text: systemsetting.exe  BIOPASS RAT binary (PyInstaller)  Trojan.Win32.BIOPASS.A  b3bd28951789ef7cfaf659e07e198b45b04a2f3cde268e6ede4d4f877959341e  systemsetting.exe  BIOPASS RAT binary (PyInstaller)  Trojan.Win32.BIOPASS.A  e0caebfbd2804fcde30e75f2c6d06e84b3bf89ed85db34d6f628b25dca7a9a0f             YIZHI_SIGNED.exe  BIOPASS RAT binary (PyInstaller)  Trojan.Win32.BIOPASS.A  2503549352527cb0ffa1811a44481f6980961d98f9d5a96d5926d5676c31b9ee  socketio.exe  BIOPASS RAT binary (Nuitka)  Trojan.Win32.BIOPASS.A  8ba72a391fb653b2cc1e5caa6f927efdf46568638bb4fc25e6f01dc36a96533b  flashplayerpp_install_cn.exe  BIOPASS RAT binary (Nuitka)  Trojan.Win32.BIOPASS.A  e5fdb754c1a7c36c288c46765c9258bb2c7f38fa2a99188a623182f877da3783  beep.sys  Derusbi  Trojan.Win64.DERUSBI.C  a7e9e2bec3ad283a9a0b130034e822c8b6dfd26dda855f883a3a4ff785514f97  Browser_plugin (8).exe  Cobalt Strike Loader  Trojan.Win64.COBEACON.SUX        IP/Domain/URL  Note  webplus-cn-hongkong-s-5faf81e0d937f14c9ddbe5a0[.]oss-cn-hongkong[.]aliyuncs[.]com  Cloud storage bucket used to host BIOPASS RAT loaders  softres[.]oss-accelerate[.]aliyuncs[.]com  Cloud storage bucket used to host BIOPASS RAT loaders  flashdownloadserver[.]oss-cn-hongkong[.]aliyuncs[.]com  Cloud storage bucket used to host BIOPASS RAT modules and stolen data  lualibs[.]oss-cn-hongkong[.]aliyuncs[.]com  Cloud storage bucket used to host Cobalt Strike loader scripts  bps-rhk[.]oss-cn-hongkong[.]aliyuncs[.]com  Cloud storage bucket used for RTMP live streaming  ﻿wxdget[.]oss-cn-hongkong[.]aliyuncs[.]com  Cloud storage bucket used for storing stolen WeChat data  chinanode[.]microsoft-update-service[.]com:38080  BIOPASS RAT C&C server  0x3s[.]com  XSS attack domain  update[.]flash-installer[.]com  Associated fake installer domain  update[.]flash-installers[.]com  Associated fake installer domain  flash[.]com[.]cm  Associated fake installer domain  flash[.]com[.]se  Associated fake installer domain  flashi[.]com[.]cn  Associated fake installer domain  flash[.]co[.]cm  Associated fake installer domain  47[.]57[.]142[.]30  Cobalt Strike C&C server  47[.]57[.]186[.]151  Cobalt Strike C&C server  103[.]158[.]190[.]58  Cobalt Strike C&C server  207[.]148[.]100[.]49  Cobalt Strike C&C server  microsoft[.]update[.]flash[.]com.se  Cobalt Strike C&C server  hxxps://webplus-cn-hongkong-s-5faf81e0d937f14c9ddbe5a0[.]oss-cn-hongkong.aliyuncs[.]com/Silverlight_ins.exe  BIOPASS RAT loader download URL  hxxps://webplus-cn-hongkong-s-5faf81e0d937f14c9ddbe5a0.oss-cn-hongkong.aliyuncs[.]com/flash_ins[.]exe  BIOPASS RAT loader download URL  hxxp://softres.oss-accelerate[.]aliyuncs[.]com/Silverlight[.]exe  BIOPASS RAT loader download URL  hxxp://flashdownloadserver[.]oss-cn-hongkong.aliyuncs[.]com/res/big.txt  BIOPASS RAT script download URL  hxxp://flashdownloadserver[.]oss-cn-hongkong.aliyuncs[.]com/res/Online.txt  BIOPASS RAT script download URL  hxxp://flashdownloadserver[.]oss-cn-hongkong.aliyuncs[.]com/res/files.zip  Python runtime package download URL  hxxp://flashdownloadserver[.]oss-cn-hongkong.aliyuncs[.]com/res/ServiceHub.zip  Python runtime package download URL  hxxp://flashdownloadserver[.]oss-cn-hongkong.aliyuncs[.]com/res/c1222.txt  c1222 module script download URL  hxxp://flashdownloadserver[.]oss-cn-hongkong.aliyuncs[.]com/res/cdaemon.txt  cdaemon module download URL  hxxp://flashdownloadserver[.]oss-cn-hongkong.aliyuncs[.]com/res/x.txt  Cobalt Strike Python loader download URL  hxxp://lualibs.oss-cn-hongkong[.]aliyuncs.com/x86/1-CS-443.lua  Cobalt Strike Lua loader download URL  hxxp://flashdownloadserver[.]oss-cn-hongkong.aliyuncs[.]com/res/s.txt  Cobalt Strike shellcode download URL  hxxp://flashdownloadserver[.]oss-cn-hongkong.aliyuncs[.]com/res/sc2.txt  Cobalt Strike shellcode download URL  hxxp://flashdownloadserver[.]oss-cn-hongkong.aliyuncs[.]com/res/sc3.txt  Cobalt Strike shellcode download URL  hxxp://flashdownloadserver[.]oss-cn-hongkong.aliyuncs[.]com/res/csplugins/getwechatdb.txt  getwechatdb plug-in download URL  hxxp://flashdownloadserver[.]oss-cn-hongkong.aliyuncs[.]com/res/csplugins/wechat.txt  getwechatdb plug-in download URL  hxxp://flashdownloadserver[.]oss-cn-hongkong.aliyuncs[.]com/res/csplugins/xss_spoof.zip  xss_spoof plug-in download URL  hxxp://flashdownloadserver[.]oss-cn-hongkong.aliyuncs[.]com/res/csplugins/xss.txt  XSS payload download URL  hxxp://flashdownloadserver[.]oss-cn-hongkong.aliyuncs[.]com/res/csplugins/script.txt  XSS payload download URL  hxxp://0x3s[.]com/x[.]js  XSS injection URL         Tags  Malware | Endpoints | APT & Targeted Attacks | Research | Articles, News, Reports