Remus Info-Stealer Uses Blockchain-Anchored C2 and Fake Cracked Software Lures

Domains/URLs

aethersyncmatrix1.lol

aethersyncmatrix2.lol

aethersyncmatrix3.lol

aethersyncmatrix4.lol

aethersyncmatrix5.lol

aethersyncmatrix6.lol

aethersyncmatrix7.lol

aethersyncmatrix8.lol

aethersyncmatrix9.lol

aethersyncmatrix10.lol

neuralorbitgrid1.lol

neuralorbitgrid2.lol

neuralorbitgrid3.lol

neuralorbitgrid4.lol

neuralorbitgrid5.lol

neuralorbitgrid6.lol

neuralorbitgrid7.lol

neuralorbitgrid8.lol

neuralorbitgrid9.lol

neuralorbitgrid10.lol

quantumbytehub1.lol

quantumbytehub2.lol

quantumbytehub3.lol

quantumbytehub4.lol

quantumbytehub5.lol

quantumbytehub6.lol

quantumbytehub7.lol

quantumbytehub8.lol

quantumbytehub9.lol

quantumbytehub10.lol

tensorforgegrid1.lol

tensorforgegrid2.lol

tensorforgegrid3.lol

tensorforgegrid4.lol

tensorforgegrid5.lol

tensorforgegrid6.lol

tensorforgegrid7.lol

tensorforgegrid8.lol

tensorforgegrid9.lol

tensorforgegrid10.lol

neuralcorepulse1.lol

neuralcorepulse2.lol

neuralcorepulse3.lol

neuralcorepulse4.lol

neuralcorepulse5.lol

neuralcorepulse6.lol

neuralcorepulse7.lol

neuralcorepulse8.lol

neuralcorepulse9.lol

neuralcorepulse10.lol

vectorquantnexus1.lol

vectorquantnexus2.lol

vectorquantnexus3.lol

vectorquantnexus4.lol

vectorquantnexus5.lol

vectorquantnexus6.lol

vectorquantnexus7.lol

vectorquantnexus8.lol

vectorquantnexus9.lol

vectorquantnexus10.lol

omnidataflow1.lol

omnidataflow2.lol

omnidataflow3.lol

omnidataflow4.lol

omnidataflow5.lol

omnidataflow6.lol

omnidataflow7.lol

omnidataflow8.lol

omnidataflow9.lol

omnidataflow10.lol

vertexpulsecore1.lol

vertexpulsecore2.lol

vertexpulsecore3.lol

vertexpulsecore4.lol

vertexpulsecore5.lol

vertexpulsecore6.lol

vertexpulsecore7.lol

vertexpulsecore8.lol

vertexpulsecore9.lol

vertexpulsecore10.lol

metaforgechain1.lol

metaforgechain2.lol

metaforgechain3.lol

metaforgechain4.lol

metaforgechain5.lol

metaforgechain6.lol

metaforgechain7.lol

metaforgechain8.lol

metaforgechain9.lol

metaforgechain10.lol

digitalwavehub1.lol

digitalwavehub2.lol

digitalwavehub3.lol

digitalwavehub4.lol

digitalwavehub5.lol

digitalwavehub6.lol

digitalwavehub7.lol

digitalwavehub8.lol

digitalwavehub9.lol

digitalwavehub10.lol

alphagridnexus1.lol

alphagridnexus2.lol

alphagridnexus3.lol

alphagridnexus4.lol

alphagridnexus5.lol

alphagridnexus6.lol

alphagridnexus7.lol

alphagridnexus8.lol

alphagridnexus9.lol

alphagridnexus10.lol

neurostreamlink1.lol

neurostreamlink2.lol

neurostreamlink3.lol

neurostreamlink4.lol

neurostreamlink5.lol

neurostreamlink6.lol

neurostreamlink7.lol

neurostreamlink8.lol

neurostreamlink9.lol

neurostreamlink10.lol

hypercorevector1.lol

hypercorevector2.lol

hypercorevector3.lol

hypercorevector4.lol

hypercorevector5.lol

hypercorevector6.lol

hypercorevector7.lol

hypercorevector8.lol

hypercorevector9.lol

hypercorevector10.lol

cryptomeshforge1.lol

cryptomeshforge2.lol

cryptomeshforge3.lol

cryptomeshforge4.lol

cryptomeshforge5.lol

cryptomeshforge6.lol

cryptomeshforge7.lol

cryptomeshforge8.lol

cryptomeshforge9.lol

cryptomeshforge10.lol

aetherfluxnode1.lol

aetherfluxnode2.lol

aetherfluxnode3.lol

aetherfluxnode4.lol

aetherfluxnode5.lol

aetherfluxnode6.lol

aetherfluxnode7.lol

aetherfluxnode8.lol

aetherfluxnode9.lol

aetherfluxnode10.lol

quantumpulsegrid1.lol

quantumpulsegrid2.lol

quantumpulsegrid3.lol

quantumpulsegrid4.lol

quantumpulsegrid5.lol

quantumpulsegrid6.lol

quantumpulsegrid7.lol

quantumpulsegrid8.lol

quantumpulsegrid9.lol

quantumpulsegrid10.lol

stellarnodegrid1.lol

stellarnodegrid2.lol

stellarnodegrid3.lol

stellarnodegrid4.lol

stellarnodegrid5.lol

stellarnodegrid6.lol

stellarnodegrid7.lol

stellarnodegrid8.lol

stellarnodegrid9.lol

stellarnodegrid10.lol

orbitmeshlink1.lol

orbitmeshlink2.lol

orbitmeshlink3.lol

orbitmeshlink4.lol

orbitmeshlink5.lol

orbitmeshlink6.lol

orbitmeshlink7.lol

orbitmeshlink8.lol

orbitmeshlink9.lol

orbitmeshlink10.lol

nexuswavecore1.lol

nexuswavecore2.lol

nexuswavecore3.lol

nexuswavecore4.lol

nexuswavecore5.lol

nexuswavecore6.lol

nexuswavecore7.lol

nexuswavecore8.lol

nexuswavecore9.lol

nexuswavecore10.lol

datapulseforge1.lol

datapulseforge2.lol

datapulseforge3.lol

datapulseforge4.lol

datapulseforge5.lol

datapulseforge6.lol

datapulseforge7.lol

datapulseforge8.lol

datapulseforge9.lol

datapulseforge10.lol

cyberdriftmatrix1.lol

cyberdriftmatrix2.lol

cyberdriftmatrix3.lol

cyberdriftmatrix4.lol

cyberdriftmatrix5.lol

cyberdriftmatrix6.lol

cyberdriftmatrix7.lol

cyberdriftmatrix8.lol

cyberdriftmatrix9.lol

cyberdriftmatrix10.lol

vectorquantforge1.lol

vectorquantforge2.lol

vectorquantforge3.lol

vectorquantforge4.lol

vectorquantforge5.lol

vectorquantforge6.lol

vectorquantforge7.lol

vectorquantforge8.lol

vectorquantforge9.lol

vectorquantforge10.lol

neuralcoreflux1.lol

neuralcoreflux2.lol

neuralcoreflux3.lol

neuralcoreflux4.lol

neuralcoreflux5.lol

neuralcoreflux6.lol

neuralcoreflux7.lol

neuralcoreflux8.lol

neuralcoreflux9.lol

neuralcoreflux10.lol

fimmora.surf

zelpx.garden

tzpx.courses

fightwa.biz

chalx.live

fasea.top

noevara.shop

dikdiy.xyz

fluokq.xyz

approe.shop

dolmaq.shop

dreaub.top

pivotq.top

IP Address

147.135.84.14

143.244.141.187

165.227.123.79

77.42.90.175

167.99.78.100

148.230.76.66

Hash

f52809d57d816cf9ea7e95de64df46fcc1cf62d3da972c167497935b5eca74d7

51bfb2f390653647b087d789ef1559c3fdf220c565a909f1eee4d593893420dd

205fc66381b8e254508d40c693a1314c9fc2b94b8023b29483803c8b0e449c4d

da7935affcec91c317acf98b52eca551f2501b29ad502749e4c084492142c6eb

ece6e9395edb8935c993a2945ac196a614149d65f10212e912e4654981646e37

b29391ba505af508f2110f54f73b203e2710b8b6c8a8717005e5c7a4050630e1

231123d03fa985bdb4edbcc45fafc8f4fb93f692b00f6f37df81435cd0ff1c7b

35392a9849d7e9dfb4ee700a16700a94883fde859d57fdd891631bdbc6a75db0

6aa279fe9991405963ddf7ab18116fcde85190c2639b830791fe903d90697dec

7b092a35e70113f5165a653135cb3a7ca29312ceb0b4a874c160473d30830a60

80965fa878946421e5778044fcb16bc523206eb8f3853c0f833e9dbb87fe24f1

57c1b9fe23cd8220f39383c2ab5b392e8f1416cbf75e2668fc6426294abb818f

a84ab5bc2462fa6f673f22f59e759de458d4e561763af3be0bc3397564272347

e008c4e82cff39aa0f4c040944f8deeb80b06c50aab558e8b84e20c8ee453418

44d8e760012d6f08e91fd59176e59a3e13326f8079cdcc6e3a43b30f040769b6

d9da446bbb8adcb72c5c086705d58a8dad9d9268606e86568b893d122384b5b3

28c30dc88160f1fc44a5c11976f9de8da06be3c996d50ef76b0dbd032da210b6

1a398687d1f626e71c3beec3b0bda9589415babbcdae6171293c097d3103472e

fb5a654149e5bdb09b1453fa7679e32826e81abbaa0114ca02b13be6408a5ee3

Detection Query 1 :

domainname like "neurostreamlink6.lol" or url like "neurostreamlink6.lol" or siteurl like "neurostreamlink6.lol" or domainname like "fasea.top" or url like "fasea.top" or siteurl like "fasea.top" or domainname like "stellarnodegrid10.lol" or url like "stellarnodegrid10.lol" or siteurl like "stellarnodegrid10.lol" or domainname like "hypercorevector7.lol" or url like "hypercorevector7.lol" or siteurl like "hypercorevector7.lol" or domainname like "quantumpulsegrid9.lol" or url like "quantumpulsegrid9.lol" or siteurl like "quantumpulsegrid9.lol" or domainname like "hypercorevector3.lol" or url like "hypercorevector3.lol" or siteurl like "hypercorevector3.lol" or domainname like "hypercorevector2.lol" or url like "hypercorevector2.lol" or siteurl like "hypercorevector2.lol" or domainname like "neuralorbitgrid2.lol" or url like "neuralorbitgrid2.lol" or siteurl like "neuralorbitgrid2.lol" or domainname like "quantumpulsegrid5.lol" or url like "quantumpulsegrid5.lol" or siteurl like "quantumpulsegrid5.lol" or domainname like "aethersyncmatrix9.lol" or url like "aethersyncmatrix9.lol" or siteurl like "aethersyncmatrix9.lol" or domainname like "vertexpulsecore9.lol" or url like "vertexpulsecore9.lol" or siteurl like "vertexpulsecore9.lol" or domainname like "vectorquantforge4.lol" or url like "vectorquantforge4.lol" or siteurl like "vectorquantforge4.lol" or domainname like "noevara.shop" or url like "noevara.shop" or siteurl like "noevara.shop" or domainname like "nexuswavecore5.lol" or url like "nexuswavecore5.lol" or siteurl like "nexuswavecore5.lol" or domainname like "quantumbytehub6.lol" or url like "quantumbytehub6.lol" or siteurl like "quantumbytehub6.lol" or domainname like "neuralcoreflux7.lol" or url like "neuralcoreflux7.lol" or siteurl like "neuralcoreflux7.lol" or domainname like "metaforgechain6.lol" or url like "metaforgechain6.lol" or siteurl like "metaforgechain6.lol" or domainname like "orbitmeshlink9.lol" or url like "orbitmeshlink9.lol" or siteurl like "orbitmeshlink9.lol" or domainname like "tensorforgegrid8.lol" or url like "tensorforgegrid8.lol" or siteurl like "tensorforgegrid8.lol" or domainname like "cryptomeshforge8.lol" or url like "cryptomeshforge8.lol" or siteurl like "cryptomeshforge8.lol" or domainname like "cryptomeshforge3.lol" or url like "cryptomeshforge3.lol" or siteurl like "cryptomeshforge3.lol" or domainname like "alphagridnexus5.lol" or url like "alphagridnexus5.lol" or siteurl like "alphagridnexus5.lol" or domainname like "vectorquantforge7.lol" or url like "vectorquantforge7.lol" or siteurl like "vectorquantforge7.lol" or domainname like "vertexpulsecore5.lol" or url like "vertexpulsecore5.lol" or siteurl like "vertexpulsecore5.lol" or domainname like "hypercorevector9.lol" or url like "hypercorevector9.lol" or siteurl like "hypercorevector9.lol" or domainname like "quantumbytehub4.lol" or url like "quantumbytehub4.lol" or siteurl like "quantumbytehub4.lol" or domainname like "vertexpulsecore8.lol" or url like "vertexpulsecore8.lol" or siteurl like "vertexpulsecore8.lol" or domainname like "neuralorbitgrid5.lol" or url like "neuralorbitgrid5.lol" or siteurl like "neuralorbitgrid5.lol" or domainname like "digitalwavehub3.lol" or url like "digitalwavehub3.lol" or siteurl like "digitalwavehub3.lol" or domainname like "datapulseforge6.lol" or url like "datapulseforge6.lol" or siteurl like "datapulseforge6.lol" or domainname like "hypercorevector5.lol" or url like "hypercorevector5.lol" or siteurl like "hypercorevector5.lol" or domainname like "aetherfluxnode10.lol" or url like "aetherfluxnode10.lol" or siteurl like "aetherfluxnode10.lol" or domainname like "orbitmeshlink8.lol" or url like "orbitmeshlink8.lol" or siteurl like "orbitmeshlink8.lol" or domainname like "omnidataflow1.lol" or url like "omnidataflow1.lol" or siteurl like "omnidataflow1.lol" or domainname like "neuralcoreflux1.lol" or url like "neuralcoreflux1.lol" or siteurl like "neuralcoreflux1.lol" or domainname like "neuralcoreflux3.lol" or url like "neuralcoreflux3.lol" or siteurl like "neuralcoreflux3.lol" or domainname like "cyberdriftmatrix2.lol" or url like "cyberdriftmatrix2.lol" or siteurl like "cyberdriftmatrix2.lol" or domainname like "datapulseforge9.lol" or url like "datapulseforge9.lol" or siteurl like "datapulseforge9.lol" or domainname like "vectorquantnexus5.lol" or url like "vectorquantnexus5.lol" or siteurl like "vectorquantnexus5.lol" or domainname like "vectorquantnexus2.lol" or url like "vectorquantnexus2.lol" or siteurl like "vectorquantnexus2.lol" or domainname like "tensorforgegrid4.lol" or url like "tensorforgegrid4.lol" or siteurl like "tensorforgegrid4.lol" or domainname like "dikdiy.xyz" or url like "dikdiy.xyz" or siteurl like "dikdiy.xyz" or domainname like "vertexpulsecore1.lol" or url like "vertexpulsecore1.lol" or siteurl like "vertexpulsecore1.lol" or domainname like "vectorquantforge8.lol" or url like "vectorquantforge8.lol" or siteurl like "vectorquantforge8.lol" or domainname like "nexuswavecore4.lol" or url like "nexuswavecore4.lol" or siteurl like "nexuswavecore4.lol" or domainname like "aethersyncmatrix5.lol" or url like "aethersyncmatrix5.lol" or siteurl like "aethersyncmatrix5.lol" or domainname like "neuralorbitgrid8.lol" or url like "neuralorbitgrid8.lol" or siteurl like "neuralorbitgrid8.lol" or domainname like "neuralcoreflux9.lol" or url like "neuralcoreflux9.lol" or siteurl like "neuralcoreflux9.lol" or domainname like "stellarnodegrid4.lol" or url like "stellarnodegrid4.lol" or siteurl like "stellarnodegrid4.lol" or domainname like "quantumpulsegrid8.lol" or url like "quantumpulsegrid8.lol" or siteurl like "quantumpulsegrid8.lol" or domainname like "orbitmeshlink4.lol" or url like "orbitmeshlink4.lol" or siteurl like "orbitmeshlink4.lol" or domainname like "neuralorbitgrid1.lol" or url like "neuralorbitgrid1.lol" or siteurl like "neuralorbitgrid1.lol" or domainname like "quantumbytehub7.lol" or url like "quantumbytehub7.lol" or siteurl like "quantumbytehub7.lol" or domainname like "datapulseforge10.lol" or url like "datapulseforge10.lol" or siteurl like "datapulseforge10.lol" or domainname like "vertexpulsecore7.lol" or url like "vertexpulsecore7.lol" or siteurl like "vertexpulsecore7.lol" or domainname like "aethersyncmatrix10.lol" or url like "aethersyncmatrix10.lol" or siteurl like "aethersyncmatrix10.lol" or domainname like "quantumpulsegrid7.lol" or url like "quantumpulsegrid7.lol" or siteurl like "quantumpulsegrid7.lol" or domainname like "digitalwavehub8.lol" or url like "digitalwavehub8.lol" or siteurl like "digitalwavehub8.lol" or domainname like "nexuswavecore3.lol" or url like "nexuswavecore3.lol" or siteurl like "nexuswavecore3.lol" or domainname like "tensorforgegrid10.lol" or url like "tensorforgegrid10.lol" or siteurl like "tensorforgegrid10.lol" or domainname like "cryptomeshforge1.lol" or url like "cryptomeshforge1.lol" or siteurl like "cryptomeshforge1.lol" or domainname like "cyberdriftmatrix4.lol" or url like "cyberdriftmatrix4.lol" or siteurl like "cyberdriftmatrix4.lol" or domainname like "stellarnodegrid2.lol" or url like "stellarnodegrid2.lol" or siteurl like "stellarnodegrid2.lol" or domainname like "neuralcorepulse3.lol" or url like "neuralcorepulse3.lol" or siteurl like "neuralcorepulse3.lol" or domainname like "omnidataflow9.lol" or url like "omnidataflow9.lol" or siteurl like "omnidataflow9.lol" or domainname like "metaforgechain2.lol" or url like "metaforgechain2.lol" or siteurl like "metaforgechain2.lol" or domainname like "alphagridnexus7.lol" or url like "alphagridnexus7.lol" or siteurl like "alphagridnexus7.lol" or domainname like "cryptomeshforge2.lol" or url like "cryptomeshforge2.lol" or siteurl like "cryptomeshforge2.lol" or domainname like "orbitmeshlink6.lol" or url like "orbitmeshlink6.lol" or siteurl like "orbitmeshlink6.lol" or domainname like "cyberdriftmatrix5.lol" or url like "cyberdriftmatrix5.lol" or siteurl like "cyberdriftmatrix5.lol" or domainname like "cyberdriftmatrix7.lol" or url like "cyberdriftmatrix7.lol" or siteurl like "cyberdriftmatrix7.lol" or domainname like "digitalwavehub7.lol" or url like "digitalwavehub7.lol" or siteurl like "digitalwavehub7.lol" or domainname like "neuralorbitgrid7.lol" or url like "neuralorbitgrid7.lol" or siteurl like "neuralorbitgrid7.lol" or domainname like "neurostreamlink2.lol" or url like "neurostreamlink2.lol" or siteurl like "neurostreamlink2.lol" or domainname like "quantumbytehub10.lol" or url like "quantumbytehub10.lol" or siteurl like "quantumbytehub10.lol" or domainname like "neuralcoreflux5.lol" or url like "neuralcoreflux5.lol" or siteurl like "neuralcoreflux5.lol" or domainname like "neuralcorepulse6.lol" or url like "neuralcorepulse6.lol" or siteurl like "neuralcorepulse6.lol" or domainname like "vectorquantforge2.lol" or url like "vectorquantforge2.lol" or siteurl like "vectorquantforge2.lol" or domainname like "tensorforgegrid1.lol" or url like "tensorforgegrid1.lol" or siteurl like "tensorforgegrid1.lol"

Detection Query 2 :

domainname like "neuralcorepulse1.lol" or url like "neuralcorepulse1.lol" or siteurl like "neuralcorepulse1.lol" or domainname like "digitalwavehub5.lol" or url like "digitalwavehub5.lol" or siteurl like "digitalwavehub5.lol" or domainname like "aethersyncmatrix3.lol" or url like "aethersyncmatrix3.lol" or siteurl like "aethersyncmatrix3.lol" or domainname like "metaforgechain9.lol" or url like "metaforgechain9.lol" or siteurl like "metaforgechain9.lol" or domainname like "cyberdriftmatrix8.lol" or url like "cyberdriftmatrix8.lol" or siteurl like "cyberdriftmatrix8.lol" or domainname like "cryptomeshforge10.lol" or url like "cryptomeshforge10.lol" or siteurl like "cryptomeshforge10.lol" or domainname like "orbitmeshlink2.lol" or url like "orbitmeshlink2.lol" or siteurl like "orbitmeshlink2.lol" or domainname like "fluokq.xyz" or url like "fluokq.xyz" or siteurl like "fluokq.xyz" or domainname like "stellarnodegrid8.lol" or url like "stellarnodegrid8.lol" or siteurl like "stellarnodegrid8.lol" or domainname like "vectorquantforge6.lol" or url like "vectorquantforge6.lol" or siteurl like "vectorquantforge6.lol" or domainname like "omnidataflow6.lol" or url like "omnidataflow6.lol" or siteurl like "omnidataflow6.lol" or domainname like "cryptomeshforge9.lol" or url like "cryptomeshforge9.lol" or siteurl like "cryptomeshforge9.lol" or domainname like "neuralcorepulse8.lol" or url like "neuralcorepulse8.lol" or siteurl like "neuralcorepulse8.lol" or domainname like "quantumbytehub2.lol" or url like "quantumbytehub2.lol" or siteurl like "quantumbytehub2.lol" or domainname like "omnidataflow2.lol" or url like "omnidataflow2.lol" or siteurl like "omnidataflow2.lol" or domainname like "quantumbytehub5.lol" or url like "quantumbytehub5.lol" or siteurl like "quantumbytehub5.lol" or domainname like "digitalwavehub10.lol" or url like "digitalwavehub10.lol" or siteurl like "digitalwavehub10.lol" or domainname like "digitalwavehub9.lol" or url like "digitalwavehub9.lol" or siteurl like "digitalwavehub9.lol" or domainname like "aethersyncmatrix4.lol" or url like "aethersyncmatrix4.lol" or siteurl like "aethersyncmatrix4.lol" or domainname like "cyberdriftmatrix10.lol" or url like "cyberdriftmatrix10.lol" or siteurl like "cyberdriftmatrix10.lol" or domainname like "neuralcoreflux10.lol" or url like "neuralcoreflux10.lol" or siteurl like "neuralcoreflux10.lol" or domainname like "neurostreamlink9.lol" or url like "neurostreamlink9.lol" or siteurl like "neurostreamlink9.lol" or domainname like "hypercorevector4.lol" or url like "hypercorevector4.lol" or siteurl like "hypercorevector4.lol" or domainname like "omnidataflow8.lol" or url like "omnidataflow8.lol" or siteurl like "omnidataflow8.lol" or domainname like "omnidataflow5.lol" or url like "omnidataflow5.lol" or siteurl like "omnidataflow5.lol" or domainname like "hypercorevector8.lol" or url like "hypercorevector8.lol" or siteurl like "hypercorevector8.lol" or domainname like "neuralcorepulse10.lol" or url like "neuralcorepulse10.lol" or siteurl like "neuralcorepulse10.lol" or domainname like "datapulseforge8.lol" or url like "datapulseforge8.lol" or siteurl like "datapulseforge8.lol" or domainname like "neuralcorepulse4.lol" or url like "neuralcorepulse4.lol" or siteurl like "neuralcorepulse4.lol" or domainname like "digitalwavehub1.lol" or url like "digitalwavehub1.lol" or siteurl like "digitalwavehub1.lol" or domainname like "quantumbytehub1.lol" or url like "quantumbytehub1.lol" or siteurl like "quantumbytehub1.lol" or domainname like "vectorquantnexus8.lol" or url like "vectorquantnexus8.lol" or siteurl like "vectorquantnexus8.lol" or domainname like "tensorforgegrid2.lol" or url like "tensorforgegrid2.lol" or siteurl like "tensorforgegrid2.lol" or domainname like "tensorforgegrid3.lol" or url like "tensorforgegrid3.lol" or siteurl like "tensorforgegrid3.lol" or domainname like "alphagridnexus4.lol" or url like "alphagridnexus4.lol" or siteurl like "alphagridnexus4.lol" or domainname like "alphagridnexus8.lol" or url like "alphagridnexus8.lol" or siteurl like "alphagridnexus8.lol" or domainname like "aetherfluxnode4.lol" or url like "aetherfluxnode4.lol" or siteurl like "aetherfluxnode4.lol" or domainname like "aetherfluxnode9.lol" or url like "aetherfluxnode9.lol" or siteurl like "aetherfluxnode9.lol" or domainname like "orbitmeshlink1.lol" or url like "orbitmeshlink1.lol" or siteurl like "orbitmeshlink1.lol" or domainname like "orbitmeshlink10.lol" or url like "orbitmeshlink10.lol" or siteurl like "orbitmeshlink10.lol" or domainname like "datapulseforge2.lol" or url like "datapulseforge2.lol" or siteurl like "datapulseforge2.lol" or domainname like "cyberdriftmatrix1.lol" or url like "cyberdriftmatrix1.lol" or siteurl like "cyberdriftmatrix1.lol" or domainname like "cyberdriftmatrix6.lol" or url like "cyberdriftmatrix6.lol" or siteurl like "cyberdriftmatrix6.lol" or domainname like "dreaub.top" or url like "dreaub.top" or siteurl like "dreaub.top" or domainname like "quantumbytehub9.lol" or url like "quantumbytehub9.lol" or siteurl like "quantumbytehub9.lol" or domainname like "omnidataflow7.lol" or url like "omnidataflow7.lol" or siteurl like "omnidataflow7.lol" or domainname like "neurostreamlink1.lol" or url like "neurostreamlink1.lol" or siteurl like "neurostreamlink1.lol" or domainname like "metaforgechain4.lol" or url like "metaforgechain4.lol" or siteurl like "metaforgechain4.lol" or domainname like "omnidataflow4.lol" or url like "omnidataflow4.lol" or siteurl like "omnidataflow4.lol" or domainname like "digitalwavehub4.lol" or url like "digitalwavehub4.lol" or siteurl like "digitalwavehub4.lol" or domainname like "datapulseforge4.lol" or url like "datapulseforge4.lol" or siteurl like "datapulseforge4.lol" or domainname like "neurostreamlink7.lol" or url like "neurostreamlink7.lol" or siteurl like "neurostreamlink7.lol" or domainname like "neuralcorepulse7.lol" or url like "neuralcorepulse7.lol" or siteurl like "neuralcorepulse7.lol" or domainname like "fimmora.surf" or url like "fimmora.surf" or siteurl like "fimmora.surf" or domainname like "nexuswavecore1.lol" or url like "nexuswavecore1.lol" or siteurl like "nexuswavecore1.lol" or domainname like "vectorquantnexus1.lol" or url like "vectorquantnexus1.lol" or siteurl like "vectorquantnexus1.lol" or domainname like "stellarnodegrid6.lol" or url like "stellarnodegrid6.lol" or siteurl like "stellarnodegrid6.lol" or domainname like "cyberdriftmatrix3.lol" or url like "cyberdriftmatrix3.lol" or siteurl like "cyberdriftmatrix3.lol" or domainname like "vertexpulsecore4.lol" or url like "vertexpulsecore4.lol" or siteurl like "vertexpulsecore4.lol" or domainname like "neuralcorepulse2.lol" or url like "neuralcorepulse2.lol" or siteurl like "neuralcorepulse2.lol" or domainname like "alphagridnexus10.lol" or url like "alphagridnexus10.lol" or siteurl like "alphagridnexus10.lol" or domainname like "cryptomeshforge4.lol" or url like "cryptomeshforge4.lol" or siteurl like "cryptomeshforge4.lol" or domainname like "datapulseforge1.lol" or url like "datapulseforge1.lol" or siteurl like "datapulseforge1.lol" or domainname like "cyberdriftmatrix9.lol" or url like "cyberdriftmatrix9.lol" or siteurl like "cyberdriftmatrix9.lol" or domainname like "zelpx.garden" or url like "zelpx.garden" or siteurl like "zelpx.garden" or domainname like "alphagridnexus9.lol" or url like "alphagridnexus9.lol" or siteurl like "alphagridnexus9.lol" or domainname like "quantumpulsegrid1.lol" or url like "quantumpulsegrid1.lol" or siteurl like "quantumpulsegrid1.lol" or domainname like "quantumpulsegrid3.lol" or url like "quantumpulsegrid3.lol" or siteurl like "quantumpulsegrid3.lol" or domainname like "nexuswavecore8.lol" or url like "nexuswavecore8.lol" or siteurl like "nexuswavecore8.lol" or domainname like "metaforgechain8.lol" or url like "metaforgechain8.lol" or siteurl like "metaforgechain8.lol" or domainname like "orbitmeshlink7.lol" or url like "orbitmeshlink7.lol" or siteurl like "orbitmeshlink7.lol" or domainname like "digitalwavehub6.lol" or url like "digitalwavehub6.lol" or siteurl like "digitalwavehub6.lol" or domainname like "neuralcorepulse9.lol" or url like "neuralcorepulse9.lol" or siteurl like "neuralcorepulse9.lol" or domainname like "neuralcoreflux8.lol" or url like "neuralcoreflux8.lol" or siteurl like "neuralcoreflux8.lol" or domainname like "omnidataflow10.lol" or url like "omnidataflow10.lol" or siteurl like "omnidataflow10.lol" or domainname like "cryptomeshforge6.lol" or url like "cryptomeshforge6.lol" or siteurl like "cryptomeshforge6.lol" or domainname like "metaforgechain3.lol" or url like "metaforgechain3.lol" or siteurl like "metaforgechain3.lol" or domainname like "vertexpulsecore10.lol" or url like "vertexpulsecore10.lol" or siteurl like "vertexpulsecore10.lol" or domainname like "datapulseforge5.lol" or url like "datapulseforge5.lol" or siteurl like "datapulseforge5.lol" or domainname like "neuralorbitgrid3.lol" or url like "neuralorbitgrid3.lol" or siteurl like "neuralorbitgrid3.lol" or domainname like "cryptomeshforge5.lol" or url like "cryptomeshforge5.lol" or siteurl like "cryptomeshforge5.lol" or domainname like "tensorforgegrid6.lol" or url like "tensorforgegrid6.lol" or siteurl like "tensorforgegrid6.lol" or domainname like "orbitmeshlink3.lol" or url like "orbitmeshlink3.lol" or siteurl like "orbitmeshlink3.lol"

Detection Query 3 :

domainname like "nexuswavecore9.lol" or url like "nexuswavecore9.lol" or siteurl like "nexuswavecore9.lol" or domainname like "chalx.live" or url like "chalx.live" or siteurl like "chalx.live" or domainname like "neuralcorepulse5.lol" or url like "neuralcorepulse5.lol" or siteurl like "neuralcorepulse5.lol" or domainname like "quantumbytehub8.lol" or url like "quantumbytehub8.lol" or siteurl like "quantumbytehub8.lol" or domainname like "metaforgechain10.lol" or url like "metaforgechain10.lol" or siteurl like "metaforgechain10.lol" or domainname like "quantumpulsegrid2.lol" or url like "quantumpulsegrid2.lol" or siteurl like "quantumpulsegrid2.lol" or domainname like "neuralcoreflux6.lol" or url like "neuralcoreflux6.lol" or siteurl like "neuralcoreflux6.lol" or domainname like "fightwa.biz" or url like "fightwa.biz" or siteurl like "fightwa.biz" or domainname like "neuralorbitgrid10.lol" or url like "neuralorbitgrid10.lol" or siteurl like "neuralorbitgrid10.lol" or domainname like "vectorquantnexus3.lol" or url like "vectorquantnexus3.lol" or siteurl like "vectorquantnexus3.lol" or domainname like "nexuswavecore10.lol" or url like "nexuswavecore10.lol" or siteurl like "nexuswavecore10.lol" or domainname like "neurostreamlink10.lol" or url like "neurostreamlink10.lol" or siteurl like "neurostreamlink10.lol" or domainname like "aetherfluxnode2.lol" or url like "aetherfluxnode2.lol" or siteurl like "aetherfluxnode2.lol" or domainname like "dolmaq.shop" or url like "dolmaq.shop" or siteurl like "dolmaq.shop" or domainname like "orbitmeshlink5.lol" or url like "orbitmeshlink5.lol" or siteurl like "orbitmeshlink5.lol" or domainname like "vectorquantforge5.lol" or url like "vectorquantforge5.lol" or siteurl like "vectorquantforge5.lol" or domainname like "tensorforgegrid9.lol" or url like "tensorforgegrid9.lol" or siteurl like "tensorforgegrid9.lol" or domainname like "vertexpulsecore2.lol" or url like "vertexpulsecore2.lol" or siteurl like "vertexpulsecore2.lol" or domainname like "vertexpulsecore3.lol" or url like "vertexpulsecore3.lol" or siteurl like "vertexpulsecore3.lol" or domainname like "aethersyncmatrix1.lol" or url like "aethersyncmatrix1.lol" or siteurl like "aethersyncmatrix1.lol" or domainname like "vectorquantnexus9.lol" or url like "vectorquantnexus9.lol" or siteurl like "vectorquantnexus9.lol" or domainname like "hypercorevector10.lol" or url like "hypercorevector10.lol" or siteurl like "hypercorevector10.lol" or domainname like "nexuswavecore2.lol" or url like "nexuswavecore2.lol" or siteurl like "nexuswavecore2.lol" or domainname like "quantumpulsegrid10.lol" or url like "quantumpulsegrid10.lol" or siteurl like "quantumpulsegrid10.lol" or domainname like "datapulseforge7.lol" or url like "datapulseforge7.lol" or siteurl like "datapulseforge7.lol" or domainname like "metaforgechain5.lol" or url like "metaforgechain5.lol" or siteurl like "metaforgechain5.lol" or domainname like "neurostreamlink8.lol" or url like "neurostreamlink8.lol" or siteurl like "neurostreamlink8.lol" or domainname like "vectorquantnexus10.lol" or url like "vectorquantnexus10.lol" or siteurl like "vectorquantnexus10.lol" or domainname like "aetherfluxnode8.lol" or url like "aetherfluxnode8.lol" or siteurl like "aetherfluxnode8.lol" or domainname like "nexuswavecore7.lol" or url like "nexuswavecore7.lol" or siteurl like "nexuswavecore7.lol" or domainname like "datapulseforge3.lol" or url like "datapulseforge3.lol" or siteurl like "datapulseforge3.lol" or domainname like "aetherfluxnode6.lol" or url like "aetherfluxnode6.lol" or siteurl like "aetherfluxnode6.lol" or domainname like "quantumpulsegrid6.lol" or url like "quantumpulsegrid6.lol" or siteurl like "quantumpulsegrid6.lol" or domainname like "aethersyncmatrix6.lol" or url like "aethersyncmatrix6.lol" or siteurl like "aethersyncmatrix6.lol" or domainname like "neuralcoreflux2.lol" or url like "neuralcoreflux2.lol" or siteurl like "neuralcoreflux2.lol" or domainname like "aethersyncmatrix2.lol" or url like "aethersyncmatrix2.lol" or siteurl like "aethersyncmatrix2.lol" or domainname like "neurostreamlink4.lol" or url like "neurostreamlink4.lol" or siteurl like "neurostreamlink4.lol" or domainname like "vectorquantforge10.lol" or url like "vectorquantforge10.lol" or siteurl like "vectorquantforge10.lol" or domainname like "aethersyncmatrix8.lol" or url like "aethersyncmatrix8.lol" or siteurl like "aethersyncmatrix8.lol" or domainname like "hypercorevector1.lol" or url like "hypercorevector1.lol" or siteurl like "hypercorevector1.lol" or domainname like "vectorquantforge1.lol" or url like "vectorquantforge1.lol" or siteurl like "vectorquantforge1.lol" or domainname like "aetherfluxnode7.lol" or url like "aetherfluxnode7.lol" or siteurl like "aetherfluxnode7.lol" or domainname like "neuralorbitgrid6.lol" or url like "neuralorbitgrid6.lol" or siteurl like "neuralorbitgrid6.lol" or domainname like "metaforgechain1.lol" or url like "metaforgechain1.lol" or siteurl like "metaforgechain1.lol" or domainname like "stellarnodegrid3.lol" or url like "stellarnodegrid3.lol" or siteurl like "stellarnodegrid3.lol" or domainname like "vectorquantforge3.lol" or url like "vectorquantforge3.lol" or siteurl like "vectorquantforge3.lol" or domainname like "vertexpulsecore6.lol" or url like "vertexpulsecore6.lol" or siteurl like "vertexpulsecore6.lol" or domainname like "vectorquantnexus4.lol" or url like "vectorquantnexus4.lol" or siteurl like "vectorquantnexus4.lol" or domainname like "stellarnodegrid7.lol" or url like "stellarnodegrid7.lol" or siteurl like "stellarnodegrid7.lol" or domainname like "approe.shop" or url like "approe.shop" or siteurl like "approe.shop" or domainname like "alphagridnexus2.lol" or url like "alphagridnexus2.lol" or siteurl like "alphagridnexus2.lol" or domainname like "hypercorevector6.lol" or url like "hypercorevector6.lol" or siteurl like "hypercorevector6.lol" or domainname like "stellarnodegrid5.lol" or url like "stellarnodegrid5.lol" or siteurl like "stellarnodegrid5.lol" or domainname like "stellarnodegrid1.lol" or url like "stellarnodegrid1.lol" or siteurl like "stellarnodegrid1.lol" or domainname like "cryptomeshforge7.lol" or url like "cryptomeshforge7.lol" or siteurl like "cryptomeshforge7.lol" or domainname like "neuralcoreflux4.lol" or url like "neuralcoreflux4.lol" or siteurl like "neuralcoreflux4.lol" or domainname like "aetherfluxnode5.lol" or url like "aetherfluxnode5.lol" or siteurl like "aetherfluxnode5.lol" or domainname like "digitalwavehub2.lol" or url like "digitalwavehub2.lol" or siteurl like "digitalwavehub2.lol" or domainname like "metaforgechain7.lol" or url like "metaforgechain7.lol" or siteurl like "metaforgechain7.lol" or domainname like "tensorforgegrid7.lol" or url like "tensorforgegrid7.lol" or siteurl like "tensorforgegrid7.lol" or domainname like "vectorquantnexus6.lol" or url like "vectorquantnexus6.lol" or siteurl like "vectorquantnexus6.lol" or domainname like "quantumbytehub3.lol" or url like "quantumbytehub3.lol" or siteurl like "quantumbytehub3.lol" or domainname like "neurostreamlink5.lol" or url like "neurostreamlink5.lol" or siteurl like "neurostreamlink5.lol" or domainname like "aetherfluxnode3.lol" or url like "aetherfluxnode3.lol" or siteurl like "aetherfluxnode3.lol" or domainname like "pivotq.top" or url like "pivotq.top" or siteurl like "pivotq.top" or domainname like "stellarnodegrid9.lol" or url like "stellarnodegrid9.lol" or siteurl like "stellarnodegrid9.lol" or domainname like "neuralorbitgrid9.lol" or url like "neuralorbitgrid9.lol" or siteurl like "neuralorbitgrid9.lol" or domainname like "alphagridnexus1.lol" or url like "alphagridnexus1.lol" or siteurl like "alphagridnexus1.lol" or domainname like "nexuswavecore6.lol" or url like "nexuswavecore6.lol" or siteurl like "nexuswavecore6.lol" or domainname like "neuralorbitgrid4.lol" or url like "neuralorbitgrid4.lol" or siteurl like "neuralorbitgrid4.lol" or domainname like "omnidataflow3.lol" or url like "omnidataflow3.lol" or siteurl like "omnidataflow3.lol" or domainname like "vectorquantnexus7.lol" or url like "vectorquantnexus7.lol" or siteurl like "vectorquantnexus7.lol" or domainname like "quantumpulsegrid4.lol" or url like "quantumpulsegrid4.lol" or siteurl like "quantumpulsegrid4.lol" or domainname like "aethersyncmatrix7.lol" or url like "aethersyncmatrix7.lol" or siteurl like "aethersyncmatrix7.lol" or domainname like "alphagridnexus3.lol" or url like "alphagridnexus3.lol" or siteurl like "alphagridnexus3.lol" or domainname like "neurostreamlink3.lol" or url like "neurostreamlink3.lol" or siteurl like "neurostreamlink3.lol" or domainname like "alphagridnexus6.lol" or url like "alphagridnexus6.lol" or siteurl like "alphagridnexus6.lol" or domainname like "tensorforgegrid5.lol" or url like "tensorforgegrid5.lol" or siteurl like "tensorforgegrid5.lol" or domainname like "aetherfluxnode1.lol" or url like "aetherfluxnode1.lol" or siteurl like "aetherfluxnode1.lol" or domainname like "vectorquantforge9.lol" or url like "vectorquantforge9.lol" or siteurl like "vectorquantforge9.lol"

Detection Query 4 :

dstipaddress IN ("143.244.141.187","167.99.78.100","165.227.123.79","147.135.84.14","77.42.90.175","148.230.76.66") or srcipaddress IN ("143.244.141.187","167.99.78.100","165.227.123.79","147.135.84.14","77.42.90.175","148.230.76.66")

Detection Query 5 :

sha256hash IN ("f52809d57d816cf9ea7e95de64df46fcc1cf62d3da972c167497935b5eca74d7","51bfb2f390653647b087d789ef1559c3fdf220c565a909f1eee4d593893420dd","35392a9849d7e9dfb4ee700a16700a94883fde859d57fdd891631bdbc6a75db0","205fc66381b8e254508d40c693a1314c9fc2b94b8023b29483803c8b0e449c4d","7b092a35e70113f5165a653135cb3a7ca29312ceb0b4a874c160473d30830a60","b29391ba505af508f2110f54f73b203e2710b8b6c8a8717005e5c7a4050630e1","da7935affcec91c317acf98b52eca551f2501b29ad502749e4c084492142c6eb","ece6e9395edb8935c993a2945ac196a614149d65f10212e912e4654981646e37","231123d03fa985bdb4edbcc45fafc8f4fb93f692b00f6f37df81435cd0ff1c7b","6aa279fe9991405963ddf7ab18116fcde85190c2639b830791fe903d90697dec","80965fa878946421e5778044fcb16bc523206eb8f3853c0f833e9dbb87fe24f1","57c1b9fe23cd8220f39383c2ab5b392e8f1416cbf75e2668fc6426294abb818f","a84ab5bc2462fa6f673f22f59e759de458d4e561763af3be0bc3397564272347","e008c4e82cff39aa0f4c040944f8deeb80b06c50aab558e8b84e20c8ee453418","44d8e760012d6f08e91fd59176e59a3e13326f8079cdcc6e3a43b30f040769b6","d9da446bbb8adcb72c5c086705d58a8dad9d9268606e86568b893d122384b5b3","28c30dc88160f1fc44a5c11976f9de8da06be3c996d50ef76b0dbd032da210b6","1a398687d1f626e71c3beec3b0bda9589415babbcdae6171293c097d3103472e","fb5a654149e5bdb09b1453fa7679e32826e81abbaa0114ca02b13be6408a5ee3")