MALICIOUS (1) campaign cataloged at 2025-05-11(2).
- The campaign has clearly malicious intent, like infostealers.
- This is just the date of creating the catalog entry. It may not reflect the date of creation of the campaign itself.
2025-05-free-internet-dns¶
Installing the package installs a backdoor (a qsocket.io) and automatically uploads access credentials (from the output of the qsocket client) to the remote server.
Abuse categories¶
backdoor
Campaign uses backdoor.
revshell
The package contains code to create a reverse shell, allowing an attacker to execute any commands on the victim's machine.
IoCs & related URLs¶
URLs with payloads, characteristic domains, C&C IPs, repositories with malicious code, etc.
hxxp://165.227.81.186:5050/upload