PSYC-OTX-6a2201a401cb916346d57934

OTX: Operation TaxShadow: Multi-Region Tax Phishing & In-Memory Malware Campaign

The full record for one case — how Classifyline rated it, what Scoutline observed, the evidence Sealine encrypted, where Routeline may send it, and every ledger entry it produced.

how to use this view

How to use. Read the cards top-to-bottom — classification, observables, sealed package, routes, ledger. Hit ▶ case journey for the animated walk-through.

What you're seeing. Every worker line's output for this one case: how it was rated, what was observed, what was encrypted and to whom, where it would route, and the audit rows it produced.

Why it matters. Nothing sensitive leaves psyc without a human seeing the full reasoning chain — this page is that chain, for one case.

Classification

Severity: medium
TLP: GREEN
Incident type: malware
Internal class: D

Confidence

Level: medium
Source reliability: C
Information credibility: 3

Source

Type: threat_intel
Reference: https://otx.alienvault.com/pulse/6a2201a401cb916346d57934
Observed: 2026-06-04 22:52 UTC
Ingested: 2026-06-07 00:17 UTC

Observables

Domains

appradarr.cc
asdqxcdsa.icu
guhxmg.com
mnb-ny.com
naiqja.icu
ws4962.com
zh-welcome-1xbet.com
zhengfu666.com
d.pc-weide.com
taxations.cn-web-okooo.com

Hashes

3a8f6454927b8993aded75de0de2bd00
b498256cb086a6962077cdd6d2f65327
e83ff54e58f0b295a392c7fc39a7d0de
4650f7dc1a2ddbb6d73bf5bfd1b69dd6b79e0cdd
185b7a487316454da04e9cc0fe6eb370bb2955cf6096fe3e8c02c46f8989ba37
4c9061a07d667bf7dd6f597a43a8552af2f4277b7be06d6ea138abdb668d6a49
7d87a86dbd2379ef2516c99258137cd9c25ca19c48aeb096c5332c02fcbf16d0
949acbe543fc244ffbc981ea169067da7c5792af3c3d19b2c31b3d7e19106880
be31a63cad112723178289968ad6f93a576c5a7984099c42eec3521cdf6e5fc0
87d4c8d022a298cefcb113040e69934d5be6a91c

Routes

2 allowed · 2 blocked

MISP-Community priority 2 · stix_indicators · max_tlp AMBER

URLhaus priority 3 · malware_url_report · max_tlp GREEN

CERT-Bund country_mismatch

AbuseIPDB tlp_exceeded