isotope13 labs

VirusShare_5ff8a357fdec0b795982b3b36f8c56b1 4d ago

6698391e49a3cb900c878d7bef4eabba1359b862a7193d176db756f77c46cbf5 Th

100% Metasploit macro payload

VirusShare_0d064d7585eb3f2c212d1cef5121dbf7 4d ago

fa4923e264cd9405eff297f98639fa44e339985f419697d9f7533bf2e1218d11 Th

99% Follina exploit pattern detected

traits.yaml 4d ago

a4f05352c699e18717f6f67da096ed378a9477e7493f2730f7caca4a3c6fb44f Th

config.yaml 4d ago

601ff80121e508118751f2e91dcdbefa68468ecb485b7c87cb5bd2fb41111f07 Th

LateralMovement_PassTheHash_ByInvokeWMIExec.md 4d ago

085bcb67600cf28bf3efcaf01c1f0f20e9c25994763e8f6a7643c0c079df32ca Th

95% Pass-the-Hash lateral movement tool

wordlist.txt 4d ago

29b1839bbbd60a0db2c320bfb39a981e207e58933bb3fe025b8e0173850016cc Th

17fed2ac95513fa3dd7ad158df54c01e398a9fb1571dd6d4295269c77f38b62b.unknown 5d ago

17fed2ac95513fa3dd7ad158df54c01e398a9fb1571dd6d4295269c77f38b62b Th

Backdoor.ASP.Rootkit.d 6d ago

76dd2b377b9524d21c510fe029b2d6ffdc8251d5441390ec19216a7dd5a17815 Th

100% ASP webshell backdoor

Backdoor.ASP.Ace.bc 6d ago

9fd478fe9f22c68f05756404074aad3958a7fa34d9da1e3e32e4a5385c15cdd6 Th

100% ASP/Encoded

Backdoor.ASP.Evspy.g 6d ago

cc9a1c3f9302fc423f520cb0e0309dec4de9a97192604af831c11add279bc39f Th

78% CSHARP/Generic

Email-Worm.VBS.Agent.o 6d ago

d87ac49bc86f9e9d394e1b5f43c965015bc296791073c03b0cc552d6f0c06678 Th

100% Encoded webshell worm

up.jsp Sep 23

c00e8c409f1cb4e6e7e8bcea0a82212714f6d80cb961b2f8104c5df89059cc69 Th

75% Upload/WriteJsp/Up

download 下载文件.asp Sep 23

8e51b21fc79dd9e35be249baa71cffc451328361e907c62c2813c3f7524e3abe Th

99% ASP webshell downloads and writes payload

8.jsp Sep 23

7a65ac908a2bdbe21eeb80000f560a5497aa25bed28786a2fe01727e3a124cd2 Th

99% JSP webshell executes commands

01.asp Sep 23

419852f196eaa5b3d51faafd60fa1fee9a6ac5392da93d99e52b8abf2a5552c1 Th

100% ASP webshell evals user input

CmdAsp.asp Sep 23

f738ee7fc7177c16acc64d1c5e775ce69baa2ddfaf25185a1f38d6e1e8b82561 Th

99% Known ASP webshell signature

a.asp Sep 23

352465776c8ae0a89380e3c4455970217be5e7ac8289376d9c8d75bb54d6f2c2 Th

99% ASP webshell eval request

devshell.asp Sep 23

f8751474732f13b4139d18f33929a7fa88ca7b255455b2fb814fbc1d61ad8a6a Th

80% ASP/Encoded

UTF 16LE Sep 23

a4b9d316462b1e25538d3d6b20e43e7dfb04a2ef0a87e7dd496c65128835f8ac Th

99% JSP webshell executes commands

UTF 16BE Sep 23

14af52efd53dca4d796a30984ff66da5732cfa84aada561dc900abefbcdc1b4c Th

99% JSP webshell executes commands

上传小马.asp Sep 23

e79278701a7b36d6f71ede8ee31e2475b559e1de71d7e80e1a8dbe7192715019 Th

99% ASP webshell detected

UTF 16 Sep 23

02e048470bfbf1874c34dad389c0465fcab17a1dc878fc677e00a930e0571a5c Th

99% JSP webshell executes commands

browser.jsp Sep 23

35c44ef39b71532afe1dd00b75297871296cffcfdd146bf38b7d4ac765178241 Th

100% VonLoesch JSP web shell

不带引号的Asp一句话.asp Sep 23

98524084edfac5bc95205780cd611e5c8bcdd03d9c8fc9df30539058f3c5cb58 Th

49% New/Asp1

ProcessBuilder-cmd.jsp Sep 23

e66b66c9508d4ef242db4ffd7a7200f922588e47acbd0c5b6584668efbd61c25 Th

100% JSP webshell executes arbitrary commands

glorysday.asp Sep 23

fcefb1cbd84106980cc28a7e2d7e3290a860cae2442cd7f91faa4b18342de72b Th

100% ASP webshell detected

up.jsp Sep 23

7439d1c0b9994b74db771d9568e3b845630e3497aab71f12cc3af954e7522e45 Th

100% JSP webshell file uploader

Asp最新变形一句话.asp Sep 23

ac475ae41ecd957f2e5a6aebeb327467e7b902d071afd9934e4bcdee62bdeed6 Th

100% ASP webshell backdoor

reflection 2 Sep 23

a38e68b964d22a96841b405ca1bad187c463086c63c1f38ff6c31d5e3b660180 Th

99% JSP webshell executes commands

class-terminate.asp Sep 23

fbc6438df3960d925a5d2d4880ce806ac26a73a063c66e3804ff7de9046b354b Th

100% ASP webshell evals user input

contextgo 0.15.0 Local-first context & memory runtime for multi-agent AI coding teams Sep 17 python

6e0b80d2538190cbecbd45dce1fb419eb8fdd95a6ed2abe369c219f83797592c Th

Agent/Macos

cakhiatv012.com_nano.exe Sep 17

73a918ac4dfdae16f1ec5d9b8654b79c13d39ab08331da778410775190b8bbcf ✓ Th

Sample/May18Ransomware/Gen1

px86 Sep 17

37a8e39bea79afb4e66f6a4a8924ab94c5c253e8e23c791c9da5a2315a3ef365 ✓ Th

packer/upxupx/tool-missing

cakhiatv012.com_ransome.exe Sep 17

fa5f683ecbd9eab10db2923738995acde96844af1e96d2f9c7a46b79b415a319 ✓ Th

Ransomware/Gen1

2026-09-17_dcf15786033a98ca58d6176023ae67d4_amadey_elex_rhadamanthys_smoke-loader_stop Sep 17

405cba95b1b94eb4d03ffe2206b8005235ab6112ed068b3837677c1dea660a4e ✓ Th

100% Amadey loader, generic threat

github.com/anonvector/SlipNet v2.5.3-0.20260821092610-552ab5078d90+incompatible Sep 17 go

208039beed9c13edb78e7295e580b9c8f257126379e8d61eb094031a3cf8688a Th

Tor/Client

github.com/anonvector/slipnet v2.5.3-0.20260821092610-552ab5078d90+incompatible Sep 17 go

99c6be3f94a3150da1a62ae824ae1bc9a8dec22ee3b15df8108d07d2e2993fe6 Th

80% Tor/VPN components, incomplete analysis

4b1e0096e4d32d09b6a5a55669ff982237c7e7ef136d38269533883aaf0628e0 Sep 17

4b1e0096e4d32d09b6a5a55669ff982237c7e7ef136d38269533883aaf0628e0 ✓ Th

2026-09-17_4f1fb864bc292235274046f0ba09612b_cobalt-strike_icedid_njrat_satacom_vidar Sep 17

07eff14256fed9d52db27a9073c9adca3fbe71d4124655cac2b6231a1be7d7f5 ✓ Th

100% Named Cobalt Strike, UAC bypass

2026-09-17_6b3fd6ca06d978cece7d6784d002f5c1_cobalt-strike_icedid_njrat_satacom_vidar Sep 17

fad6616727a6c508649300a200ed613316e88d8235402de6b61fff7d0010a36e ✓ Th

100% Named Cobalt Strike, UAC bypass

2026-09-17_b1dbc53d7b490becbf86457529d73652_elex_mafia_stealc_tofsee Sep 17

c04bea9518fdace5094089f961ff11e4c72f0e52011cc9fcb7759758f4825143 ✓ Th

PSSailpoint.Identities 2.1.40 Sep 17 powershell

c75d8873c7e9e819dfbc58b22a74c9bf0cb138754aebdc5585e3d643a318518e Th

PSSailpoint.DeclassifySource 2.1.40 Sep 17 powershell

388fd354b36f0cd9e3a556b7565942186ef28420cf562c3a4f1c91ca16439802 Th

PSSailpoint.IaiPeerGroupStrategies 2.1.40 Sep 17 powershell

fdba8d7f420dda18e78db9a7c24d6752f0c76925dbd0eb079e178b5d3ff43af5 Th

PSSailpoint.IaiOutliers 2.1.40 Sep 17 powershell

fd85c0691914bbf7b982b4215efcf90afdda6353f4cf4a02552a6bf6d9770f98 Th

PSSailpoint.CustomUserLevels 2.1.40 Sep 17 powershell

bfb2427d2aae52239e278ab123637a208bc09d9b17d39772c8ffe1fff729cdfe Th

PSSailpoint.MachineAccounts 2.1.40 Sep 17 powershell

ebfc9753488ad59fd379fc18a8720bb84a8bdb270168ce272e15f39d1fb3708a Th

getty Sep 17

97d433c19f469b548abdf32a0121b627e51afde5f2e590c52b89cb894874cae9 ✓ Th

PSSailpoint.ConnectorCustomizers 2.1.40 Sep 17 powershell

3ef0c0c03c31083051a483c556138684411f6cc59d180e66a69c1b05b4c2e903 Th

PSSailpoint.Dimensions 2.1.40 Sep 17 powershell

9b75353715c99a5ef5100b3767e0ce32167133179aaaa242a4a7013b9f0b6629 Th

PSSailpoint.MachineIdentitiesLifecycleActions 2.1.40 Sep 17 powershell

14a934a2625d46cf2970511ab5ee24ba5e7416e9ec612c77a1d06ceff273e356 Th

PSSailpoint.MachineAccountMappings 2.1.40 Sep 17 powershell

d692d2c6c887d81290f7e6db755d12136b5b7cd2f2f13975d0e5bc6c322d8ac9 Th

PSSailpoint.DataSegmentation 2.1.40 Sep 17 powershell

d0c29ad4a402efe6890975cac1f7b99f5fabdf270515f14a62acfbacf369c848 Th

PSSailpoint.PersonalAccessTokens 2.1.40 Sep 17 powershell

9e44570c19197a5ea6b5ac1d8625cb2b28a47bd03811962d3da31618375709bd Th

PSSailpoint.Icons 2.1.40 Sep 17 powershell

a9074b34103b5b18cf16808e30fc022297aeb80c6f9ffeda8684ffb8e3fd4846 Th

PSSailpoint.WorkReassignment 2.1.40 Sep 17 powershell

2e8dd4995787f843252a51bc94288e900265baaf107742f835e36f94764e267f Th

PSSailpoint.SpConfig 2.1.40 Sep 17 powershell

f7eb5a01d48334617bb08c572ac3606eb5d17507ab97c161a407090ec0eb5efc Th

PSSailpoint.IaiRecommendations 2.1.40 Sep 17 powershell

23bf2eb7403b8d56a0d9253307e0be0c26aa9fdd52fdeeeb92510d86d102fd93 Th

PSSailpoint.PrivilegeCriteriaConfiguration 2.1.40 Sep 17 powershell

9e27f320fa3f7e357a2556dd8d9ac166bc2c41cba798facda74b5d71cd05a339 Th

PSSailpoint.LifecycleStates 2.1.40 Sep 17 powershell

8d5ffc5052ce84264483347ab4d73658ab9e5bb82be6afc5483136cadcf6b9ef Th

PSSailpoint.MachineIdentities 2.1.40 Sep 17 powershell

3fdb337aff48fdd979eaee2805671dcbc13d5371744c506093200c73b30a07cc Th

PSSailpoint.Triggers 2.1.40 Sep 17 powershell

6800ebb021258cfb441f5af157eb61b04b8dbd49b267d01907cc6ac413e0ce49 Th

PSSailpoint.RequestableObjects 2.1.40 Sep 17 powershell

a501d4d48169e067102efdc370ce35892f413eaa41e8ea4e3da20cb84efe1fc6 Th

PSSailpoint.PasswordDictionary 2.1.40 Sep 17 powershell

baa79370e4e1e2dd6b08b85e94a457098d5cb7946f27418b02d0a614a5f8d12a Th

PSSailpoint.PasswordPolicies 2.1.40 Sep 17 powershell

e4b88439f988dd40d11163dd3120c7e059a4f47e8a5ead15f3d27e67c9d1c179 Th

PSSailpoint.SimIntegrations 2.1.40 Sep 17 powershell

b1cdf64d28d1294e2e89c867da907b9ead7c5f9a6a1aae82ac972852b0abee97 Th

PSSailpoint.SavedSearch 2.1.40 Sep 17 powershell

b0a4a8c73ad0a282b098f2a2347f8693ab29d2a1cd8af85c4e65a9b719725d5f Th

PSSailpoint.PublicIdentities 2.1.40 Sep 17 powershell

a16eda5492a5c87560b33191b89aeb0682d874a5dba0dada35274b4da7eac4a6 Th

PSSailpoint.SodControls 2.1.40 Sep 17 powershell

a586b2602f5f6a0f27be84fdb574fade6e331afe73e245cae9f825056d627a14 Th

PSSailpoint.SodPolicies 2.1.40 Sep 17 powershell

94b476a4e72297e8324f89ab3b65058e72fb77bdac69f6db8de1c003199a6968 Th

PSSailpoint.Segments 2.1.40 Sep 17 powershell

72cc4846953780756ef0ed5e9f2388a7903f53c66b8cb68c6a8a235f21df440e Th

PSSailpoint.PublicIdentitiesConfig 2.1.40 Sep 17 powershell

578b441935f29bdb82753d9b70f796f0c9754dedc7146b538b667971a672829d Th

PSSailpoint.SodViolations 2.1.40 Sep 17 powershell

ead8b6509e39035e0beea6958933a5e333a214e4b17ebf6b2f12cfa095b38920 Th

PSSailpoint.SourceUsages 2.1.40 Sep 17 powershell

c0df7f440e551910c88fdf97dd27a1fc381f925035561cd99c255410b9967129 Th

PSSailpoint.Transforms 2.1.40 Sep 17 powershell

4610c38ecdd42d24602217e222935ca82c347d85b1823c4a8f367e9abf2f6e7f Th

PSSailpoint.SearchAttributeConfiguration 2.1.40 Sep 17 powershell

4916d5753aa39f0a3f764a98f9ee20c4e2c97fabff578481ff550b556ffb7d64 Th

2026-09-17_fd5d4c225aa66f7e57bf10d6096d4c17_cobalt-strike_hive_luca-stealer Sep 17

707845df597e1b1ce03d1f00ac44574253ef088cd832191cc3e3675f0043f8e7 ✓ Th

100% Cobalt Strike stealer binary

2026-09-17_fcd34cb4192c748fe66dd692cef8594c_destroyer_elex_glassworm_ngrbot_wannacry Sep 17

f5482a3787e6f97df40b5f6208de01ab2502ec87b30744fb5c10c621eef8ab9b ✓ Th

100% Destructive malware signatures present

2026-09-17_f7542aa2c253d808eec7b8c4f430d351_destroyer_elex_glassworm_ngrbot_wannacry Sep 17

bdebc43886ce684fd7135de2bcc52a433404f69294719b30de9eacacdc2d344c ✓ Th

Ransomware/Gen1

github.com/philsphicas/arcify v0.1.1-0.20260831100851-3615b5fab0b2 Sep 17 go

2e57ad2102abe21b9400256aa1c443b2af2d6e938dc551a3b9bd8b256179cc2f Th

d1de93fdbfb82b7b902cc78c6970b2fd5dfddaf0b7af782c4018bfb7ffcd1a41 Sep 17

d1de93fdbfb82b7b902cc78c6970b2fd5dfddaf0b7af782c4018bfb7ffcd1a41 ✓ Th

windows/generic_threat

@signalscout/pipeline 0.3.0 The stateful half of SignalScout: monitors, posts, matches, cursors, the budget guard and the jobs, with their migrations. Sep 17 javascript

834ec04b5289b6421781d320e0bc589fa46a4be7a6106ee73610ca080ca16933 Th

Exec/Regex

x86_64 Sep 17

d9cdcd0d1afd0646bfe92a7dedd80db905975f8677e75c81b0c2c349b3c43ab5 ✓ Th

100% Mirai and Gafgyt botnet signatures

pkg:npm/%40lancedb/[email protected] Sep 17 npm

d34326e342ab4c2394e09ee4189c196ad43d1f4694c2ed7494715bea025000d6 Th

plugx/plugx_config

2026-09-17_b93343b4e766a6716d8d48db66c80e0a_coinminer_elex_stop Sep 17

428da38fe6fe3040ed7e28bf4e72cb7edec386fefc0613a31a8bb8f02c697c3b ✓ Th

bashka 0.7.0 A safety guard for `curl <url> | bash`: analyzes the script before it runs Sep 17 rust

00aaf83dd971f334acb11184a53b0dd24da32beeac87c2c1b334104d7992cb69 Th

92% Exfiltrates SSH keys, reverse shell

2026-09-17_f9f6fbe39fb5ece25dd4ed2454582e06_cryptolocker_elex Sep 17

07663d8055d929eb56881c2388fc0b911f6de83494de5bd440314579f2b4f8c5 ✓ Th

100% CryptoLocker variant detected

2026-09-16_21b64ff080f96a2e09ad885d613f3880_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar Sep 17

2aa1f6ad3e297efc337cead35d181508827c5e0d451f5dc1d67ad16a5a42089f ✓ Th

Coinminer/Strings

@darkrei08/setup-ai 3.5.2 Cross-OS installer for an AI coding toolchain (pi, codex, antigravity, opencode, herdr, gentle-ai/gga, Engineering Excellence) with an inte… Sep 17 javascript

587dec08ccb026db5878ac10499dfdd2fe2921bd68217f93a4afce222f8aae5e Th

2026-09-16_186cb0d4243619d19c960ebd9b6b16b0_cryptolocker_elex Sep 17

9b1edccad1a16f8429af140f23c1659e25f706d9d12537af1ad6e8d9f83df81b ✓ Th

100% CryptoLocker ransomware variant

2026-09-16_622aad1af77e7f4384146ed05eae4128_cobalt-strike_icedid_njrat_satacom_vidar Sep 17

2afb5de9856bceafcd85707ebabeb7a83df0ad2bde74b260ee9517070fd3fd2e ✓ Th

Uacbypass/CMSTPCOM

Loader.exe Sep 16

22edabf5bd6c9bd9709b7d2211ecb3bec98814974e34e5b7d332dd05c10a02e9 ✓ Th

EXE/Discordurl

2026-09-16_aabdebd72f4c76913b9d614a54c743a0_elex_mafia_poet-rat_stealc_tofsee Sep 16

e6e9ef18abb623270511892e0c8df5159c6fe550814b3dcb1ae309c24acadf02 ✓ Th

grazulex/laravel-modelschema v1.2.0 Generate and manage Laravel model schemas with automatic validation, documentation, and migration helpers for better data structure managem… 333 installs Sep 16 php

642a9b55501fc9b68185973335b37b88c18b69b48cdf596fcaeca404aa6d9dc0 Th

Generic/Eval

d9c70679d03602fc1d186bc6547868b62e62135e3f180edde6746d7bd135e991 Sep 16

d9c70679d03602fc1d186bc6547868b62e62135e3f180edde6746d7bd135e991 ✓ Th

96% UPX packed binary

github.com/christitustech/winutil v0.0.0-20260903181826-69ff04b632f4 Sep 16 go

d34b3c12dba1b491e7a65859f1a9c9db22be226badad5e553d13e5b1062d4a64 Th

62% legitimate utility, standard dependencies

@promptster/teams-cli-win32-x64 0.32.0 promptster-teams binary for win32-x64 Sep 16 javascript

f6ea3d140170bf7ba75a87e292a5763d3e486f26fe14619aa35faff19f934f32 Th

EXE/Discordurl

cbeacon_dns.exe Sep 14

91ef4177f479b5751d5abbf8014b8f058bee9b083fa6244ed369d44d6815927d ✓ Th

38% trojan/adaptix

cbeacon_doh.exe Sep 14

0ba97d306e5cdf75492d1a90463585ba6539fbe5e017f57d375375f9e0e0d434 ✓ Th

100% Detected as Windows.Trojan.Adaptix

traits.yaml Sep 14

db4d6b548266890ee0a1bf53307bc8cff36960ebe71d9d277bdf2df37f1afd94 Th

Index