CRYPTOLOVE_iocs_11-2024.txt

CryptoLove bot

cryptolove[.]team

CX - clusters: 

CX 1 - Fato PDF Reader
fatoreader[.]net
fatoreader[.]com

CX 2 - Orionix Game
orionix[.]xyz
orionix[.]io
orionix[.]app

CX 3 - Dinoverse Game
dinoverse[.]live
dinoverse[.]app
dinoverse[.]online
dinoverse[.]life
dinoverse[.]pro
dinoverse[.]co
dinoverse[.]cc

CX 4 - Toffee Suite
toffeecalendar[.]app
toffeeresearch[.]app
toffeetools[.]app

CX 5 - Land of Dreams Game (impersonating sunflower-land[.]com)
landofdreams[.]io
landofdreamsgame[.]com
lands-of-dreams[.]com
land-of-dreams-nft[.]com
lod-nft[.]com
nft-lod[.]com
land-of-dream[.]com
game-landofdreams[.]com
landofdrams[.]space
landofdrems[.]xyz
landdreams[.]pw
land-of-dream[.]org
land-of-dreams[.]world
land-of-dreams[.]org
trendspider[.]dev
dreamsquest[.]lol
cosmicusa[.]online
swapnou[.]site
galaxycheats[.]org

CX 6 - Fake Meeting Software domains
us07web[.]us
us12web[.]us
us13web[.]us
zoom[.]us07web[.]us
zoom[.]us12web[.]us
zoom[.]us13web[.]us
webjoining[.]com
meet[.]google[.]webjoining[.]com
wechat-usweb[.]com

CX 7 - Whales Game
whales-project[.]com
whales-project[.]app
cosmo-whales[.]io
crypto-whales[.]io
crypto-whales[.]tech
cosmo-whales[.]cc

CX 8 - Orbit Game (Impersonating WarUniverse)
orbit-unit[.]net
orbit-unit[.]com
orbit-unit[.]io
orbitweb3[.]com
orbit-wars[.]app

CX 9 - Veriscroll/Verdascript PDF Reader
veriscroll[.]com
verdascript[.]com

CX 10 - Cryptic Cave Game
crypticisland[.]net
crypticisland[.]org 
cryptic-cave[.]org
cryptic-cave[.]online
cryptic-cave[.]com
cryptic[.]farm
crypticisland[.]io

CX 11 - LinkUp Meeting 
linkupcall[.]com
linkupcalls[.]com

CX 12 - Dragonborn Game
dragonborn[.]org
dragonborn[.]cc
dragonborneu4[.]com
dragonborneu3[.]org

CX 13 - Doculuma PDF Reader
doculuma[.]com

CX 14 - NexCall Meeting
nexcall[.]us
nexcal[.]cc
nexcall[.]app

CX 15 - Capsure Labs
capsuredash[.]xyz
capsure[.]xyz
capsurelabs[.]info


CX 16 - Cosmic Miner Game
cosmicway[.]io 

CX 17 - Universecity Game 
universecity[.]app
game[.]universecity[.]app
universe-city[.]io
universecity[.]land
universecity[.]art
universecity[.]at
verifybot[.]org
spacecity[.]games
space-city[.]games

CX 18 - Anaxyn Protocol (impersonating cetus[.]zone)
anaxine[.]finance
anaxyn[.]com
app[.]anaxyn[.]com
anaxyn[.]org

CX 19 - World Of Creatures game (impersonating cryptureworld[.]com:)
worldofcreatures[.]io
worldofcreatures[.]at

CX 20 - Crystal Game (Impersonating: kryxivia[.]io:)
crystalgame[.]io
crystal-p2e[.]io
crystalplay[.]io
c-play[.]net

CX 21 - NFT Museum
nftmuseum[.]store
nftum[.]art
nftuart[.]com
nftmus[.]art
musnftu[.]art
nftumus[.]art
xn--pudgypenguns-1fb[.]com

CX 22 - NFT elevation
elevation[.]lu
art-elevation[.]io

CX 23 - Cryptoconquest game (uimpersonating cryptofights[.]com)
cryptoconquest[.]at

CX24 - World of Fairy
worldoffairy[.]com
worldoffairy[.]net
worldoffairy[.]online
wofcdn[.]com

CX25 - Wizverse Game (impersoanting wizarre[.]io)
wizverse[.]org
wizverse[.]land
wizverse[.]net
wizverse[.]at

CX26 - Tower of Madness Game
towerofmadness[.]com

CX27 - Brave Arena Game
bnbarena[.]io
bravearena[.]org
bravearena[.]io

CX28 - Blaze Arena Game
blazearena[.]org

CX29 - Cryptocore 
cryptocore[.]app
cryptocore[.]com[.]co

CX30 - Candy Kingdom Game (impersonating sugarkingdom[.]io)
candykingdom[.]io
candykingdom[.]net
candykingdom[.]xyz
candykingdom[.]org
candykingdomp2e[.]net

CX31 - Saint Legend Game
saint-legend[.]com

CX32 - Fiery Blade Game (impersonating embersword[.]com)
fieryblade[.]org
fieryblade[.]io	
embersword[.]cam

CX33 - Neon War Game (impersonating eonrift[.]com)
neonwar[.]xyz
neonwar[.]net
neonwars[.]net
eonrift[.]org

CX34 - Metasphere (impersonating metacene[.]io)
metaspheres[.]net
metaspherep2e[.]net

CX35 - Skyland Game
cryptoskyland[.]org
synergyland[.]live

CX36 - Empyra (linealand[.]com:)
empyra[.]org
empyra[.]at
empyra[.]in
empyra[.]info

CX37 - Untitled Game
untitledgame[.]io
untitledgames[.]org
untitledgame[.]org
untitledgame[.]xyz|
untitledgame[.]games
untitledplatformer[.]io

CX38 - DIVA App
divaapp[.]net

CX39 - Cosmic Way Game 2.0 (reborn of CX16 several months later)
cosmicwayrb[.]org

CX40 - iMind (impersonating imind[.]com)
imindbusiness[.]com
mindmeets[.]app
mindmeet[.]app
mindcall[.]app
mindconferences[.]io
mindconferences[.]com

CX41 - Night Shifts
nightshifts[.]net
nightshiftss[.]net

CX42 - Undertime Game
undertime[.]fun

CX43 - Isphere Meeting
isphere[.]app
videocall-izoom[.]online
isphere[.]tools
ispherebusiness[.]com
isphere[.]cc

CX44 - Castle Strife Game
castlestrife[.]com
castlestrifenft[.]com
castlestrife-nft[.]com
castlestrife[.]net
nftgame-castlestrife[.]com
newcastlestrife[.]com
castlestrife[.]xyz
nftcastlestrife[.]com
castbstrif[.]com (Key to CX49)
castlestrife[.]art
krkn10[.]lat

CX45 - V Ether
vether[.]org 

CX46 - Arcanix Game (impersonating lvcidia[.]xyz)
arcanix[.]land
arcanix[.]one
arcanix[.]top
spectrongame[.]com

CX47 - Argon Game
argongame[.]fun
argongame[.]com
argongame[.]org

CX48 - Argon Game 2.0 (CX47 appears again after several months)
genom2[.]com 

CX49 - Chronos World (impersonating chronosworlds[.]com)

chronosworlds[.]world
chronosworlds[.]info
chronwrlds[.]com
chronworlds[.]com
chronosworlds-nft[.]com
chronosworlds[.]online
nft-chronosworlds[.]com
nftchronosworlds[.]com
chronosworlds[.]pro
gamechronos[.]world
register-chronosworlds[.]com
esportscs2[.]com
valoroffers[.]fun
playearn[.]click
freeetokens[.]com
nevobix[.]com

CX50 - Calipso / Lunacy Game
projectcalipso[.]com
calipsoproject[.]com
thecalipsoproject[.]com
lunacy3[.]com
lunacy4[.]com

CX51 - Cost Meeting
costweb3[.]com
call-cost[.]com
greeencost[.]com

CX52 - Gravitium
gravitiumgame[.]com

Other:
#Loader
mysticsmirage[.]com
supercoinsmarketing[.]com
xilloolli[.]com
service-goverment[.]com

#hosts
95.216.241[.]251
apikokoapi[.]com
147[.]45[.]47[.]18
94.232.249[.]131
firvfirv[.]com
dewatabalirental[.]com
hsiwhfhdjwkkfncdn[.]lol
77.105.166[.]229
hth98765[.]com

#Botnet IDs
mainteam

#Invite codes:
Promocode: ABKLFG - #bag1kq
Promocode: ADEFUU - #lanrock
Promocode: ADMYTB - #yakura3
Promocode: AIDYGG - #1mlnfrme
Promocode: ALDYWX - #kase
Promocode: APULRE - #danyacollector
Promocode: ATWTSG - #danyacollector
Promocode: AUGHCA - #Itachi
Promocode: AUXKBA - #winkezhy
Promocode: AYKDKR - #shoako
Promocode: AYRKDD - #paket
Promocode: BDDGUU - #capsave
Promocode: BFZBNW - #xxxwl
Promocode: BHUPAQ - #suuss
Promocode: BHXTIT - #danyacollector
Promocode: BNOYZW - #yakura3
Promocode: BQYVCR - #bag1kq
Promocode: BRGLTA - #reger
Promocode: BSXBDF - #shoako
Promocode: BVGYXR - #mastercard
Promocode: BZQCRL - #kauuis
Promocode: CCSIJB - #nuvarish
Promocode: CFQKOZ - #kup1donlove3
Promocode: CQVKNY - #katsuro
Promocode: CUFYLR - #reger
Promocode: CVXNUU - #topsork
Promocode: CWXTYT - #lanrock
Promocode: DAXYOR - #shara
Promocode: DBKTHV - #paket
Promocode: DEEJEF - #PeniSnakeYE
Promocode: DHAJDV - #baron
Promocode: DJJNFU - #secretname
Promocode: DQNRAF - #kashenko
Promocode: DVSTSJ - #inferno
Promocode: DWZSYP - #prostofilya
Promocode: DXAFHN - #bakaporken
Promocode: DZVWPQ - #danyacollector
Promocode: EBITRT - #cryptomafiozi
Promocode: ECOMVZ - #monument
Promocode: EINMJO - #scamgodcitadel
Promocode: ELCDVU - #danyacollector
Promocode: ENBZDV - #feii
Promocode: ENGLDF - #scamgodcitadel
Promocode: EVYKCU - #shoako
Promocode: EZRGUP - #kase
Promocode: FBOSQM - #paket
Promocode: FCUARV - #M3TA
Promocode: FDNKMI - #asfixxgg
Promocode: FFXLLB - #PeniSnakeYE
Promocode: FUTLYM - #danyacollector
Promocode: FVTECN - #topsork
Promocode: FXAZZA - #Парс
Promocode: FXVUST - #tagtagtag
Promocode: GACASH - #d1ma
Promocode: GHVOAK - #dark17
Promocode: GIQEIP - #PowerParker
Promocode: GMQHAI - #danyacollector
Promocode: GTAJTO - #kase
Promocode: GUITOL - #yakura3
Promocode: GVAWVM - #paket
Promocode: GXHNKY - #federal
Promocode: HEZAQE - #Otec66
Promocode: HNVJMN - #katsuro
Promocode: HPCVRA - #xxxwl
Promocode: HQCYUT - #katsuro
Promocode: HQDUOC - #danyacollector
Promocode: HTCFFG - #cryptomafiozi
Promocode: HUXKDI - #razorblade
Promocode: HWZYDV - #lykis
Promocode: HYVZVG - #rage4rage
Promocode: HZTIDS - #PowerParker
Promocode: IAEJWZ - #lanrock
Promocode: IGUPGS - #yakura3
Promocode: ILZSHA - #xylismotrish
Promocode: IQDOHD - #xxxwl
Promocode: ITNHWX - #paket
Promocode: IXINGY - #lanrock
Promocode: JBLQEB - #Парс
Promocode: JDRZRZ - #yakura3
Promocode: JGJYON - #katsuro
Promocode: JHNVXR - #pussyascamer
Promocode: JKDBVP - #katsuro
Promocode: JKYZBE - #lanrock
Promocode: JUIMTE - #besperdel3
Promocode: JXMXTO - #paket
Promocode: JYBEGI - #tolstosum
Promocode: KFEKTS - #goxchief
Promocode: KFLDXF - #jazzzex
Promocode: KNPSTN - #danyacollector
Promocode: KRRIUZ - #pussyascamer
Promocode: KSONTC - #topsork
Promocode: KWAPPP - #outburst
Promocode: KZQECZ - #unxknown
Promocode: LGQWDY - #schye
Promocode: LHQAWB - #palach
Promocode: LSTBIX - #Itachi
Promocode: LWEYFZ - #federal
Promocode: MBJDBD - #cryptomafiozi
Promocode: MDPBYP - #dark17
Promocode: MGOTDE - #wpgbrww
Promocode: MKCTDL - #tolstosum
Promocode: MKSRST - #sykkub
Promocode: MMIWIN - #Instress
Promocode: MNRBXW - #besperdel3
Promocode: MTUOPP - #yakura3
Promocode: MUHQNS - #kauuis
Promocode: MXLGJB - #monument
Promocode: NADVZO - #wiixom
Promocode: NBARWI - #В159РУ
Promocode: NCWTMY - #kashenko
Promocode: NEDEDR - #capsave
Promocode: NNRCQZ - #dvdd
Promocode: NONEH - NONE (no worker)
Promocode: NUHLSA - #Instress
Promocode: NUHMGZ - #outlaw
Promocode: NUOYTL - #kashenko
Promocode: NVFTHS - #kup1donlove3
Promocode: NZJQTD - #paket
Promocode: OANIPD - #kashenko
Promocode: OBNHBO - #prostofilya
Promocode: OGKFKK - #Парс
Promocode: OHBPEJ - #PowerParker
Promocode: OILOBD - #yakura3
Promocode: OIWYOA - #Kokutim
Promocode: OIXCYE - #paket
Promocode: OJUMMD - #razorblade
Promocode: OMIDUK - #trip
Promocode: OPHMTQ - #tolstosum
Promocode: OQOQHQ - #nuvarish
Promocode: OWUJHR - #reger
Promocode: OXCBKO - #PowerParker
Promocode: OXMKJZ - #Instress
Promocode: OZAJWP - #kup1donlove3
Promocode: PKXWTA - #cryptomafiozi
Promocode: PVFTQB - #kkndkm
Promocode: PVHZCU - #lanrock
Promocode: PZLROO - #kauuis
Promocode: QHZQHS - #M3TA
Promocode: QKWUGE - #anon
Promocode: QMFVPS - #kashenko
Promocode: QPFOVJ - #suuss
Promocode: QSFMBH - #metamorphos1s
Promocode: QSOHJD - #pussyascamer
Promocode: QVULSJ - #danyacollector
Promocode: QXFUAF - #Reqquid
Promocode: QXISON - #dark17
Promocode: RERFJY - #monument
Promocode: RHKRIG - #prostofilya
Promocode: RJAZSK - #tolstosum
Promocode: RKDPEY - #danyacollector
Promocode: RLUHKN - #tolstosum
Promocode: RMXDBH - #bastard
Promocode: RTEHAN - #yung
Promocode: RXIOGQ - #kase
Promocode: RZPDMP - #sykkub
Promocode: SDDLNO - #topsork
Promocode: SGJDCJ - #chppp
Promocode: SQQDUM - #kashenko
Promocode: SSBDKF - #Itachi
Promocode: STPVJO - #Парс
Promocode: SXOOPM - #shoako
Promocode: T3ST1D - #lanrock
Promocode: TLAAKS - #stas228aye
Promocode: TMOSLW - #reger
Promocode: TNCZYB - #PowerParker
Promocode: TUGHAU - #inferno
Promocode: UCCJZF - #kauuis
Promocode: UDHKFB - #aleks9250
Promocode: UESNNJ - #tolstosum
Promocode: UJMNMY - #secretname
Promocode: ULUGUP - #tolstosum
Promocode: UNXQCO - #dark17
Promocode: UPCRFB - #Instress
Promocode: UQGJCF - #Instress
Promocode: UZDTXF - #secretname
Promocode: VEHIYI - #1mlnfrme
Promocode: VEYRVE - #wiixom
Promocode: VHENUU - #tolstosum
Promocode: VIHLJV - #wiixom
Promocode: VJHEWG - #topsork
Promocode: VKJAZZ - #reger
Promocode: VLIQOU - #kase
Promocode: VQPHTQ - #lanrock
Promocode: VTQYZD - #shoako
Promocode: VXTJPI - #bakaporken
Promocode: VZMMAS - #prostofilya
Promocode: WBRSNC - #bastard
Promocode: WDGIRH - #glonk
Promocode: WFLNSM - #pussyascamer
Promocode: WFNLIG - #Парс
Promocode: WHXWYA - #monument
Promocode: WKIBPH - #capsave
Promocode: WNUQRX - #tolstosum
Promocode: WQKFUD - #reger
Promocode: WURPFP - #topsork
Promocode: WWRBHG - #M3TA
Promocode: WZLVTC - #marvindead
Promocode: XBWMOX - #monument
Promocode: XFTOSZ - #scamgodcitadel
Promocode: XFXAGA - #PeniSnakeYE
Promocode: XGGOAT - #danyacollector
Promocode: XJOAIX - #wiixom
Promocode: XKWAJO - #suuss
Promocode: XLAGOR - #shoako
Promocode: XMDNIZ - #lanrock
Promocode: XQUSTF - #Instress
Promocode: XSGZSV - #yakura3
Promocode: XSYWLS - #1mlnfrme
Promocode: XTVWFQ - #dungeonmaster
Promocode: XZLOOV - #qud3t
Promocode: YBWCOT - #xxxwl
Promocode: YDAGEJ - #Instress
Promocode: YEDGMN - #Itachi
Promocode: YFTJMI - #shoako
Promocode: YJRROA - #xylismotrish
Promocode: YMYNDX - #tolstosum
Promocode: YODBDC - #1mlnfrme
Promocode: YQDDJB - #palach
Promocode: YSVTGN - #rage4rage
Promocode: ZDGQKB - #paracetamol
Promocode: ZEFXTJ - #prostofilya
Promocode: ZGVOCC - #guessmoney
Promocode: ZHOHQY - #unxknown
Promocode: ZHTHDI - #paket
Promocode: ZIFVWL - #1mlnfrme
Promocode: ZNXRVZ - #paket
Promocode: ZRWRVV - #PeniSnakeYE
Promocode: ZUHBEK - #kauuis
Promocode: ZVJXCG - #Instress
Promocode: ZWTDNQ - #yakura3

List of some of the workers:

https://x.com/TemphestZokio
https://x.com/adrianaleortega
https://x.com/helloimthathume
https://x.com/BarkarBaskar
https://x.com/xGeeny_eth
https://x.com/BENJI_ETH95
https://x.com/milesdecimus
https://x.com/JudithKullah
https://x.com/reallydoeBTC

https://bsky.app/profile/v4xom.bsky.social
https://bsky.app/profile/ttdigital.bsky.social
https://bsky.app/profile/agathedavray.bsky.social
https://bsky.app/profile/techstorm.bsky.social
https://bsky.app/profile/0xshibo.bsky.social
https://bsky.app/profile/benji95.bsky.social
https://bsky.app/profile/bitkitty3.bsky.social
https://bsky.app/profile/winomes.bsky.social
https://bsky.app/profile/cryptowalkerye.bsky.social
https://bsky.app/profile/laraeth.bsky.social
https://bsky.app/profile/shwagzs.bsky.social
https://bsky.app/profile/jasperchain.bsky.social
https://bsky.app/profile/cryptowalkerye.bsky.social
https://bsky.app/profile/mc2021.bsky.social
https://bsky.app/profile/bitkitty3.bsky.social
https://bsky.app/profile/shwagznft.bsky.social
https://bsky.app/profile/toolegitcrypto.bsky.social

CryptoLove September launchers:

f032a4c2e9b87c74294e05b839a29a47cbc546bac2999dd59fd9adc4ac4f22ff
7b5a81dd13644bf2217c6f1a4f7222fad70dd103296e30a382a667a4696416f7
52ea6446112f715ab84f77647b85307015b0856428cf1349eb856a12a2eefbc0
5698304aacd1b2da4987aa896a835c8fa111d11bb113310c7c104e0fea78c118
8e83027468093aa6c1c166ec37dcc6c64191152a1083e2d29c95080c44ab63b0
142a6fb9ddebcde7553d8f2b23a67c61641f373bc855c7346ecf87f6855054fc
5935b75de4060df46e8c17d587937a1315fb2292d9b1b518a870d652aac52e0d
98d9314bcb22355a99d7f843f3b264ba590ced4b4de0a9ce386934b466420b7e
41a9507322d5c7d3d3fa2cfb4ba872ab39fb8b3fb43a69becc46fe1d8db926fa
3784fc39dc5c0dec08ad0a49bbbb990359e313a9fa87e6842fd67ed7cc1c0baa
61ed00dbcf9d405da13c01311dd8fd39d62cd6ab3d19c486721d0ed056ca7562
99761ef16e32792133fca6cda9abb42dffe63838711a42bb3a2b599b4642e541
28ad6585595b0fb9616c0cca701b05e11aa1d7ac6d18888c265aa4139c531bb4
a0b507100114a9184575bbe83b01016371cff807d17645cd4c92aa7ec1ef329d
e9180a1c77086084d30e3316a7afd999fa26a5c02cad61793fd85a9e9f3314f8
bbcaa568daeebcdf94259b0f5c4c4a254531cb63185c8cd0a1b7c8330f1d05a7
fcc44f73eab23955a4692240fb71545ae401c4bff669cfb7a53973418ce89dd3
2164779c29daaafa9cf27df914279476d212dad9a35aae32a8c3cd6bc59be85f
e45be056a92a5e20b9cdd997b2acabf092a33999954c5ff224414910feaae8b7
4515605287cc4f0d13511749b1bf2cf07470d9ca8f48355e011ebac960b5ede7
70facacff8ac4aaab48006c2dd57b1543b428f4c783ffbaee6f65e812a756980
e07a495cc5661c472faf177e1031fd31dacf7916885664236d144dc7d31fb5ce
28b7cf8913bffd7f08d943c6484f39c1eea8d23db36d8570a2cc2f47d00aec56
83bdbfc4072bf6e903e0f77944676c0bd73d13376b66f99f847e33e89fcbb8c4
5407eafb8fa1eeb57a828563c87ee75d9d747d535e846dc324a24e616256d509
950cf82596ab0080e0b751b489a134b92f85df633d4a2016f7e296f57af55435
453168e2671b17798a90dfb2926ab54ee03a2a0dd44fbe7fe98e657a155f21cc
1ade0800070c4ec3219c2249161b1c01a17efdba5285dd6e462c16938481897b
e576e14177ae08f93dd14f240cd0903b39b9c65a78b7c3f8ad2ac3fa1d232487
d388566fa25f7f0c4ede9eede268b3b027daba62d2319c315d39374358037c24
7d09c0ed15a20f9b88848729aff0cfd575999a229ea1dc4cf2722a75a5bb0f97
2fc0fb4f71399f85680dd803fb017a00696e6e4261f90ce98dea61e49cbec0c2
2fc0fb4f71399f85680dd803fb017a00696e6e4261f90ce98dea61e49cbec0c2
9945748c39397a25611602bfe5cab2f6cdd2d37753c64e4fab13536639196315
36d4117dc4673677b002f6ec4e8885497c2c74491a180244d1a4b86b183d79e2
330306b814f5c4bf575a3991cc94e46705fb6e75a962c6e03ad0fbeedc33c39e
d88560b743139a5f4cd3b06c08fb8c7c1ee54e62155e789898a796cf83ae49b3
c31d00a21d5fd171f6fe0dd66e9239a68d29816d80d3a5bda527822c01224a1b
8ac4c52f6bd1b3baf8d728322b4bd5fc1872a31aaa12bbec34dba40b84df26cd
d81be651a8fdecafec3a4e5d572afe6d6e6d066c6adcaecc063a7855bccf6fdd
5ef23bc34a60f6a007c742725982ba7ac47703fb232757b248655e66103a5011
b1733e0795d0eb508e3c7619b84ff3122455e5350f3d0e566f551e64b31c3efc
e1dbec1fea6f0197ac5d3b33dbfd50ce7e2918c9930ed9e9bee16e2f576a2875
b966428056fbf13e8c0684e477c0ed6fd3b742762eac490b3beca8224e342927
88b3a66468e167b661b9615e6eda101f4cea6c697deb430dfbc274ef946c2922
e1dc6f86bec37d4203e3ffe6bcfbba3eae9c07618770b2703e294f4a33846422
2ece236d20e247dcc0c2916ad5421382909c26be739d51cfaae225f2669b38fb
c217b606e59b4cdbfd27e2cd6b36ccdd1a0cface658f84616c8c16e5beb2056a
ddb387a39987d3ce5ed24efce1b0200f78503be9eee88dde8374d2f2856a6eaa
23a3695e4fe73fedc68efcc823e5e47f764289ec0d4c2cd7d2f110a843ff13b0
4a0b1027b7c25e72202554597d63a1179ffc8e7d7d89cccecc170e528d2ed384
510449debf7951f96cc0bd045d7a4acabd5fe67d08f7da353614849a9e3391dd
45671a0636dd487c9685e057bf3b99a8528ec61dc5e7fb11f2591abcd4f1ef20
d5af181efbfc4d5e27101e25de4d4b830fb8fa74da00a8e9d627159f4b666a88
af409567e3cb0fdc0f0128544e7ca0f4b67d8822c5d35af062b49aa62810b42e
50d4e1cc466d3e02b48f03b6a419f60c665ce5cef6b6db6878641609d2a46212
de46c5a772df95645f099ab018a7b5295efd3e3a74524eb838186ed83d73bb35
a9ae230f0f2ebc824c5dc2d5f0e9cb506bf55954363a20e732079f25a9e7a126
64a60daadc7aedf35b4bc55eda866768157cac145374e9ba07ceef352fc27eb0
d18e67d049d8ab7db0e9c0a0e2a0836bfaa77df8f65b7e52d81730725459538d
9aaad769641d5d61e525e5ca416c22826f77909d73ec81b60c1d167df652cac1
949b7ee06e3e00da6bd725f964f0ca5a12a15ce38334e6c0274a7eed977bf8dc
2167ffb63b19e68e09ffe24725c066708c96edeea92a643ac04b01726bbd5fc2
2d9e237d85562d8236fe5cbd6f154267ca04816353f3a5d6e1d9fd2e6e1ad6b8
8d47b54669ef008d3b310418ff9ef640dd456997c35e9d7356d649e2572c57a1

CryptoLove October launchers:

2d003e2d1efc8092df19c285257262cb769c98cde02f984ac8ef1c7cd7a62ed8
84f58a55fcc5a444563b294bd0c8cfc321b8989dc4ceded869a846b665454ed3
a2ddde9e5f90ed6af941572a4363eddd78d1680e080fca9612c595aa0ab90961
a2ddde9e5f90ed6af941572a4363eddd78d1680e080fca9612c595aa0ab90961
12a74893cc9da4f84c616c63a0c2abbf6d1aebd6aa968a9e682916979451695f
2d003e2d1efc8092df19c285257262cb769c98cde02f984ac8ef1c7cd7a62ed8
24acaada01211613c0eb1888805cec607d7c6228e30d3c50a9a477ef1e223393
24acaada01211613c0eb1888805cec607d7c6228e30d3c50a9a477ef1e223393
ad62a16c290a03c72cbe494aa3db539a5c20ed66a5b0dc7047e75a5e6d979831
eaff229c984a63d18be5755c79fc30863e73378a236a2c6efcac98260a6702bf
f708a94d605cc2b5b3da6876ef9b3022304b67ee8262353e3a098436c2084709
1c27bf57ec4d5e057efecc730a379e17ed1081c8e09caa870ab412baed65e622
1c27bf57ec4d5e057efecc730a379e17ed1081c8e09caa870ab412baed65e622
1024515949aded6e99ecf92f997be15af7901cdba4f772fae70aeb8511591f60
b238a4fcbae1ac0c0b22605f2836de9c271d14c9fc60f2c9ecafc78b8cbe2d0a
2d003e2d1efc8092df19c285257262cb769c98cde02f984ac8ef1c7cd7a62ed8
b64f848ef44feea84e7a21f1a917bb5f86310c6f064e9d6d3b2edd5bf1a5c940
7bfaaa5039449f4930f4c298b7a31e66fd89f0a3afdc3701be985319175aaf3d
bdbe95f2da3aa529248d5e495cb3bd45b8296811cb3bff9551a29200eefc3d0f
be49f2ec1df1193acd677d1bcb55c8dcfccb59a1b18ea3fb074e70f7293b1e0f
c6bd2084c6b413d14f2bcd8345f60e027b4cee05d6c33b305ac8a1c2ae0d51d0
add72434d77bf44ad68b9e229a5fd06eb7fbeedfd91f33b6958d207c3be2b8b3
add72434d77bf44ad68b9e229a5fd06eb7fbeedfd91f33b6958d207c3be2b8b3
d774014c62fe13d05fe4f059c4f249522a3f768cf0d3fe9cb6804ae627734099
8c2716aa5d68fb60f5c30b94c7af399813b84bd754d0548c29a33d9d7c8cd7b2
0e78afc201c29489b5cb85b9aacc09d27d37a7ee63f78cd62483eaa1912f7650
0e78afc201c29489b5cb85b9aacc09d27d37a7ee63f78cd62483eaa1912f7650
1ede1c4d24715e39fe61f5d1328802ce88806e0e3478b775cbda0add8e71bb7f
5cccba0779b6a1da25e4253a99fda38116f8699bf222cbf0241467540693a399
5cccba0779b6a1da25e4253a99fda38116f8699bf222cbf0241467540693a399
42fd2c3552cb54c663b1fa9657c1e899162388472901c763ee531dbd5fb5d907
42fd2c3552cb54c663b1fa9657c1e899162388472901c763ee531dbd5fb5d907
99f93b17686b626a384538ca6cc2aa9c168759a32d3d33f35bcff1404333209a
410886ea6bf99516d643c0e36616c9deb1f0c5b4aeb56db5110de948d1377fe8
bd9482c3bb8eadf74115434eaad28f8f1ca412b57876958005ecc2129206a938
6200a3b21d763439774725488d444549f474de813509282f643de0633691fc3a
3ac709520dc29d6197655ce8d9f05c2bdcc465fd3fcb469dd96dffe445aca06c
2122ab43f4ddf64dac0010fd845df0e64685e6d108ac5bd5888e540b71ce294e
ab3dcba40e425212da2af8461eb3e4599e2080ba1fede2367afa2fdc0243f4ba
5204ce2a068c73b0d183e4bfcb884ab815ac3700d7f8a9f602bd7292b2478b00
b66d42ce56c98dd57694a08b43edbe4f8bec5b712adab83528b427e9caa00cf1
de5c24cb801b7cbdca4bb160c66568dd5d1cedb8313b27f245daf0b70e278b8a
88d3c5bd818f326ec9ad529a5a68c7c3bfdf238347d9237e95ce0f94b4be0936
950bdd54cfd0e37a1a0d3237571e022bdfd93a084b499aa6bb4a88a84bbd5407
14f232b80a377d209d081a9a97e5d866a16efc658f7d60ad84df0a322f7d688e
917169a53a05abd36ac3fa6a82477d8695f8cff015a298181b7fdf69fa1dff9a
bc1ca6b1d41bc3c03dbb207ebcc9482f42d892c4b418cf214e0e0b9d27b27fb5
d7def07071f2c7f102b366edd1aa16b38493f1dcdac6d79bcedc03a46e029a47
12be9292bf16c925f5e7cfbbbad872951b32b211f8e415dd77098c986803db32
7d3eb3ebf741ddce837ba938bee916115ede43dced07e5dde2a47e1fe16ce4ac
d0b4530a3a4c2afc9ccd0ce2a083d488edfb0da3ade37e3723fdc57801962438
d0b4530a3a4c2afc9ccd0ce2a083d488edfb0da3ade37e3723fdc57801962438
089a0058704ca979dc23107286630a3babcb229a0585a412f0dd7b6787660c5a
09438968b47ee753579a8a2a672568331a77aa5c822bea98e9c6972bccb436b2
09438968b47ee753579a8a2a672568331a77aa5c822bea98e9c6972bccb436b2
cb2fcd94951a895045770bd0f2773a5372ceba134d055e4ea022cd49965cce89
bb3ec5c222bc11cc2a006d2a0120db484abdb4405b4d00915074c081923683bd
5b39fd79b48fab451043af8895852f9527c6fe40fda34d7eb3fed8f2c9203290
bafa791829d800325f1a502fc8344d85e3b5e9ab30f913d35f37b45d75009825
bafa791829d800325f1a502fc8344d85e3b5e9ab30f913d35f37b45d75009825
9c2971d7e9f9ec535b13def1faa1d1eb39443d4f476d5c7c34a6b3b305c5a1f8
cc4565ccfe0ad03adf8849a5414fd773a77646f0a8a938dc7ed9bf1f27b52ac0
cc4565ccfe0ad03adf8849a5414fd773a77646f0a8a938dc7ed9bf1f27b52ac0
d86330dfd59a802d78a10077563e5348d7fe0f9b65766132c2434569facbeb85
8058c42f83c34b7d075fc96dea2a9414feff86a2757e99ca2dd7e0c9f4527c05
b390300b26d305f9eaf01b8a53e19052fc4bf4c8ddd2708bc4eac7af693208e7
b81fcff0d0a37f91ad48a966ef7e2808a4239651aa709def9b0411a4da4186da
b81fcff0d0a37f91ad48a966ef7e2808a4239651aa709def9b0411a4da4186da
c77342488b91830331a9dfb5a42bd7a02e65a53c76df62c2809953fe068e1789
cc92b982056919e07d6dbb064ca6e4ca2ca8bd0a09a79f21e334cb96f73298b3
0f120dd5a12f02744a6411b0e2a478de2b0341102eb91dec69c426c079577c84
15c30982628f4e8884d28066ba7ce7e4eb6c02ddfa8d33a9bc1c0581a0849516
b474c10e5c7884f556148d4a73e870cee25509c512ca049260293f05b3428388
ac135c043972a99c2055a9957a7f43a3baa4bf52062139836d5a591edf901e4b
afb772cc2c79e652f0b75a8f3fda483be36f66d8cca47f10d4aad2a69d05371f
ad35a9f7af14734c1c71b13d5382d422f11160e7280d1fc0fd4acc0ce0ef916d
969b1c156305c4ddb23abbf319faaa074170b2abfbb47e2b16380ac845e9415d
384adb027a1ef70bd59d6f59572d8226d44914f51e8d616c9d616f4dfe620fb5
70ba8b9538fcc02f25e04eb18928394404b3c8d9fb717ae926110fa30312c909
cc9ea9aac9aacf3e8218c8d55678acca7c0ba0941360a790cc3a39c3bf2a9dba
f92bf4f61ee194b424b4ba0930d85922633a96cdc06c5e4c1f96bc9c953bae24
28be318e0f7f548e36d05875680bcb6ef13e920f75e3534ddb2b888944da7ac0
428a5027197c2c24f5e115fa95868af9680af5c424f46fad6703782331db3877
3c0bd989c52d54661c841385f2483171054f9369a996d193f8042a8bd18952d8
3c0bd989c52d54661c841385f2483171054f9369a996d193f8042a8bd18952d8
3c0bd989c52d54661c841385f2483171054f9369a996d193f8042a8bd18952d8

PE loaders:

a66b1738e5944d8117df8a6ac027a152de4759623e489422415b33cae25d8479
6b6648c129917fbd5769749952d6dc47623daec0eb509d585140307f9611e99b
2b8625f76bade3b023cabb5b166cc9f768c3bf9185d94173465c85610a935d79
10c3f8d1e213c640975f4e05b84c44eca992d9a04c55fe1b6e4656d4b1af5ba1
7a866d41e2e5fbe3b8c2371d34094ed417c8de072db9f89b1c310f7eea701905

Launcher IOCs:

http://xilloolli.com/api.php
http://xilloolli.com/api-debug.php
https://cdn-gravitiumgame.xyz/launcher.exe
oklibed.com

StealC:

46.8.237.122

Rhadamanthys:

hxxps://95.182.97.106:5980/363881569c00eea8aaf3/pmgoamua.jpbdq

LummaC2:

pull-trucker.​sbs
faintbl0w.​sbs
shootyprovedn.​biz
300snails.​sbs
crib-endanger.​sbs
fleez-inc.​sbs
3xc1aimbl0w.​sbs
thicktoys.​sbs
bored-light.​sbs

November loader:

723c731b3265cfe3960502219316bc13f4cd9929df507930a7e5010d4ada4e92
a7edb703c4bd8a33434d18b72fd1e718608a9a99b8b30d35add27c609bd24c0e
360a405b8eb0b6e748aafabf6db25e6b7137d2dce791d61c64f37f596df7bd6f

November Payloads URLs:

hxxp://77.105.166.229/second
hxxp://77.105.166.229/first