Index

Virus.VBS.Lanus Oct 10

7e548dc0501b67d5da2c3dd93f26e85b8bcc27c6a157643196a25fc1582e800e O₂(CAs)

webshell/request

Trojan-Dropper.VBS.Inor.aj Oct 10

ec8438d6ad384ce4ac4b2f84c0eb0c76dffb2b22d6303912812b82757f2346e8 O₂(CAs)

webshell/request

e89da17129ef3b800c30bdb9030e6a557d623d0937d77066ed60455039f45290.hta Oct 10

e89da17129ef3b800c30bdb9030e6a557d623d0937d77066ed60455039f45290 O₂(CAs)

100% obfuscated C2 dropper logic

a641cee7d039e049ac6721323fc033b06c22fa2be2ef39dbd43452bda3479b3e.unknown Oct 10

a641cee7d039e049ac6721323fc033b06c22fa2be2ef39dbd43452bda3479b3e O₂(CAs)

80% obfuscated VBS dropper

7eb136cd76d9f0ef97dfd79ef3d64da3b6812ea4d5da2bf2227459006a9ff00f.hta Oct 10

7eb136cd76d9f0ef97dfd79ef3d64da3b6812ea4d5da2bf2227459006a9ff00f O₂(CAs)

83% obfuscated WSH payload execution

0f0de0a1fe03d028e395189c38736742f05b61834363d4dec12b3f6c27719ec0.hta Oct 10

0f0de0a1fe03d028e395189c38736742f05b61834363d4dec12b3f6c27719ec0 O₂(CAs)

80% obfuscated C2 dropper

74e90d08e189b4d93a0ad58356c26375c9dda3ecd24d3800cc28a1887d190f9c.hta Oct 10

74e90d08e189b4d93a0ad58356c26375c9dda3ecd24d3800cc28a1887d190f9c O₂(CAs)

80% obfuscated C2 dropper execution

559f3340e547fa3f928fe5035045aff87e9ba21f7cf74df11484a6d9029e94c7.hta Oct 10

559f3340e547fa3f928fe5035045aff87e9ba21f7cf74df11484a6d9029e94c7 O₂(CAs)

100% obfuscated C2 dropper logic

39839d63e4bf79274afbe99ac96912bb3df06b52861b07250308e1314c7131ad.hta Oct 10

39839d63e4bf79274afbe99ac96912bb3df06b52861b07250308e1314c7131ad O₂(CAs)

80% Obfuscated C2 dropper execution

b2e38dcde349a45f7b292878dd74ce57f1885a9f2cc9c0d33a30f1cb78cd6d57.hta Oct 10

b2e38dcde349a45f7b292878dd74ce57f1885a9f2cc9c0d33a30f1cb78cd6d57 O₂(CAs)

80% obfuscated C2 dropper

8064d6090e35140bc051492cb4049c3d8ec74a19e60483057b4bedb5c0b967b3.hta Oct 10

8064d6090e35140bc051492cb4049c3d8ec74a19e60483057b4bedb5c0b967b3 O₂(CAs)

80% Obfuscated C2 dropper execution

127f7e1c646f21e12c268db49aca017562f1ae5bf42625b3de536ab5d10d8437.hta Oct 10

127f7e1c646f21e12c268db49aca017562f1ae5bf42625b3de536ab5d10d8437 O₂(CAs)

80% Obfuscated HTA executes C2 payload

San.html Oct 10

49151419f15b1bf00dc4d5b1d988d9c2669d1e4e46c62cf2b0db3c89cd0293e7 O₂(CAs)

webshell/request

Adobe_Reader_uk_install.bat Aug 3

361fd82dba53c49c5f1cdfc1b3ca658339726a60a1e921ad52d437c0e62a6f85 ✓ O₂(CAs)

100% Batch CJK-smuggled degenerate loader

4. stage4.ps1.bin Jun 27

0b811e347bfe27424827cdcdede953f276d2ebc5919db05926d2ffe0aca39280 O₂(CAs)

85% PowerShell stager with obfuscated eval

efs.ko.zst Jun 27

06ec0f722dd55c1202b5e2e24bb21d92769a60e08f405a255cf2cca01701781e O₂(CAs)

efs.ko.zst Jun 27

e14d0d21febeaa07d1f187f8e1a98e572361e9dd2e76e2bbd0497180ca52df44 O₂(CAs)

e43ce0ce876d35b6e80206077fd36b59e4e9ae137fb754b9d3231f77ff34e02a.bat Jun 27

e43ce0ce876d35b6e80206077fd36b59e4e9ae137fb754b9d3231f77ff34e02a O₂(CAs)

98% Obfuscated PowerShell GZip loader

d79874c1a0040cb29418343c766d2f6c69cf8fa5ecd0629cac7cc60d69c4f107.7z Jun 21

c50e5100e78a15d2b6314b78a06d3ce62bcced241c1caf6e5682688e74de2152 O₂(CAs)

80% Reflective class loading and C2 paths

RailReader.Core.Vlm.OpenAI 0.32.1 Jun 16 dotnet

12c258690ec62dd7585e4ec4a55eed86ed8fb8669a58173528e09463c0d668fc O₂(CAs)

80% Stego packing indicator in DLL

JD.AI.Plugins.SDK 1.1.674 Jun 15 dotnet

231999dcd33db9bcb336b99c984de95f89a4d587ed8520c00f28840f952d2670 O₂(CAs)

Luxoft.Framework.Database.Legacy.Domain 27.3.2 Jun 13 dotnet

c7947f55be1fef84092743f665af132bd9df59d19c2a06bbe35ad9c858ca86b0 O₂(CAs)

Luxoft.Framework.Validation.Domain 27.3.2 Jun 13 dotnet

408646e0246138c7cc68aa1a84cc7a12cef0ddec5035cfffad870f3718bb4a57 O₂(CAs)

PicoWeb 2026.1.0 Jun 12 dotnet

68044b865c67f64f22ce5958d667a6417219624ef93d4aba5fe83522cc55d696 O₂(CAs)

CommonNetFuncs.Web.Jwt 4.1.3 Jun 9 dotnet

66c339da3f26fd51169be0f996290c3c7845b4781bdfe3befb551066005b1566 O₂(CAs)

Invex.Atom.Module.GitVersion 3.0.0 Jun 8 dotnet

08047389bbee44f79ec9bda99a43e4f2f52caf19184430ae5e893bdb87b3aca9 O₂(CAs)

Invex.Atom.Module.GitVersion 3.0.0-rc.201 Jun 8 dotnet

bb9e65ecc6b0eca6a0db41cc8e5dd5f679a6ac39a43cb6b7fef4f0049e9c36dc O₂(CAs)

Conf.h Jun 4

788603a52098949789f846b802f2d4b10a98a44bade2408e38eae6c9eb699447 O₂(CAs)

VirusShare_b6b6a6ed5a25cc20f4da4227d923fda3 May 31

fd1d1a11e25e7f0b6f03353aade20b4f034ff5fdea0c51cc51fd58f22882cb8b O₂(CAs)

VirusShare_3ce2a63d1d589898b925fb5019ff48fe May 31

d7d2176bab8bef01eeb6bba8745c73986c9abd744708e8e24a518025bda67fab O₂(CAs)

VirusShare_dfe063067edd6d94518da0c7004a0794 May 31

41100877a7d42e832c32875e4df3e5b4af199fe33c9838755b5f861f973b7009 O₂(CAs)

heimdall_test 0.2.0 May 22 dart

a238075669e5cefb05cfa1447426b5855164e693b76865f03eb6a024acf1c3dc O₂(CAs)

daitum-configuration 2.0.0 May 21 python

0c1fbbf30f7dd2f5f9d1cf8fcdfc053e4407ebb04e60e8f3e42fb5133b433127 O₂(CAs)

4042294f41157694c38bac2b2bac0cf1.js May 21

ab0098847e9c05199516104d80c8701d255573aef254b7d558338aa5e85468ae O₂(CAs)

2be13a0f30cdc24a359e1c9f25ad7cec.js May 21

a84abb7e329599253264c7ce2a39537ebb686b9408cf1db0031764dedb8e5e96 O₂(CAs)

styled_jsx 6.0.0 May 20 rust

53d2ea3ef36f26332ae91f661968850f39149ca6ddbe9c28d8fd1e7042181b20 O₂(CAs)

80ebc347f3256dd2c0b505f25c9620f334bf9fd716f17f1b45a020671d3a69f7.apk May 19

80ebc347f3256dd2c0b505f25c9620f334bf9fd716f17f1b45a020671d3a69f7 O₂(CAs)

b7dfef717c500fe8539630c092ccf0449538547d11cd227b79384bfca9949d8f.apk May 19

b7dfef717c500fe8539630c092ccf0449538547d11cd227b79384bfca9949d8f O₂(CAs)

f7dc24966272b86432e72bfe7e0d56fb27e951ce67f3044c14e486c37bf116f8.apk May 19

f7dc24966272b86432e72bfe7e0d56fb27e951ce67f3044c14e486c37bf116f8 O₂(CAs)

3a5705acc39fb96b67cd78182ec27e774d7e4e9a27a34ccedf02c5dcd34c036c.apk May 19

3a5705acc39fb96b67cd78182ec27e774d7e4e9a27a34ccedf02c5dcd34c036c O₂(CAs)

95b75076c52d87f8ba33929d22ce739a6e9cd65903d31aa3fb563aa7138da0af.apk May 19

95b75076c52d87f8ba33929d22ce739a6e9cd65903d31aa3fb563aa7138da0af O₂(CAs)

model-research-v07-part02 0.1.0 May 19 python

34fb1e3d825e98d588fc78efea9cf4856c9818fed2a563bde5926a211cbb9918 O₂(CAs)

constup 2.1.0 May 17 php

e2a2e960ba746ad06134cbcaf0b9fbdaced719b542a77ca864abea0aecc9d38c O₂(CAs)

constup 2.0.0 May 17 php

bcc0e691ed3af0719ed96a7b6767af30eb2c23a0a875c5d073b32d868aa173a6 O₂(CAs)

omnivideo v0.1.0 May 16 php

ccdd7a169610ee6ca7c2663f36d519ff0663055f6072ccfd43a1d374139cb18b O₂(CAs)

vaened v0.5.2 May 15 php

eb79ac631653f496c4432c272cff4b40e2207412bc44a5e8897cb756e4f3e4f7 O₂(CAs)

vaened v0.4.0 May 15 php

2948735fbc7d63cfdbf73a5825b2348464559579a2a39e03de3d71504f4c9a80 O₂(CAs)

ec17f83ea576014a59184b8da30b03ba7dcdb596b3794d5bef49fd11688b7e45.rar May 13

ec17f83ea576014a59184b8da30b03ba7dcdb596b3794d5bef49fd11688b7e45 O₂(CAs)

0b72c22517fdefd4cf0466d8d4c634ca73b7667d378be688efe131af4ac3aed8.zip May 13

0b72c22517fdefd4cf0466d8d4c634ca73b7667d378be688efe131af4ac3aed8 O₂(CAs)

VirusShare_61b722edf73e0abe8756928afa20824f May 12

3a2bb38b7fac706e0d29434ca242fa32b9d9d33d2c79a988895a513a04325e33 O₂(CAs)

VirusShare_49006023919c825a91dfecef1459e665 May 12

8b249792ffabf0198099331ce83af17845a827c10e25fa0e686c377323a8f234 O₂(CAs)

VirusShare_776d7e33461413b626ca67a9c415ab35 May 12

fa87f12cecf33073ceec00c49f5d11e9381182deb1523728ef9719e729022f34 O₂(CAs)

223e1910ed9dcd610c50bdfea19900fc_php.txt May 8 php-malware-analysis

24e31b86c0823bc93e8e009d6f27410b0fac9a4e7c1df47f6071355532fd802d O₂(CAs)