Indicators of Compromise

IPv4 Address

TLP:CLEAR

161.97.187.42

50% confidence

Added

2026-08-09

IPv4 Address

TLP:CLEAR

161.97.135.154

50% confidence

Added

2026-08-09

IPv4 Address

TLP:CLEAR

161.97.163.87

50% confidence

Added

2026-08-09

IPv4 Address

TLP:CLEAR

161.97.186.175

50% confidence

Added

2026-08-09

IPv4 Address

TLP:CLEAR

193.187.129.143

50% confidence

Added

2026-08-09

Domain

TLP:CLEAR

extractor.py

50% confidence

Added

2026-08-09

Filename

TLP:CLEAR

AF.exe

50% confidence

Added

2026-08-09

Filename

TLP:CLEAR

SERVI.bat

50% confidence

Added

2026-08-09

IPv4 Address

TLP:CLEAR

83.171.249.231

50% confidence

Added

2026-08-09

IPv4 Address

TLP:CLEAR

161.97.129.25

50% confidence

Added

2026-08-09

Filename

TLP:CLEAR

update.bin

50% confidence

Added

2026-08-09

Domain

TLP:CLEAR

parser.py

50% confidence

Added

2026-08-09

Domain

TLP:CLEAR

docker.sock

50% confidence

Added

2026-08-09

Domain

TLP:CLEAR

harvest.jsonl

50% confidence

Added

2026-08-09

Filename

TLP:CLEAR

update-386.bin

50% confidence

Added

2026-08-09

Filename

TLP:CLEAR

update-arm.bin

50% confidence

Added

2026-08-09

Filename

TLP:CLEAR

spider.dll

50% confidence

Added

2026-08-09

Domain

TLP:CLEAR

wallet.dat

50% confidence

Added

2026-08-09

IPv4 Address

TLP:CLEAR

38.242.237.196

50% confidence

Added

2026-08-09

IPv4 Address

TLP:CLEAR

38.242.204.245

50% confidence

Added

2026-08-09

IPv4 Address

TLP:CLEAR

213.136.80.73

50% confidence

Added

2026-08-09

Domain

TLP:CLEAR

bootstrap.sh

50% confidence

Added

2026-08-09

Domain

TLP:CLEAR

monitor.py

50% confidence

Added

2026-08-09

Domain

TLP:CLEAR

worm.py

50% confidence

Added

2026-08-09

Domain

TLP:CLEAR

lateral.py

50% confidence

Added

2026-08-09

Domain

TLP:CLEAR

check.sh

50% confidence

Added

2026-08-09

Domain

TLP:CLEAR

utils.py

50% confidence

Added

2026-08-09

IPv4 Address

TLP:CLEAR

38.242.245.147

50% confidence

Added

2026-08-09

Domain

TLP:CLEAR

cdn.cloudfront-js.com

PCPJack | Cloud Worm Evicts TeamPCP and Steals Credentials at Scale

75% confidence

Added

2026-05-10

SHA-1 Hash

TLP:CLEAR

9c7ab48c9fdbbeecdad8433529bdab38584f0e25

PCPJack | Cloud Worm Evicts TeamPCP and Steals Credentials at Scale

75% confidence

Added

2026-05-10

SHA-1 Hash

TLP:CLEAR

a20a9924d92c2b06d82b79c0fe87451c650cabec

PCPJack | Cloud Worm Evicts TeamPCP and Steals Credentials at Scale

75% confidence

Added

2026-05-10

SHA-1 Hash

TLP:CLEAR

c2dd8051d89c4efa71bd67d2df7d9b4bc3e67810

PCPJack | Cloud Worm Evicts TeamPCP and Steals Credentials at Scale

75% confidence

Added

2026-05-10

SHA-1 Hash

TLP:CLEAR

fed52a4bbac7b5b6ae4f76cab3eadd67e79227e3

PCPJack | Cloud Worm Evicts TeamPCP and Steals Credentials at Scale

75% confidence

Added

2026-05-10

URL

TLP:CLEAR

https://cdn.cloudfront-js.com:8443/u

PCPJack | Cloud Worm Evicts TeamPCP and Steals Credentials at Scale

75% confidence

Added

2026-05-10

SHA-1 Hash

TLP:CLEAR

0b86434ca5145636d745222f7e49c903ce6ef538

PCPJack | Cloud Worm Evicts TeamPCP and Steals Credentials at Scale

75% confidence

Added

2026-05-10

SHA-1 Hash

TLP:CLEAR

2cd2c5268e41cdece1b0506bcda3b9eba2998119

PCPJack | Cloud Worm Evicts TeamPCP and Steals Credentials at Scale

75% confidence

Added

2026-05-10

SHA-1 Hash

TLP:CLEAR

2fab324eb0d927846c8744dc0e217beea65138e0

PCPJack | Cloud Worm Evicts TeamPCP and Steals Credentials at Scale

75% confidence

Added

2026-05-10

SHA-1 Hash

TLP:CLEAR

339cbf61c80f757085c5afb7304d69f323bdf87a

PCPJack | Cloud Worm Evicts TeamPCP and Steals Credentials at Scale

75% confidence

Added

2026-05-10

SHA-1 Hash

TLP:CLEAR

6060da100b5cd587131a1c11a20d6e0108604744

PCPJack | Cloud Worm Evicts TeamPCP and Steals Credentials at Scale

75% confidence

Added

2026-05-10

SHA-1 Hash

TLP:CLEAR

848ef1f638807826586802428a7ebafdc710915c

PCPJack | Cloud Worm Evicts TeamPCP and Steals Credentials at Scale

75% confidence

Added

2026-05-10

Domain

TLP:CLEAR

lastpass-login-help.com

PCPJack | Cloud Worm Evicts TeamPCP and Steals Credentials at Scale

75% confidence

Added

2026-05-10

MD5 Hash

TLP:CLEAR

b8e7288656eca9750a5490aa96d3594b

PCPJack | Cloud Worm Evicts TeamPCP and Steals Credentials at Scale

75% confidence

Added

2026-05-10

SHA-1 Hash

TLP:CLEAR

005587975a483876c1fa26b64b418931019be38f

PCPJack | Cloud Worm Evicts TeamPCP and Steals Credentials at Scale

75% confidence

Added

2026-05-10

SHA-1 Hash

TLP:CLEAR

01cebc48016395e284ac76afc1816f143ee3e7b6

PCPJack | Cloud Worm Evicts TeamPCP and Steals Credentials at Scale

75% confidence

Added

2026-05-10

SHA-256 Hash

TLP:CLEAR

e41c635e4c3514e266d143d544ad1abde5db3dcfe6cccdf9bb7a218003f8ab6a

PCPJack | Cloud Worm Evicts TeamPCP and Steals Credentials at Scale

75% confidence

Added

2026-05-10