Earth Lamia Develops Custom Arsenal to Target Multiple Industries ================================================================= [Hacktool Rakshasa] 4598d35d789db350008c2307febe18859221923fe9f1fd2fa61bccc8eca8828e [Hacktool Kscan] 2fd5b4d1cb318b8cbd9c3a5df0ee0c248e8261a20f33110b221ae9cb8b1071ae [Hacktool Fscan] 5c74a6e283b679c9a2e1e8dc74b0ac301f5fa4bd2b37a6c3af2ba4015b34a780 62ba281147ceeefca5bd15f58ac52125bc42b0e134a6fcb4bd90efdae0fce318 78eed41cec221edd4ffed223f2fd2271a96224fd1173ed685c8c0b274fe93029 b26458a0b60f4af597433fb7eff7b949ca96e59330f4e4bb85005e8bbcfa4f59 e82ecbe3823046a27d8c39cc0a4acb498f415549946c9ff0e241838b34ed5a21 [Hacktool GodPotato] 3027a212272957298bf4d32505370fa63fb162d6a6a6ec091af9d7626317a858 d04904e32b5cb0f9b559855fac81d62c6ad0472dc443be02f08b6fe4a7d56f71 [Hacktool JuicyPotato] 0f56c703e9b7ddeb90646927bac05a5c6d95308c8e13b88e5d4f4b572423e036 1d0b246f8d43442ea0eaecde5cfa7fcd8139a9ba93496cd82a8ac056f7393bcf 5060bcd360683d43dcde43676d908d5d10b5310e71f16c42529b103b91818d57 95fb0944a2348f1e326b4ce65b04a5b62e1587d90c40d3bb505dc93f5f61295a b8c0d54f40d0c9deafa44860799a54a09c32cc795498bf0e9f2bef49fa056288 c04860e0ecce7d3a91c5358aecbafc495b2a9f0936dabf99db5f46457776687a [Hacktool Stowaway] a134f4f4a8d5efd1529dfe83ba1084083da36fd3e78963e1d5d127f7649acb24 ad7848c78cfb589190a1363ee25c6db47dd04a577300a4fbe829ce5b71f0ff39 d8e272f50e1d699870a74f8cbed06a9371212c208bcfa8b3c992a4744e84ed87 [BypassBoss] c87f7e0ae64e11ef755083bde6b756c695d07c6b89633f6fb66cd96214bcd502 [DLL sideloading loader] 0916166f5cf72e5869aeb75331a46f9bf978fa328b08e13ee356dd7b0b13afba 15a61d74ba86155e9d4636b9f081452a530b6766cc59e950d557a21eab96d60a 3c50d4953e0f695d8e2849546dd0a4a9b8d06b3ab3d70d32e4181ca7f8c58b1e d8364dc34ccece608beea861067fa31cae3f4ef0c3fcdf1804cc88d162c0ff15 edc9222aece9098ad636af351dd896ffee3360e487fda658062a9722edf02185 ffdb183742a3404c3756ba654ea8eb7983650cbf8fdc4e8a6514870e251f2915 [Cobalt Strike] 8e53784a8600a6e6fcb61cf9a363a49c44fd97bf22cfec2948728ec622d817fc [Vshell stager] 03bc25ae7222a8142e06629d22c62900e9cd2554ff7d2b9d8836125c6c4fea8c 7787eca1528144693930458282ee26c39508a9014152d36efa3b8645c188964c a4f8ffff81c13d2bc6ba5f0ded5ea31b73450ad1a0f42c592f1040d46263846a acbd2ed341e3dab5d7f258afc098ca86be9916bca6b9d2624557100164a4df2e bb6ab67ddbb74e7afb82bb063744a91f3fecf5fd0f453a179c0776727f6870c7 eb1df006c34463faf8325c52c2f132b62adaaff37afc0bd7ddf0274fa30e59d0 [Vshell] 037bda8a7e324e378720ff143ca1810b95c78e74062913e9bc588aac9aa55483 038712505c782f6de7fd435805db35cd806da5132bd7b2f2b16b0c430b800f65 1572c35417c425433d03477d8e02784739337db9c26df25c0e6b2aa0444c0668 1b4660133c2f2125b1013a3fa22de51d60176052d7c1487c09630fee5582298a 2629de99f35a283ad44e8fea20a3b536187c8babb24f18763429390f77144128 2a5e8e3d02de6f13195ac962862e37918fa7ab9aa14d8fbe3eb9f2fb217b9517 2a62393c3b2e97cdbd03181d4e4cf699d4511c56a1c9c4ed8ff122f05eb919cc 2ea8980002af5ace6c34408626ac56b424ea0a2504ccd0281e09d560e8e05276 367aa34601606f4f09a496dfeed1d301b8b76643f976ed02960d9e85cce38595 3e2f9c3b76c3b4d932783faeb7ab25cfed3edd939f58659e0aa92fd46a6b1111 411005c29ff637fa65d20a1ffcb6877663e8c73c0ec67b09a9648df9647930a8 538e5a536714c0db69b4bb1ea6df421299e75e8c0b2c4644992ebd022c98cd65 54b0949e3771e1b1dd7eabdbaf2acffe5e527edafc4a5ffa6aaeb0a6047479f1 56a00f3f589909783b72ca6fe40d898f45d9787e94f4291a008259ff0a18b12c 613985e6cb0783fa378100d464065c0cfab636230ed76994d9daed6b19af3be1 687ca3726ef5168cc4e27ebb560ba649ec4967e44d24806c620f5d1337afa46c 6d9b34bec276a1351ef46e63829237c7352a2e64118fe072a650979557b421b9 6ecd637ec715709a21ae05c3917e7b33cc35ce2b77700c938d16897fcd0cd8ea 7ab4710efc9cee29c4c17c2d7b367ee528ca3070835bc961eb8481f4ef010ee8 84f3b5432a437a8319d81556cceb857609d2c5c9a1e4eb8dab61f528db59e83c 8550677e8ca53235c5eda21401e75ab495e418877e71149d1ae0c3ce247c3124 92e82fe79025aa9e68cae7b734de8c840ec7c6dd439f17abefe69354d4a8bd6e b24316e81b6ebf954fab7a87a211554cde6986b239792610f8d234d05d2a2a1f b2850795bd5be0e6556e20fa10160585def005c2a5cd8df2c345a662714bd815 ba114a9b775ccf8215f80094d353b06b3a9fd32e22167e4e06ba986a738ec518 bce9616ed0d829a05ce7df6c1fb90895a93772eb438ed7b2cc35407c34031666 dc27e0fabdbad970519d354a83f8c4791d2311dedb9e7ed3cee2d0f52078f000 ff724631dba8abe354c8742f09d88821237632e36c305ba4f1132a95880dde67 [PULSEPACK HTTP] 029c5914cedf8e79a647ab69ac08b7ea662c7608ea80cd8c42d07f1d9fe84c9b 0323aca727e12cbb4c492e3339f64969e46b3d300465af8dcdaf0e881aae1d0d 0bc2ac5aa152fe7ebb4225f09f691f456631845eab2d71d548bdffed681af3b8 0f7148bd9e74527c9da1a5913a04ee1b4c1c4ea75cab57539e6781e617b9dab0 0fda765ed7aba6aa92dca681ab7e93160fcc5caaa0afae815d34e33fa647673a 160dd63c6c58bd2a958c6b9e01c873c4192b6a4533197d7b506e49a04c5aef1c 21a832ac4c538652416124106b307026d9a8abb943501ff2ce3a14d5fdf2c08b 263ee8e9f8fbdb95ca8afb642e990f66c41e194110a70765f2abf7257e0790e3 268c2b3286bb079ec6b047fe17321c7a98b24bf36c16598998de4fc48b6bedf9 3b7b0b7dabe9fe77797ef944121f611d6eb69716a15942c6b58998fbfd6b13d9 475e1a46141efb13bae2e935e61a8731d466a53c1268ca54cd7ba3815b002256 4b49ec2d58a5a2726bd3f8aea4cb876fd24be3f0f44b2c2a5fed61424a7b5f05 4e1c1f94358a6402c69cca010fc2829514aeb77d11b33561469f0d0fdf64f989 6aa6250bf821907b7a2927086e0f5b8d759a81c620a3cc7cc45023f734dbac70 900a9e65bab0c31cefb8e144e4d43052d1b0699d8df05b695bfe4b3275747d0f 9144c7df6fbae476a8f288bbe002a5f83bbd58826dcea2e851f66c25ca568034 94ba2a1b5360a6799546999d8c528a064ddf76126b4478df8973ffdada2fdd62 b905802b0e600f2988fb4d16eaa6eec65ed3c5b9735b79dd9a00dfa4d7abe65e ba65d71d06a8201d32edb98ca54149fb7662baac43d8ecd853c90d03f4320db0 c44d1a50eab5299fe20d742093df44a617eeee1e2e0a176bafd8ed95dd60c6c5 d3f0e0563269d23cfd1e54a16badd2e03d7826c364e2fb84ffe3d48b2a3738e9 e1e03d90eb8a65ed6d3b4ff16aed51443ecacba465ff1c96a6604c84b215fec8 [PULSEPACK WebSocket] 026bda0dd43bb9b1fa988803837582abd3265b33a6932a82724312ecc550e7ba 057782a338549fdb031b21b6cf4bccdfead95f0b97f439f18cef1485b2d17677 0cad360457a42c0408d4e7ed9f4f0faf3d96ec2320c2cdd11b53d82de85b5428 114465c38e51d9cd15b84f5c57afd2ca5427ef71ece73d592c0f92f5bb69b237 11bab07f4dd49504f15a0d7bd4c3d57bf93c67939a200fb34d70f18219984c38 160911c246a25cae17454901fb2d7fb31e20dd0f5c12cbf686ffe24510f22ede 183fd2afead8af67f7b7e52c052a906aa089b76f3a734137a9fe3e71ebb56f06 18cb28c5c7beae394111cf867b4e3cd8e154ab7c7f3d91016e0ead5d90009ee3 2301d1efbe6f2cccabad1583fc2d9846b34117159c8576e550a799e91d80d176 24a7ce118461c264bf797a4632e8b83b11c7f16c4c6836057284751bc33d20f8 266d2307216788fcf174735535193c77488435b3da5f9b3867e714d94ae1f4e3 2c067b470ab3802719ad65ef1e721a3850933c1a9ebf3e97303a3164effb6f63 2efd13442f109790bdd5e1b33f706e60501546eb06d15a2aa8226458bbbd315e 3264a6fae4613963e5b559c956d7d0d48041b6e873a5162f6f0a5f942b1b6215 34903b66d9035ab84878b4a058f99b86852d55c4b69f8e3254f6097f3d0b674f 36aa5dc6c23669821204c7d18a714e360cf0ea2b6e48175ba89c7bbb01a3a1bb 3b50605e11ff66a370a0a2f99ebc6df09d589d107735004862178f661e051ed8 3be0b7d41d9fedfcbf5dd8147640f1d12c5693936910fcc76d7af99243056b94 3bd969b1b078a20c5a43bb50e7fc035e9c4af41f0c735d07524f770c0fb0ed22 3c248c1fbc3a03da1acb32a7aa932b130db31251aaa5880b6b94dc7cc2423f8e 49c71b594ba808832900316af90ab7cac3e9af825d5b7a081244913c8fed849f 4e10dfd43a25bcf34c545371bbb579c1d7c14a5df6b0a0bf513e306f4a19f7e9 4e1c1f94358a6402c69cca010fc2829514aeb77d11b33561469f0d0fdf64f989 512ad96221ddc5bb90228b719ac2badb999e43c129aa759b3619ae6ffea49c73 52af32ab127d9956c598e926e20abfddeff28cf8f6271bc60ea21cc074def08f 53a26d5e2b1ee5d2a8261843c1fe0c68632d6686222f11177bee9c572c485005 57fe3bc7b7d4e2f8b10869d735c95f53d6a85bd59dacd26292c2d6a089fc36b4 608a5144ae8ddec032854092da555eb9e29626465657c1c5cc3de0ada0bfea7e 62f734b99e5b690c12f339562c08e6a9168ad91c00bf4efc6c3f2d6c7a9677bd 67e5fe71333949e664d9fb1d9ac0081c106fabb9b8e141af9874b58c132ab9e7 6ddf5c9c790a3a4a536b75d46e6ff10edee2012c625d10fbb69a119b68643cef 70da3b1b49c0d6c660501a803026e5a5390bbea749b25b8b2ddffef8bb211ff6 7c56b87fbc92c9ff8bbd0f0979acb839eea8695c1fd18b731fdb0feca077fd4f 7df588daaa053890cebfc0ac09b3c6b64bac4523719bc88323af6cc7e64377ed 8019ea81df3933f933d94e2d7989b70f9aa8f4876d8103e79dc2fa9ae3cc87c2 853e735b64cac5c64d18b78b35dc4129551909b8ee3bdb1ad2b6ef75349f0108 8656a40ad826829fc90537ca0bbdbc2bb9d2e7d96e080f3fc4b5796e44c13881 8ce7e340773af5310bc851b5a9b848a72759fc33059a0d8cc5732a5f97766aa7 8e036e4c156fe5c51fbca42121b70dd77741b1ccdc1999867d5ca28fc4d57ae8 93d6f9f0172206779c753a4c486dda1de4aa17a5147e84c31203c694655cd8ab 961afc40bd120d3715d2fa333de19a83ab4c712092e9289c28e271ec778f4ea0 9c50cdfed01bb15b584c8871d5cf4dc506705839020fd0626305bf675bd912fc a7a7004ed404980e56f3e9dd4b349a42b39d08b310d32c8ec7db8d55ee693a93 a8163c286a140dd67a8c97631d4ef5799f93de94a914c3ab1c3026e1688743fa af2c6c59f98c5a172e071a38706255ee56e9e8f7b4a1c575593b862e60f8a2c4 b0269634a1d295d170e58d6c3c2cb86cd91dea2acd5f3dea9449df8ed0c889c2 b4caf6949964f75e8dd281ae2ab9947248120c680415b5f5b307532c1dc99b58 b61c22c6b74a546ee337b3a6cc2ee1fa9f3e92e93eced40fe7df27ffddc4c0fe b905802b0e600f2988fb4d16eaa6eec65ed3c5b9735b79dd9a00dfa4d7abe65e b93632280602502b9480abc7c4acd5c7398004197c4a6013ccd2a4ee4c599591 bc246e2508013cb3d8df5c21bac16ab3584e40b16b31647db31006877bc13db3 c2fdb76ec20047129d5f993917cae4a73b61204c531121a57a9121910910fbaf c7137d350aaf2acc965763e380255e9fb63d6feefae4ed91c80b70ff022db855 c8f855c7b1456739d1c03c4225093475baba75cb49d3f1051ba4e40831e5ce84 cbb512c427297c2b67b83e459887b59e3171ad47a22a62d89f03a1eacab1ac42 ce98feac673b63a3c030c976c0dd4a0fba0cd5e124373b390b0f3c7fa761f95e d1d957406e9177a1ab10bb5a4d2d4dfb3ac971c390f8383eeaa263bdf8038058 d6c3c83d8549c691972e8fe91277c579efe83b731d5a1669d42692b0b3a17980 d8d1635a515fd3afb2ccfbd2a82feb2c2150161872f3a4babd90146626fe8355 de9117872e6b32d01fe2e2ec54899641486a1ebb3439123aadea8d5388617eee e5d34a8a39ae067efe12336732f43775fa8eaf86e0d7668816780d1db9821e5d e9808c0e5ebba9aa2b2b5f856d1cb6965f6b5fa49e22dc423251786bb46ac2b7 ed8684894015e74ff5cf217cbda2f2036e7c9f573f9b0aa46e29e7ff8c13f11b f29e98d60486472e80d2fac7afa7433bad74d69e25ba8b9533c3b23d6b6be9bd f3bd3637ad90eae0bfa31c0735fa3bb2e0d7061f63456f7479948ce7e8cd7310 f3f1ac9e1739a840242c9c215080085af61500dbe7bfd01886fe972e0ca22a26 f55bb674f524ea72d91dba894ea5448ecf92aab7bceb0cf0025383483e72cc1f f80313b4e2d743c94571a98d1672ffc3bc003209c6315ce2a22a9989aae051c2 f90e8f85f79cbff664ad3c4758f1bed8a6ebc2a712180d675ff560bea2b88c65 fc56184a160c0fbb3d2a98e5955dfad4e09e3a8db99f162199d9c1f419460984 [PULSEPACK plugins] 09375c5edc56752d5b8d84cb433e6a2151a57b02938bb84e1e07deefbcede3aa 0c4015083a3eefa815d0f5310b112e7aff27199d38d5605f88a79dcab85db2b5 526610d0cf97982044b892731a7d47832893028c67e85c1ae04092c7e05dd827 bc647e05eea89ea9b5ec3ce728e3c039dd2abd17441e7c39cf130f292edd6efc [Earth Lamia hosting servers] 185[.]238[.]251[.]244 206[.]237[.]1[.]201 206[.]238[.]179[.]242 [Cobalt Strike C&C Domains] chrome-online[.]site times[.]windowstimes[.]online [Brute Ratel C&C Domains] dxzdq7un7c7hs[.]cloudfront[.]net d3hg0xriyu9bjh[.]cloudfront[.]net [Vshell C&C Servers] 103[.]30[.]76[.]206 149[.]104[.]23[.]171 154[.]211[.]89[.]5 164[.]155[.]231[.]64 185[.]238[.]251[.]38 185[.]238[.]251[.]46 206[.]237[.]0[.]251 206[.]238[.]179[.]172 206[.]238[.]76[.]121 206[.]238[.]196[.]155 206[.]238[.]199[.]21 api[.]xwphd[.]com bkp[.]windowstimes[.]me times[.]windowstimes[.]me image[.]windowstimes[.]online images[.]windowstimes[.]online [PULSEPACK C&C Servers] 104[.]233[.]140[.]135 134[.]122[.]176[.]156 141[.]11[.]149[.]124 0ac0568239f8978[.]ccega6r0yph8[.]com 784564141[.]ccega6r0yph8[.]com c43f5d6e73a7eb[.]ccega6r0yph8[.]com admin[.]668608[.]xyz