{
  "source": "https://vojtechhron.dev/cs/ioc",
  "exported_at": "2026-08-26T13:33:30.871Z",
  "count": 31,
  "analyses": [
    {
      "slug": "psyduck",
      "title": "Psyduck - PowerShell RAT ",
      "url": "https://vojtechhron.dev/cs/article/psyduck",
      "indicators": [
        {
          "group": "Hashe",
          "type": "Fáze 1 (dropper) / SHA-256",
          "value": "feb46ecf8212f3d6d43afff5ff37558a97486ebea72059ea03b29b53f42ed23c"
        },
        {
          "group": "Hashe",
          "type": "Fáze 2 (Psyduck) / SHA-256",
          "value": "6f732fbbcbce8f4af84d65d6f016113819e3de4616e1b644b3d4c2086fdabe09"
        },
        {
          "group": "Síť",
          "type": "C2 doména",
          "value": "duck12.dynuddns.net"
        },
        {
          "group": "Síť",
          "type": "C2 port",
          "value": "1234"
        },
        {
          "group": "Síť",
          "type": "C2 protokol",
          "value": "HTTP"
        },
        {
          "group": "Síť",
          "type": "C2 endpoint",
          "value": "/Vre"
        },
        {
          "group": "Síť",
          "type": "C2 endpoint",
          "value": "/AW"
        },
        {
          "group": "Síť",
          "type": "C2 endpoint",
          "value": "/SS"
        },
        {
          "group": "Síť",
          "type": "C2 endpoint",
          "value": "/CF"
        },
        {
          "group": "Síť",
          "type": "C2 endpoint",
          "value": "/DF"
        },
        {
          "group": "Síť",
          "type": "C2 endpoint",
          "value": "/DR"
        },
        {
          "group": "Síť",
          "type": "Externí služba pro zjištění IP",
          "value": "https://icanhazip.com"
        },
        {
          "group": "Host",
          "type": "Dočasný vytvořený soubor",
          "value": "%TEMP%\\agent_1781054578.ps1"
        },
        {
          "group": "Host",
          "type": "Název uloženého spustitelného souboru",
          "value": "%TEMP%\\ce.exe (CK command)"
        },
        {
          "group": "Host",
          "type": "Název uloženého spustitelného souboru",
          "value": "%TEMP%\\update.exe (/DLF default)"
        },
        {
          "group": "Host",
          "type": "Název globálního mutexu",
          "value": "Global\\677d95b1-c2a4-4c21-a54f-874ddf08e8c9"
        },
        {
          "group": "Host",
          "type": "Prefix unikátního ID oběti",
          "value": "app_"
        },
        {
          "group": "Host",
          "type": "Oddělovač C2 příkazů",
          "value": "|V|"
        },
        {
          "group": "Host",
          "type": "Řetězec používaný pro maškarádu",
          "value": "Apex Monitoring Co Fleet Monitor Agent"
        },
        {
          "group": "Chování",
          "type": "Vzor User-Agent",
          "value": "app_<random>\\<hostname>\\<user>\\<OS>\\<AV>\\<UAC>\\<.NET>\\<exclusions>\\<window>"
        },
        {
          "group": "Chování",
          "type": "Parametr pro obejití Execution Policy",
          "value": "-ep bypass"
        },
        {
          "group": "Chování",
          "type": "Parametr skrytého spuštění",
          "value": "-WindowStyle Hidden"
        },
        {
          "group": "Chování",
          "type": "WMI namespace a třída",
          "value": "root/SecurityCenter2: AntiVirusProduct"
        },
        {
          "group": "Chování",
          "type": "Čtení registry klíče",
          "value": "HKLM:\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Policies\\System (ConsentPromptBehaviorAdmin)"
        }
      ]
    },
    {
      "slug": "cloudflare-malware",
      "title": "Analýza falešného Cloudflare ověření a macOS Infostealeru",
      "url": "https://vojtechhron.dev/cs/article/cloudflare-malware",
      "indicators": [
        {
          "group": "Soubory a cesty",
          "type": "",
          "value": "/tmp/alego.zip"
        },
        {
          "group": "Soubory a cesty",
          "type": "",
          "value": "/tmp/stravy/"
        },
        {
          "group": "Soubory a cesty",
          "type": "",
          "value": "~/.pwd"
        },
        {
          "group": "Soubory a cesty",
          "type": "",
          "value": "~/.username"
        },
        {
          "group": "Síť",
          "type": "",
          "value": "uterimoxis.com"
        },
        {
          "group": "Síť",
          "type": "",
          "value": "mekoilsuharum.com"
        },
        {
          "group": "Procesy / chování",
          "type": "",
          "value": "AppleScript dialog s názvem „macOS Protection Service\" žádající o systémové heslo"
        }
      ]
    }
  ]
}