🤲🏼 NEW | abuse.ch Community Hub! Earn recognition 🏅 for the malware intelligence you share, climb the leaderboards 📈, and connect with like-minded contributors who share your hunting focus 🤝. Ready to unlock your profile? Go to the Community Hub →

ThreatFox IOC Database

You are viewing the ThreatFox database entry for url https://msvci.com/files/.ini.

Database Entry


IOC ID:1967842
IOC: https://msvci.com/files/.ini
IOC Type :url
Threat Type :payload_delivery
Malware: Unknown malware
Confidence Level : Confidence level is high (100%)
Is compromised? : False
ASN:AS399629 BLNWX
Country:- NL
First seen:2026-10-15 18:37:38 UTC
Last seen:never
UUID:3822dfd7-c8bb-11f1-bd13-42010aa4000a
Reporter devmihaylov
Reward 5 credits from ThreatFox
Tags:cab Certum Dropper EV-signed payload-delivery pycached python signed
Reference: https://any.run/report/9b43bb4e22b438ef28ea41f29c755d71a825950c70a11fa9c569dd02bca91129/2af2b954-72a8-475d-b94c-a726d8ded008

Avatar
devmihaylov
AES-encrypted download URL hardcoded in the Certum EV-signed IMG_958742253158.scr, fetched over WinHTTP with User-Agent CabAgent/1.0 and an X-CAB-Key header, 301 to /files/.ini/ then 200. Serves a 23 MB junk-padded cabinet holding a Python 3.9 runtime and the pycached Socket.IO RAT, VirusTotal's crawler, which sends neither header, got a 403.