Remote profile

#xworm SHA256: 7fa93a5eea3d26ac6bc5054d77b393dbd2a3ba93b26b084df5921b727451b83e C2: t2d2[.]ddns[.]net:4444

#xworm SHA256: 7fa93a5eea3d26ac6bc5054d77b393dbd2a3ba93b26b084df5921b727451b83e C2: t2d2[.]ddns[.]net:4444

#PowerShellMeterpreter SHA256: db45b65ad87f069c181058f0de529be8fb2b353c7713804262abbe4ddf805868 C2: 162[.]35[.]184[.]236:9001

#StagedC2 config observed at Sat Oct 24 13:39:03 2026 UTC, located at hXXps://pastebin[.]com/raw/bLNnCELn C2: node10[.]botkeep[.]cloud:8787 (IP: 195.32.64.31)

#StagedC2 config observed at Sat Oct 24 12:56:03 2026 UTC, located at hXXps://pastebin[.]com/raw/S4CkaWBC C2: vivo-rail[.]tun[.]ply[.]gg:26870 (IP: 147.185.221.218)

#StagedC2 config observed at Sat Oct 24 12:45:04 2026 UTC, located at hXXps://pastebin[.]com/raw/rmHCXeRk C2: vivo-asset[.]tun[.]ply[.]gg:26780 (IP: 147.185.221.214)

#StagedC2 config observed at Sat Oct 24 11:40:04 2026 UTC, located at hXXps://pastebin[.]com/raw/PyEiZiMH C2: 46[.]109[.]90[.]127:27771

#StagedC2 config observed at Sat Oct 24 01:02:02 2026 UTC, located at hXXps://pastebin[.]com/raw/QwwdjMw6 C2: bladeee-56812[.]portmap[.]host:56812 (IP: 193.161.193.99)

#ZHacker13ReverseTCPShell SHA256: a4e9a43b745abe74a2d1202d3da419c09f17757918f5c50297a2ad33b3d47612 C2: 100[.]64[.]39[.]92:4444

#StagedC2 config observed at Fri Oct 23 14:23:03 2026 UTC, located at hXXps://pastebin[.]com/raw/Dm8JM0Xs C2: easkfooa-46769[.]portmap[.]host:46769 (IP: 193.161.193.99)

#StagedC2 config observed at Thu Oct 22 23:55:02 2026 UTC, located at hXXps://pastebin[.]com/raw/dC3YXmD8 C2: rails-kirk[.]tun[.]ply[.]gg:28466 (IP: 209.25.140.16)

#StagedC2 config observed at Thu Oct 22 14:47:05 2026 UTC, located at hXXps://pastebin[.]com/raw/t9xB7e0u C2: hinlok-54059[.]portmap[.]host:54059 (IP: 193.161.193.99)

#StagedC2 config observed at Thu Oct 22 14:46:05 2026 UTC, located at hXXps://pastebin[.]com/raw/g5adTtEn C2: hinlok-54059[.]portmap[.]host:54059 (IP: 193.161.193.99)

#StagedC2 config observed at Thu Oct 22 14:38:02 2026 UTC, located at hXXps://pastebin[.]com/raw/RPtXAj8i C2: sjplzunm7n[.]localto[.]net:4610 (IP: 23.158.232.71)

#StagedC2 config observed at Thu Oct 22 13:18:01 2026 UTC, located at hXXps://pastebin[.]com/raw/0K3nq1Hj C2: eddyybankster-30386[.]portmap[.]host:30386 (IP: 193.161.193.99)

#StagedC2 config observed at Thu Oct 22 13:08:02 2026 UTC, located at hXXps://pastebin[.]com/raw/G4bgmabK C2: easfkooa-44140[.]portmap[.]host:44140 (IP: 193.161.193.99)

#StagedC2 config observed at Thu Oct 22 12:22:03 2026 UTC, located at hXXps://pastebin[.]com/raw/yXDN7SRV C2: sjplzunm7n[.]localto[.]net:6125 (IP: 23.158.232.71)

#StagedC2 config observed at Thu Oct 22 12:21:02 2026 UTC, located at hXXps://pastebin[.]com/raw/bpGZKFTM C2: sjplzunm7n[.]localto[.]net:6125 (IP: 23.158.232.71)

#ZHacker13ReverseTCPShell SHA256: fc81d726c5ebe5db6ee4921c657c3eed66eb4cecb5c31124f8efb127bd27115e C2: 162[.]35[.]184[.]236:9001

#ZHacker13ReverseTCPShell SHA256: 5f6d1f32c2cc9a158bd0b4356f80e851250a50d223881dfbd5aa541fc9c69523 C2: 162[.]35[.]184[.]236:9001

#StagedC2 config observed at Wed Oct 21 21:19:03 2026 UTC, located at hXXps://pastebin[.]com/raw/7aVj9pym C2: sjplzunm7n[.]localto[.]net:7122 (IP: 23.158.232.71)

#StagedC2 config observed at Wed Oct 21 21:18:02 2026 UTC, located at hXXps://pastebin[.]com/raw/URMSYBax C2: sjplzunm7n[.]localto[.]net:7122 (IP: 23.158.232.71)

#StagedC2 config observed at Wed Oct 21 20:36:02 2026 UTC, located at hXXps://pastebin[.]com/raw/LnM11PNA C2: Si-One1-45435[.]portmap[.]host:45435 (IP: 193.161.193.99)

#StagedC2 config observed at Wed Oct 21 20:31:03 2026 UTC, located at hXXps://pastebin[.]com/raw/wXCwia4X C2: Si-One1-45435[.]portmap[.]host:45435 (IP: 193.161.193.99)

#StagedC2 config observed at Wed Oct 21 14:45:03 2026 UTC, located at hXXps://pastebin[.]com/raw/GeEJKRAf C2: hoaiphong[.]ddns[.]net:5555 (IP: 116.100.243.183)

#StagedC2 config observed at Wed Oct 21 05:54:03 2026 UTC, located at hXXps://pastebin[.]com/raw/HSujSEcH C2: agewgwevwgwevewhwe-48323[.]portmap[.]host:48323 (IP: 193.161.193.99)

#StagedC2 config observed at Tue Oct 20 18:17:02 2026 UTC, located at hXXps://pastebin[.]com/raw/p0NRpAyG C2: microsoft[.]localto[.]net:6967 (IP: 89.163.135.20)

#StagedC2 config observed at Tue Oct 20 14:56:04 2026 UTC, located at hXXps://pastebin[.]com/raw/bdQsAZH0 C2: 200[.]9[.]154[.]230:80

#StagedC2 config observed at Tue Oct 20 11:15:03 2026 UTC, located at hXXps://pastebin[.]com/raw/yi0iFrM1 C2: 130[.]49[.]213[.]211:20300

#StagedC2 config observed at Mon Oct 19 18:20:03 2026 UTC, located at hXXps://pastebin[.]com/raw/Sm4Xth3T C2: gtavragempserver-53103[.]portmap[.]host:53103 (IP: 193.161.193.99)