HarfangLab IOCs
- Dépôt
- https://github.com/HarfangLab/iocs
- Commit
- 3e2b674bf2f591ac46301420671ba553de094dea
- Récupéré le
- 2026-09-27
- Licence
- No licence (all rights reserved)
- Publication
- Métadonnées
- Justification
- No LICENSE file in the repository and no licence statement in its README (checked 2026-09-29). Without a grant, the rules are all rights reserved: metadata and an upstream link only.
Règles de HarfangLab IOCs
- HARFANGLAB_Xdspy_EtdownloaderMétadonnées seules
Matches XDSpy 1st stage ET Downloader malware
MalwareHarfangLab IOCs· HarfangLab· 2025-05-16 - HARFANGLAB_Xdspy_LNK_2025Métadonnées seules
Matches XDSpy malicious LNK files, used in 2025
MalwareHarfangLab IOCs· HarfangLab· 2025-05-16 - HARFANGLAB_Xdspy_XdigoMétadonnées seules
Rule to catch XDSpy Main module, written in golang
MalwareHarfangLab IOCs· HarfangLab· 2025-05-16 - HARFANGLAB_Apt31_Rawdoor_DropperMétadonnées seules
Matches the RawDoor dropper
MalwareHarfangLab IOCs· HarfangLab· 2024-04-12 - HARFANGLAB_Apt31_Rawdoor_PayloadMétadonnées seules
Matches the RawDoor payload
MalwareHarfangLab IOCs· HarfangLab· 2024-04-12 - HARFANGLAB_Gamaredon_GammadropMétadonnées seules
Matches Gamaredon GammaDrop VBScript samples used in late 2025 - mid 2026
GénériqueHarfangLab IOCs· HarfangLab· 2026-05-13 - HARFANGLAB_Gamaredon_Gammaload_HTAMétadonnées seules
Matches Gamaredon GammaLoad HTA wrapped VBScript samples used in late 2025 - mid 2026
GénériqueHarfangLab IOCs· HarfangLab· 2026-05-13 - HARFANGLAB_Vbscript_RAR_CVE_2025_8088Métadonnées seules
Matches RAR5 archives exploiting CVE-2025-8088 to drop VBScript into Startup folder, used by Gamaredon in late 2025 - mid 2026
ExploitHarfangLab IOCs· HarfangLab· 2026-05-13 - HARFANGLAB_Apache_Module_Hijackserver_Php_DecodedMétadonnées seules
Matches the decompressed and decoded Apache HijackServer PHP module
GénériqueHarfangLab IOCs· HarfangLab· 2025-10-15 - HARFANGLAB_Gamaredon_Pterolnk_VbscriptMétadonnées seules
Matches Gamaredon PteroLNK VBScript samples used in late 2024 to early 2025
GénériqueHarfangLab IOCs· HarfangLab· 2025-04-04 - HARFANGLAB_Gamaredon_Pterolnk_Vbscript_Update2506Métadonnées seules
Matches Gamaredon PteroLNK VBScript samples used in 2025
GénériqueHarfangLab IOCs· HarfangLab· 2025-06-23 - HARFANGLAB_Iis_Module_Hijackserver_DotnetMétadonnées seules
Matches the IIS HijackServer .NET module
GénériqueHarfangLab IOCs· HarfangLab· 2025-10-14 - HARFANGLAB_Iis_Module_Hijackserver_NativeMétadonnées seules
Matches the IIS HijackServer module
GénériqueHarfangLab IOCs· HarfangLab· 2025-08-25 - HARFANGLAB_Trr250801_Cpp_DownloaderMétadonnées seules
Detects C++ downloaders as likely leveraged by UNC1151, and observed during May 2025
MalwareHarfangLab IOCs· HarfangLab· 2025-08-08 - HARFANGLAB_Trr250801_Csharp_Downloader_CombinedMétadonnées seules
Detects C# downloaders as likely leveraged by UNC1151, and observed between May and July 2025
MalwareHarfangLab IOCs· HarfangLab· 2025-08-08 - HARFANGLAB_Wingtb_RootkitMétadonnées seules
Matches the customized Hidden rootkit, Wingtb.sys.
MalwareHarfangLab IOCs· HarfangLab· 2025-10-15 - HARFANGLAB_Wingtb_Rootkit_Commandline_Tool_WingtbcliMétadonnées seules
Matches the usermode command-line tool for rootkit, WingtbCLI.exe.
MalwareHarfangLab IOCs· HarfangLab· 2025-10-15 - HARFANGLAB_Allasenhamaycampaign_AllasenhaMétadonnées seules
Detects AllaSenha banking trojan DLLs.
MalwareHarfangLab IOCs· HarfangLab· 2024-05-28 - HARFANGLAB_Charmingkitten_CyclopsMétadonnées seules
Detects Cyclops Golang Malware
MalwareHarfangLab IOCs· HarfangLab· 2024-08-05 - HARFANGLAB_Custom_Ateraagent_OperatorMétadonnées seules
Detect Atera Agent configured to certain email addresses, or email domains
GénériqueHarfangLab IOCs· HarfangLab· 2024-04-17 - HARFANGLAB_Donut_ShellcodeMétadonnées seules
Detects Donut shellcode in memory.
GénériqueHarfangLab IOCs· HarfangLab· 2024-06-20 - HARFANGLAB_Masepie_Campaign_HtmlstarterMétadonnées seules
Detect Malicious Web page HTML file from CERT-UA#8399
GénériqueHarfangLab IOCs· HarfangLab· 2024-01-24 - HARFANGLAB_Masepie_Campaign_WebdavlnkMétadonnées seules
Detect Malicious LNK from CERT-UA#8399
GénériqueHarfangLab IOCs· HarfangLab· 2024-01-24 - HARFANGLAB_Muddywater_Ateraagent_OperatorsMétadonnées seules
Detect Atera Agent abused by MuddyWater
GénériqueHarfangLab IOCs· HarfangLab· 2024-04-17 - HARFANGLAB_Nhas_Reverse_Shell_Elf_Inmem_LargeMétadonnées seules
Matches packed NHAS reverse_ssh ELF samples in-memory during execution
Suspect / chasseHarfangLab IOCs· HarfangLab· 2024-09-24 - HARFANGLAB_Nhas_Reverse_Shell_Pe_Inmem_LargeMétadonnées seules
Matches packed NHAS reverse_ssh PE samples in-memory during execution
Suspect / chasseHarfangLab IOCs· HarfangLab· 2024-09-24 - HARFANGLAB_Nhas_Reverse_Shell_Unpacked_LargeMétadonnées seules
Matches unpacked NHAS reverse_ssh file samples
Suspect / chasseHarfangLab IOCs· HarfangLab· 2024-09-24 - HARFANGLAB_Samecoin_Campaign_LoaderMétadonnées seules
Matches the loader used in the SameCoin campaign
MalwareHarfangLab IOCs· HarfangLab· 2024-02-13 - HARFANGLAB_Samecoin_Campaign_NativewiperMétadonnées seules
Matches the native Android library used in the SameCoin campaign
GénériqueHarfangLab IOCs· HarfangLab· 2024-02-13 - HARFANGLAB_Samecoin_Campaign_WiperMétadonnées seules
Matches the wiper used in the SameCoin campaign
MalwareHarfangLab IOCs· HarfangLab· 2024-02-13 - HARFANGLAB_Supposed_Grasshopper_DownloaderMétadonnées seules
Detects the Nim downloader from the Supposed Grasshopper campaign.
MalwareHarfangLab IOCs· HarfangLab· 2024-06-20 - HARFANGLAB_Trr260101_SloppymioMétadonnées seules
Detects SloppyMIO, a C# implant leveraged by an Iranian threat actor in January 2026.
APT / acteurHarfangLab IOCs· HarfangLab· 2026-01-28 - HARFANGLAB_Apache_Module_Hijackserver_PhpMétadonnées seules
Matches the encoded Apache HijackServer PHP module
GénériqueHarfangLab IOCs· HarfangLab· 2025-10-15 - HARFANGLAB_Gamaredon_Pterolnk_LNKMétadonnées seules
Matches Gamaredon PteroLNK-generated LNK files used in late 2024 to early 2025
GénériqueHarfangLab IOCs· HarfangLab· 2025-04-04 - HARFANGLAB_Masepie_Campaign_MasepieMétadonnées seules
Detect MASEPIE from CERT-UA#8399
GénériqueHarfangLab IOCs· HarfangLab· 2024-01-24 - HARFANGLAB_Masepie_Campaign_OceanmapMétadonnées seules
Detect OCEANMAP from CERT-UA#8399
GénériqueHarfangLab IOCs· HarfangLab· 2024-01-24 - HARFANGLAB_Samecoin_Campaign_TasksspreaderMétadonnées seules
Detect .NET Task Scheduler that is dropper by SameCoin Loader
MalwareHarfangLab IOCs· HarfangLab· 2024-02-13 - HARFANGLAB_PackxorMétadonnées seules
Detection rule for PackXOR
GénériqueHarfangLab IOCs· Harfanglab· 2024-08-05