Files
Every file in this archive, by family, with the hosts that served it where delivery was observed.
Families
VShell 9,222 · Cobalt Strike 948 · Meterpreter 194 · PureRAT 159 · Mozi 3 · Kaizen 2 · Adaptix 1 · Hajime 1 · Quasar-family 1 · VenomRAT 1
Most-served files first. An identified file had its family read from the file itself, by a sandbox run or by file analysis. The others take the family of the host that served them, and are known only by their first bytes (ELF or PE) or by a content-type header, which does not say what the file is.
VShell · 9,222 files · 1,690 hosts · 1,690 still listed
7,948 read from the file and 1,274 from sandbox runs that reached a live listener. A VShell loader’s only configuration is the address and port it calls. The listener key (vkey) and the salt arrive from the listener when the loader connects, so only sandbox runs that reached a live listener show them.
all 9,222 VShell files → · family page → · YARA rules (9,222 hashes) · hash list
Cobalt Strike · 948 files · 245 hosts · 245 still listed
5 identified by sandbox run and 943 identified by file analysis.
all 948 Cobalt Strike files → · family page → · YARA rules (948 hashes) · hash list
Meterpreter · 194 files · 1 host · 0 still listed
194 identified by file analysis.
all 194 Meterpreter files → · family page → · YARA rules (194 hashes) · hash list
PureRAT · 159 files · 159 hosts · 159 still listed
159 known only by a content-type header.
Mozi · 3 files · 965 hosts · 964 still listed
3 ELF files known only by their first bytes.
Kaizen · 2 files · no delivery observed
2 identified by file analysis.
Adaptix · 1 file · 1 host · 1 still listed
1 known only by a content-type header.
Hajime · 1 file · 153 hosts · 0 still listed
1 ELF file known only by its first bytes.
Quasar-family · 1 file · 1 host · 1 still listed
1 known only by a content-type header.
VenomRAT · 1 file · 1 host · 1 still listed
1 identified by sandbox run.
family page → · YARA rules (1 hash) · hash list
Recurring configuration values: config-key sha-256 · certificate cn · certificate sha-256 · certificate serial (hex)