709ab23d51e29e652ab47d5a317aa31f6302481159458 | — | |
hashf97b286d61b26c98b900bb842fb7a5ccd781162bbeca8032f9c0ed81fe93fb7d | — | |
hashfb35436322e9429a498f79b9abea24ca419fafab93117582c3e97f9beab3a034 | — |
Domain
| Value | Description | Copy |
|---|---|---|
domain18-22-59.com | — | |
domain87-899.help | — | |
domainapp-desktop-download.com | — | |
domainapp-desktop.com | — | |
domainapp-desktops-downloads.com | — | |
domainapp-desktops-pc.com | — | |
domainapp-downloads-desktops.com | — | |
domainapp-pc-desktops.com | — | |
domainapp-pc-download.com | — | |
domainapp-pc-downloads.com | — | |
domainapp-pc-windows.com | — | |
domainapp-pc.com | — | |
domainapp-windows.com | — | |
domainapps-desktop-download.com | — | |
domainapps-desktop-downloads.com | — | |
domainapps-desktop.com | — | |
domainapps-desktops-download.com | — | |
domainapps-desktops-downloads.com | — | |
domainapps-desktops-pc.com | — | |
domainapps-download-desktops.com | — | |
domainapps-downloads-desktop.com | — | |
domainapps-downloads-pc.com | — | |
domainapps-pc-download.com | — | |
domainapps-pc-downloads.com | — | |
domainbitcoinvn.io | — | |
domainbithumbcorp.com | — | |
domaincsgo-play-de.com | — | |
domaindesktop-app-download.com | — | |
domaindesktop-app-pc.com | — | |
domaindesktop-apps.com | — | |
domaindesktop-downloads.com | — | |
domaindesktop-pc-download.com | — | |
domaindesktops-download-app.com | — | |
domaindesktops-download-pc.com | — | |
domaindesktops-downloads-app.com | — | |
domaindesktops-pc-download.com | — | |
domaindockmilk.com | — | |
domaindownload-app-pc.com | — | |
domaindownload-apps-desktop.com | — | |
domaindownload-apps-pc.com | — | |
domaindownload-apps-windows.com | — | |
domaindownload-desktop.com | — | |
domaindownload-desktops-app.com | — | |
domaindownload-desktops-pc.com | — | |
domaindownload-desktops.com | — | |
domaindownload-pc-app.com | — | |
domaindownload-windows-desktops.com | — | |
domaindownloads-app-pc.com | — | |
domaindownloads-app.com | — | |
domaindownloads-apps-windows.com | — | |
domaindownloads-apps.com | — | |
domaindownloads-desktop-windows.com | — | |
domaindownloads-desktop.com | — | |
domaindownloads-pc-desktop.com | — | |
domaindownloads-windows-app.com | — | |
domaindownloads-windows-apps.com | — | |
domainexperimental-tech.com | — | |
domainexternal-sex.com | — | |
domainfirewall-813.com | — | |
domainfoo-foo.bar | — | |
domaingrpc-test.me | — | |
domainlocal-mailer.com | — | |
domainlovely-race.com | — | |
domainluiowitz.cfd | — | |
domainlutianwl.com | — | |
domainpaid-rewards.lol | — | |
domainpc-app-desktops.com | — | |
domainpc-app-download.com | — | |
domainpc-app-downloads.com | — | |
domainpc-app.com | — | |
domainpc-apps-download.com | — | |
domainpc-apps-downloads.com | — | |
domainpc-desktops-apps.com | — | |
domainpc-download-app.com | — | |
domainpc-download-desktop.com | — | |
domainpc-download-desktops.com | — | |
domainpc-downloads-app.com | — | |
domainpc-downloads-desktop.com | — | |
domainpc-downloads.com | — | |
domainpffffer.icu | — | |
domainprintscreen.lol | — | |
domainrunt.monster | — | |
domainschilllr.icu | — | |
domainsupercharming.com | — | |
domainsupernegro.mom | — | |
domaintaylor-convert.com | — | |
domaintiming-kings.com | — | |
domaintwisted.mom | — | |
domainwindows-downloads-app.com | — | |
domainllr.experimental-tech.com | — | |
domainr2.ohyoulookstupid.win | — | |
domainwww.bitazza.com | — | |
domainwww.coinhub.mn | — | |
domainwww.topshare.com.au | — | |
domainwww.twex.exchange | — | |
domainxhab.grpc-test.me | — |
Threat ID: 688b3f45ad5a09ad00b5ff86
Added to database: 7/31/2025, 10:02:45 AM
Last enriched: 7/31/2025, 10:17:55 AM
Last updated: 7/31/2025, 12:29:32 PM
Views: 4
Related Threats
Fake OnlyFans, Discord and Twitch ClickFix-Themed Pages Spread Epsilon Red Ransomware
MediumGOLD BLADE remote DLL sideloading attack deploys RedLoader
MediumQilin Ransomware and the Hidden Dangers of BYOVD
MediumResearchers released a decryptor for the FunkSec ransomware
MediumThreatFox IOCs for 2025-07-30
MediumActions
Updates to AI analysis are available only with a Pro account. Contact root@offseq.com for access.
External Links
Need enhanced features?
Contact root@offseq.com for Pro access with improved analysis and higher rate limits.