HarfangLab IOCs
- Repository
- https://github.com/HarfangLab/iocs
- Commit
- 3e2b674bf2f591ac46301420671ba553de094dea
- Retrieved
- 2026-09-27
- Licence
- No licence (all rights reserved)
- Published
- Metadata
- Why
- No LICENSE file in the repository and no licence statement in its README (checked 2026-09-29). Without a grant, the rules are all rights reserved: metadata and an upstream link only.
Rules from HarfangLab IOCs
- HARFANGLAB_Xdspy_EtdownloaderMetadata only
Matches XDSpy 1st stage ET Downloader malware
MalwareHarfangLab IOCs· HarfangLab· 2025-05-16 - HARFANGLAB_Xdspy_LNK_2025Metadata only
Matches XDSpy malicious LNK files, used in 2025
MalwareHarfangLab IOCs· HarfangLab· 2025-05-16 - HARFANGLAB_Xdspy_XdigoMetadata only
Rule to catch XDSpy Main module, written in golang
MalwareHarfangLab IOCs· HarfangLab· 2025-05-16 - HARFANGLAB_Apt31_Rawdoor_DropperMetadata only
Matches the RawDoor dropper
MalwareHarfangLab IOCs· HarfangLab· 2024-04-12 - HARFANGLAB_Apt31_Rawdoor_PayloadMetadata only
Matches the RawDoor payload
MalwareHarfangLab IOCs· HarfangLab· 2024-04-12 - HARFANGLAB_Gamaredon_GammadropMetadata only
Matches Gamaredon GammaDrop VBScript samples used in late 2025 - mid 2026
GenericHarfangLab IOCs· HarfangLab· 2026-05-13 - HARFANGLAB_Gamaredon_Gammaload_HTAMetadata only
Matches Gamaredon GammaLoad HTA wrapped VBScript samples used in late 2025 - mid 2026
GenericHarfangLab IOCs· HarfangLab· 2026-05-13 - HARFANGLAB_Vbscript_RAR_CVE_2025_8088Metadata only
Matches RAR5 archives exploiting CVE-2025-8088 to drop VBScript into Startup folder, used by Gamaredon in late 2025 - mid 2026
ExploitHarfangLab IOCs· HarfangLab· 2026-05-13 - HARFANGLAB_Apache_Module_Hijackserver_Php_DecodedMetadata only
Matches the decompressed and decoded Apache HijackServer PHP module
GenericHarfangLab IOCs· HarfangLab· 2025-10-15 - HARFANGLAB_Gamaredon_Pterolnk_VbscriptMetadata only
Matches Gamaredon PteroLNK VBScript samples used in late 2024 to early 2025
GenericHarfangLab IOCs· HarfangLab· 2025-04-04 - HARFANGLAB_Gamaredon_Pterolnk_Vbscript_Update2506Metadata only
Matches Gamaredon PteroLNK VBScript samples used in 2025
GenericHarfangLab IOCs· HarfangLab· 2025-06-23 - HARFANGLAB_Iis_Module_Hijackserver_DotnetMetadata only
Matches the IIS HijackServer .NET module
GenericHarfangLab IOCs· HarfangLab· 2025-10-14 - HARFANGLAB_Iis_Module_Hijackserver_NativeMetadata only
Matches the IIS HijackServer module
GenericHarfangLab IOCs· HarfangLab· 2025-08-25 - HARFANGLAB_Trr250801_Cpp_DownloaderMetadata only
Detects C++ downloaders as likely leveraged by UNC1151, and observed during May 2025
MalwareHarfangLab IOCs· HarfangLab· 2025-08-08 - HARFANGLAB_Trr250801_Csharp_Downloader_CombinedMetadata only
Detects C# downloaders as likely leveraged by UNC1151, and observed between May and July 2025
MalwareHarfangLab IOCs· HarfangLab· 2025-08-08 - HARFANGLAB_Wingtb_RootkitMetadata only
Matches the customized Hidden rootkit, Wingtb.sys.
MalwareHarfangLab IOCs· HarfangLab· 2025-10-15 - HARFANGLAB_Wingtb_Rootkit_Commandline_Tool_WingtbcliMetadata only
Matches the usermode command-line tool for rootkit, WingtbCLI.exe.
MalwareHarfangLab IOCs· HarfangLab· 2025-10-15 - HARFANGLAB_Allasenhamaycampaign_AllasenhaMetadata only
Detects AllaSenha banking trojan DLLs.
MalwareHarfangLab IOCs· HarfangLab· 2024-05-28 - HARFANGLAB_Charmingkitten_CyclopsMetadata only
Detects Cyclops Golang Malware
MalwareHarfangLab IOCs· HarfangLab· 2024-08-05 - HARFANGLAB_Custom_Ateraagent_OperatorMetadata only
Detect Atera Agent configured to certain email addresses, or email domains
GenericHarfangLab IOCs· HarfangLab· 2024-04-17 - HARFANGLAB_Donut_ShellcodeMetadata only
Detects Donut shellcode in memory.
GenericHarfangLab IOCs· HarfangLab· 2024-06-20 - HARFANGLAB_Masepie_Campaign_HtmlstarterMetadata only
Detect Malicious Web page HTML file from CERT-UA#8399
GenericHarfangLab IOCs· HarfangLab· 2024-01-24 - HARFANGLAB_Masepie_Campaign_WebdavlnkMetadata only
Detect Malicious LNK from CERT-UA#8399
GenericHarfangLab IOCs· HarfangLab· 2024-01-24 - HARFANGLAB_Muddywater_Ateraagent_OperatorsMetadata only
Detect Atera Agent abused by MuddyWater
GenericHarfangLab IOCs· HarfangLab· 2024-04-17 - HARFANGLAB_Nhas_Reverse_Shell_Elf_Inmem_LargeMetadata only
Matches packed NHAS reverse_ssh ELF samples in-memory during execution
Suspicious / huntingHarfangLab IOCs· HarfangLab· 2024-09-24 - HARFANGLAB_Nhas_Reverse_Shell_Pe_Inmem_LargeMetadata only
Matches packed NHAS reverse_ssh PE samples in-memory during execution
Suspicious / huntingHarfangLab IOCs· HarfangLab· 2024-09-24 - HARFANGLAB_Nhas_Reverse_Shell_Unpacked_LargeMetadata only
Matches unpacked NHAS reverse_ssh file samples
Suspicious / huntingHarfangLab IOCs· HarfangLab· 2024-09-24 - HARFANGLAB_Samecoin_Campaign_LoaderMetadata only
Matches the loader used in the SameCoin campaign
MalwareHarfangLab IOCs· HarfangLab· 2024-02-13 - HARFANGLAB_Samecoin_Campaign_NativewiperMetadata only
Matches the native Android library used in the SameCoin campaign
GenericHarfangLab IOCs· HarfangLab· 2024-02-13 - HARFANGLAB_Samecoin_Campaign_WiperMetadata only
Matches the wiper used in the SameCoin campaign
MalwareHarfangLab IOCs· HarfangLab· 2024-02-13 - HARFANGLAB_Supposed_Grasshopper_DownloaderMetadata only
Detects the Nim downloader from the Supposed Grasshopper campaign.
MalwareHarfangLab IOCs· HarfangLab· 2024-06-20 - HARFANGLAB_Trr260101_SloppymioMetadata only
Detects SloppyMIO, a C# implant leveraged by an Iranian threat actor in January 2026.
APT / threat actorHarfangLab IOCs· HarfangLab· 2026-01-28 - HARFANGLAB_Apache_Module_Hijackserver_PhpMetadata only
Matches the encoded Apache HijackServer PHP module
GenericHarfangLab IOCs· HarfangLab· 2025-10-15 - HARFANGLAB_Gamaredon_Pterolnk_LNKMetadata only
Matches Gamaredon PteroLNK-generated LNK files used in late 2024 to early 2025
GenericHarfangLab IOCs· HarfangLab· 2025-04-04 - HARFANGLAB_Masepie_Campaign_MasepieMetadata only
Detect MASEPIE from CERT-UA#8399
GenericHarfangLab IOCs· HarfangLab· 2024-01-24 - HARFANGLAB_Masepie_Campaign_OceanmapMetadata only
Detect OCEANMAP from CERT-UA#8399
GenericHarfangLab IOCs· HarfangLab· 2024-01-24 - HARFANGLAB_Samecoin_Campaign_TasksspreaderMetadata only
Detect .NET Task Scheduler that is dropper by SameCoin Loader
MalwareHarfangLab IOCs· HarfangLab· 2024-02-13 - HARFANGLAB_PackxorMetadata only
Detection rule for PackXOR
GenericHarfangLab IOCs· Harfanglab· 2024-08-05