Indicators of Compromise

Filename

TLP:CLEAR

thebat.exe

50% confidence

Added

2026-08-08

Filename

TLP:CLEAR

steam.exe

50% confidence

Added

2026-08-08

Filename

TLP:CLEAR

powerpnt.exe

50% confidence

Added

2026-08-08

Filename

TLP:CLEAR

outlook.exe

50% confidence

Added

2026-08-08

Filename

TLP:CLEAR

onenote.exe

50% confidence

Added

2026-08-08

Filename

TLP:CLEAR

mspub.exe

50% confidence

Added

2026-08-08

Filename

TLP:CLEAR

msaccess.exe

50% confidence

Added

2026-08-08

Filename

TLP:CLEAR

infopath.exe

50% confidence

Added

2026-08-08

Filename

TLP:CLEAR

excel.exe

50% confidence

Added

2026-08-08

Filename

TLP:CLEAR

sqbcoreservice.exe

50% confidence

Added

2026-08-08

Filename

TLP:CLEAR

xfssvccon.exe

50% confidence

Added

2026-08-08

Filename

TLP:CLEAR

mydesktopservice.exe

50% confidence

Added

2026-08-08

Filename

TLP:CLEAR

dbeng50.exe

50% confidence

Added

2026-08-08

Filename

TLP:CLEAR

mysqld-opt.exe

50% confidence

Added

2026-08-08

Filename

TLP:CLEAR

mysqld-nt.exe

50% confidence

Added

2026-08-08

Filename

TLP:CLEAR

mysqld.exe

50% confidence

Added

2026-08-08

Filename

TLP:CLEAR

ocomm.exe

50% confidence

Added

2026-08-08

Filename

TLP:CLEAR

tbirdconfig.exe

50% confidence

Added

2026-08-08

Filename

TLP:CLEAR

firefoxconfig.exe

50% confidence

Added

2026-08-08

Filename

TLP:CLEAR

encsvc.exe

50% confidence

Added

2026-08-08

Filename

TLP:CLEAR

ocautoupds.exe

50% confidence

Added

2026-08-08

Filename

TLP:CLEAR

sqlagent.exe

50% confidence

Added

2026-08-08

Filename

TLP:CLEAR

isqlplussvc.exe

50% confidence

Added

2026-08-08

Filename

TLP:CLEAR

mydesktopqos.exe

50% confidence

Added

2026-08-08

Filename

TLP:CLEAR

synctime.exe

50% confidence

Added

2026-08-08

Filename

TLP:CLEAR

dbsnmp.exe

50% confidence

Added

2026-08-08

Filename

TLP:CLEAR

ocssd.exe

50% confidence

Added

2026-08-08

Filename

TLP:CLEAR

oracle.exe

50% confidence

Added

2026-08-08

Filename

TLP:CLEAR

sqlwriter.exe

50% confidence

Added

2026-08-08

Filename

TLP:CLEAR

sqlservr.exe

50% confidence

Added

2026-08-08

Filename

TLP:CLEAR

sqlbrowser.exe

50% confidence

Added

2026-08-08

Filename

TLP:CLEAR

msftesql.exe

50% confidence

Added

2026-08-08

Filename

TLP:CLEAR

agntsvc.exe

50% confidence

Added

2026-08-08

Domain

TLP:CLEAR

tr.dldr

50% confidence

Added

2026-08-08

Filename

TLP:CLEAR

info.hta

50% confidence

Added

2026-08-08

Filename

TLP:CLEAR

8base-ransomware-analyst-note.pdf

50% confidence

Added

2026-08-08

SHA-256 Hash

TLP:CLEAR

34d798a6c55e57ed0932b6499f4fbcb5454bdfca903307be101a0594b0ac07bc

New Backdoor May be Linked to Ransomware Access Broker

75% confidence

Added

2026-07-24

Domain

TLP:CLEAR

sss.authorized-logins.net

New Backdoor May be Linked to Ransomware Access Broker

75% confidence

Added

2026-07-24

Domain

TLP:CLEAR

php.authorized-logins.net

New Backdoor May be Linked to Ransomware Access Broker

75% confidence

Added

2026-07-24

Domain

TLP:CLEAR

nano.upscale-kolo.com

New Backdoor May be Linked to Ransomware Access Broker

75% confidence

Added

2026-07-24

Domain

TLP:CLEAR

mails.updater-worelos.com

New Backdoor May be Linked to Ransomware Access Broker

75% confidence

Added

2026-07-24

Domain

TLP:CLEAR

mailes.upd-domain-goloro.com

New Backdoor May be Linked to Ransomware Access Broker

75% confidence

Added

2026-07-24

Domain

TLP:CLEAR

ftps.upd-domain-goloro.com

New Backdoor May be Linked to Ransomware Access Broker

75% confidence

Added

2026-07-24

Domain

TLP:CLEAR

defs.updater-worelos.com

New Backdoor May be Linked to Ransomware Access Broker

75% confidence

Added

2026-07-24

Domain

TLP:CLEAR

upscale-kolo.com

New Backdoor May be Linked to Ransomware Access Broker

75% confidence

Added

2026-07-24

Domain

TLP:CLEAR

updater-worelos.com

New Backdoor May be Linked to Ransomware Access Broker

75% confidence

Added

2026-07-24

Domain

TLP:CLEAR

upd-domain-goloro.com

New Backdoor May be Linked to Ransomware Access Broker

75% confidence

Added

2026-07-24

Domain

TLP:CLEAR

sql-updater-service.com

New Backdoor May be Linked to Ransomware Access Broker

75% confidence

Added

2026-07-24

Domain

TLP:CLEAR

rotoa-upda-lo.com

New Backdoor May be Linked to Ransomware Access Broker

75% confidence

Added

2026-07-24

Domain

TLP:CLEAR

b6w9m2z5x8q1v3k.top

New Backdoor May be Linked to Ransomware Access Broker

75% confidence

Added

2026-07-24