Skip to content

Instantly share code, notes, and snippets.

@kirk-sayre-work

kirk-sayre-work/gist:1dd6e5b08cf168a9b5f9281ce5c37ebb

Created December 19, 2023 21:22
Show Gist options
  • Save kirk-sayre-work/1dd6e5b08cf168a9b5f9281ce5c37ebb to your computer and use it in GitHub Desktop.
Save kirk-sayre-work/1dd6e5b08cf168a9b5f9281ce5c37ebb to your computer and use it in GitHub Desktop.
Download ZIP
Gaameradon Word/VBS IOCs 12/19/2023
Raw
gistfile1.txt
Gaameradon Word/VBS IOCs 12/19/2023
Word VBS Dropper Samples:
0d5ac615c2ed6b9082a31d8bf972354ac207a314619a34d84b3e6365f33278ec
d4670935070941c60f39fbf58318574139262a4830e1f14e30144929b445dbd1
e06ab88a57c9fb5c32a12cdfcfc4945f00f4992cf715b1ef051835f39d1ff6d1
67e83344af4e3adaebbd81438b367175107e3985af48847ff49842d034bb439d
f8728139fc099387abf6a6ad92614ea82d3eeace122e347266dfaf941ba05736
6956804df2c6463d8bd049c5b0d462f92981f343800bb20b6d39d8e8b80093bc
aa97df6479143e3022802b2b08bee046145eb51dda24d15b48303ef704f8f44a
Dropped VBS Samples:
SHA256: 3003be914ed161d8e020493c9f2cfa148d16f782f7724718a85bfcc71c411071
Example 2nd Stage URL: http://50desired.barentsot.ru/inch50/incredible.fits
Base 2nd Stage Domain Name: desired.barentsot.ru
SHA256: f8728139fc099387abf6a6ad92614ea82d3eeace122e347266dfaf941ba05736
Example 2nd Stage URL: http://21deception.fatuamos.ru/innumerable21/infinite.pl1
Base 2nd Stage Domain Name: deception.fatuamos.ru
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment