Open Directory Spills DoNot’s Toolkit Aimed at Pakistan’s Nuclear Sector
InfraHunter found an exposed server holding 48 files it ties to DoNot APT: reverse shells, an HTTP implant, Inveigh credential-poisoning scripts and document hunts keyed to Pakistan's nuclear, power and oil and gas sectors.
Spies are supposed to clean up after themselves. InfraHunter says it found an unprotected web directory on a French-hosted server holding 48 files of what it assesses is the DoNot APT group’s working toolkit: Go and PowerShell reverse shells, a custom HTTP implant, a Metasploit loader, credential-poisoning scripts and file hunts keyed to Pakistan’s nuclear and power sector, with terms like PAEC, Chashma, KANUPP, SCADA and Modbus. The files were uploaded between Oct. 9 and Oct. 14, 2026.
For defenders
Who: InfraHunter ties the kit to DoNot APT (also tracked as APT-C-35 and SectorE02), calling the link credible but not conclusive; the scripts don’t confirm a victim or the objective. A matching lure, File Copy.ppt, uses an Auto_Open macro to write batch files and create scheduled tasks named yfda and mxfd, staging in %PUBLIC%\Music\ (T1204.002 (User Execution: Malicious File), T1053.005 (Scheduled Task/Job: Scheduled Task)).
What the scripts do (mapping per InfraHunter): reverse shells and an HTTP implant that takes commands in response headers and injects into processes (T1059.001 (Command and Scripting Interpreter: PowerShell), T1071.001 (Application Layer Protocol: Web Protocols), T1055 (Process Injection)); the open-source Inveigh tool to poison LLMNR, NBNS and mDNS and capture NetNTLM hashes, with the domain name spoofed as WORKGROUP and later OGDCL, Pakistan’s state oil and gas company (T1557.001 (Adversary-in-the-Middle: Name Resolution Poisoning and SMB Relay), T1036 (Masquerading)); recon with arp -a, route print, net share and USB mount-point registry queries; keyword hunts through user documents; and a test of C$ access on 30 hosts in one subnet with three credential sets (T1021.002 (Remote Services: SMB/Windows Admin Shares)). Results pile up in C:\loot and C:\Windows\Temp\*.txt (T1074.001 (Data Staged: Local Data Staging)). One script ran from a profile named ELECTRICAL, and a plaintext credential file sat alongside. No YARA or Sigma rules were published.
193.29.104[.]84 (ports 8099 open directory, 45600 reverse shell)
179.43.145[.]232 (ports 80, 61135)
31.7.61[.]8 (port 443)
pakdw.orchidheaven[.]online%USERPROFILE%\Wallet\Hunrd\
C:\loot\
C:\inv\console.txt, C:\inv\console2.txt, C:\inv12pid.txt
C:\Windows\Temp\recon88.txt, hunt88.txt, lantest.txt, contenthunt.txt
C:\Windows\Temp\rv88b.exe, C:\Users\Public\Videos\rvb61135.exe
Scheduled tasks: yfda, mxfd
File Copy.ppt SHA256 bfaec98e7fdcf93c1bce3cc592f29e098e1facef0387cdccf8b0d7e5fa87c5eeWhat it means for you
This is state-level espionage aimed at Pakistan’s nuclear, power and energy organizations, so most people have nothing to do. If you work in that sector, or for a supplier to it, the story shows the attackers want engineering documents and control-system files, and that they try to grab Windows logins by tricking machines on the office network into talking to them.
Do this now
- Don’t open PowerPoint or Office files with macros from unexpected senders, and keep Office macros blocked for files from the internet.
- Turn off LLMNR and NetBIOS name resolution on Windows networks where you don’t need them; that stops Inveigh-style password grabbing.
- Require SMB signing and keep admin shares (C$) reachable only from admin jump hosts.
- Check for folders named
C:\lootorWallet\Hunrdand scheduled tasks called yfda or mxfd.
Source article: Exposed Opendir Reveals APT DONOT Cyber Espionage Toolkit Targeting Pakistan’s Nuclear and Energy Sectors
Publisher: InfraHunter (@volrant136)
Published: November 1, 2026
URL: https://www.infrahunter.com/research/open-directory-exposes-apt-donot-toolkit-targeting-pakistan
Executive Summary
InfraHunter reports an exposed open directory at 193.29.104[.]84:8099 (M247 Europe SRL, AS9009, Saint-Denis, France) holding 48 files, about 12 MB, uploaded between Oct. 9 and Oct. 14, 2026, which it assesses with credible but not conclusive confidence belong to DoNot APT, also tracked as APT-C-35 and SectorE02; a related StrikeReady Labs post describes the activity as an India-linked campaign. Targeting keywords in the scripts (PAEC, Chashma, KANUPP, SCADA, Modbus) and domain spoofing as OGDCL point at Pakistan’s nuclear, power, ICS and oil and gas sectors, and one script ran under a user profile named ELECTRICAL. A related lure, File Copy.ppt, uses an Auto_Open macro to decode Base64, write batch files, create the scheduled tasks yfda and mxfd and stage in %PUBLIC%\Music\, matching earlier DoNot tradecraft. The toolkit itself covers the post-access chain: environment checks (tp.bat, ptest.bat), Go reverse shells (rvb80_232.exe, rvb61135.exe, rvb_new.exe) and PowerShell reverse shells to 179.43.145[.]232 on ports 80 and 61135 and 193.29.104[.]84 on 45600, a MinGW-built HTTP implant (Beacon-trydnd1.exe) that takes commands from response headers and injects into processes, a Metasploit x64 shellcode loader (rv88b.exe) relaunched by a batch loop, the open-source Inveigh tool run hidden with USERDOMAIN overridden to WORKGROUP and then OGDCL to capture NetNTLM hashes, network and USB recon, keyword hunts through user documents, a plaintext credential file and a C$ access test against 30 hosts in 192.168.6.0/24 with three credential sets, with output staged in C:\loot, C:\inv\ and C:\Windows\Temp\. The objective is espionage against Pakistan’s strategic energy sector; the impact is credential theft, lateral movement and document collection inside those networks. InfraHunter published no YARA or Sigma rules; hunt leads, false positive expectations and indicators are detailed below.
ATT&CK chain: Initial Access → Execution → Persistence → Defense Evasion → Credential Access → Discovery → Lateral Movement → Collection → Command and Control
Hunt Lead Grid
| Hunt Lead Level | Hunt Lead Name | ATT&CK | Risk of False Positives |
|---|---|---|---|
| 1 (Junior) | DoNot Open-Directory Infrastructure and File Sweep | T1105 (Ingress Tool Transfer), T1074.001 (Data Staged: Local Data Staging) | Low. The IPs and ports, hashes, C:\loot, Wallet\Hunrd and the specific output file names have no legitimate use; the generic Inveigh.ps1 name only counts outside an approved penetration test. |
| 2 (Pro) | Inveigh Poisoning with a Spoofed USERDOMAIN | T1557.001 (Adversary-in-the-Middle: Name Resolution Poisoning and SMB Relay), T1059.001 (Command and Scripting Interpreter: PowerShell) | Medium. Red teams and penetration testers run Inveigh; the rule anchors on PowerShell overriding USERDOMAIN or USERDNSDOMAIN, Inveigh script content and a workstation answering LLMNR/NBNS queries, and allowlists sanctioned test windows. |
| 2 (Pro) | Batch Recon Dumped to Windows Temp | T1016 (System Network Configuration Discovery), T1012 (Query Registry), T1120 (Peripheral Device Discovery) | Medium. Inventory and support scripts run arp, route and net share; the rule anchors on several of these from one cmd.exe parent within minutes, redirected into text files in C:\Windows\Temp, plus MountPoints2 queries. |
| 3 (Elite) | One Workstation Testing C$ Across a Subnet | T1021.002 (Remote Services: SMB/Windows Admin Shares), T1552.001 (Unsecured Credentials: Credentials In Files) | Medium. Management servers and vulnerability scanners touch C$ on many hosts; the lead holds when a non-admin workstation tries C$ on dozens of hosts with several different accounts in a short window, especially after a reverse-shell connection. |
DoNot Open-Directory Infrastructure and File Sweep
The exposed server 193.29.104[.]84 served the toolkit on port 8099 and listened for reverse shells on 45600 (rev106.ps1, rvb_new.exe with TLS); 179.43.145[.]232 was the primary C2 on 61135 (rev.ps1, revcmd.ps1, rvb61135.exe) and on 80 (rvb80_232.exe and the Beacon-trydnd1.exe HTTP implant); tcptest.ps1 checked 31.7.61[.]8:443, which VirusTotal passive DNS showed for pakdw.orchidheaven[.]online. Host artifacts are the staging folder %USERPROFILE%\Wallet\Hunrd\, the collection folder C:\loot, Inveigh output in C:\inv\ and C:\inv2\ (console.txt, console2.txt) and C:\inveigh_console.txt, the PID file C:\inv12pid.txt, recon output C:\Windows\Temp\recon88.txt, hunt88.txt, hunt88b.txt, contenthunt.txt and lantest.txt, binaries at C:\Windows\Temp\rv88b.exe and C:\Users\Public\Videos\rvb61135.exe, and, from the lure, scheduled tasks yfda and mxfd with staging in %PUBLIC%\Music\. The detection logic is a retrospective sweep of firewall, NetFlow and proxy logs for the three IPs (with the specific ports) and the domain, file-creation telemetry for every path and file name above, task inventories for yfda and mxfd, and hash searches for the 48 SHA-256s and the lure.
Use firewall and NetFlow (the Go shells use raw TCP on high ports, so proxy logs alone will miss them), DNS logs, EDR file telemetry and Event 4698. Sweep at least 90 days, since the files date from early October and the batch loops relaunch shells until stopped. Scope fleet-wide, but start with engineering, SCADA and nuclear-program workstations and anything in or reaching 192.168.6.0/24-style office subnets. Hash blocking is weak here because the toolkit is mostly small, easily edited scripts and InfraHunter describes curl_x64.exe and curl_x86.exe as clean curl builds, so blocking those hashes could break legitimate curl use; the folder names, IP and port pairs and output files are the better anchors. Any hit on the IPs, C:\loot or the Inveigh output paths goes to incident response.
Hunt Lead Level: 1 (Junior Analyst)
ATT&CK: Command and Control → T1105 (Ingress Tool Transfer); Collection → T1074.001 (Data Staged: Local Data Staging) (mapping per source article)
Sources: “Exposed Opendir Reveals APT DONOT Cyber Espionage Toolkit Targeting Pakistan’s Nuclear and Energy Sectors”, InfraHunter, Nov. 1, 2026, https://www.infrahunter.com/research/open-directory-exposes-apt-donot-toolkit-targeting-pakistan (source article)
Inveigh Poisoning with a Spoofed USERDOMAIN
The largest group of files are wrappers around Inveigh, the open-source LLMNR, NBNS and mDNS poisoner, used to capture NetNTLM hashes from machines on the local segment. Early wrappers (inv8.ps1, inv9.ps1) set $env:USERDOMAIN = “WORKGROUP” and $env:USERDNSDOMAIN = “workgroup.local”; later ones (invgo2.bat, tinv2.bat, tinv3.bat) set USERDOMAIN=OGDCL so the fake responder looks like part of the oil and gas company’s domain. inv12.ps1 starts Inveigh in a hidden, non-interactive child PowerShell with the execution policy bypassed and stdio redirected, writing the child’s PID to C:\inv12pid.txt, and invgo2.bat enables LLMNR, NBNS, mDNS, HTTP and SMB listeners with output to C:\inv\console2.txt. The detection logic pairs a host rule, PowerShell (script block logging or command line) that assigns USERDOMAIN or USERDNSDOMAIN, or contains Inveigh function and parameter names, launched hidden with -ExecutionPolicy Bypass, with a network rule for a workstation sending LLMNR (UDP 5355), NBNS (UDP 137) or mDNS (UDP 5353) responses to other hosts’ queries.
Use PowerShell 4104 script block and 4103 module logging, EDR process telemetry, and network sensor or Zeek data that records name-resolution responses; Windows hosts normally answer only for their own name, so one machine answering for many names is the anchor. Sweep 90 days. Allowlist only sanctioned penetration tests by host and date, never by script name, since attackers rename Inveigh freely. The preventive control is disabling LLMNR and NetBIOS over TCP/IP and enforcing SMB signing; blocking UDP 5355 at the perimeter is the wrong fix because poisoning happens inside the LAN. The lead generalizes to Responder and any other poisoner. A hit means NetNTLM hashes from that segment may be captured: escalate, and reset passwords for accounts that authenticated near the host during the window.
Hunt Lead Level: 2 (Pro)
ATT&CK: Credential Access → T1557.001 (Adversary-in-the-Middle: Name Resolution Poisoning and SMB Relay); Execution → T1059.001 (Command and Scripting Interpreter: PowerShell) (mapping per source article; InfraHunter also maps the domain spoof to T1036 (Masquerading))
Sources: “Exposed Opendir Reveals APT DONOT Cyber Espionage Toolkit Targeting Pakistan’s Nuclear and Energy Sectors”, InfraHunter, Nov. 1, 2026, https://www.infrahunter.com/research/open-directory-exposes-apt-donot-toolkit-targeting-pakistan (source article)
Batch Recon Dumped to Windows Temp
recon88.bat runs arp -a, route print, net share and nbtstat -S and writes the output to C:\Windows\Temp\recon88.txt; hunt88.bat queries the MountPoints2 registry key and USB mount points; hunt88b.bat enumerates user profiles; contenthunt.bat searches Documents for 15 strategic keywords (InfraHunter lists PAEC, Chashma, KANUPP, SCADA and Modbus) and writes contenthunt.txt; tp.bat checks the PowerShell version and username and ptest.bat checks write access to C:\Windows\Temp and C:\loot. The detection logic is a process-creation rule that counts distinct discovery commands (arp.exe -a, route.exe print, net.exe share, nbtstat.exe -S, reg.exe query against MountPoints2, findstr or PowerShell keyword searches over user folders) spawned by the same cmd.exe parent within a few minutes, raised in severity when their output is redirected to .txt files in C:\Windows\Temp or C:\loot.
Use EDR process creation with parent and command lines, or Sysmon Event ID 1 and 4688, plus file-creation events for C:\Windows\Temp\*.txt. Sweep 90 days and start with engineering and operations workstations. Tune by allowlisting signed inventory and RMM agents by image path, and set the threshold at three or more distinct discovery commands from one parent rather than alerting on any single command, which IT staff run daily. Blocking these built-in tools is the wrong control; the cluster plus the redirect into Temp is the signal, and it generalizes to most hands-on-keyboard intrusions. Pair a hit with the C$ lead below: recon followed by share testing from the same host is a strong escalation trigger.
Hunt Lead Level: 2 (Pro)
ATT&CK: Discovery → T1016 (System Network Configuration Discovery) (our mapping), T1012 (Query Registry), T1120 (Peripheral Device Discovery), T1083 (File and Directory Discovery) (mapping per source article)
Sources: “Exposed Opendir Reveals APT DONOT Cyber Espionage Toolkit Targeting Pakistan’s Nuclear and Energy Sectors”, InfraHunter, Nov. 1, 2026, https://www.infrahunter.com/research/open-directory-exposes-apt-donot-toolkit-targeting-pakistan (source article)
One Workstation Testing C$ Across a Subnet
lantest.bat tests access to the C$ administrative share on 30 hosts in 192.168.6.0/24 using three different credential sets and logs results to C:\Windows\Temp\lantest.txt, while ad_pwd.txt in the same directory holds plaintext credentials of unconfirmed origin, likely the input for those tests. This comes after the operator already has a reverse shell on the host (to 179.43.145[.]232:61135 or 193.29.104[.]84:45600) and has run the recon scripts. The detection logic correlates, per source workstation, SMB connections to \\*\C$ (Event 5140 or 5145 on the targets, or EDR network telemetry on the source) against a large number of distinct hosts with more than one account in a short window, combined with Event 4624 logon type 3 or 4625 failures from that source for several usernames, and, where available, a preceding long-lived outbound TCP session from the same host to a rare external IP on a high port.
Use domain controller and member server security logs (4624, 4625, 4776, 5140, 5145), EDR network telemetry and firewall or NetFlow data for the outbound leg. Baseline which management servers, backup systems and scanners legitimately touch C$ and allowlist them by host; the lead should only fire for user workstations. Disabling admin shares fleet-wide is often the wrong control because it breaks management tooling; restricting SMB from workstations to workstations with host firewall rules is the better one. Credential files like ad_pwd.txt are worth a separate hunt for *.txt files containing “pwd” or “pass” in user and Temp folders. A confirmed sequence means the operator holds working credentials: escalate as lateral movement, reset all three credential sets’ accounts and check every host that accepted them.
Hunt Lead Level: 3 (Elite)
ATT&CK: Lateral Movement → T1021.002 (Remote Services: SMB/Windows Admin Shares); Credential Access → T1552.001 (Unsecured Credentials: Credentials In Files) (mapping per source article)
Sources: “Exposed Opendir Reveals APT DONOT Cyber Espionage Toolkit Targeting Pakistan’s Nuclear and Energy Sectors”, InfraHunter, Nov. 1, 2026, https://www.infrahunter.com/research/open-directory-exposes-apt-donot-toolkit-targeting-pakistan (source article)
Hash Appendix
Implants and loaders
SHA-256s come from the source article. OTX AlienVault and VirusTotal were not checked, so MD5 and SHA-1 are not available.
MD5s
(not available) # Beacon-trydnd1.exe, HTTP C2 implant
(not available) # rvb80_232.exe, Go reverse shell
(not available) # rvb61135.exe, Go reverse shell
(not available) # rvb_new.exe, Go reverse shell (TLS)
(not available) # rv88b.exe, Metasploit shellcode loaderSHA1s
(not available) # Beacon-trydnd1.exe, HTTP C2 implant
(not available) # rvb80_232.exe, Go reverse shell
(not available) # rvb61135.exe, Go reverse shell
(not available) # rvb_new.exe, Go reverse shell (TLS)
(not available) # rv88b.exe, Metasploit shellcode loaderSHA256s
393bc7084ac943861135a222c32f720df4e4fbb73ac0cfb2a6cf4ab67282f7d2 # Beacon-trydnd1.exe, HTTP C2 implant
7b3570b9c01b40a840d16ce5639988607b86bb4550b781a384a9ed9907d83df2 # rvb80_232.exe, Go reverse shell
40b3fd6b7f355d9186840337d3fbea7a130cb60d556c71bfac242fbadad76bcf # rvb61135.exe, Go reverse shell
00ea396ca1d9ac288701449748a28d30a2d180dfd3c2a8e3ea2d76b6232b949e # rvb_new.exe, Go reverse shell (TLS)
a9c3d5b4a8e9458b12305b1eb7df4c2087d0a0697b904cddcd22282ae613b228 # rv88b.exe, Metasploit shellcode loaderLure
SHA-256 from the source article; MD5 and SHA-1 not available.
MD5s
(not available) # File Copy.ppt, macro lureSHA1s
(not available) # File Copy.ppt, macro lureSHA256s
bfaec98e7fdcf93c1bce3cc592f29e098e1facef0387cdccf8b0d7e5fa87c5ee # File Copy.ppt, macro lureScripts and credential file
SHA-256s from the source article; MD5 and SHA-1 not available. Inveigh.ps1 and Inveigh_pub.ps1 share one hash, as do inv6.ps1 and inv13.ps1. Inveigh is a public open-source tool, so its hash may match copies used in legitimate penetration tests.
MD5s
(not available) # all files belowSHA1s
(not available) # all files belowSHA256s
cc7dd1d68dc3cc41f385afd000a516145cee2284b2526ee79dfd5e72278e2a23 # Inveigh.ps1 / Inveigh_pub.ps1, open-source Inveigh
8126be8d793c4b1c2f377e056a19c351bbf90c3ddc1b180b041e0a073256cebc # ad_pwd.txt, plaintext credentials
2bec79043f55175f632fc8760c53a722357eec52fc3b37181237287f2b55d184 # contenthunt.bat, keyword search
23817da7a93a1ebae204f86438842e0a9a4e72ba25fad2a992ef03ce23b916e5 # go.bat, downloader
90bc7e727088ac3f54b5741e950e183ed33042612d9300c351956c453f58ed5a # go2.bat, downloader
e5f58614d9fef5609e02dcc3a7b03610a5e566e55ca2dcbbc0f21e99420e3b58 # hunrdloop.bat, loop
0c2e135c9d782af2c15031628d408e5585d1d63c4a059c5b92c7a340e2c7dc4b # hunt88.bat, USB/MountPoints2 query
8fdafa606326b1d53c4ffff9414050064b0318087e6154af059ad9720c5233fb # hunt88b.bat, profile enumeration
96c962abe22d2ab3f74698070ad9210ffab2c684be5be5e817ee9886db7fbd6b # inv10.ps1, Inveigh wrapper
40b9dfd4beaf3b9f3922584e80ef77dc2274e707f27031104ac22a7d74d12778 # inv12.ps1, hidden Inveigh launcher
8e9cfd427efc7df647e4cd0f3cff6b51f8ec0a9b41d6de073b8d77a55a2883bb # inv13.ps1 / inv6.ps1, Inveigh wrapper
701387d51eb1daef68a39b1964c05a8133295f540286690dee482ecd62fcf2ce # inv3.ps1, Inveigh wrapper
db56d38f075746d92f37da5445b486af5f720b934ba41733e087ba9d540cdc08 # inv4.ps1, Inveigh wrapper
d591126dc7d844cc01dc500a498b48a1387e528a6ed7dd7d8fba27f2cf72a251 # inv7.ps1, Inveigh wrapper
a5f78bf5056c43d03cbdd30039a6be51158701ec92abe8888b38a3e622442d42 # inv8.ps1, Inveigh wrapper (WORKGROUP spoof)
f00976def17340f329a4f1b443a344ebf7326965481895f9269553240f3f0f07 # inv9.ps1, Inveigh wrapper (WORKGROUP spoof)
5bc32f94ab1ddb6e71fab3d0d4ecc39b88e8048e1116b322589bfaaa6453ac60 # invdbg.bat, Inveigh wrapper
8b7cc7fa0c1d587f49b356f598f9c64ac67b346c1f28aac7ceeeb44c22417358 # inveigh.bat, Inveigh wrapper
59a65879e97a3110d6c17b5837901b1d55f273a76974b5785f3840a8bcbf49b8 # invgo.bat, Inveigh wrapper
ed264ed0a89ae2050a1fc90b6990469a18dba642eeacc3ff421dbd9ebda77863 # invgo2.bat, Inveigh wrapper (OGDCL spoof)
b9c84474f87a0ee06bfee8967b1e89e2016ff70fde26b695496c505ada16d26a # invrun.bat, Inveigh wrapper
114c1b82ddf8632a09932e6522ea3fa65ab082accc9a62b3d69d74be39c00cdb # invrun.ps1, Inveigh wrapper
0175c1b2c3fb7400e2aaa78a60fcc24741d0cfbddff06a7adb3e895ae578e369 # invtest.bat, Inveigh wrapper
ac5994d0c962815e5837de7e8a4a5bd903c7f937298d0f0e864b791f2c4f7fd3 # invtry.bat, Inveigh wrapper
0f3b433672ca747273c03572c296e32715e49ff8049a124304752740144ff6fb # lantest.bat, C$ access test
6061c4214407f6ad89825cacb7db5c518dc99b1b7306d45bd4ead8ef8a48bc7a # ptest.bat, write-access check
c04761d9d1491e7cc6fdde4893a8c189a55a831f9417edb9dbddbc1ca705d7a7 # recon88.bat, network recon
1c9706602a5edec07943ef8f1a6077f7a82186e5870db82cf70ad33fb9f62f61 # rev.ps1, PowerShell reverse shell
bd6735f902dbf4483aa557cd1f535c984e530b3ec7ba8d638cd6234c77ec1222 # rev106.ps1, PowerShell reverse shell
dbbd28a151e0ded943dfcd89ad8ccdcc82b9624420cfc8026341fd438eee6eeb # revcmd.ps1, PowerShell reverse shell
f69b79d19182843048bb97877429a6f8729d902cb3eec9c9ff0efc1e007bb466 # revloop.bat, shell relaunch loop
3a28d424ef15812f47817de93dc01b1e973ee0b7a06c6af099c79a04acf827fd # run115.bat, curl/certutil transfer
608c6ef36e3bc504750b18df8aa4f5b18be97276cc81dd9c82afccbf9f9fbc66 # rv88b.bat, loader relaunch loop
14ea9d7f141d9dfbd857bfc12eed4609d7258e9a6035ccf002ad9d82940d2e74 # rvbloop.bat, shell relaunch loop
09ef5d350ee8521fa7b123752a0475efa364623ad5b37cbf76cd0e2d987b8ad2 # t.ps1, connectivity check
501128d49fe306cead27cefc69060aafdfaf68c355a58a7f3b53753843d71705 # tcptest.ps1, endpoint reachability check
22d38a4d2026c0628c369f4c0915104b3117db84ee03f8ff20863a67718e4711 # tinv2.bat, Inveigh wrapper (OGDCL spoof)
71779722c204a8847076813b1cccf6c4fad2c6fc2c684e5e74e31a487872a073 # tinv3.bat, Inveigh wrapper (OGDCL spoof)
88bb72a9a27268ecf6f81b671f7bd6d66202370bf212d9948c9185bba3bc80a9 # tp.bat, environment checkcurl builds (legitimate)
SHA-256s from the source article, which describes these as clean curl 7.40.0-DEV builds. They are legitimate software; blocking these hashes could break legitimate curl use, so detect the paths and parentage instead.
MD5s
(not available) # curl_x64.exe, legitimate curl
(not available) # curl_x86.exe, legitimate curlSHA1s
(not available) # curl_x64.exe, legitimate curl
(not available) # curl_x86.exe, legitimate curlSHA256s
9c500cfe5fec24ea0cd06e18b1034dc3809233954976d3a29937d4719d139d27 # curl_x64.exe, legitimate curl
78dbe1fbbc7e5f51fa385be08bb679251e46b43be690fbc49c412d9d4f647a10 # curl_x86.exe, legitimate curlReferences Appendix
- “Exposed Opendir Reveals APT DONOT Cyber Espionage Toolkit Targeting Pakistan’s Nuclear and Energy Sectors”, InfraHunter (@volrant136), Nov. 1, 2026, https://www.infrahunter.com/research/open-directory-exposes-apt-donot-toolkit-targeting-pakistan (source article; toolkit contents, behaviors, ATT&CK mapping, indicators and hashes)
- MITRE ATT&CK Enterprise technique pages linked above, MITRE, https://attack.mitre.org/