C2Agent - Llm-Operated Windows Malware With Mcp, Skills And Living-Off-The-Ai

Domains/URLs

agent.x90.dev

https://agent.x90.dev/data/copilot.txt

https://aibox.x90.dev

https://mcp.firecrawl.dev/v2/mcp

Hash

35fc649622dfea297cb2a37ce2b6a9f89733546a22a5d13410c96ff904126e92

14d7dee40dbe0fd62a9b0fb68b71b58616664bad620d32efeafe127ab599030d

07897df23a207350daacd466c09ffecf29593d9acca9617bbc4512dd3508f835

9bebb49772b14f7ff15b30c6b5657f67828418882ac18b123effea3bedef8618

d9c1ddf3d0d56a64d35ef4dd2862c39e336b0b2552ba9cd1085fd19882dbdc8d

966bf00ada3671379f56ec9851353b6cbccbbbdb5ad66eee01560ff057382000

04f29d72a1bdd4348880e25d2360319ae4ca637a173f2a3b051daf111a5811cf

6827a35e1ad79a0511d0b9445aeef97e23a0416e2184ce7463747fb2cba1900b

9cad1f8a5d858536d83e852d443ed0a01a09a8ecf848496880528d7c05a74f37

02b15d3d2a34e6d6eedda40319e3558bef164309eda3132d8ea625d35c24ed1c

319b8e424e113a465893d7b05de053fa22fd2219ee53d37364ab7b585ff603b7

5494c19618058553d769916b08cacbd42c68695416e4b9a9bc55cb0934a15ef5

88e418ac9d70caf9be2cd3482bc3c17541df97646bb16b3fea1752e2afdf946b

83fe8207e2fc66df527efe0331109625d841e9904bd8b609c21c603777125e38

f954028b957f02f2c73f3d670316a970997af0e1818f2e15304efd4424ef76fb

6f4ddcab4cb6007d308a63f371406ea17177d7444696b1fb62e474eed3207b56

87166fdeb09c4317b22b144d06881f35a2b7ff1fa24bfd2e1c520fe5cf68d533

074147b2f1687571ba2f0ca51037ab2274381b0d3cd3fa5cc63cafd371eb9a1b

aaea58096313c877495ab0c07de3217cefdf1bc9bd9d08df06b44881fe9b90a9

fec98965094b2c2da2f82c2bbcc302f767d63ad62e89976ce805717a1c3eb100

376cacae394932b14e23257d2e5a166f1a7ceb68a6135ba265c06c201cda731a

0a138c328634a1903ebe299eef049d6e516821c6ee17b3c8d023dcbb16207414

ea459c203b53e8bc6ba4aa11a4efda3b7bd97cd86ab7607b24debe0c1addf6f4

333470f4f2b85b5de18a37499ef1dbc0f3e1d5380cb2c1327f6de838c01f6a97

e6ad79c9c792c0337c7d19ad5e6c9e9d94b6355a45460bef2c72000fc3197292

18ad1fa64328c998a13cbae0c09f84114433c03872868475e455119a9acb9bed

8193e19521d27d513ca7c1c47b20f64a385a4189707efbe42483f5556f2c7f2b

215efb8405e32c9b59a95b560363fb4c51a6471e8c067938d67a464e33facd3c

70b726bc777779abddb7e9a4001f58a9f59faaf0f3a433859e149b0f44c655a3

9913432b854f344f3b3603a19aab9fec64a24f424b838bbe36ad9a1103e37079

3dcb6cd93093e01119614e40d2d8695ac29c6702482fb73b8c67bd6859d88c62

316c71f65517016ad58770410ca639b9c3bfb2f23ccd341cdaaf13375c829a26

Detection Query 1 :

domainname like "https://aibox.x90.dev" or url like "https://aibox.x90.dev" or siteurl like "https://aibox.x90.dev" or domainname like "agent.x90.dev" or url like "agent.x90.dev" or siteurl like "agent.x90.dev" or domainname like "https://agent.x90.dev/data/copilot.txt" or url like "https://agent.x90.dev/data/copilot.txt" or siteurl like "https://agent.x90.dev/data/copilot.txt" or domainname like "https://mcp.firecrawl.dev/v2/mcp" or url like "https://mcp.firecrawl.dev/v2/mcp" or siteurl like "https://mcp.firecrawl.dev/v2/mcp"

Detection Query 2 :

sha256hash IN ("333470f4f2b85b5de18a37499ef1dbc0f3e1d5380cb2c1327f6de838c01f6a97","35fc649622dfea297cb2a37ce2b6a9f89733546a22a5d13410c96ff904126e92","04f29d72a1bdd4348880e25d2360319ae4ca637a173f2a3b051daf111a5811cf","966bf00ada3671379f56ec9851353b6cbccbbbdb5ad66eee01560ff057382000","6827a35e1ad79a0511d0b9445aeef97e23a0416e2184ce7463747fb2cba1900b","aaea58096313c877495ab0c07de3217cefdf1bc9bd9d08df06b44881fe9b90a9","88e418ac9d70caf9be2cd3482bc3c17541df97646bb16b3fea1752e2afdf946b","70b726bc777779abddb7e9a4001f58a9f59faaf0f3a433859e149b0f44c655a3","9913432b854f344f3b3603a19aab9fec64a24f424b838bbe36ad9a1103e37079","14d7dee40dbe0fd62a9b0fb68b71b58616664bad620d32efeafe127ab599030d","02b15d3d2a34e6d6eedda40319e3558bef164309eda3132d8ea625d35c24ed1c","fec98965094b2c2da2f82c2bbcc302f767d63ad62e89976ce805717a1c3eb100","376cacae394932b14e23257d2e5a166f1a7ceb68a6135ba265c06c201cda731a","3dcb6cd93093e01119614e40d2d8695ac29c6702482fb73b8c67bd6859d88c62","d9c1ddf3d0d56a64d35ef4dd2862c39e336b0b2552ba9cd1085fd19882dbdc8d","f954028b957f02f2c73f3d670316a970997af0e1818f2e15304efd4424ef76fb","87166fdeb09c4317b22b144d06881f35a2b7ff1fa24bfd2e1c520fe5cf68d533","6f4ddcab4cb6007d308a63f371406ea17177d7444696b1fb62e474eed3207b56","319b8e424e113a465893d7b05de053fa22fd2219ee53d37364ab7b585ff603b7","18ad1fa64328c998a13cbae0c09f84114433c03872868475e455119a9acb9bed","9bebb49772b14f7ff15b30c6b5657f67828418882ac18b123effea3bedef8618","07897df23a207350daacd466c09ffecf29593d9acca9617bbc4512dd3508f835","83fe8207e2fc66df527efe0331109625d841e9904bd8b609c21c603777125e38","5494c19618058553d769916b08cacbd42c68695416e4b9a9bc55cb0934a15ef5","8193e19521d27d513ca7c1c47b20f64a385a4189707efbe42483f5556f2c7f2b","9cad1f8a5d858536d83e852d443ed0a01a09a8ecf848496880528d7c05a74f37","0a138c328634a1903ebe299eef049d6e516821c6ee17b3c8d023dcbb16207414","215efb8405e32c9b59a95b560363fb4c51a6471e8c067938d67a464e33facd3c","ea459c203b53e8bc6ba4aa11a4efda3b7bd97cd86ab7607b24debe0c1addf6f4","316c71f65517016ad58770410ca639b9c3bfb2f23ccd341cdaaf13375c829a26","074147b2f1687571ba2f0ca51037ab2274381b0d3cd3fa5cc63cafd371eb9a1b","e6ad79c9c792c0337c7d19ad5e6c9e9d94b6355a45460bef2c72000fc3197292")