Sponsored by Hudson Rock – Use Hudson Rock's free cybercrime intelligence tools to learn how Infostealer infections are impacting your business
| Favicon | Title | Type | Available | Last Visit | Server Info | FQDN | |
|---|---|---|---|---|---|---|---|
|
|
This Site Has Been Seized | Yes | 2025-11-19 19:31:27 | nginx | weg7sdx54bevnvulapqu6bpzwztryeflq3s23tegbmnhkbpqz637f2yd.onion |
| Discovery | RMM Tools | Defense Evasion | Credential Theft | OffSec | Networking | LOLBAS | Exfiltration |
|---|---|---|---|---|---|---|---|
|
AdFind
Advanced IP Scanner
SharpHound
SharpShares
SoftPerfect NetScan
|
AnyDesk
Atera
LogMeIn
MobaXterm
|
Eraser
GMER
Inno Setup
PowerTool
|
AccountRestore
Mimikatz
NirSoft Dialupass
NirSoft IEPassView (iepv)
NirSoft MailPassView
NirSoft Netpass
NirSoft RouterPassView
|
Brute Ratel C4
Cobalt Strike
Rubeus
|
Chisel
Cloudflared
OpenSSH
|
attrib
PsExec
|
Bublup
RClone
Temp[.]sh
|
No vulnerabilities exploited available.
| Resource Development | Initial Access | Privilege Escalation | Defense Evasion | Command and Control | Impact |
|---|---|---|---|---|---|
| Acquire Access | Remote Services: Remote Desktop Protocol | Valid Accounts | Remote Services: Remote Desktop Protocol | Ingress Tool Transfer | Data Encrypted for Impact |
| External Remote Services | Valid Accounts: Domain Accounts | Indicator Removal: Clear Windows Event Logs | Protocol Tunneling | Inhibit System Recovery | |
| Exploit Public-Facing Application | Automated Collection | ||||
| Phishing | Domain Policy Modification: Group Policy Modification | ||||
| Phishing: Spear phishing Attachment | Impair Defenses: Disable or Modify Tools | ||||
| Phishing: Spear phishing Link |
No negotiation chats available.
| Type | IOC |
|---|---|
ip
|
104.244.75.168
|