Void Dokkaebi Uses Fake Job Interview Lure to Spread Malware via Code Repositories IoCs ==================================================================================================================================================== Indicator Detection name Description ==================================================================================================================================================== 23e37cf4e2a7d55ed107b3bc3eb7812a0e3d8f90b23b0c8f549d5c10d089a2c8 temp_auto_push.bat 834a92277f1bd82d4d473ac0aa2ddb23208a3a8763a576b882e7326c42bc5412 temp_auto_push.bat Wallet TA48dct6rFW8BXsiLAtjFaVFoSuryMjD3v Tron Wallet 0x533b2dbcaeff19cd1f799234a27b578d713d8fcaa341b7501e4526106483e0b1 Aptos Wallet TXfxHUet9pJVU1BgVkBAbrES4YUc1nGzcG Tron Wallet 0x3f0e5781d0855fb460661ac63257376db1941b2bb522499e4757ecb3ebd5dce3 Aptos Wallet TMfKQEd7TJJa5xNZJZ2Lep838vrzrs7mAP Tron Wallet 0xbe037400670fbf1c32364f762975908dc43eeb38759263e7dfcdabc76380811e Aptos Wallet ==================================================================================================================================================== URLs ==================================================================================================================================================== C&C servers 136[.]0[.]9[.]8:443 198[.]105[.]127[.]210:443 23[.]27[.]202[.]27:27017 154[.]91[.]0[.]196:443 23[.]27[.]20[.]143:27017 85[.]239[.]62[.]36:27017 83[.]168[.]68[.]219:27017 166[.]88[.]4[.]2 23[.]27[.]120[.]142 Domain vscode-config-settings[.]vercel[.]app VSCode Tasks Hijack vscode-extension-260120[.]vercel[.]app VSCode Tasks Hijack vscode-settings-config[.]vercel[.]app VSCode Tasks Hijack vscode-settings-bootstrap[.]vercel[.]app VSCode Tasks Hijack vscode-extensions-bootstrap[.]vercel[.]app VSCode Tasks Hijack davhub88[.]vercel[.]app VSCode Tasks Hijack chvsvr[.]short[.]gy VSCode Tasks Hijack PEsnCV[.]short[.]gy VSCode Tasks Hijack cgbrandh[.]short[.]gy VSCode Tasks Hijack lackservice[.]short[.]gy VSCode Tasks Hijack gurucooldown[.]short[.]gy VSCode Tasks Hijack codeviewer-three[.]vercel[.]app VSCode Tasks Hijack coreviewer[.]vercel[.]app VSCode Tasks Hijack vscode-helper171[.]vercel[.]app VSCode Tasks Hijack task-hrec[.]vercel[.]app VSCode Tasks Hijack vscode-bootstrapper[.]vercel[.]app VSCode Tasks Hijack vscode-production-setting[.]vercel[.]app VSCode Tasks Hijack vscode-toolkit-settings[.]vercel[.]app VSCode Tasks Hijack tailwind-version-4[.]vercel[.]app VSCode Tasks Hijack default-configuration-sandy[.]vercel[.]app VSCode Tasks Hijack 260120[.]vercel[.]app VSCode Tasks Hijack vscode-ext-git[.]vercel[.]app VSCode Tasks Hijack thopywork[.]vercel[.]app VSCode Tasks Hijack regioncheck[.]xyz VSCode Tasks Hijack vscode-config[.]vercel[.]app VSCode Tasks Hijack vscode-helper171-ruby[.]vercel[.]app VSCode Tasks Hijack isvalid-regions[.]vercel[.]app VSCode Tasks Hijack vscode-config-setting[.]vercel[.]app VSCode Tasks Hijack vscode-settings-config-md[.]vercel[.]app VSCode Tasks Hijack default-configuration[.]vercel[.]app VSCode Tasks Hijack ext-checkedin[.]vercel[.]app VSCode Tasks Hijack data-kappa[.]vercel[.]app VSCode Tasks Hijack