Files named dingtalk_downloader.exe

tools.wanqs.com · dingtalk_downloader.exe

Hong Kong · Alibaba US Technology Co., Ltd.

Yara OpCloudHopper_Malware_3 From Florian Roth by Florian Roth (Nextron Systems)

Download archived sample

The password is "infected"

SHA1: 3e4a5082ee71202453c4c465fd32a1737763ddb5
SHA256: 1041962780029fab7ba54ab21c49185c8f105f774f3e75286dd6f83f27a6a587
application/octet-stream
4.98MB
2022-12-05 04:01:03 +0000 UTC

dl.3reality.co · dingtalk_downloader.exe

/files/

China · China Telecom Group

Yara OpCloudHopper_Malware_3 From Florian Roth by Florian Roth (Nextron Systems)

Download archived sample

The password is "infected"

SHA1: e68fc81f963449d974db1ca0f2eae22841cebf69
SHA256: d15330bac40fe81a88d307d808e535ce3b70831fa90e9826509c8969d3514cde
application/octet-stream
5.21MB
2021-11-24 04:02:42 +0000 UTC

cloud.wenkin.cn · dingtalk_downloader.exe

/WinInstall/

Hong Kong · Alibaba US Technology Co., Ltd.

Yara OpCloudHopper_Malware_3 From Florian Roth by Florian Roth (Nextron Systems)

Download archived sample

The password is "infected"

SHA1: b84129c1f859797771ac79f04e152321962b22d3
SHA256: a8ff5a98c831dd43e7eecbd746da63f5d85cdd180e6cd0fa04cc1dc62751f79d
application/octet-stream
4.97MB
2025-01-08 02:35:26 +0000 UTC

m2.dsik.cn · dingtalk_downloader.exe

/即时通讯/钉钉/

China · Hangzhou Alibaba Advertising Co.,Ltd.

Yara INDICATOR_EXE_Packed_UPolyX From AlienVault by ditekSHen

Download archived sample

The password is "infected"

SHA1: 880277959e898b1908a46d7c13c709038b33c3f9
SHA256: 91e6278f9b1756baf0fe3a4f7f6a1897ed1c1811de51ae3934e0360327eeb9ea
application/octet-stream
2.69MB
2025-08-17 14:52:24 +0000 UTC

dl.3reality.co · dingtalk_downloader.exe

/files/

China · China Telecom Group

Yara OpCloudHopper_Malware_3 From Florian Roth by Florian Roth (Nextron Systems)

Download archived sample

The password is "infected"

SHA1: e68fc81f963449d974db1ca0f2eae22841cebf69
SHA256: d15330bac40fe81a88d307d808e535ce3b70831fa90e9826509c8969d3514cde
application/octet-stream
5.21MB
2021-11-24 04:02:42 +0000 UTC

pan121.wanqs.com · dingtalk_downloader.exe

/tools/windows/chat/

Hong Kong · Alibaba US Technology Co., Ltd.

Yara OpCloudHopper_Malware_3 From Florian Roth by Florian Roth (Nextron Systems)

Download archived sample

The password is "infected"

SHA1: 3e4a5082ee71202453c4c465fd32a1737763ddb5
SHA256: 1041962780029fab7ba54ab21c49185c8f105f774f3e75286dd6f83f27a6a587
application/octet-stream
4.98MB
2022-12-05 04:01:03 +0000 UTC

cloud.wenkin.cn · dingtalk_downloader.exe

/WinInstall/

Hong Kong · Alibaba US Technology Co., Ltd.

Yara OpCloudHopper_Malware_3 From Florian Roth by Florian Roth (Nextron Systems)

Download archived sample

The password is "infected"

SHA1: b84129c1f859797771ac79f04e152321962b22d3
SHA256: a8ff5a98c831dd43e7eecbd746da63f5d85cdd180e6cd0fa04cc1dc62751f79d
application/octet-stream
4.97MB
2025-01-08 02:35:26 +0000 UTC

zyt.wanqs.com · dingtalk_downloader.exe

/tools/windows/chat/

Hong Kong · Alibaba US Technology Co., Ltd.

Yara OpCloudHopper_Malware_3 From Florian Roth by Florian Roth (Nextron Systems)

Download archived sample

The password is "infected"

SHA1: 3e4a5082ee71202453c4c465fd32a1737763ddb5
SHA256: 1041962780029fab7ba54ab21c49185c8f105f774f3e75286dd6f83f27a6a587
application/octet-stream
4.98MB
2022-12-05 04:01:03 +0000 UTC

tools.wanqs.com · dingtalk_downloader.exe

/tools/windows/chat/

Hong Kong · Alibaba US Technology Co., Ltd.

Yara OpCloudHopper_Malware_3 From Florian Roth by Florian Roth (Nextron Systems)

Download archived sample

The password is "infected"

SHA1: 3e4a5082ee71202453c4c465fd32a1737763ddb5
SHA256: 1041962780029fab7ba54ab21c49185c8f105f774f3e75286dd6f83f27a6a587
application/octet-stream
4.98MB
2022-12-05 04:01:03 +0000 UTC

pan.wanqs.com · dingtalk_downloader.exe

/tools/windows/chat/

Hong Kong · Alibaba US Technology Co., Ltd.

Yara OpCloudHopper_Malware_3 From Florian Roth by Florian Roth (Nextron Systems)

Download archived sample

The password is "infected"

SHA1: 3e4a5082ee71202453c4c465fd32a1737763ddb5
SHA256: 1041962780029fab7ba54ab21c49185c8f105f774f3e75286dd6f83f27a6a587
application/octet-stream
4.98MB
2022-12-05 04:01:03 +0000 UTC

zy2.wanqs.com · dingtalk_downloader.exe

/tools/windows/chat/

Hong Kong · Alibaba US Technology Co., Ltd.

Yara OpCloudHopper_Malware_3 From Florian Roth by Florian Roth (Nextron Systems)

Download archived sample

The password is "infected"

SHA1: 3e4a5082ee71202453c4c465fd32a1737763ddb5
SHA256: 1041962780029fab7ba54ab21c49185c8f105f774f3e75286dd6f83f27a6a587
application/octet-stream
4.98MB
2022-12-05 04:01:03 +0000 UTC

zyt.wanqs.com · dingtalk_downloader.exe

/tools/windows/chat/

Hong Kong · Alibaba US Technology Co., Ltd.

Yara OpCloudHopper_Malware_3 From Florian Roth by Florian Roth (Nextron Systems)

Download archived sample

The password is "infected"

SHA1: 3e4a5082ee71202453c4c465fd32a1737763ddb5
SHA256: 1041962780029fab7ba54ab21c49185c8f105f774f3e75286dd6f83f27a6a587
application/octet-stream
4.98MB
2022-12-05 04:01:03 +0000 UTC

tools.wanqs.com · dingtalk_downloader.exe

/tools/windows/chat/

Hong Kong · Alibaba US Technology Co., Ltd.

Yara OpCloudHopper_Malware_3 From Florian Roth by Florian Roth (Nextron Systems)

Download archived sample

The password is "infected"

SHA1: 3e4a5082ee71202453c4c465fd32a1737763ddb5
SHA256: 1041962780029fab7ba54ab21c49185c8f105f774f3e75286dd6f83f27a6a587
application/octet-stream
4.98MB
2022-12-05 04:01:03 +0000 UTC

pan.wanqs.com · dingtalk_downloader.exe

/tools/windows/chat/

Hong Kong · Alibaba US Technology Co., Ltd.

Yara OpCloudHopper_Malware_3 From Florian Roth by Florian Roth (Nextron Systems)

Download archived sample

The password is "infected"

SHA1: 3e4a5082ee71202453c4c465fd32a1737763ddb5
SHA256: 1041962780029fab7ba54ab21c49185c8f105f774f3e75286dd6f83f27a6a587
application/octet-stream
4.98MB
2022-12-05 04:01:03 +0000 UTC

dl.3reality.co · dingtalk_downloader.exe

/files/

China · China Telecom Group

Yara OpCloudHopper_Malware_3 From Florian Roth by Florian Roth (Nextron Systems)

Download archived sample

The password is "infected"

SHA1: e68fc81f963449d974db1ca0f2eae22841cebf69
SHA256: d15330bac40fe81a88d307d808e535ce3b70831fa90e9826509c8969d3514cde
application/octet-stream
5.21MB
2021-11-24 04:02:42 +0000 UTC

cloud.wenkin.cn · dingtalk_downloader.exe

/WinInstall/

China · Shenzhen Tencent Computer Systems Company Limited

Yara OpCloudHopper_Malware_3 From Florian Roth by Florian Roth (Nextron Systems)

Download archived sample

The password is "infected"

SHA1: b84129c1f859797771ac79f04e152321962b22d3
SHA256: a8ff5a98c831dd43e7eecbd746da63f5d85cdd180e6cd0fa04cc1dc62751f79d
application/octet-stream
4.97MB
2023-09-20 01:07:09 +0000 UTC

dl.3reality.co · dingtalk_downloader.exe

/files/

China · China Telecom Group

Yara OpCloudHopper_Malware_3 From Florian Roth by Florian Roth (Nextron Systems)

Download archived sample

The password is "infected"

SHA1: e68fc81f963449d974db1ca0f2eae22841cebf69
SHA256: d15330bac40fe81a88d307d808e535ce3b70831fa90e9826509c8969d3514cde
application/octet-stream
5.21MB
2021-11-24 04:02:42 +0000 UTC

42.242.72.158 · dingtalk_downloader.exe

/办公软件/

China · Chinanet

Yara OpCloudHopper_Malware_3 From Florian Roth by Florian Roth (Nextron Systems)

Download archived sample

The password is "infected"

SHA1: e68fc81f963449d974db1ca0f2eae22841cebf69
SHA256: d15330bac40fe81a88d307d808e535ce3b70831fa90e9826509c8969d3514cde
application/octet-stream
5.21MB
2021-10-21 06:07:13 +0000 UTC

42.242.73.40 · dingtalk_downloader.exe

/办公软件/

China · Chinanet

Yara OpCloudHopper_Malware_3 From Florian Roth by Florian Roth (Nextron Systems)

Download archived sample

The password is "infected"

SHA1: 940b2c90817e8121c436db82b4dfec11abe0f57b
SHA256: 9fb1ac89d8c73dba1350a1639fb86197bdbf7d3d7e4317c0a7d1d716d3753f49
application/octet-stream
5.21MB
2021-10-21 06:07:13 +0000 UTC

tools.wanqs.com · dingtalk_downloader.exe

/tools/windows/chat/

Hong Kong · Alibaba US Technology Co., Ltd.

Yara OpCloudHopper_Malware_3 From Florian Roth by Florian Roth (Nextron Systems)

Download archived sample

The password is "infected"

SHA1: 3e4a5082ee71202453c4c465fd32a1737763ddb5
SHA256: 1041962780029fab7ba54ab21c49185c8f105f774f3e75286dd6f83f27a6a587
application/octet-stream
4.98MB
2022-12-05 04:01:03 +0000 UTC