Indicators of Compromise

Domain

TLP:CLEAR

setup.pth

50% confidence

Added

2026-08-09

Domain

TLP:CLEAR

api.anthropic.com

50% confidence

Added

2026-08-09

Domain

TLP:CLEAR

setup.mdc

50% confidence

Added

2026-08-09

Filename

TLP:CLEAR

setup.js

50% confidence

Added

2026-08-09

Domain

TLP:CLEAR

shadescreekdental.com

ThreatFox: IClickFix

65% confidence

Added

2026-08-07

URL

TLP:CLEAR

http://94.103.1.175/hidbqweiuybdf2836hifwoHADES/siweiw4iekxaiw21cbdsaw.exe

ThreatFox: Unknown Loader

85% confidence

Added

2026-07-30

URL

TLP:CLEAR

http://94.103.1.175/hidbqweiuybdf2836hifwoHADES/ijfcdbhjnidefarpgjbiuearhjgui9wehj38725yhfeehj.ps1

ThreatFox: Unknown Loader

85% confidence

Added

2026-07-30

URL

TLP:CLEAR

http://94.103.1.175/hidbqweiuybdf2836hifwoHADES/

ThreatFox: Unknown Loader

85% confidence

Added

2026-07-30

URL

TLP:CLEAR

http://94.103.1.175/hidbqweiuybdf2836hifwoHADES/ifgoI9f9KFBKjvbmskasdkb.exe

ThreatFox: Unknown Loader

85% confidence

Added

2026-07-30

SHA-256 Hash

TLP:CLEAR

ec7e9ab43a0cc65d29f0b84a93ba88c43d01fed3dec5c968525dc73c03cbfda2

Thailand's Ministry of Finance Targeted With Hermes AI Agent Running Unattended, Hades Implant Staged

75% confidence

Added

2026-07-24

Domain

TLP:CLEAR

redhatupdating432.dnsrd.com

Thailand's Ministry of Finance Targeted With Hermes AI Agent Running Unattended, Hades Implant Staged

75% confidence

Added

2026-07-24

Domain

TLP:CLEAR

mail4.pl

Thailand's Ministry of Finance Targeted With Hermes AI Agent Running Unattended, Hades Implant Staged

75% confidence

Added

2026-07-24

IPv4 Address

TLP:CLEAR

202.181.27.115

Thailand's Ministry of Finance Targeted With Hermes AI Agent Running Unattended, Hades Implant Staged

75% confidence

Added

2026-07-24

IPv4 Address

TLP:CLEAR

103.97.0.57

Thailand's Ministry of Finance Targeted With Hermes AI Agent Running Unattended, Hades Implant Staged

75% confidence

Added

2026-07-24

SHA-256 Hash

TLP:CLEAR

ff662b60f6a142f99292fbdd65dd1ccd79dc9628686ddf5935c92f7fb1b62a81

Thailand's Ministry of Finance Targeted With Hermes AI Agent Running Unattended, Hades Implant Staged

75% confidence

Added

2026-07-24

SHA-256 Hash

TLP:CLEAR

58338a93fee4e008ea28e459c4d1598313d1524763ab13894ab63bf2bec4302a

Thailand's Ministry of Finance Targeted With Hermes AI Agent Running Unattended, Hades Implant Staged

75% confidence

Added

2026-07-24

SHA-256 Hash

TLP:CLEAR

2a4cb412efa93fed7c3b3b3e49d6247b11a95ce9fddf71d9fe9db8e5f0068e0d

Thailand's Ministry of Finance Targeted With Hermes AI Agent Running Unattended, Hades Implant Staged

75% confidence

Added

2026-07-24

SHA-256 Hash

TLP:CLEAR

5633bc0033fde3aad929d6cbd47c554e264180360b017aae04687c2d6d83f753

Thailand's Ministry of Finance Targeted With Hermes AI Agent Running Unattended, Hades Implant Staged

75% confidence

Added

2026-07-24

SHA-256 Hash

TLP:CLEAR

576c70e12be8b2e8e7c35a5feb082e90621989adce8e64400126918d37f13e49

Thailand's Ministry of Finance Targeted With Hermes AI Agent Running Unattended, Hades Implant Staged

75% confidence

Added

2026-07-24

SHA-256 Hash

TLP:CLEAR

9ff4b6d3b7dbb023bad65d2538ade745d46b763e5a12116c9c83aa2f6f5d96aa

Thailand's Ministry of Finance Targeted With Hermes AI Agent Running Unattended, Hades Implant Staged

75% confidence

Added

2026-07-24

SHA-256 Hash

TLP:CLEAR

a9447ae174f4aa54f760b7d7cc985c1a970f31e151d3ff66fac247f99ba1b509

Thailand's Ministry of Finance Targeted With Hermes AI Agent Running Unattended, Hades Implant Staged

75% confidence

Added

2026-07-24

SHA-256 Hash

TLP:CLEAR

b65b7ede835ebba36294d52d7780065523340ee09bb8b209ef2dc495e53dfd53

Thailand's Ministry of Finance Targeted With Hermes AI Agent Running Unattended, Hades Implant Staged

75% confidence

Added

2026-07-24

SHA-256 Hash

TLP:CLEAR

d252ee7b348b7e43e432d8fb154465838f5cd5fb564905323460e6f0a0c7d1e2

Thailand's Ministry of Finance Targeted With Hermes AI Agent Running Unattended, Hades Implant Staged

75% confidence

Added

2026-07-24

SHA-256 Hash

TLP:CLEAR

dbbb8a11a239da11cbaf99f847a2d032f34d3b522e13b0fd4ef7b2649da7123b

Thailand's Ministry of Finance Targeted With Hermes AI Agent Running Unattended, Hades Implant Staged

75% confidence

Added

2026-07-24

SHA-256 Hash

TLP:CLEAR

0f8c905aa25c86f85454acb7e77bf5c50220c2a82e5b69a33741e55c8a85f2fc

Thailand's Ministry of Finance Targeted With Hermes AI Agent Running Unattended, Hades Implant Staged

75% confidence

Added

2026-07-24

SHA-1 Hash

TLP:CLEAR

cfa6312db63b91f8c4022078a487c1c86b7e0901

Thailand's Ministry of Finance Targeted With Hermes AI Agent Running Unattended, Hades Implant Staged

75% confidence

Added

2026-07-24

MD5 Hash

TLP:CLEAR

9c9976adbb1f4cda0e3ba85d3ed9c211

Thailand's Ministry of Finance Targeted With Hermes AI Agent Running Unattended, Hades Implant Staged

75% confidence

Added

2026-07-24

IPv4 Address

TLP:CLEAR

43.246.208.207

Thailand's Ministry of Finance Targeted With Hermes AI Agent Running Unattended, Hades Implant Staged

75% confidence

Added

2026-07-24

SHA256

TLP:CLEAR

11b50a6143f0a10495f509cc7582a141e644b7322a481e02ea8e9a6db7edbbc0

ThreatFox: Unknown malware

85% confidence

Added

2026-07-04

IPV4

TLP:CLEAR

162.55.1.86

ThreatFox: Unknown malware

85% confidence

Added

2026-07-04

URL

TLP:CLEAR

http://162.55.1.86:3005/log

ThreatFox: Unknown malware

85% confidence

Added

2026-07-04

URL

TLP:CLEAR

http://162.55.1.86:3005/browser

ThreatFox: Unknown malware

85% confidence

Added

2026-07-04

URL

TLP:CLEAR

http://162.55.1.86:3005/capture

ThreatFox: Unknown malware

85% confidence

Added

2026-07-04

SHA256

TLP:CLEAR

1fb0b008bc63f128227ddaaa8bc77542c0caa198825f9c514c15cec26f1660f4

ThreatFox: Unknown malware

85% confidence

Added

2026-07-04

Domain

TLP:CLEAR

shutterandshades.com

The Evolution of ClickFix: From Cleartext to Server Side Polymorphism

75% confidence

Added

2026-05-26

Domain

TLP:CLEAR

shadescollectivellc.com

The Evolution of ClickFix: From Cleartext to Server Side Polymorphism

75% confidence

Added

2026-05-26

Domain

TLP:CLEAR

shadesking.com

The Evolution of ClickFix: From Cleartext to Server Side Polymorphism

75% confidence

Added

2026-05-26

Domain

TLP:CLEAR

gatesofhades.com

download location

50% confidence

Added

2026-05-06

URL

TLP:CLEAR

http://gatesofhades.com/ldtaked

download location

50% confidence

Added

2026-05-06

IPv4 Address

TLP:CLEAR

91.236.116.144

BlackShades trojan - RAT-Controllers-20150918.csv

40% confidence

Added

2026-05-06

IPv4 Address

TLP:CLEAR

93.172.154.42

BlackShades trojan - RAT-Controllers-20150818.csv

40% confidence

Added

2026-05-06

IPv4 Address

TLP:CLEAR

46.116.109.7

BlackShades trojan - RAT-Controllers-20150818.csv

40% confidence

Added

2026-05-06

Domain

TLP:CLEAR

pachadesert.com

DEV-0196 activity

90% confidence

Added

2026-05-06

SHA-256 Hash

TLP:CLEAR

37004c5019db04463248da8469952af8ed742ba00cfa440dd65b2d94d0856809

Update.exe (Hades Locker)

50% confidence

Added

2026-05-06

URL

TLP:CLEAR

http://pfmydcsjib.ru/config.php

Hades Locker C2

50% confidence

Added

2026-05-06

URL

TLP:CLEAR

http://jdybchotfn.ru/config.php

Hades Locker C2

50% confidence

Added

2026-05-06

URL

TLP:CLEAR

http://185.45.193.169/update.exe

Payload (Hades Locker) downloaded by documents

50% confidence

Added

2026-05-06

SHA-1 Hash

TLP:CLEAR

68e8e1eaa7439173362ff42fec37e1149f162662

Update.exe (Hades Locker) - Xchecked via VT: 37004c5019db04463248da8469952af8ed742ba00cfa440dd65b2d94d0856809

50% confidence

Added

2026-05-06

MD5 Hash

TLP:CLEAR

8f03cf5d3c951cf2711144e84779b590

Update.exe (Hades Locker) - Xchecked via VT: 37004c5019db04463248da8469952af8ed742ba00cfa440dd65b2d94d0856809

50% confidence

Added

2026-05-06

Domain

TLP:CLEAR

tltkbshades.no-ip.info

MISP: tltkbshades.no-ip.info

40% confidence

Added

2026-05-06