{
  "source": "https://vojtechhron.dev/en/ioc",
  "exported_at": "2026-08-26T13:32:27.831Z",
  "count": 31,
  "analyses": [
    {
      "slug": "psyduck",
      "title": "Psyduck - PowerShell RAT",
      "url": "https://vojtechhron.dev/en/article/psyduck",
      "indicators": [
        {
          "group": "Hashes",
          "type": "Phase 1 (dropper) / SHA-256",
          "value": "feb46ecf8212f3d6d43afff5ff37558a97486ebea72059ea03b29b53f42ed23c"
        },
        {
          "group": "Hashes",
          "type": "Phase 2 (Psyduck) / SHA-256",
          "value": "6f732fbbcbce8f4af84d65d6f016113819e3de4616e1b644b3d4c2086fdabe09"
        },
        {
          "group": "Network",
          "type": "C2 domain",
          "value": "duck12.dynuddns.net"
        },
        {
          "group": "Network",
          "type": "C2 port",
          "value": "1234"
        },
        {
          "group": "Network",
          "type": "C2 protocol",
          "value": "HTTP"
        },
        {
          "group": "Network",
          "type": "C2 endpoint",
          "value": "/Vre"
        },
        {
          "group": "Network",
          "type": "C2 endpoint",
          "value": "/AW"
        },
        {
          "group": "Network",
          "type": "C2 endpoint",
          "value": "/SS"
        },
        {
          "group": "Network",
          "type": "C2 endpoint",
          "value": "/CF"
        },
        {
          "group": "Network",
          "type": "C2 endpoint",
          "value": "/DF"
        },
        {
          "group": "Network",
          "type": "C2 endpoint",
          "value": "/DR"
        },
        {
          "group": "Network",
          "type": "External IP lookup service",
          "value": "https://icanhazip.com"
        },
        {
          "group": "Host",
          "type": "Temporary created file",
          "value": "%TEMP%\\agent_1781054578.ps1"
        },
        {
          "group": "Host",
          "type": "Saved executable filename",
          "value": "%TEMP%\\ce.exe (CK command)"
        },
        {
          "group": "Host",
          "type": "Saved executable filename",
          "value": "%TEMP%\\update.exe (/DLF default)"
        },
        {
          "group": "Host",
          "type": "Global mutex name",
          "value": "Global\\677d95b1-c2a4-4c21-a54f-874ddf08e8c9"
        },
        {
          "group": "Host",
          "type": "Victim unique ID prefix",
          "value": "app_"
        },
        {
          "group": "Host",
          "type": "C2 command delimiter",
          "value": "|V|"
        },
        {
          "group": "Host",
          "type": "Masquerade string",
          "value": "Apex Monitoring Co Fleet Monitor Agent"
        },
        {
          "group": "Behavior",
          "type": "User-Agent pattern",
          "value": "app_<random>\\<hostname>\\<user>\\<OS>\\<AV>\\<UAC>\\<.NET>\\<exclusions>\\<window>"
        },
        {
          "group": "Behavior",
          "type": "Execution Policy bypass parameter",
          "value": "-ep bypass"
        },
        {
          "group": "Behavior",
          "type": "Hidden execution parameter",
          "value": "-WindowStyle Hidden"
        },
        {
          "group": "Behavior",
          "type": "WMI namespace and class",
          "value": "root/SecurityCenter2: AntiVirusProduct"
        },
        {
          "group": "Behavior",
          "type": "Registry key read",
          "value": "HKLM:\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Policies\\System (ConsentPromptBehaviorAdmin)"
        }
      ]
    },
    {
      "slug": "cloudflare-malware",
      "title": "Analysis of a Fake Cloudflare Authentication and a macOS Infostealer",
      "url": "https://vojtechhron.dev/en/article/cloudflare-malware",
      "indicators": [
        {
          "group": "Files and paths",
          "type": "",
          "value": "/tmp/alego.zip"
        },
        {
          "group": "Files and paths",
          "type": "",
          "value": "/tmp/stravy/"
        },
        {
          "group": "Files and paths",
          "type": "",
          "value": "~/.pwd"
        },
        {
          "group": "Files and paths",
          "type": "",
          "value": "~/.username"
        },
        {
          "group": "Network",
          "type": "",
          "value": "uterimoxis.com"
        },
        {
          "group": "Network",
          "type": "",
          "value": "mekoilsuharum.com"
        },
        {
          "group": "Processes / Behavior",
          "type": "",
          "value": "AppleScript dialog titled “macOS Protection Service” requesting the system password"
        }
      ]
    }
  ]
}