Malware for Hire: The Story of Marsalek, a Malware-as-a-Service Operation

Domains/URLs

marsalek.cy     

telemetrydata.to

huehnchenfarm.ru

http://cdn.filepost.dev/file/filepost/uploads/ad/adac14669df84170ae21e99e542ff7d3.exe  

http://solaraexecutor.online/solara.zip   

https://cdn.discordapp.com/attachments/1406651955421384817/1453822535136186560/net-nuker.exe?ex=69517c3f&is=69502abf&hm4786f77b0db68586992f5e2f7f8961146ae3401cb3ae4edef52a69dce1392538&

https://cdn.discordapp.com/attachments/1406651955421384817/1455720862660563037/net-nuker.exe?ex=695a5e73&is=69590cf3&hm=

80369b451d7f9b20ebe4893adab9f7530dead3493e895aad7727b0b29ff1e50c&

https://files.catbox.moe/11b8bu.py       

https://github.com/shreddfv/Matcha-External/archive/refs/heads/main.zip

https://github.com/shreddfv/Matcha-External/raw/refs/heads/main/Matcha.exe   

https://github.com/shreddfv/Matrix-Hub-External-Cracked/blob/main/newuimatrix.exe?raw=true

https://github.com/shreddfv/Matrix-Hub-External-Cracked/raw/refs/heads/main/newuimatrix.exe

https://www.swiftexecutor.online/swift.zip        

http://130.12.180.43/files/6749237131/MVvd2DP.exe    

http://github.com/FomaNory/Roblox-Script-Executor/releases/download/Release/Executor.rar     

http://130.12.180.43/files/5532726588/cPr84lu.exe        

http://cdn.filepost.dev/file/filepost/uploads/ad/adac14669df84170ae21e99e542ff7d3.exe  

http://solaraexecutor.online/solara.zip   

https://cdn.filepost.dev/file/filepost/uploads/ad/adac14669df84170ae21e99e542ff7d3.exe 

https://cdn.discordapp.com/attachments/1406651955421384817/1455720862660563037/net-nuker.exe?ex=699af7f3&is=6999a673&hm=

6d372f7c5fc686135fedbc1943d7b1eff339fbfd91d26a62f3dddca1c1b7a884&

https://cdn.discordapp.com/attachments/1460394029215781075/1462929986381152378/netgen.exe?ex=696ffb38&is=696ea9b8&hm=50afe3eaad628cce1300d9571049357f09ae70fae17a56231736c335eda276de&

https://cdn.discordapp.com/attachments/1467511838848847997/1475468285955932232/szatum.exe?ex=699ee9ec&is=699d986c&hm=4d10ad22da0b18019744b491de4be40b31b336c4b42d4067e16e967bfc07e8f8&

https://cdn.discordapp.com/attachments/684808088372510766/1458557911142895737/Fortnite_tweaks.exe?ex=69601368&is=695ec1e8&hm=4c997f6b315b450a4db6f7079966ff58203b7ef66023a36e97b4b1131d515ce7&

Hash

c70728c7e1bb1369152817d732ae068c0cd6e3356343ca5ea3a916acdf6f3b97

98f138624ea96313dd5803356dc9428d230e535b5e775ed7cb4fc6dfd8397ab4

29f65faa96c9743e9ea1242dcb9d8a4a453b778f7dfb488c8add3f04ee087011

ae975e468c26c67a2618d0da28d671c1101d01979a10677abe658a7b40f221be

04b0dbddaa7791445adbaf7c47fe388d4ddad724b2a6b55463d2a81cacf3339d

075d2ad32039674a2c65d899ae6760adf2457fe6af93710d204cee69e318a858

0c6f22efc8212739358ee2ce3564ffd3d193a74c1197cfc90d6345e33655ddeb

206e7a9a9cb0767d356de26d2f3b6fca85552c2d89104f343fc2e20a64e1efa4

279b6b8621f61f63e1537f7225bef375fc497342a812904d8194b5a44df3efbe

fe510937483b1b79e9da1f1a18bc7fce21637c0ce7a5799259ee3d29e8364f1e

4067e5f3dea8180dc47ea8c737b0cd2b11d4dfd5ef65f9e5ff30049eb8762f3e

b75cc775a8c1f91d38dab69a9b7278b9ef7c84cf14435d374a6d7c2660e16c02

4067e5f3dea8180dc47ea8c737b0cd2b11d4dfd5ef65f9e5ff30049eb8762f3e

6fb6adb819a82bc9e7afdc83649af7e9e23daec19b45d19ed92f1877bc54acd9

091736aba514598513a936446a7776b1fa4585883bee38afb74cfe840176a8bc

76d90ab4ba2be337e1ae03f69d12bfa873357bd5a0f177274a95b66621139c59

b28bbedac88d0b52531cf344f25ef95fe364e0f3ff9e5105a119f379d83c6ebd

9327a55cb9e76aab18c404ae4c4b95f2be50fce57c65ba7c0c16ff48193e84ae

3281e77e96bbd073ec8287928eadb2e47ba5337909800268bc9af0ee985def42

7387b1ff5c2d4cdff9abcdb078742f26373e479f883bdd472f1aff58969b4fb2

c12ffe59220fff73cabe6fd3cbec73a1c78df6988b742ae1d3a6458a82d135a7

714267c512e8cfec6a535cda85897d901dfca9761c678b82781177ff13ec5923

54ec316f639c97ec8b0cf321a8df32b1e9e2a19da91784f5575ed0a625ead811

2c1c38eb0c427ff5f2aaa3029cc4526f797676ee3ba154c6a980c39f9357e2df

c7691712d794d4ef582c591566bf5fda76a364b0bcdad315adbaaec8607ad0f3

9cf8bab29514d62595e148eb588f0cbecefb947d572c06b4547cff7ea4231747

e0866124208da639f6cde652d78a3d5e350ad99dbd008aa48dbd1475af4e93ff

9e4ea8b578475f18e092da73e56c0054261a881180d93f0909135bd6bdb4845d

Detection Query 1 :

domainname like "huehnchenfarm.ru" or url like "huehnchenfarm.ru" or siteurl like "huehnchenfarm.ru" or domainname like "http://solaraexecutor.online/solara.zip" or url like "http://solaraexecutor.online/solara.zip" or siteurl like "http://solaraexecutor.online/solara.zip" or domainname like "telemetrydata.to" or url like "telemetrydata.to" or siteurl like "telemetrydata.to" or domainname like "https://github.com/shreddfv/Matcha-External/archive/refs/heads/main.zip" or url like "https://github.com/shreddfv/Matcha-External/archive/refs/heads/main.zip" or siteurl like "https://github.com/shreddfv/Matcha-External/archive/refs/heads/main.zip" or domainname like "https://cdn.discordapp.com/attachments/1460394029215781075/1462929986381152378/netgen.exe?ex=696ffb38&is=696ea9b8&hm=50afe3eaad628cce1300d9571049357f09ae70fae17a56231736c335eda276de&" or url like "https://cdn.discordapp.com/attachments/1460394029215781075/1462929986381152378/netgen.exe?ex=696ffb38&is=696ea9b8&hm=50afe3eaad628cce1300d9571049357f09ae70fae17a56231736c335eda276de&" or siteurl like "https://cdn.discordapp.com/attachments/1460394029215781075/1462929986381152378/netgen.exe?ex=696ffb38&is=696ea9b8&hm=50afe3eaad628cce1300d9571049357f09ae70fae17a56231736c335eda276de&" or domainname like "http://cdn.filepost.dev/file/filepost/uploads/ad/adac14669df84170ae21e99e542ff7d3.exe" or url like "http://cdn.filepost.dev/file/filepost/uploads/ad/adac14669df84170ae21e99e542ff7d3.exe" or siteurl like "http://cdn.filepost.dev/file/filepost/uploads/ad/adac14669df84170ae21e99e542ff7d3.exe" or domainname like "https://github.com/shreddfv/Matcha-External/raw/refs/heads/main/Matcha.exe" or url like "https://github.com/shreddfv/Matcha-External/raw/refs/heads/main/Matcha.exe" or siteurl like "https://github.com/shreddfv/Matcha-External/raw/refs/heads/main/Matcha.exe" or domainname like "marsalek.cy" or url like "marsalek.cy" or siteurl like "marsalek.cy" or domainname like "https://github.com/shreddfv/Matrix-Hub-External-Cracked/blob/main/newuimatrix.exe?raw=true" or url like "https://github.com/shreddfv/Matrix-Hub-External-Cracked/blob/main/newuimatrix.exe?raw=true" or siteurl like "https://github.com/shreddfv/Matrix-Hub-External-Cracked/blob/main/newuimatrix.exe?raw=true" or domainname like "https://github.com/shreddfv/Matrix-Hub-External-Cracked/raw/refs/heads/main/newuimatrix.exe" or url like "https://github.com/shreddfv/Matrix-Hub-External-Cracked/raw/refs/heads/main/newuimatrix.exe" or siteurl like "https://github.com/shreddfv/Matrix-Hub-External-Cracked/raw/refs/heads/main/newuimatrix.exe" or domainname like "https://files.catbox.moe/11b8bu.py" or url like "https://files.catbox.moe/11b8bu.py" or siteurl like "https://files.catbox.moe/11b8bu.py" or domainname like "https://www.swiftexecutor.online/swift.zip" or url like "https://www.swiftexecutor.online/swift.zip" or siteurl like "https://www.swiftexecutor.online/swift.zip" or domainname like "http://130.12.180.43/files/5532726588/cPr84lu.exe" or url like "http://130.12.180.43/files/5532726588/cPr84lu.exe" or siteurl like "http://130.12.180.43/files/5532726588/cPr84lu.exe" or domainname like "https://cdn.discordapp.com/attachments/684808088372510766/1458557911142895737/Fortnite_tweaks.exe?ex=69601368&is=695ec1e8&hm=4c997f6b315b450a4db6f7079966ff58203b7ef66023a36e97b4b1131d515ce7&" or url like "https://cdn.discordapp.com/attachments/684808088372510766/1458557911142895737/Fortnite_tweaks.exe?ex=69601368&is=695ec1e8&hm=4c997f6b315b450a4db6f7079966ff58203b7ef66023a36e97b4b1131d515ce7&" or siteurl like "https://cdn.discordapp.com/attachments/684808088372510766/1458557911142895737/Fortnite_tweaks.exe?ex=69601368&is=695ec1e8&hm=4c997f6b315b450a4db6f7079966ff58203b7ef66023a36e97b4b1131d515ce7&" or domainname like "http://github.com/FomaNory/Roblox-Script-Executor/releases/download/Release/Executor.rar" or url like "http://github.com/FomaNory/Roblox-Script-Executor/releases/download/Release/Executor.rar" or siteurl like "http://github.com/FomaNory/Roblox-Script-Executor/releases/download/Release/Executor.rar" or domainname like "http://130.12.180.43/files/6749237131/MVvd2DP.exe" or url like "http://130.12.180.43/files/6749237131/MVvd2DP.exe" or siteurl like "http://130.12.180.43/files/6749237131/MVvd2DP.exe" or domainname like "https://cdn.filepost.dev/file/filepost/uploads/ad/adac14669df84170ae21e99e542ff7d3.exe" or url like "https://cdn.filepost.dev/file/filepost/uploads/ad/adac14669df84170ae21e99e542ff7d3.exe" or siteurl like "https://cdn.filepost.dev/file/filepost/uploads/ad/adac14669df84170ae21e99e542ff7d3.exe" or domainname like "https://cdn.discordapp.com/attachments/1406651955421384817/1453822535136186560/net-nuker.exe?ex=69517c3f&is=69502abf&hm4786f77b0db68586992f5e2f7f8961146ae3401cb3ae4edef52a69dce1392538&" or url like "https://cdn.discordapp.com/attachments/1406651955421384817/1453822535136186560/net-nuker.exe?ex=69517c3f&is=69502abf&hm4786f77b0db68586992f5e2f7f8961146ae3401cb3ae4edef52a69dce1392538&" or siteurl like "https://cdn.discordapp.com/attachments/1406651955421384817/1453822535136186560/net-nuker.exe?ex=69517c3f&is=69502abf&hm4786f77b0db68586992f5e2f7f8961146ae3401cb3ae4edef52a69dce1392538&" or domainname like "https://cdn.discordapp.com/attachments/1406651955421384817/1455720862660563037/net-nuker.exe?ex=695a5e73&is=69590cf3&hm=

80369b451d7f9b20ebe4893adab9f7530dead3493e895aad7727b0b29ff1e50c&" or url like "https://cdn.discordapp.com/attachments/1406651955421384817/1455720862660563037/net-nuker.exe?ex=695a5e73&is=69590cf3&hm=80369b451d7f9b20ebe4893adab9f7530dead3493e895aad7727b0b29ff1e50c&" or siteurl like "https://cdn.discordapp.com/attachments/1406651955421384817/1455720862660563037/net-nuker.exe?ex=695a5e73&is=69590cf3&hm=

80369b451d7f9b20ebe4893adab9f7530dead3493e895aad7727b0b29ff1e50c&" or domainname like "https://cdn.discordapp.com/attachments/1406651955421384817/1455720862660563037/net-nuker.exe?ex=699af7f3&is=6999a673&hm=

6d372f7c5fc686135fedbc1943d7b1eff339fbfd91d26a62f3dddca1c1b7a884&" or url like "https://cdn.discordapp.com/attachments/1406651955421384817/1455720862660563037/net-nuker.exe?ex=699af7f3&is=6999a673&hm=

6d372f7c5fc686135fedbc1943d7b1eff339fbfd91d26a62f3dddca1c1b7a884&" or siteurl like "https://cdn.discordapp.com/attachments/1406651955421384817/1455720862660563037/net-nuker.exe?ex=699af7f3&is=6999a673&hm=

6d372f7c5fc686135fedbc1943d7b1eff339fbfd91d26a62f3dddca1c1b7a884&" or domainname like "https://cdn.discordapp.com/attachments/1467511838848847997/1475468285955932232/szatum.exe?ex=699ee9ec&is=699d986c&hm=4d10ad22da0b18019744b491de4be40b31b336c4b42d4067e16e967bfc07e8f8&" or url like "https://cdn.discordapp.com/attachments/1467511838848847997/1475468285955932232/szatum.exe?ex=699ee9ec&is=699d986c&hm=4d10ad22da0b18019744b491de4be40b31b336c4b42d4067e16e967bfc07e8f8&" or siteurl like "https://cdn.discordapp.com/attachments/1467511838848847997/1475468285955932232/szatum.exe?ex=699ee9ec&is=699d986c&hm=4d10ad22da0b18019744b491de4be40b31b336c4b42d4067e16e967bfc07e8f8&"

Detection Query 2 :

sha256hash IN ("fe510937483b1b79e9da1f1a18bc7fce21637c0ce7a5799259ee3d29e8364f1e","b75cc775a8c1f91d38dab69a9b7278b9ef7c84cf14435d374a6d7c2660e16c02","e0866124208da639f6cde652d78a3d5e350ad99dbd008aa48dbd1475af4e93ff","6fb6adb819a82bc9e7afdc83649af7e9e23daec19b45d19ed92f1877bc54acd9","4067e5f3dea8180dc47ea8c737b0cd2b11d4dfd5ef65f9e5ff30049eb8762f3e","9cf8bab29514d62595e148eb588f0cbecefb947d572c06b4547cff7ea4231747","c12ffe59220fff73cabe6fd3cbec73a1c78df6988b742ae1d3a6458a82d135a7","075d2ad32039674a2c65d899ae6760adf2457fe6af93710d204cee69e318a858","54ec316f639c97ec8b0cf321a8df32b1e9e2a19da91784f5575ed0a625ead811","279b6b8621f61f63e1537f7225bef375fc497342a812904d8194b5a44df3efbe","0c6f22efc8212739358ee2ce3564ffd3d193a74c1197cfc90d6345e33655ddeb","9e4ea8b578475f18e092da73e56c0054261a881180d93f0909135bd6bdb4845d","04b0dbddaa7791445adbaf7c47fe388d4ddad724b2a6b55463d2a81cacf3339d","091736aba514598513a936446a7776b1fa4585883bee38afb74cfe840176a8bc","b28bbedac88d0b52531cf344f25ef95fe364e0f3ff9e5105a119f379d83c6ebd","206e7a9a9cb0767d356de26d2f3b6fca85552c2d89104f343fc2e20a64e1efa4","7387b1ff5c2d4cdff9abcdb078742f26373e479f883bdd472f1aff58969b4fb2","9327a55cb9e76aab18c404ae4c4b95f2be50fce57c65ba7c0c16ff48193e84ae","714267c512e8cfec6a535cda85897d901dfca9761c678b82781177ff13ec5923","ae975e468c26c67a2618d0da28d671c1101d01979a10677abe658a7b40f221be","76d90ab4ba2be337e1ae03f69d12bfa873357bd5a0f177274a95b66621139c59","c7691712d794d4ef582c591566bf5fda76a364b0bcdad315adbaaec8607ad0f3","2c1c38eb0c427ff5f2aaa3029cc4526f797676ee3ba154c6a980c39f9357e2df","c70728c7e1bb1369152817d732ae068c0cd6e3356343ca5ea3a916acdf6f3b97","98f138624ea96313dd5803356dc9428d230e535b5e775ed7cb4fc6dfd8397ab4","29f65faa96c9743e9ea1242dcb9d8a4a453b778f7dfb488c8add3f04ee087011","3281e77e96bbd073ec8287928eadb2e47ba5337909800268bc9af0ee985def42")