Skip to content

[pull] master from Neo23x0:master #148

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We鈥檒l occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
pull merged 6 commits into from
Aug 31, 2026
Merged

[pull] master from Neo23x0:master #148

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
6 commits
Select commit Hold shift + click to select a range
409eddf
Create apt_virtualizor_compromise_aug26.yar
cod3nym Aug 31, 2026
58502f1
add c2 icos for virtualizor compromise
cod3nym Aug 31, 2026
45d92e1
add filename iocs for virtualizor compromise
cod3nym Aug 31, 2026
315caa4
add hash iocs for virtualizor compromise
cod3nym Aug 31, 2026
aa48c8a
Update yara/apt_virtualizor_compromise_aug26.yar
Neo23x0 Aug 31, 2026
278165d
Merge pull request #417 from cod3nym/apt-virtualizor-compromise
Neo23x0 Aug 31, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
4 changes: 4 additions & 0 deletions iocs/c2-iocs.txt
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -1931,4 +1931,8 @@ ebix.portal-career.com
ebix-exam.com
ebix.recruitment-flow.com

# Virtualizer Compromise IOCs https://lowendtalk.com/discussion/220625/urgent-virtualizor-compromised-31st-aug/p1
cdn.nerat.cc;90
connect.ne-rat.xyz;90

# Last Line
5 changes: 5 additions & 0 deletions iocs/filename-iocs.txt
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -4583,4 +4583,9 @@ C:\\ProgramData\\Microsoft\\mcrypto\.chiper;85
\\2FAGuard\\main\.dll;85
\\2FAGuard\\setup\.exe\.config;85

# Virtualizor Compromise IOCs https://lowendtalk.com/discussion/220625/urgent-virtualizor-compromised-31st-aug/p1
/tmp/widdow\.jar;75
/tmp/\.vz_svc_done;75
/etc/systemd/system/java\-jre\-update\.service;75

# End
2 changes: 2 additions & 0 deletions iocs/hash-iocs.txt
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -3376,3 +3376,5 @@ aea55e42c4436236278e5692d3dcbcbe5fe6ce0b;DAEMON Tools Lite supplychain compromis
2d4eb55b01f59c62c6de9aacba9b47267d398fe4;DAEMON Tools Lite supplychain compromise IOCs https://securelist.com/tr/daemon-tools-backdoor/119654/
9dbfc23ebf36b3c0b56d2f93116abb32656c42e4;DAEMON Tools Lite supplychain compromise IOCs https://securelist.com/tr/daemon-tools-backdoor/119654/
295ce86226b933e7262c2ce4b36bdd6c389aaaef;DAEMON Tools Lite supplychain compromise IOCs https://securelist.com/tr/daemon-tools-backdoor/119654/

b81a4e1fab9fc4e404d57224fe71e2c143aa93942bd46998789bdc944a7870c7;Virtualizor Compromise IOCs https://lowendtalk.com/discussion/220625/urgent-virtualizor-compromised-31st-aug/p1
40 changes: 40 additions & 0 deletions yara/apt_virtualizor_compromise_aug26.yar
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,40 @@
rule APT_Virtualizor_Compromise_ForensicArtifacts_Aug26 {
meta:
description = "Detects forensic artifacts found in a campaign against compromised hosting providers using Virtualizor software"
author = "Florian Roth"
date = "2026-08-31"
reference = "https://lowendtalk.com/discussion/220625/urgent-virtualizor-compromised-31st-aug/p1"
score = 75
strings:
$x1 = "AAAAC3NzaC1lZDI1NTE5AAAAIP13pPAm5jmInLQYD3XNb3HwrW4cAKDcphoT4kSKrnte"
$x2 = "/tmp/.vz_svc_done"
$x3 = "/tmp/widdow.jar"
$x4 = "31.77.220.138:2025" // Java connection

$sa1 = "proxyuser"
$sb1 = "193.32.127.248"
condition:
filesize < 5MB
and (
1 of ($x*)
or all of ($s*)
)
}

rule APT_Virtualizor_Compromise_Payload_Aug26 {
meta:
description = "Detects java based payload used in a campaign against compromised hosting providers using Virtualizor software"
author = "Jonathan Peters (cod3nym)"
date = "2026-08-31"
reference = "https://lowendtalk.com/discussion/220625/urgent-virtualizor-compromised-31st-aug/p1"
hash = "b81a4e1fab9fc4e404d57224fe71e2c143aa93942bd46998789bdc944a7870c7"
score = 80
strings:
$s1 = "net/ikvm/clientvds/stresser/methods/impl/l4/minecraft/protocollib/" ascii
$s2 = "oshi/util/VirtualizationDetector" ascii
$s3 = "META-INF/proguard/base.proUT" ascii
condition:
uint16(0) == 0x4b50
and filesize < 20MB
and all of them
}
Loading