HarfangLab IOCs
- Repository
- https://github.com/HarfangLab/iocs
- Commit
- 3e2b674bf2f591ac46301420671ba553de094dea
- Abgerufen
- 2026-09-27
- Lizenz
- No licence (all rights reserved)
- Veröffentlicht
- Metadaten
- Begründung
- No LICENSE file in the repository and no licence statement in its README (checked 2026-09-29). Without a grant, the rules are all rights reserved: metadata and an upstream link only.
Regeln von HarfangLab IOCs
- HARFANGLAB_Xdspy_EtdownloaderNur Metadaten
Matches XDSpy 1st stage ET Downloader malware
MalwareHarfangLab IOCs· HarfangLab· 2025-05-16 - HARFANGLAB_Xdspy_LNK_2025Nur Metadaten
Matches XDSpy malicious LNK files, used in 2025
MalwareHarfangLab IOCs· HarfangLab· 2025-05-16 - HARFANGLAB_Xdspy_XdigoNur Metadaten
Rule to catch XDSpy Main module, written in golang
MalwareHarfangLab IOCs· HarfangLab· 2025-05-16 - HARFANGLAB_Apt31_Rawdoor_DropperNur Metadaten
Matches the RawDoor dropper
MalwareHarfangLab IOCs· HarfangLab· 2024-04-12 - HARFANGLAB_Apt31_Rawdoor_PayloadNur Metadaten
Matches the RawDoor payload
MalwareHarfangLab IOCs· HarfangLab· 2024-04-12 - HARFANGLAB_Gamaredon_GammadropNur Metadaten
Matches Gamaredon GammaDrop VBScript samples used in late 2025 - mid 2026
GenerischHarfangLab IOCs· HarfangLab· 2026-05-13 - HARFANGLAB_Gamaredon_Gammaload_HTANur Metadaten
Matches Gamaredon GammaLoad HTA wrapped VBScript samples used in late 2025 - mid 2026
GenerischHarfangLab IOCs· HarfangLab· 2026-05-13 - HARFANGLAB_Vbscript_RAR_CVE_2025_8088Nur Metadaten
Matches RAR5 archives exploiting CVE-2025-8088 to drop VBScript into Startup folder, used by Gamaredon in late 2025 - mid 2026
ExploitHarfangLab IOCs· HarfangLab· 2026-05-13 - HARFANGLAB_Apache_Module_Hijackserver_Php_DecodedNur Metadaten
Matches the decompressed and decoded Apache HijackServer PHP module
GenerischHarfangLab IOCs· HarfangLab· 2025-10-15 - HARFANGLAB_Gamaredon_Pterolnk_VbscriptNur Metadaten
Matches Gamaredon PteroLNK VBScript samples used in late 2024 to early 2025
GenerischHarfangLab IOCs· HarfangLab· 2025-04-04 - HARFANGLAB_Gamaredon_Pterolnk_Vbscript_Update2506Nur Metadaten
Matches Gamaredon PteroLNK VBScript samples used in 2025
GenerischHarfangLab IOCs· HarfangLab· 2025-06-23 - HARFANGLAB_Iis_Module_Hijackserver_DotnetNur Metadaten
Matches the IIS HijackServer .NET module
GenerischHarfangLab IOCs· HarfangLab· 2025-10-14 - HARFANGLAB_Iis_Module_Hijackserver_NativeNur Metadaten
Matches the IIS HijackServer module
GenerischHarfangLab IOCs· HarfangLab· 2025-08-25 - HARFANGLAB_Trr250801_Cpp_DownloaderNur Metadaten
Detects C++ downloaders as likely leveraged by UNC1151, and observed during May 2025
MalwareHarfangLab IOCs· HarfangLab· 2025-08-08 - HARFANGLAB_Trr250801_Csharp_Downloader_CombinedNur Metadaten
Detects C# downloaders as likely leveraged by UNC1151, and observed between May and July 2025
MalwareHarfangLab IOCs· HarfangLab· 2025-08-08 - HARFANGLAB_Wingtb_RootkitNur Metadaten
Matches the customized Hidden rootkit, Wingtb.sys.
MalwareHarfangLab IOCs· HarfangLab· 2025-10-15 - HARFANGLAB_Wingtb_Rootkit_Commandline_Tool_WingtbcliNur Metadaten
Matches the usermode command-line tool for rootkit, WingtbCLI.exe.
MalwareHarfangLab IOCs· HarfangLab· 2025-10-15 - HARFANGLAB_Allasenhamaycampaign_AllasenhaNur Metadaten
Detects AllaSenha banking trojan DLLs.
MalwareHarfangLab IOCs· HarfangLab· 2024-05-28 - HARFANGLAB_Charmingkitten_CyclopsNur Metadaten
Detects Cyclops Golang Malware
MalwareHarfangLab IOCs· HarfangLab· 2024-08-05 - HARFANGLAB_Custom_Ateraagent_OperatorNur Metadaten
Detect Atera Agent configured to certain email addresses, or email domains
GenerischHarfangLab IOCs· HarfangLab· 2024-04-17 - HARFANGLAB_Donut_ShellcodeNur Metadaten
Detects Donut shellcode in memory.
GenerischHarfangLab IOCs· HarfangLab· 2024-06-20 - HARFANGLAB_Masepie_Campaign_HtmlstarterNur Metadaten
Detect Malicious Web page HTML file from CERT-UA#8399
GenerischHarfangLab IOCs· HarfangLab· 2024-01-24 - HARFANGLAB_Masepie_Campaign_WebdavlnkNur Metadaten
Detect Malicious LNK from CERT-UA#8399
GenerischHarfangLab IOCs· HarfangLab· 2024-01-24 - HARFANGLAB_Muddywater_Ateraagent_OperatorsNur Metadaten
Detect Atera Agent abused by MuddyWater
GenerischHarfangLab IOCs· HarfangLab· 2024-04-17 - HARFANGLAB_Nhas_Reverse_Shell_Elf_Inmem_LargeNur Metadaten
Matches packed NHAS reverse_ssh ELF samples in-memory during execution
Verdächtig / HuntingHarfangLab IOCs· HarfangLab· 2024-09-24 - HARFANGLAB_Nhas_Reverse_Shell_Pe_Inmem_LargeNur Metadaten
Matches packed NHAS reverse_ssh PE samples in-memory during execution
Verdächtig / HuntingHarfangLab IOCs· HarfangLab· 2024-09-24 - HARFANGLAB_Nhas_Reverse_Shell_Unpacked_LargeNur Metadaten
Matches unpacked NHAS reverse_ssh file samples
Verdächtig / HuntingHarfangLab IOCs· HarfangLab· 2024-09-24 - HARFANGLAB_Samecoin_Campaign_LoaderNur Metadaten
Matches the loader used in the SameCoin campaign
MalwareHarfangLab IOCs· HarfangLab· 2024-02-13 - HARFANGLAB_Samecoin_Campaign_NativewiperNur Metadaten
Matches the native Android library used in the SameCoin campaign
GenerischHarfangLab IOCs· HarfangLab· 2024-02-13 - HARFANGLAB_Samecoin_Campaign_WiperNur Metadaten
Matches the wiper used in the SameCoin campaign
MalwareHarfangLab IOCs· HarfangLab· 2024-02-13 - HARFANGLAB_Supposed_Grasshopper_DownloaderNur Metadaten
Detects the Nim downloader from the Supposed Grasshopper campaign.
MalwareHarfangLab IOCs· HarfangLab· 2024-06-20 - HARFANGLAB_Trr260101_SloppymioNur Metadaten
Detects SloppyMIO, a C# implant leveraged by an Iranian threat actor in January 2026.
APT / AkteurHarfangLab IOCs· HarfangLab· 2026-01-28 - HARFANGLAB_Apache_Module_Hijackserver_PhpNur Metadaten
Matches the encoded Apache HijackServer PHP module
GenerischHarfangLab IOCs· HarfangLab· 2025-10-15 - HARFANGLAB_Gamaredon_Pterolnk_LNKNur Metadaten
Matches Gamaredon PteroLNK-generated LNK files used in late 2024 to early 2025
GenerischHarfangLab IOCs· HarfangLab· 2025-04-04 - HARFANGLAB_Masepie_Campaign_MasepieNur Metadaten
Detect MASEPIE from CERT-UA#8399
GenerischHarfangLab IOCs· HarfangLab· 2024-01-24 - HARFANGLAB_Masepie_Campaign_OceanmapNur Metadaten
Detect OCEANMAP from CERT-UA#8399
GenerischHarfangLab IOCs· HarfangLab· 2024-01-24 - HARFANGLAB_Samecoin_Campaign_TasksspreaderNur Metadaten
Detect .NET Task Scheduler that is dropper by SameCoin Loader
MalwareHarfangLab IOCs· HarfangLab· 2024-02-13 - HARFANGLAB_PackxorNur Metadaten
Detection rule for PackXOR
GenerischHarfangLab IOCs· Harfanglab· 2024-08-05