malware-ioc - This repository contains indicators of compromise

项目说明

PRODAFT Threat Intelligence

This repository contains indicators of compromise (IOCs) of our in.

Threat Actors

| A | Threat Actors | Description | Moti |
|-------|----------------|--------------|------------|
| !ArcaneMantisImage | ArcaneMantis | Arcane Mantis (a.k.a. Vice Society, Rhysida) is a ransomware group that first appeared in the summer of 2021. | Ransomware |
| !CrypticSil | CrypticSil | Cryptic Sil, also known as Evil Corp, is a notorious Russian cybercriminal group acti at least 2007. | Organized Crime |
| !DiabolicLadybugImage | DiabolicLadybug | Diabolic Ladybug, also known as TA505, is a financially motivated cybercriminal group acti at least 2014, known for orchestrating large-scale malicious email campaigns to distribute malware families. | Financial Crime |
| !ElysianMantisImage | ElysianMantis | Elysian Mantis, also known as Conti, was a ransomware group active from 2019 to 2022, known for operating a ransomware-as-a-service (RaaS) model.. | Ransomware |
| !LAR | LAR | LAR, also known as Brunhilda, is the threat actor behind the Brunhilda DaaS operation, an Android malware dropper targeting banking apps, cryptocurrency wallets, and social media platforms in specific regions. | Criminal Service |
| !LAR | LAR | LAR, also known as CryptoChameleon, UNK-12, or Perm, is a cybercriminal threat actor specializing in ad phishing campaigns targeting cryptocurrency users and exchanges like Binance, Uphold, and Kraken. | Criminal Service |
| !LAR | LARVA-15 | LARVA-15, also known as Wazawaka and identified as Mikhail Pa Matveev, is a prominent cybercriminal linked to ransomware groups such as Monti, Ragnar Locker, NoEscape, and LockBit RaaS. | Initial Access Broker |
| !LAR | LARVA-17 | LARVA-17, a.k.a. Adminko, is a threat actor behind a phishing email campaign first observed in 2020, targeting users in Europe. | Financial Crime |
| !LAR | LARVA-18 | LARVA-18, publicly known as Tramp or TA577, is a prolific cybercrime threat actor tracked by cybersecurity researchers since mid-2020. | Initial Access Broker |
| !LAR | LAR | LAR, also known as "EncryptHub," is a cybercriminal threat actor specializing in highly sophisticated spear-phishing attacks. | Initial Access Broker |
| !LAR | LAR | LAR is a cybercriminal group operating a large-scale cryptocurrency scam through phishing websites. They exploit by enforcing deposit-based account , pre withdrawals while coercing further deposits. The group uses automated domain rotation, pri registrations, and CDN services to evade takedowns. | Financial Crime |
| !LAR | LARVA-39 | LARVA-39, also known as PTI-249, is the de and maintainer of PcWebControl, a Remote Access Trojan (RAT) used by threat actors primarily for financial crimes and ransomware attacks. | Criminal Service |
| !LAR | LAR | LAR, also known as fckcrpt, allegedly operates as a traffer, supplying malicious traffic to other criminals. | Criminal Service |
| !LAR | LARVA-47 | LARVA-47, commonly referred to as the RIG Exploit Kit operator, is a cybercriminal group that has been acti 2014.| Initial Access Broker |
| !LAR | LARVA-57 | LARVA-57, also known as PTI-257, is a sub-group within the cybercrime organization Wizard Spider (Mystical Sil), known for deploying LockBit ransomware in high-profile attacks. | Ransomware |
| !MysticalSil | MysticalSil | Mystical Sil (a.k.a Wizard Spider) is a sophisticated and financially motivated cybercrime group, known for its deployment of the TrickBot malware and the highly destructive Ryuk and Conti ransomware. | Organized Crime |
| !NebulousMantis | NebulousMantis | Nebulous Mantis (a.k.a. Cuba, STORM-0978, Tropical Scorpius, UNC2596) is a Russian-speaking cyber espionage group that has actively deployed the RomCom remote access trojan (RAT) and Hancitor loader in targeted campaigns since mid-2019. Operating with geopolitical motives, the group primarily focuses on critical infrastructure, go agencies, political leaders, and NATO related defense organizations. | Ransomware |
| !PrimalSnailImage | PrimalSnail | Primal Snail, also known as Nomadic Octopus, is a Russian-speaking cyber espionage group acti at least 2014, primarily targeting Central Asian entities such as local go, diplomatic missions, and indi. | Espionage |
| !RuthlessMantisImage | RuthlessMantis | Ruthless Mantis, or PTI-288, is a ransomware group that employs double extortion by exfiltrating data before encrypting systems. They collaborate with numerous ransomware affiliate programs, such as Ragnar Locker, INC Ransom, and others, to enhance their operational reliability and expand their range of actions. | Ransomware |
| !Sa | Sa | Savage Ladybug (a.k.a. FIN7) is a sophisticated cybercriminal group notorious for targeting financial institutions, hospitality, and retail sectors.| Financial Crime |
| !SubtleSnailImage| SubtleSnail | Subtle Snail (UNC1549, TA455), an Iran-nexus espionage group linked to the Eclipsed Wasp (Charming Kitten) network, has been acti at least No 2022.| Espionage |
| !TenaciousMantisImage | TenaciousMantis | Tenacious Mantis, also known as LockBit, is a highly prolific ransomware group that operates under a Ransomware-as-a-Service (RaaS) model, allowing affiliates to utilize the ransomware for launching attacks. | Ransomware |
| !TranquilWaspImage | TranquilWasp | Tranquil Wasp (also known as UNC1151) is a sophisticated, state-sponsored threat actor linked to Belarus, primarily known for its cyber espionage and disinformation campaigns, including the infamous Ghostwriter operations. | State Sponsored |
| ! | | Mantis, also known as PYSA or Mespinoza, is a highly organized ransomware threat actor that primarily targets large organizations across sectors such as healthcare, education, and go. | Ransomware |

Malware

| Name | Description | Type |
|----------------|--------------|------------|
| FluBot | FluBot is a mobile banking Trojan that primarily targets Android devices through SMS phishing (smishing) campaigns. It spreads by sending malicious text messages containing links to fake websites that trick users into downloading the malware. | RAT |
| Gorilla | Gorilla is an e Android malware that focuses on SMS interception and persistent C2 communication while a permission restrictions and battery optimizations. It employs stealthy techniques and may introduce phishing or new persistence mechanisms in future . | Stealer |
| Kurisu | Kurisu is a malware known for targeting Windows systems. It operates by executing malicious payloads that has keylogger functionality, meaning it's created to spy on and capture e they type. | RAT |
| PlutoCrypt | PlutoCrypt is a of CryptoJoker ransomware. The decryptor in this repository has been de for PlutoCrypt - but with a small modification, it can also work for other CryptoJoker . | Ransomware |
| RagnarLoader | Ragnar Loader, also known as Sardonic, is a sophisticated toolkit of the Monstrous Mantis (a.k.a. Ragnar Locker) ransomware group, which has been inflicting targeted cyberattacks on organizations since its emergence in 2020. Ragnar Loader often referred to as the Ragnar Framework by its affiliates—plays an essential role by establishing persistent access to compromised systems and ensuring long-term fixation. | Loader |
| ShadowRansomware | Shadow ransomware is a custom-built ransomware that is written in the .NET platform. It is dubbed as shadow because of the extension of the encrypted files | Ransomware |
| Solarmarker | Solarmarker is a multi-stage, heavily obfuscated malware targeting thousands of globally. De changed several installation steps in time, such as the initial point of entry in MSI installation files, making this ad persistent threat even more dangerous. | Backdoor |
| AnubisBackdoor | A Python-based backdoor used by the Savage Ladybug group is de to provide remote access, execute commands, and steal data. It is obfuscated to avoid detection. | Backdoor |
| Skitnet | Skitnet is a multi-stage malware that uses Rust and Nim to execute a stealthy reverse shell over DNS, le encryption, manual mapping, and dynamic API resolution to evade detection. It also includes persistence mechanisms, remote access tools, and commands for data exfiltration, making it a threat.| Backdoor |
| Odyssey | Odyssey is an ad macOS-specific infostealer malware that is a rebranded of Poseidon. It has become a major threat by enhancing technical capabilities and le effecti, such as mal campaigns.| Stealer |
| AntiDot | AntiDot is a powerful Android botnet being sold as a Malware-as-a-Service (MaaS) by the threat actor LAR on underground forums. Packaged as a “3-in-1” solution, it includes its own loader, packer, and botnet infrastructure, making it easy for cybercriminals to deploy. | Botnet |
| Matanbuchus | Matanbuchus 3.0 is the latest of the well-known malware loader, and threat actors are already buzzing about it. This new release is a complete rewrite, now featuring DNS and HTTPS-based command and control, in-memory payload execution, reverse shell capabilities via WMI, and support for morphing builds to bypass detection. | Loader |
| CastleLoader | CastleLoader is a loader malware that first emerged in early 2025. Since its emergence, CastleLoader has been distributing information stealers and remote access trojans (RATs) through Cloudflare-themed Clickfix phishing attacks and fake Github repositories opened under the names of legitimate applications. | Loader |

Others

| Name | Description | Type |
|----------------|--------------|------------|
| CoreSecThree | CoreSecThree is a sophisticated framework first identified on February 17, 2022, and publicly recognized in early 2024. The framework employs an ad ClickFix technique that le social engineering tactics to compromise systems through malicious PowerShell execution. | Pay-per-install Service |
| Lucid | The Lucid Phishing-as-a-Service (PhAAS) platform, de by the XinXin group, facilitates large-scale phishing campaigns targeting global organizations, including postal and courier services. Utilizing ad technologies like RCS and iMessage, the group employs automated tools and e techniques to bypass detection. | Phishing-as-a-Service (PhAAS) |
| Private Encrypter | Threat actors, including Cuba Ransomware group, Wizard Spider and others, are using a private encrypting service to evade A. The system is designed explicitly for the Cobalt Strike beacons, making conducting reverse engineering on the samples challenging. | Encrypter |

Copyright © PRODAFT 2025

项目信息

开发语言：Python

Star 数：320

技术要点

该项目属于病毒分析方向的开源资源，代码结构清晰，适合安全研究人员学习参考。项目围绕This repository contains indicators of compromise (IOCs) of our various investigations.展开，提供了可运行的实现，对理解相关安全机制、工具原理与攻防技术具有较高的研究价值。

从技术实现角度看，此类项目的核心在于对底层原理的深入理解与工程化落地。开发者在研究过程中可以结合官方文档与社区讨论，梳理项目的初始化流程、核心模块职责与数据流转，逐步掌握其中的技术细节与设计思路。

使用与学习建议

1. 下载源码压缩包，解压到本地环境。

2. 根据项目类型准备对应的运行环境与依赖。

3. 按照 README 中的步骤完成配置与部署。

4. 在隔离的测试环境中运行验证，避免影响生产系统。

免责声明

本资源来源于开源社区，仅供安全研究、技术学习与合法授权范围内的攻防演练使用，请勿用于任何非法或侵害他人权益的用途。使用本项目产生的一切后果由使用者自行承担。