Editor’s note: The current article is authored by Clandestine, threat researcher and threat hunter. You can find Clandestine on X.

Threat actors today are continuously developing sophisticated techniques to evade traditional detection methods. ANY.RUN’s Threat Intelligence Lookup offers advanced capabilities for threat data gathering and analysis. As a specialized search engine, it allows security analysts to query various indicators of compromise (IOCs), behaviors (IOBs), and attacks (IOAs), providing valuable insights into real-world malware activity observed in sandboxed environments.  

We shall review several advanced threat hunting techniques using ANY.RUN’s TI Lookup to provide cybersecurity researchers and threat intelligence analysts of SOC and MSSP teams with effective strategies to identify and analyze various types of threats.

Threat Intelligence Lookup Key Capabilities 

Threat Intelligence Lookup provides analysts with access to a vast malware database topped up by over 500,000 users of the Interactive Sandbox, including 15,000 corporate SOC teams. A single search request can deliver hundreds of relevant analysis sessions, malware samples, or indicators for further research and refining the results with more specific queries. 

Besides the ability to instantly get a verdict and context on a potential indicator of compromise, TI Lookup offers a number of functions that enable effective threat hunting and analysis: 

• IOC Lookups: Detailed searches of various indicators of compromise, including IP addresses, file hashes, URLs, and domain names.  

• Behavioral Lookups: Beyond traditional IOCs, the service enables searches based on behavioral indicators, such as registry modifications, process activities, network communications, and mutex creations. It is particularly effective for identifying unknown or emerging threats that may not have established IOCs. 

• MITRE Techniques Detection: The incorporation of the MITRE ATT&CK framework allows analysts to search for specific tactics, techniques, and procedures (TTPs) used by threat actors. This capability facilitates a more structured and comprehensive approach to threat hunting. 

• File/Event Correlation: The ability to correlate files and events helps analysts identify relationships between different components of an attack and understand the broader context of malicious activities. 

• YARA-based Threat Hunting: This capability allows for highly specific searches based on file characteristics and patterns. 

• Wildcards and Logical Operators: The search supports various wildcards and logical operators for the construction of complex and precise queries. 

The sophisticated query syntax of Threat Intelligence Lookup supports over 40 parameters, allowing for highly specific and contextualized searches. The basic structure of a query typically includes a parameter, a colon, and a value, often enclosed in quotation marks (e.g., submissionCountry:”us” ). 

Logical operators play a crucial role in constructing effective queries:  

• The AND operator requires both conditions to be true. 

• The OR operator requires at least one condition to be. 

• The NOT operator excludes results that match a specific condition.  

• Parentheses can be used to group conditions and establish precedence. 

Wildcards and special characters enhance the flexibility of queries:  

• The asterisk (*) represents any number of characters. 

• The question mark (?) represents a single character. 

• The caret (^) matches the beginning of a string. 

• The dollar sign ($) matches the end of a string. 

The search parameter set covers various aspects of threat analysis, including file properties (e.g., fileExtension, filePath), process activities (e.g., commandLine, imagePath), network communications (e.g., destinationIp, URL), registry operations (e.g., registryKey, registryValue), and threat classifications (e.g., threatName, threatLevel). 

Key Tasks Solved by Threat Intelligence Lookup 

Threat Intelligence Lookup is used by security teams worldwide to detect, prioritize, and contain threats faster. With TI Lookup, your SOC can: 

• Speed Up Incident Response: Flexible queries across 40+ IOCs, IOAs, and IOBs with 2-second response times and exclusive indicators enable SOC teams to quickly investigate and mitigate incidents, slashing Mean Time to Respond (MTTR) and minimizing damage. 

• Enhance Alert Triage with Contextual Insights: An extensive database of indicators on the latest attacks provides analysts with quick insights into any artifact, letting them enrich alerts, pin them to threats, and prioritize critical incidents.  

• Accelerate Threat Detection and Containment: Query Updates subscriptions and proactive searches using network artifacts help uncover hidden threats, allowing SOC teams to detect, escalate, and mitigate attacks early, preventing spread and protecting business operations. 

Now let’s see how this architecture works on a number of hands-on use cases of peculiar threat hunting tasks.  

1. Country-based Threat Detection 

Geographic analysis of threats provides valuable insights into the origin and distribution of malicious activities. ANY.RUN’s TI Lookup enables country-based threat detection through the submissionCountry parameter, which can be combined with other parameters to create highly specific queries. Many organizations that employ TI Lookup in their SOC, utilize this feature. 

Geographic threat analysis typically involves identifying submissions from specific countries and filtering them based on threat levels, threat names, or behavioral indicators. This approach helps security analysts understand regional threat landscapes, identify country-specific attack campaigns, and establish geopolitical context for observed threats. 

Several example queries demonstrate the application of country-based threat detection.  

The query below targets phishing attacks originating from Brazil. By combining the submissionCountry parameter with the threatName parameter, it focuses on a specific type of threat within a geographic context. 

submissionCountry:”br” AND threatName:”phishing” 

This approach helps identify regional trends in phishing campaigns, which may target local institutions or use language-specific social engineering techniques. 

The next identifies malicious submissions from India that involve PowerShell commands. It combines geographic filtering with a behavioral indicator and threat classification, providing a more comprehensive view of specific attack methodologies within a regional context. 

submissionCountry:”in” AND commandLine:”powershell” AND threatLevel:”malicious” 

This approach is particularly valuable for identifying sophisticated attacks that leverage legitimate system tools like PowerShell. 

Country-based threat detection can be further enhanced by analyzing temporal patterns, comparing threat distributions across different regions, and correlating geographic data with other threat indicators. This multidimensional approach provides a more comprehensive understanding of the global threat landscape and helps security teams prioritize their defensive efforts based on regional risk profiles. 

2. MITRE Technique-Focused Queries 

TI Lookup incorporates this framework through the MITRE parameter, enabling highly specific searches based on known attack techniques. 

Command and Script Execution (T1059) 

Command and script execution involves the use of command-line interfaces or scripting languages to execute commands, scripts, or binaries. This technique is commonly used by threat actors for various purposes, including initial access, execution, and persistence. The following query targets this technique: 

MITRE:”T1059″ AND (commandLine:”powershell” OR imagePath:”mshta.exe”) 

Here we identify submissions that exhibit command and script execution behavior, as defined by the MITRE technique T1059, and involve either PowerShell commands or the Microsoft HTML Application Host (mshta.exe). The combination of the MITRE parameter with specific command-line or image path indicators provides insights into how threat actors leverage legitimate system tools for malicious purposes. 

This example also gives us a representation of TI Lookup’s search volume and comprehensiveness: it can deliver hundreds and thousands of relevant malware samples, indicators, artifacts, and other types of data. An analyst can limit and refine the search employing the parameters and setting, for instance, changing the search period (circled on the screenshot) from the minimum of one day to the maximum of 180 days.  

Registry-Based Persistence (T1547) 

Registry-based persistence involves modifying the Windows Registry to ensure that malware runs automatically when the system starts or when specific conditions are met. This technique is commonly used by threat actors to maintain access to compromised systems. The following query targets this technique: 

MITRE:”T1547″ AND registryKey:”CurrentVersion\Run” 

This query identifies submissions that exhibit registry-based persistence behavior, as defined by the MITRE technique T1547, and specifically target the Run key in the Windows Registry. This key is commonly used for persistence, as any executable listed here will run automatically when a user logs in. 

Advanced MITRE Correlation 

Advanced threat hunting often involves correlating multiple MITRE techniques to identify sophisticated attack patterns. The following query illustrates this approach: 

MITRE:”T1055″ AND MITRE:”T1547″ AND MITRE:”T1082″ 

This query identifies submissions that exhibit three distinct MITRE techniques: process injection (T1055), registry-based persistence (T1547), and system information discovery (T1082). 

The correlation of these techniques suggests a sophisticated attack that injects code into legitimate processes, establishes persistence through registry modifications, and attempts to collect information about the system.  

MITRE technique-focused queries can be further enhanced by incorporating additional parameters related to file properties, network communications, or threat classifications. This multidimensional approach provides a more comprehensive understanding of how specific techniques are implemented in real-world attacks and helps security teams develop more effective detection and mitigation strategies. 

3. Obfuscated File Behavior Detection 

Obfuscation is a common technique used by malware authors to hide malicious code and evade analysis. ANY.RUN TI Lookup enables the detection of various obfuscation techniques through specialized queries that focus on file behaviors and characteristics. 

Executables in Non-Standard Directories 

Malware often places executable files in non-standard directories to avoid detection and blend in with legitimate system files. The following query targets this behavior: 

fileExtension:”exe” AND NOT filePath:”Windows*” AND NOT filePath:”Program Files*” 

This query identifies executable files (.exe) that are not located in the standard Windows or Program Files directories. The combination of the fileExtension parameter with negative conditions for standard file paths helps security analysts identify potentially suspicious executables that may be attempting to hide in unusual locations. 

Script-Based Obfuscation 

Script-based obfuscation involves the use of scripting languages to hide malicious code or execute obfuscated commands. The following query targets this behavior: 

commandLine:”powershell” and fileExtension:”js” 

This query identifies JavaScript (.js) files that execute PowerShell commands (you can also search for other script types, like Visual Basic Script (.vbs) files). This pattern is commonly observed in multi-stage attacks where script files are used as initial droppers that subsequently execute obfuscated PowerShell commands. The combination of file extension parameters with command-line indicators helps security analysts identify and analyze this obfuscation technique. 

4. Persistence and Mutex Creation 

Persistence mechanisms and mutex creation are common techniques used by malware to maintain access to compromised systems and ensure that only one instance of the malware is running at a time.  

Mutexes can be explored with the aid of Object parameters: 
 
syncObjectName:”rmc” 

This query identifies submissions that contain a mutex (a synchronization object often used by malware to ensure single-instance execution) with the name “rmc”. TI Lookup provides numerous analysis results, demonstrating that this mutex belongs to the Remcos trojan.  

This approach helps security analysts identify sophisticated malware based on artifacts found in system logs. Further analysis of persistence and mutex creation can involve examining the specific values written to registry keys, analyzing the naming conventions of mutexes, and correlating these indicators with other malicious behaviors. 

5. Domain Generation Algorithm (DGA) Detection 

Domain Generation Algorithms (DGAs) are techniques used by malware to dynamically generate domain names for command and control (C2) communication. This approach helps malware evade detection and blocking by constantly changing the domains used for communication. ANY.RUN TI Lookup enables the detection of DGA-based malware through specialized queries that focus on domain characteristics and communication patterns. 

Random TLD with Active Communication 

DGA-generated domains often use uncommon or cheaper top-level domains (TLDs) to reduce costs and avoid detection. The following query targets this behavior: 

domainName:”.top” OR domainName:”.xyz” AND (destinationPort:”80″ OR destinationPort:”443″) AND threatLevel:”malicious” 

This query identifies malicious submissions that communicate with domains using the .top or .xyz TLDs over HTTP (port 80) or HTTPS (port 443). These TLDs are relatively inexpensive and are commonly used in DGA implementations. The combination of domain name patterns, communication ports, and threat classification helps security analysts identify potential DGA-based malware. 

Domain Name Patterns 

This query identifies submissions that communicate with domains deployed on Cloudflare Workers. This is a common way for attackers to host phishing pages:  
 
domainName:”.workers.dev” AND threatLevel:”malicious” 

Known DGA Families 

Certain malware families are known to use specific DGA implementations. The following query targets these associations: 

(threatName:”redline” OR threatName:”lumma”) AND domainName:”.” AND destinationIpAsn:”cloudflare” 

This query identifies submissions associated with RedLine or Lumma malware families that communicate with any domain resolved to Cloudflare’s infrastructure. These malware families are known to use DGAs, and the correlation with Cloudflare ASN (Autonomous System Number) may indicate attempts to hide behind legitimate CDN services. This approach helps security analysts identify specific malware families that employ DGAs for C2 communication. 

DGA detection can be further enhanced by analyzing temporal patterns of domain generation, examining the linguistic characteristics of generated domains, and correlating domain communications with other malicious behaviors. 

6. Malware Family Behavior Queries 

Different malware families exhibit distinct behavioral patterns that can be used for identification and analysis. ANY.RUN TI Lookup enables the detection of specific malware families through queries that target their characteristic behaviors. 

Formbook 

Formbook is a data-stealing malware that captures screenshots, logs keystrokes, and steals data from web browsers.  

threatName:”formbook” OR (MITRE:”T1055″ AND registryKey:”Windows\CurrentVersion\Run” AND fileExtension:”exe”) OR (URL:”*.php” AND httpRequestContentType:”application/x-www-form-urlencoded”) 

This query identifies submissions explicitly classified as Formbook or exhibiting behaviors characteristic of this malware family, including process injection (MITRE T1055) combined with Run registry modifications and executable files, or communication with PHP endpoints using specific content types. These indicators collectively provide strong evidence of Formbook activity. 

AsyncRAT 

AsyncRAT is a remote access trojan that provides attackers with full control over infected systems. 

threatName:”asyncrat” and commandLine:”mshta.exe” OR commandLine:”powershell” 

This query identifies submissions explicitly classified as AsyncRAT or exhibiting behaviors characteristic of this malware family, including the use of mshta.exe or PowerShell.   

Malware family behavior queries can be further enhanced by incorporating additional indicators specific to each family, analyzing temporal evolution of behaviors, and correlating family-specific indicators with broader threat intelligence. This comprehensive approach provides deeper insights into malware family behaviors and helps security teams develop more effective detection and mitigation strategies. 

7. Thematic Search Query Updates 

TI Lookup lets you subscribe to receive updates on your custom search queries. For example, you can focus on specific malware families, enabling more efficient and targeted threat hunting.  

Credential Stealers 

Credential stealing is a common objective for various malware families. The following query targets three popular credential stealers Redline, Lumma, and Formbook that access the Security Account Manager (SAM) registry key, which stores user account information.  

threatName:”redline” OR threatName:”lumma” OR threatName:”formbook” AND registryKey:”SAM\” 

By subscribing to this query, we’ll receive updates each time new search results become available in TI Lookup. This thematic approach helps security analysts focus specifically on threats targeting credentials, regardless of the specific malware family involved. 

Conclusion 

We have reviewed a number of advanced threat hunting techniques using ANY.RUN TI Lookup.  

Through detailed exploration of various query methodologies, including country-based threat detection, MITRE technique-focused queries, obfuscated file behavior detection, persistence mechanisms, domain generation algorithm detection, and malware family behavior analysis, the research demonstrates the power and flexibility of query-based threat intelligence in modern security operations.  

The correlation of different indicators through logical operators and grouping enhances detection precision and reduces false positives, allowing security analysts to focus their efforts on the most relevant threats.  

By focusing on specific threat categories and leveraging advanced query techniques, security teams can develop more efficient and effective threat detection strategies. 

About ANY.RUN 

ANY.RUN helps more than 500,000 cybersecurity professionals worldwide. Our Interactive Sandbox simplifies malware analysis of threats that target both Windows and Linux systems. Our threat intelligence products, Threat Intelligence Lookup and Feeds, help you find IOCs or files to learn more about the threats and respond to incidents faster. 

Request trial of ANY.RUN’s services to test them in your organization → 

The post Threat Hunting: Hands-on Tips for SOC Analysts and MSSPs  appeared first on ANY.RUN’s Cybersecurity Blog.

ANY.RUN’s Cybersecurity Blog – ​Read More

• In May 2025, Cisco Talos identified a Python-based remote access trojan (RAT) we call “PylangGhost,” used exclusively by a North Korean-aligned threat actor. PylangGhost is functionally similar to the previously documented GolangGhost RAT, sharing many of the same capabilities. 
• In recent campaigns, the threat actor Famous Chollima — potentially made up of multiple groups — has been using a Python-based version of their trojan to target Windows systems, while continuing to deploy a Golang-based version for MacOS users. Linux users are not targeted in these latest campaigns. 
• The attacks are targeting employees with experience in cryptocurrency and blockchain technologies. 
• Based on open-source intelligence, only a small number of users, predominantly in India, are affected. Cisco product telemetry does not indicate that there are any affected Cisco users. 

---

Since mid-2024, the threat actor group Famous Chollima (aka Wagemole), a North Korean-aligned threat actor, has been very active through several well-documented campaigns. These campaigns include using variants of Contagious Interview (aka DeceptiveDevelopment) and creating fake job advertisements and skill-testing pages. In the latter, users are instructed to copy and paste (ClickFix) a malicious command line in order to install drivers necessary to conduct the final skill-testing stage.  

Toward the end of the year, researchers documented Famous Chollima’s remote access trojan (RAT) called “GolangGhost” in its source code format, which was frequently used as the final payload in the threat actor’s ClickFix campaigns. 

In May 2025, Cisco Talos discovered threat actors starting to deploy a functionally equivalent Python variant of GolangGhost trojan, which we call “PylangGhost.” 

Fake job interview sites mislead users to PylangGhost infection 

Famous Chollima seek financial benefit using a two-pronged approach: first, by creating fake employers for the purpose of jobseekers exposing their personal information, and second by deploying fake employees as workers in targeted victim companies.  

This blog focuses on the first method, where real software engineers, marketing employees, designers and other workers are targeted by fake recruiters and instructed to visit skill-testing pages in order to move forward with their application. 

Based on the advertised positions, it is clear that the Famous Chollima is broadly targeting individuals with previous experience in cryptocurrency and blockchain technologies. The skill-testing sites attempt to impersonate real companies such as Coinbase, Archblock, Robinhood, Parallel Studios, Uniswap and others, which helps with the targeting.  

Each target is sent an invite code to visit a testing website where, depending on the position, they are instructed to enter their details and answer several questions to test their experience and skills. The sites are created using the React framework and have very similar visual designs, no matter the type of position.  

Once the user answers all the questions and provides personal details, the site displays an invitation to record a video for the interviewer, recommending that the user request camera access by pressing a button. 

Finally, when the user requests camera, the site displays the instructions for the user to copy, paste and execute a command to allegedly install the required video drivers, if the OS is supported. When Talos used Windows and MacOS test systems, the instructions were shown as seen in Figure 4 and 5. The Linux test system led to another error message, without any instructions to download and install the payload.  

Instructions for downloading the alleged fix are different based on the browser fingerprinting, and also given in appropriate shell language for the OS: PowerShell or Command Shell for Windows, and Bash for MacOS.

PylangGhost – Python variant of GolangGhost 

As the Golang variant of the RAT is already well-documented, this blog focuses on the Python version and the similarities between the two. The initial stage consists of a command line which the fake webpage tells the unsuspecting user to copy, paste and execute. 

The command line uses either PowerShell Invoke-Webrequest or curl to download a ZIP file containing the PylangGhost modules as well as Visual Basic Script file. This script is responsible for unzipping the Python library stored in the “lib.zip file” and launching the trojan by running a renamed Python interpreter using the file “nvidia.py” as the Python program to run. 

 PylangGhost consists of six well-structured Python modules. It is not clear to Talos why the threat actors decided to create two variants using a different programming language, or which was created first. Based on the comments in the code, it is unlikely that the threat actors used a large language model (LLM) to help rewrite the code for Python. One of the strings in the configuration module file (“config.py”) indicates that the Python version is 1.0, while the appropriate configuration variable in the Golang version indicates that the version is 2.0. However, Talos cannot definitively conclude that those two version numbers are comparable. 

 The execution starts with the file “nvidia.py”, which performs several tasks: It creates a registry value to launch the RAT every time user logs onto the system, generates a GUID for the system to be used in communication with command and control (C2) server, connects to the C2 server and enters the command loop for communication with the server.  

 The configuration file “config.py” specifies the commands that can be received from the server, which are identical to the commands previously documented in the Golang version of the RAT. These commands enable remote control the infected system and the theft of cookies and credentials from over 80 browser extensions, including password managers and cryptocurrency wallets, including Metamask, 1Password, NordPass, Phantom, Bitski, Initia, TronLink and MultiverseX. 

The command handling module, “command.py”, defines function handlers and handles the commands received from the C2 server.  

Command	Functionality
qwer	COMMAND_INFORMATION – collect information about the infected system, username, OS version etc
asdf	COMMAND_FILE_UPLOAD – file upload
zxcv	COMMAND_FILE_DOWNLOAD – file download
vbcx	COMMAND_OS_SHELL – launch an OS shell for remote access and control of the infected system
ghdj	COMMAND_WAIT – sleep for a number of seconds specified by the C2 server
r4ys	COMMAND_AUTO – browser information stealing command
89io	AUTO_CHROME_GATHER_COMMAND – subcommand of the browser information stealer command
gi%#	AUTO_CHROME_COOKIE_COMMAND – subcommand of the browser information stealer command
dghh	COMMAND_EXIT

Table 1. Commands and functionalities.

The module “auto.py” contains the functionality for stealing the stored browser credentials and session cookies, as well as collecting data from various browser extensions.  

“Api.py” is responsible for implementing the communications protocol with the C2 server, using RC4 encryption to encrypt packets over otherwise unencrypted HTTP used while communicating with the C2 server. The data in a HTTP packet is encrypted with RC4 algorithm, but the encryption key is also sent within the packet structure. The packet begins with 16 bytes of MD5 checksum for the rest of the packet, for verification of data integrity, followed by 128 bytes containing the RC4 encryption key, followed by an encrypted data blob.  

Finally, “util.py” handles the compression and decompression of files. 

Comparison of Python and Golang modules 

To assess the similarity between the two versions, Talos compares the names of the modules written in different languages as well as their functionality. The structure, the naming conventions and the function names are very similar, which indicates that the developers of the different versions either worked closely together or are the same person.   

Module	Python name	Golang name
Main function module	nvidia.py	cloudfixer.go
Configuration module	config.py	config/constans.go
Main command loop	nvidia.py	core/loop.go
Command handlers	command.py	core/loop.go
Browser Stealer functionality	auto.py	auto/* modules
File compression	util.py	util/compress.go
Base64 message encoding	command.py	command/stackcmd.go
Duplicate process check	nvidia.py	instance/check.go
Communications protocol	api.py	transport/htxp.go

Table 2. Comparison of Python and Golang RAT module names. 

Coverage  

Ways our customers can detect and block this threat are listed below.  

Cisco Secure Endpoint (formerly AMP for Endpoints) is ideally suited to prevent the execution of the malware detailed in this post. Try Secure Endpoint for free here.  

Cisco Secure Email (formerly Cisco Email Security) can block malicious emails sent by threat actors as part of their campaign. You can try Secure Email for free here.  

Cisco Secure Firewall (formerly Next-Generation Firewall and Firepower NGFW) appliances such as Threat Defense Virtual, Adaptive Security Appliance and Meraki MX can detect malicious activity associated with this threat.  

Cisco Secure Network/Cloud Analytics (Stealthwatch/Stealthwatch Cloud) analyzes network traffic automatically and alerts users of potentially unwanted activity on every connected device.  

Cisco Secure Malware Analytics (Threat Grid) identifies malicious binaries and builds protection into all Cisco Secure products.  

Cisco Secure Access is a modern cloud-delivered Security Service Edge (SSE) built on Zero Trust principles.  Secure Access provides seamless transparent and secure access to the internet, cloud services or private application no matter where your users work.  Please contact your Cisco account representative or authorized partner if you are interested in a free trial of Cisco Secure Access.  

Umbrella, Cisco’s secure internet gateway (SIG), blocks users from connecting to malicious domains, IPs and URLs, whether users are on or off the corporate network.   

Cisco Secure Web Appliance (formerly Web Security Appliance) automatically blocks potentially dangerous sites and tests suspicious sites before users access them.   

Additional protections with context to your specific environment and threat data are available from the Firewall Management Center.  

Cisco Duo provides multi-factor authentication for users to ensure only those authorized are accessing your network.   

Open-source Snort Subscriber Rule Set customers can stay up to date by downloading the latest rule pack available for purchase on Snort.org.  

ClamAV detections available for this threat:

Win.Backdoor.PyChollima-10045389-0
Win.Backdoor.PyChollima-10045388-0
Win.Backdoor.PyChollima-10045387-0
Win.Backdoor.PyChollima-10045386-0
Win.Backdoor.PyChollima-10045385-0
Win.Backdoor.PyChollima-10045384-0

IOCs 

The IOCs can also be found in our GitHub repository here.

SHA256 

a206ea9b415a0eafd731b4eec762a5b5e8df8d9007e93046029d83316989790a - auto.py  
c2137cd870de0af6662f56c97d27b86004f47b866ab27190a97bde7518a9ac1b - auto.py  
0d14960395a9d396d413c2160570116e835f8b3200033a0e4e150f5e50b68bec - api.py 
8ead05bb10e6ab0627fcb3dd5baa59cdaab79aa3522a38dad0b7f1bc0dada10a - api.py 
5273d68b3aef1f5ebf420b91d66a064e34c4d3495332fd492fecb7ef4b19624e - nvidia.py 
267009d555f59e9bf5d82be8a046427f04a16d15c63d9c7ecca749b11d8c8fc3 - nvidia.py 
7ac3ffb78ae1d2d9b5d3d336d2a2409bd8f2f15f5fb371a1337dd487bd471e32 - nvidia.py 
b7ab674c5ce421d9233577806343fc95602ba5385aa4624b42ebd3af6e97d3e5 - util.py 
fb5362c4540a3cbff8cb1c678c00cc39801dc38151edc4a953e66ade3e069225 - util.py 
d029be4142fca334af8fe0f5f467a0e0e1c89d3b881833ee53c1e804dc912cfd - command.py 
b8402db19371db55eebea08cf1c1af984c3786d03ff7eae954de98a5c1186cee - command.py 
1f482ce7e736a8541cc16e3e80c7890d13fb1f561ae38215a98a75dce1333cee - config.py 
ed170975e3fd03440360628f447110e016f176a44f951fcf6bc8cdb47fbd8e0e - config.py 
929c69827cd2b03e7b03f9a53c08268ab37c29ac4bd1b23425f66a62ad74a13b - config.py 
127406b838228c39b368faa9d6903e7e712105b5ad8f43a987a99f7b10c29780 - config.py 
0ec9d355f482a292990055a9074fdabdb75d72630b920a61bdf387f2826f5385 - update.vbs 
c2d2320ae43aaa0798cbcec163a0265cba511f8d42d90d45cd49a43fe1c40be6 - update.vbs 
e7c2b524f5cb0761a973accc9a4163294d678f5ce6aca73a94d4e106f4c8fea4 - nvidiaRelease.zip 
28198494f0ed5033085615a57573e3d748af19e4bd6ea215893ebeacf6e576df - vdriverWin.zip 
fc71a1df2bb4ac2a1cc3f306c3bdf0d754b9fab6d1ac78e4eceba5c6e7aee85d - nvidiaRelease.zip 
d3500266325555c9e777a4c585afc05dfd73b4cbe9dba741c5876593b78059fd - nvidiaRelease.zip 

C2 servers 

hxxp[://]31[.]57[.]243[.]29:8080 
hxxp[://]154[.]58[.]204[.]15:8080 
hxxp[://]212[.]81[.]47[.]217:8080 
hxxp[://] 31[.]57[.]243[.]190:8080

Download host names 

api[.]quickcamfix[.]online   
api[.]auto-fixer[.]online   
api[.]quickdriverupdate[.]online   
api[.]camtuneup[.]online   
api[.]driversofthub[.]online   
api[.]drive-release[.]cloud   
api[.]vcamfixer[.]online   
api[.]nvidia-drive[.]cloud   
api[.]nvidia-release[.]us   
api[.]autodriverfix[.]online   
api[.]camdriversupport[.]com   
api[.]smartdriverfix[.]cloud   
api[.]drivercams[.]cloud   
api[.]camtechdrivers[.]com   
api[.]web-cam[.]cloud   
api[.]camera-drive[.]org   
api[.]nvidia-release[.]org 
api[.]fixdiskpro[.]online 
api[.]autocamfixer[.]online

Fake job interview host names 

krakenhire[.]com  
yuga[.]skillquestions[.]com  
uniswap[.]speakure[.]com  
doodles[.]skillquestions[.]com  
www[.]hireviavideo[.]com  
kraken[.]livehiringpro[.]com  
quiz-nest[.]com  
www[.]smartvideohire[.]com  
www[.]talent-hiringstep[.]com  
provevidskillcheck[.]com  
skill[.]vidintermaster[.]com  
digitaltalent[.]review  
robinhood[.]ecareerscan[.]com  
evalswift[.]com  
livetalentpro[.]com  
quantumnodespro[.]com  
evalassesso[.]com  
parallel[.]eskillora[.]com  
coinbase[.]talentmonitoringtool[.]com  
uniswap[.]testforhire[.]com  
coinbase[.]talenthiringtool[.]com  
crosstheages[.]skillence360[.]com 
parallel [.] eskillprov [.] com 
assesstrack [.] com 
coinbase [.] talentmonitoringtool [.] com 
talent-hiringtalk[.]com 
uniswap[.]prehireiq[.]com 
fast-video-recording[.]com

Cisco Talos Blog – ​Read More

In today’s world, staying connected isn’t just a habit — it’s a necessity. We’re used to sharing beach photos on social media, keeping in touch with loved ones across time zones, and handling work from anywhere. All of this is possible if your smartphone has a reliable internet connection.

For years, the main barriers to seamless connectivity abroad were high roaming costs and the hassle associated with physical SIM cards, which you had to find, buy, activate, figure out how to top up, and swap out — risking losing your primary one in the process. With the invention of eSIMs (embedded digital SIM cards) — supported by most modern smartphones — the fuss with physical SIMs became a thing of the past. However, you still had to find a suitable, usually single-use, eSIM for the specific region you were visiting, and do it all over again for each trip.

The new Kaspersky eSIM Store is a game-changer for mobile internet, providing a simple way to find, pay for, and activate available mobile-data plans from local carriers worldwide. What’s more, you won’t have to buy and activate a new eSIM every time. Once you install it, you can use it indefinitely, connecting to data plans for different regions with the amount of data you need through a user-friendly app or website. Plus, with non-expiring Kaspersky eSIM Store plans, the mobile data you paid for doesn’t expire, which means any unused GBs will be there for you for your next trip. Let’s dive into the details…

What’s an eSIM?

First, let’s refresh our memory (or learn for the first time) what an eSIM — embedded SIM — is, and how it differs from traditional physical SIM cards.

Every cell phone has one or more slots for mini, micro, or nano-SIM cards. This small piece of plastic with contacts and a chip — essentially a microcomputer — stores GSM identification keys, which the given network uses to identify the subscriber. The SIM card can also store your contacts, SMS messages, lists of incoming, outgoing, and missed calls, as well as pre-installed carrier apps. However, the memory capacity of SIM cards is usually small, which limits their functionality.

But why not extract the chip from the plastic and install it into the phone directly? That’s exactly how eSIMs emerged in 2016. The data identifying the subscriber is no longer hardwired into the SIM card’s chip during manufacturing. Instead, it’s transmitted by the carrier to the subscriber in encrypted form and written to the eSIM on their device. Thanks to its larger memory capacity, an eSIM can store multiple carrier profiles, so you can have several virtual SIMs in your phone at once.

This doesn’t mean they’ll all work simultaneously, though. Most often, you can store multiple profiles and switch between them, but the upside is you don’t have to fiddle with swapping tiny pieces of plastic and risk losing them. Depending on the smartphone, one or more profiles can be active simultaneously.

What almost all modern smartphones allow you to do is choose which SIM to use for voice calls and text messages, and which for data. And this is one of the main advantages of eSIMs. To avoid huge roaming bills for mobile internet, you install Kaspersky eSIM Store on your smartphone, select your travel country or region, the plan type — either with a time limit or non-expiring — and the amount of data you need, then buy and activate the eSIM. If you buy the eSIM in advance, you can choose not to activate it immediately but schedule the desired activation date.

Installing and activating the eSIM takes a few minutes, and you can do it either in your destination country or at home. You’ll need a stable internet connection for this, so we recommend doing it beforehand. When you arrive at your destination, the eSIM will automatically connect to a local carrier — but don’t forget to enable roaming and switch data-transmission to the eSIM in your phone’s settings, following the instructions provided.

eSIMs acquired from Kaspersky eSIM Store don’t support voice calls — only data transmission. However, your regular SIM card stays in your phone, meaning you’ll still receive text messages and incoming calls. You don’t necessarily have to answer them while roaming, but you can always call back through messaging apps without breaking the bank on roaming. Now that’s handy!

You can find out if your smartphone supports eSIM on the Kaspersky eSIM Store website.

Benefits of the Kaspersky eSIM Store

Let’s talk about some of the not-so-obvious advantages of Kaspersky eSIM Store.

Privacy

Unlike traditional SIM cards, activating an eSIM requires neither an ID/passport, nor verification through local government services. Payment can be made in the mobile app or on the secure website. Thus, your personal and banking details won’t leak from some local SIM card stand.

Unified account

When you first use it, you’ll need to register on the website or in the app. But if you already have a My Kaspersky account, just link that, and you’ll be logged in automatically. In your personal account on the website or in the app, you can track your mobile data usage in real time, receive notifications when you’re about to run out of data, and instantly top up your eSIM with any amount of data you need.

In some countries, a Smart Top-up feature is available. When your data balance drops below 100MB, we’ll automatically boost your eSIM with the same amount of gigabytes that you purchased earlier and extend your plan’s validity. That way, you won’t be caught off guard by a sudden loss of connectivity.

Value

Our wide selection of plans allows you to find the perfect fit. You can choose (i) a Local plan — valid in one of the 177 available countries and territories, (ii) one of nine Regional plans, or (iii) the Global plan — valid in 122 countries worldwide.

Next, you can select the type of plan (Expiring or Non-expiring), specify how much data you need, and pay for it with your bank card in just a few clicks.

With Expiring plans, you need to use all your data within a fixed period, which is 30 days for most plans. With Non-expiring plans, your mobile data remains assigned to your account indefinitely. Even if you’ve bought too much data and haven’t been able to use it all up, or if you had to cut your trip short for some reason, you can use the remainder on your next journey to the same region.

Planning

Conveniently, you can activate your eSIM immediately upon purchase — for example, if you’re already abroad — or postpone its activation to a specific date. By default, the eSIM starts working at the moment of purchase, and for Expiring plans, the validity period begins at that time too. However, if you like to plan and get everything ready in advance, you can buy a data plan ahead of time from home. At checkout, select the Schedule activation option, and specify your trip’s start date. If your plans change, you can alter the activation date even after purchase.

Rollover and flexibility

The issue with most travel eSIMs is that they’re effectively single-use. You buy it, install it, use it, and that’s it. You have to delete the eSIM from your phone and get a new one for your next trip. With Kaspersky eSIM Store, you buy the eSIM once, install it on your smartphone, and then connect different data plans to it as needed. Still, there’s nothing stopping you from buying more than one eSIM. For example, you could get one for each family member traveling with you. This way, you can monitor each person’s data usage in a single personal account (and remind your teens to go easy on the social media if they’re burning through their data too quickly!). Or, if you have an eSIM with remaining data on a Non-expiring plan for a specific country or region, but you’re heading to a different part of the world, you can simply purchase another eSIM for your new destination. If you frequently travel to the same few countries, it’s more cost-effective to set up multiple eSIMs, one for each country, and use a Non-expiring plan on each. That way, you won’t lose a single byte. Kaspersky eSIM Store provides all the flexibility you need for eSIM juggling.

Security

Let’s start with something we’ve covered in previous articles: when in a foreign country, it’s much safer to use mobile internet than to connect to public Wi-Fi, and here’s why. However, buying a local SIM card isn’t as easy as it seems. You need to find a mobile operator’s store (or a booth selling SIMs), navigate a dizzying array of plans often described in the local language, and make sure they’re not trying to push unnecessary services on you. Moreover, in most countries, you have to give the seller a copy of your passport to buy a SIM card. Are you sure you want to share your passport (and also maybe bank card details) with a stranger? And let’s not forget the difficulties of tracking remaining data and topping up local SIM cards.

That’s why using an eSIM — which doesn’t require a passport to purchase, offers clear and transparent pricing, comes with no hidden fees or unwanted add-ons, and processes payments through a secure connection — is really the smartest way to go. To further enhance your gadgets’ security while traveling, our robust protection will shield you from viruses, secure online payments, and warn you about connecting to unsafe networks. And for Android smartphone owners, it can even help locate a lost or stolen phone.

And Kaspersky VPN Secure Connection, included with a Kaspersky Premium subscription, or available separately, will encrypt your internet traffic — preventing interception, and helping you connect to banking sites, government services, or streaming platforms in your home country as if you never left it.

Kaspersky official blog – ​Read More

Welcome to this week’s edition of the Threat Source newsletter. 

This week, I’m coming to you from Cisco Live in San Diego where I’ve just talked to a room that some of you may have been in, so writing this feels a bit surreal. It’s really hard to try and write a cogent newsletter with all that’s happening in the world, some directly outside my door. To purposefully butcher Charles Dickens, “It was the worst of times, it was the even worse times.” Nevertheless, I’m persisting.  

I’ve had great conversations with so many smart people this week, but I was reminded once again that the most important tool you can leverage in protecting and securing your environment is knowing your environment and knowing yourself.  

Knowing your environment can and should be tooled and processed so that it can be repeatable. Continuing to know your environment requires constant vigilance and effort. Knowing yourself requires a level of introspection that is hard — and honestly, sometimes I just lift the rug and sweep my issues under it when I can’t tackle that negativity.  

I’ll give you an excellent example: every single thing I write would get flagged as AI. Everything. Why? I use an em dash (“—”) for roughly every four words I write — sometimes more, if I let it fly. It’s clear that I could never go back to school successfully, despite the comedy gold that it would produce. For those of you old enough to remember “Back to School” with Rodney Dangerfield, I think you can imagine. I don’t even want to talk about my kludgy code. Sure, it runs, but at what cost? 

So my advice? Do as I say, not as I do. Learn everything about your environment in a repeatable way, with a clear and documented process. Then analyze your own weaknesses in your work — let’s not try to make miracles happen — and identify chances for you to learn, fill the gaps in your skill set and then do it all over again. The bad guys are really good at learning your environment; make it as hard for them as you can. 

The one big thing 

Cisco Talos recently disclosed several vulnerabilities across various software, including catdoc, Parallel, NVIDIA and High-Logic FontCreator. While most vulnerabilities were patched by their respective vendors, catdoc posed an exception as the vendor was unreachable, prompting Talos to provide patches directly.

Why do I care? 

These vulnerabilities highlight risks in widely used software, potentially exposing systems to attacks such as privilege escalation, memory corruption and data leaks. Understanding these risks is crucial to protect your systems. 

So now what? 

If you use these programs, update them immediately with the latest patches to protect yourself.  If you’re on a security team, grab the latest Snort rules to detect possible exploits and keep an eye out for suspicious activity.  And if you’re a developer, take notes from these vulnerabilities to strengthen your own code and avoid similar pitfalls in your projects. Security is everyone’s job!

Top security headlines of the week 

NHS in England calls for blood donors after ransomware attack
The UK’s National Health Service (NHS) is calling for one million donors after a Qilin ransomware attack last summer caused a severe shortage of O-negative blood. (Cybernews) 

Let them eat junk food: Major organic supplier to Whole Foods, Walmart, hit by cyberattack
North American grocery wholesaler United Natural Foods told regulators that a cyber incident temporarily disrupted operations, including its ability to fulfill customer orders. (The Register) 

Google fixes bug that could reveal users’ private phone numbers 
A security researcher has discovered a bug that could be exploited to reveal the private recovery phone number of almost any Google account without alerting its owner, potentially exposing users to privacy and security risks. (TechCrunch) 

SinoTrack GPS Devices Vulnerable to Remote Vehicle Control via Default Passwords 
Two security vulnerabilities have been disclosed in SinoTrack GPS devices that could be exploited to control certain remote functions on connected vehicles and even track their locations. (The Hacker News)

Can’t get enough Talos? 

Microsoft Patch Tuesday for June 2025 
Microsoft has released its monthly security update, which includes 66 vulnerabilities affecting a range of products, including 10 that Microsoft marked as “critical.” Read the blog here.

PathWiper targeting Ukrainian critical infrastructure 
Cisco Talos observed a destructive attack on a critical infrastructure entity within Ukraine, using a previously unknown wiper we are calling “PathWiper.” Learn more.

Upcoming events where you can find Talos 

• REcon (June 27 – 29) Montreal, Canada 
• NIRMA (July 28 – 30) St. Augustine, FL 
• Black Hat USA (Aug. 2 – 7) Las Vegas, NV 

Most prevalent malware files from Talos telemetry over the past week 

SHA 256: 9f1f11a708d393e0a4109ae189bc64f1f3e312653dcf317a2bd406f18ffcc507 
MD5: 2915b3f8b703eb744fc54c81f4a9c67f 
VirusTotal: https://www.virustotal.com/gui/file/9f1f11a708d393e0a4109ae189bc64f1f3e312653dcf317a2bd406f18ffcc507
Typical Filename: VID001.exe 
Claimed Product: N/A 
Detection Name: Win.Worm.Coinminer::1201 

SHA 256: 5616b94f1a40b49096e2f8f78d646891b45c649473a5b67b8beddac46ad398e1 
MD5: 3e10a74a7613d1cae4b9749d7ec93515 
VirusTotal: https://www.virustotal.com/gui/file/5616b94f1a40b49096e2f8f78d646891b45c649473a5b67b8beddac46ad398e1
Typical Filename: IMG001.exe 
Claimed Product: N/A 
Detection Name: Win.Dropper.Coinminer::1201 

SHA 256: c67b03c0a91eaefffd2f2c79b5c26a2648b8d3c19a22cadf35453455ff08ead0 
MD5: 8c69830a50fb85d8a794fa46643493b2  
VirusTotal: https://www.virustotal.com/gui/file/c67b03c0a91eaefffd2f2c79b5c26a2648b8d3c19a22cadf35453455ff08ead0
Typical Filename: AAct.exe  
Claimed Product: N/A  
Detection Name: PUA.Win.Dropper.Generic::1201 

SHA 256: a31f222fc283227f5e7988d1ad9c0aecd66d58bb7b4d8518ae23e110308dbf91   
MD5: 7bdbd180c081fa63ca94f9c22c457376   
VirusTotal: https://www.virustotal.com/gui/file/a31f222fc283227f5e7988d1ad9c0aecd66d58bb7b4d8518ae23e110308dbf91/details  
Typical Filename: IMG001.exe  
Detection Name: Simple_Custom_Detection   

SHA256 275A021BBFB6489E54D471899F7DB9D1663FC695EC2FE2A2C4538AABF651FD0F 
MD5: 44d88612fea8a8f36de82e1278abb02f 
VirusTotal: https://www.virustotal.com/gui/file/275a021bbfb6489e54d471899f7db9d1663fc695ec2fe2a2c4538aabf651fd0f/detection
Typical Filename: eicar.com-42987 
Detection Name: eicarTestFile 

Cisco Talos Blog – ​Read More