HarfangLab IOCs
- Repositorio
- https://github.com/HarfangLab/iocs
- Commit
- 3e2b674bf2f591ac46301420671ba553de094dea
- Obtenido
- 2026-09-27
- Licencia
- No licence (all rights reserved)
- Publicación
- Metadatos
- Motivo
- No LICENSE file in the repository and no licence statement in its README (checked 2026-09-29). Without a grant, the rules are all rights reserved: metadata and an upstream link only.
Reglas de HarfangLab IOCs
- HARFANGLAB_Xdspy_EtdownloaderSolo metadatos
Matches XDSpy 1st stage ET Downloader malware
MalwareHarfangLab IOCs· HarfangLab· 2025-05-16 - HARFANGLAB_Xdspy_LNK_2025Solo metadatos
Matches XDSpy malicious LNK files, used in 2025
MalwareHarfangLab IOCs· HarfangLab· 2025-05-16 - HARFANGLAB_Xdspy_XdigoSolo metadatos
Rule to catch XDSpy Main module, written in golang
MalwareHarfangLab IOCs· HarfangLab· 2025-05-16 - HARFANGLAB_Apt31_Rawdoor_DropperSolo metadatos
Matches the RawDoor dropper
MalwareHarfangLab IOCs· HarfangLab· 2024-04-12 - HARFANGLAB_Apt31_Rawdoor_PayloadSolo metadatos
Matches the RawDoor payload
MalwareHarfangLab IOCs· HarfangLab· 2024-04-12 - HARFANGLAB_Gamaredon_GammadropSolo metadatos
Matches Gamaredon GammaDrop VBScript samples used in late 2025 - mid 2026
GenéricaHarfangLab IOCs· HarfangLab· 2026-05-13 - HARFANGLAB_Gamaredon_Gammaload_HTASolo metadatos
Matches Gamaredon GammaLoad HTA wrapped VBScript samples used in late 2025 - mid 2026
GenéricaHarfangLab IOCs· HarfangLab· 2026-05-13 - HARFANGLAB_Vbscript_RAR_CVE_2025_8088Solo metadatos
Matches RAR5 archives exploiting CVE-2025-8088 to drop VBScript into Startup folder, used by Gamaredon in late 2025 - mid 2026
ExploitHarfangLab IOCs· HarfangLab· 2026-05-13 - HARFANGLAB_Apache_Module_Hijackserver_Php_DecodedSolo metadatos
Matches the decompressed and decoded Apache HijackServer PHP module
GenéricaHarfangLab IOCs· HarfangLab· 2025-10-15 - HARFANGLAB_Gamaredon_Pterolnk_VbscriptSolo metadatos
Matches Gamaredon PteroLNK VBScript samples used in late 2024 to early 2025
GenéricaHarfangLab IOCs· HarfangLab· 2025-04-04 - HARFANGLAB_Gamaredon_Pterolnk_Vbscript_Update2506Solo metadatos
Matches Gamaredon PteroLNK VBScript samples used in 2025
GenéricaHarfangLab IOCs· HarfangLab· 2025-06-23 - HARFANGLAB_Iis_Module_Hijackserver_DotnetSolo metadatos
Matches the IIS HijackServer .NET module
GenéricaHarfangLab IOCs· HarfangLab· 2025-10-14 - HARFANGLAB_Iis_Module_Hijackserver_NativeSolo metadatos
Matches the IIS HijackServer module
GenéricaHarfangLab IOCs· HarfangLab· 2025-08-25 - HARFANGLAB_Trr250801_Cpp_DownloaderSolo metadatos
Detects C++ downloaders as likely leveraged by UNC1151, and observed during May 2025
MalwareHarfangLab IOCs· HarfangLab· 2025-08-08 - HARFANGLAB_Trr250801_Csharp_Downloader_CombinedSolo metadatos
Detects C# downloaders as likely leveraged by UNC1151, and observed between May and July 2025
MalwareHarfangLab IOCs· HarfangLab· 2025-08-08 - HARFANGLAB_Wingtb_RootkitSolo metadatos
Matches the customized Hidden rootkit, Wingtb.sys.
MalwareHarfangLab IOCs· HarfangLab· 2025-10-15 - HARFANGLAB_Wingtb_Rootkit_Commandline_Tool_WingtbcliSolo metadatos
Matches the usermode command-line tool for rootkit, WingtbCLI.exe.
MalwareHarfangLab IOCs· HarfangLab· 2025-10-15 - HARFANGLAB_Allasenhamaycampaign_AllasenhaSolo metadatos
Detects AllaSenha banking trojan DLLs.
MalwareHarfangLab IOCs· HarfangLab· 2024-05-28 - HARFANGLAB_Charmingkitten_CyclopsSolo metadatos
Detects Cyclops Golang Malware
MalwareHarfangLab IOCs· HarfangLab· 2024-08-05 - HARFANGLAB_Custom_Ateraagent_OperatorSolo metadatos
Detect Atera Agent configured to certain email addresses, or email domains
GenéricaHarfangLab IOCs· HarfangLab· 2024-04-17 - HARFANGLAB_Donut_ShellcodeSolo metadatos
Detects Donut shellcode in memory.
GenéricaHarfangLab IOCs· HarfangLab· 2024-06-20 - HARFANGLAB_Masepie_Campaign_HtmlstarterSolo metadatos
Detect Malicious Web page HTML file from CERT-UA#8399
GenéricaHarfangLab IOCs· HarfangLab· 2024-01-24 - HARFANGLAB_Masepie_Campaign_WebdavlnkSolo metadatos
Detect Malicious LNK from CERT-UA#8399
GenéricaHarfangLab IOCs· HarfangLab· 2024-01-24 - HARFANGLAB_Muddywater_Ateraagent_OperatorsSolo metadatos
Detect Atera Agent abused by MuddyWater
GenéricaHarfangLab IOCs· HarfangLab· 2024-04-17 - HARFANGLAB_Nhas_Reverse_Shell_Elf_Inmem_LargeSolo metadatos
Matches packed NHAS reverse_ssh ELF samples in-memory during execution
Sospechoso / huntingHarfangLab IOCs· HarfangLab· 2024-09-24 - HARFANGLAB_Nhas_Reverse_Shell_Pe_Inmem_LargeSolo metadatos
Matches packed NHAS reverse_ssh PE samples in-memory during execution
Sospechoso / huntingHarfangLab IOCs· HarfangLab· 2024-09-24 - HARFANGLAB_Nhas_Reverse_Shell_Unpacked_LargeSolo metadatos
Matches unpacked NHAS reverse_ssh file samples
Sospechoso / huntingHarfangLab IOCs· HarfangLab· 2024-09-24 - HARFANGLAB_Samecoin_Campaign_LoaderSolo metadatos
Matches the loader used in the SameCoin campaign
MalwareHarfangLab IOCs· HarfangLab· 2024-02-13 - HARFANGLAB_Samecoin_Campaign_NativewiperSolo metadatos
Matches the native Android library used in the SameCoin campaign
GenéricaHarfangLab IOCs· HarfangLab· 2024-02-13 - HARFANGLAB_Samecoin_Campaign_WiperSolo metadatos
Matches the wiper used in the SameCoin campaign
MalwareHarfangLab IOCs· HarfangLab· 2024-02-13 - HARFANGLAB_Supposed_Grasshopper_DownloaderSolo metadatos
Detects the Nim downloader from the Supposed Grasshopper campaign.
MalwareHarfangLab IOCs· HarfangLab· 2024-06-20 - HARFANGLAB_Trr260101_SloppymioSolo metadatos
Detects SloppyMIO, a C# implant leveraged by an Iranian threat actor in January 2026.
APT / actorHarfangLab IOCs· HarfangLab· 2026-01-28 - HARFANGLAB_Apache_Module_Hijackserver_PhpSolo metadatos
Matches the encoded Apache HijackServer PHP module
GenéricaHarfangLab IOCs· HarfangLab· 2025-10-15 - HARFANGLAB_Gamaredon_Pterolnk_LNKSolo metadatos
Matches Gamaredon PteroLNK-generated LNK files used in late 2024 to early 2025
GenéricaHarfangLab IOCs· HarfangLab· 2025-04-04 - HARFANGLAB_Masepie_Campaign_MasepieSolo metadatos
Detect MASEPIE from CERT-UA#8399
GenéricaHarfangLab IOCs· HarfangLab· 2024-01-24 - HARFANGLAB_Masepie_Campaign_OceanmapSolo metadatos
Detect OCEANMAP from CERT-UA#8399
GenéricaHarfangLab IOCs· HarfangLab· 2024-01-24 - HARFANGLAB_Samecoin_Campaign_TasksspreaderSolo metadatos
Detect .NET Task Scheduler that is dropper by SameCoin Loader
MalwareHarfangLab IOCs· HarfangLab· 2024-02-13 - HARFANGLAB_PackxorSolo metadatos
Detection rule for PackXOR
GenéricaHarfangLab IOCs· Harfanglab· 2024-08-05