{
  "metadata": {
    "generator": "Bulwark Black IOC Extractor",
    "source": "https://bulwarkblack.com/shadowhs-fileless-linux-post-exploitation-framework-runs-entirely-in-memory/",
    "fang": "live",
    "exported_at": "2026-07-15T22:57:01Z",
    "total": 40,
    "categories": 6
  },
  "iocs": {
    "IPv4": [
      "204.93.253.180",
      "62.171.153.47",
      "91.92.242.200"
    ],
    "Domains": [
      "Kawpow.asia",
      "Kawpow.asia.mine.zergpool.com",
      "Kawpow.na",
      "Kawpow.na.mine.zergpool.com",
      "kawpow.eu",
      "kawpow.eu.mine.zergpool.com",
      "payload.so"
    ],
    "URLs": [
      "zergpool.com"
    ],
    "sha256": [
      "04a072481ebda2aa8f9e0dac371847f210199a503bf31950d796901d5dbe9d58",
      "072e08b38a18a00d75b139a5bbb18ac4aa891f4fd013b55bfd3d6747e1ba0a27",
      "0bb7d4d8a9c8f6b3622d07ae9892aa34dc2d0171209e2829d7d39d5024fd79ef",
      "148f199591b9a696197ec72f8edb0cf4f90c5dcad0805cfab4a660f65bf27ef3",
      "19df5436972b330910f7cb9856ef5fb17320f50b6ced68a76faecddcafa7dcd7",
      "20c1819c2fb886375d9504b0e7e5debb87ec9d1a53073b1f3f36dd6a6ac3f427",
      "3ba88f92a87c0bb01b13754190c36d8af7cd047f738ebb3d6f975960fe7614d6",
      "3f014aa3e339d33760934f180915045daf922ca8ae07531c8e716608e683d92d",
      "4069eaadc94efb5be43b768c47d526e4c080b7d35b4c9e7eeb63b8dcf0038d7d",
      "574a17028b28fdf860e23754d16ede622e4e27bac11d33dbf5c39db501dfccdc",
      "5a6b08d42cc8296b32034b132bab18d201a48c1628df3200e869722506dd4ec6",
      "662d4e58e95b7b27eb961f3d81d299af961892c74bc7a1f2bb7a8f2442030d0e",
      "666122c39b2fd4499678105420e21b938f0f62defdbc85275e14156ae69539d6",
      "6c50fcf14af7f984a152016498bf4096dd1f71e9d35000301b8319bd50f7f6d0",
      "72023e9829b0de93cf9f057858cac1bcd4a0499b018fb81406e08cd3053ae55b",
      "7361c6861fdb08cab819b13bf2327bc82eebdd70651c7de1aed18515c1700d97",
      "7fbab71fcc454401f6c3db91ed0afb0027266d5681c23900894f1002ceca389a",
      "8007b94d367b7dbacaac4c1da0305b489f0f3f7a38770dcdb68d5824fe33d041",
      "847846a0f0c76cf5699342a066378774f1101d2fb74850e3731dc9b74e12a69d",
      "9f2cfc65b480695aa2fd847db901e6b1135b5ed982d9942c61b629243d6830dd",
      "9fdaf64180b7d02b399d2a92f1cdd062af2e6584852ea597c50194b62cca3c0b",
      "b3ee445675fce1fccf365a7b681b316124b1a5f0a7e87042136e91776b187f39",
      "c679b408275f9624602702f5601954f3b51efbb1acc505950ee88175854e783f",
      "e11bcba19ac628ae1d0b56e43646ae1b5da2ccc1da5162e6719d4b7d68d37096",
      "e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855",
      "e5a6deec56095d0ae702655ea2899c752f4a0735f9077605d933a04d45cd7e24"
    ],
    "Ethereum Addresses": [
      "0xd67f158b2bcc819eee7029f3477f0270ec1d37b4"
    ],
    "Monero Addresses": [
      "87YLCx7zEFghgMEeZvJCZ3gHyS3fUsbAnXSTH8nh8EP7SeptPH8Pnh18snravwhE3dfRt5x67aWo8e6tSJ2cv4mpRNkSdqL",
      "88H9UmU6QyYiGeZdR6hXZJXtJF9Z8zLHDQbC1NV1PDdjCynBq3QKzB1fo1NRhgMX4cBx68Rva5msyKW3PGXfPhCA4itHmiv"
    ]
  }
}