{
  "metadata": {
    "generator": "Bulwark Black IOC Extractor",
    "source": "https://bulwarkblack.com/xworm-rat-campaign-exploits-cve-2018-0802-in-multi-language-phishing-attacks-using-fileless-injection/",
    "fang": "live",
    "exported_at": "2026-08-27T00:00:00Z",
    "total": 19,
    "categories": 5,
    "migration_policy": "typed-only-better-v2"
  },
  "iocs": {
    "Domains": [
      "berlin101.com",
      "cloudinary.com",
      "pub-3bc1de741f8149f49bdbafa703067f24.r2.dev",
      "r2.dev",
      "res.cloudinary.com",
      "retrodayaengineering.icu"
    ],
    "URLs": [
      "http://pub-3bc1de741f8149f49bdbafa703067f24.r2.dev/wwa.txt",
      "https://pub-3bc1de741f8149f49bdbafa703067f24.r2.dev/wwa.txt",
      "https://res.cloudinary.com/dbjtzqp4q/image/upload/v1767455040/",
      "https://res.cloudinary.com/dbjtzqp4q/image/upload/v1767455040/optimized_MSI_lpsd9p.jpg",
      "https://retrodayaengineering.icu/HGG.hta"
    ],
    "md5": [
      "3bc1de741f8149f49bdbafa703067f24"
    ],
    "sha256": [
      "3f4c3c16f63fb90d1fd64b031d8a9803035f3cb18332e198850896881fb42fe5",
      "8665bc1b33cbe6f5859cd6e362af77738ba73a6e6d4b9974c16c8521d84c1892",
      "eacd8e95ead3ffe2c225768ef6f85672c4bfdf61655ed697b97f598203ef2cf6",
      "ee663d016894d44c69b1fdc9d2a5be02f028a56fc22b694ff7c1dacb2bbbcc6d",
      "fd9ba9e6bd4886edc1123d4074d0eac363df61162364530b1303390aa621140b"
    ],
    "CVEs": [
      "CVE-2017-11882",
      "CVE-2018-0802"
    ]
  }
}