ThreatFox IOCs for 2024-07-04
Severity: mediumType: malware
ThreatFox IOCs for 2024-07-04
AI Analysis
Technical Summary
The provided threat intelligence report titled "ThreatFox IOCs for 2024-07-04" relates to a malware threat categorized under the OSINT (Open Source Intelligence) product type. The report is sourced from ThreatFox and was published on July 4, 2024. The threat is classified with a medium severity level and is tagged as type:osint with a TLP (Traffic Light Protocol) white classification, indicating that the information is publicly shareable without restriction. The technical details include a threat level of 2, an analysis rating of 1, and a distribution rating of 3, suggesting moderate threat presence and distribution. However, no specific affected versions, CWE identifiers, patch links, or known exploits in the wild are reported. Additionally, no specific indicators of compromise (IOCs) such as file hashes, IP addresses, or domains are provided in the report. The absence of detailed technical indicators and exploit information implies that this threat intelligence entry serves primarily as a general alert or collection of IOCs related to malware activity rather than a detailed vulnerability or exploit analysis. The threat's nature as OSINT-related malware suggests it may be involved in reconnaissance, data gathering, or information leakage activities, potentially targeting publicly available data or leveraging open-source tools for malicious purposes. Given the lack of detailed technical specifics, the threat appears to be in an early or observational stage without confirmed active exploitation or widespread impact at this time.
Potential Impact
For European organizations, the medium severity malware threat categorized under OSINT-related activity could pose risks primarily related to information confidentiality and potential data leakage. If the malware is designed to collect or exfiltrate open-source intelligence, it may lead to unauthorized disclosure of sensitive organizational data, strategic plans, or intellectual property. This could undermine competitive advantage, damage reputations, or provide adversaries with actionable intelligence. The absence of known exploits in the wild and lack of specific indicators reduces the immediate risk of widespread disruption or system compromise. However, organizations involved in sectors with high strategic importance—such as government agencies, defense contractors, critical infrastructure operators, and large multinational corporations—may be more attractive targets for such reconnaissance malware. The impact on integrity and availability appears limited based on current information, but the potential for escalation or use as a foothold for further attacks cannot be discounted. Overall, the threat may contribute to an increased attack surface by enabling adversaries to gather intelligence that facilitates subsequent targeted attacks or social engineering campaigns.
Mitigation Recommendations
To mitigate risks associated with this OSINT-related malware threat, European organizations should implement targeted measures beyond generic cybersecurity hygiene: 1. Enhance Monitoring of OSINT Channels: Regularly monitor open-source intelligence platforms and threat intelligence feeds for emerging IOCs and malware signatures related to this threat. 2. Harden Data Exposure Controls: Review and restrict the amount of sensitive information publicly available through corporate websites, social media, and other open channels to reduce the effectiveness of OSINT gathering. 3. Deploy Advanced Endpoint Detection: Utilize endpoint detection and response (EDR) solutions capable of identifying anomalous behaviors consistent with reconnaissance or data exfiltration activities. 4. Conduct Threat Hunting Exercises: Proactively search internal networks for signs of this malware or related suspicious activity, even in the absence of known IOCs. 5. Employee Awareness and Training: Educate staff on the risks of OSINT-based attacks and social engineering tactics that may leverage information gathered by such malware. 6. Network Segmentation and Least Privilege: Limit lateral movement opportunities by segmenting networks and enforcing least privilege access controls, reducing the impact if reconnaissance malware gains a foothold. 7. Collaborate with Threat Intelligence Sharing Communities: Participate in European and sector-specific intelligence sharing groups to receive timely updates and share findings related to this threat.
Affected Countries
Germany, France, United Kingdom, Netherlands, Italy, Spain, Poland
Indicators of Compromise
- file: 79.110.62.16
- hash: 1912
- file: 178.78.19.238
- hash: 1337
- file: 91.222.173.204
- hash: 80
- url: https://starjod.xyz/website.php
- file: 94.156.71.43
- hash: 80
- file: 105.154.107.145
- hash: 10000
- file: 77.91.77.180
- hash: 50500
- url: http://a0996099.xsph.ru/l1nc0in.php
- url: https://www.antonina.campi.spotkaniakultur.com/article.php
- url: http://47.237.84.207:9777/ptj
- file: 47.237.84.207
- hash: 8001
- url: http://47.236.69.44:8002/ie9compatviewlist.xml
- file: 47.237.84.207
- hash: 8002
- url: http://144.22.38.242/4444.apk
- url: http://144.22.38.242/4444.elf
- url: http://144.22.38.242/4444.exe
- url: http://144.22.38.242/5555.exe
- url: http://144.22.38.242/6666.apk
- file: 144.22.38.242
- hash: 4444
- file: 144.22.38.242
- hash: 5555
- file: 144.22.38.242
- hash: 6666
- file: 39.96.33.40
- hash: 8080
- file: 124.222.81.106
- hash: 8888
- file: 8.130.102.101
- hash: 801
- file: 47.101.136.3
- hash: 443
- file: 117.72.47.134
- hash: 80
- file: 49.232.56.252
- hash: 8000
- file: 103.108.41.148
- hash: 9001
- file: 59.110.28.63
- hash: 443
- file: 35.225.182.42
- hash: 443
- file: 154.201.87.164
- hash: 80
- file: 8.130.114.243
- hash: 80
- file: 35.225.182.42
- hash: 80
- file: 47.103.36.17
- hash: 80
- file: 8.130.33.181
- hash: 8888
- file: 1.92.89.193
- hash: 9999
- file: 205.198.64.65
- hash: 443
- file: 47.99.78.222
- hash: 443
- file: 154.201.78.34
- hash: 443
- file: 107.172.46.157
- hash: 80
- file: 159.75.164.94
- hash: 8888
- file: 124.221.66.51
- hash: 2095
- file: 103.108.41.146
- hash: 9001
- file: 172.86.124.64
- hash: 443
- file: 142.171.177.156
- hash: 443
- file: 1.12.181.224
- hash: 80
- file: 54.174.120.223
- hash: 80
- file: 47.94.133.210
- hash: 8888
- file: 54.174.120.223
- hash: 81
- file: 139.159.163.30
- hash: 8080
- file: 31.192.108.40
- hash: 8080
- file: 39.101.71.208
- hash: 8088
- file: 103.108.41.147
- hash: 9001
- url: https://www.arkadiuszkedziora.pl/article.php
- file: 172.93.218.178
- hash: 44555
- file: 45.77.172.240
- hash: 8443
- file: 13.40.7.10
- hash: 7443
- file: 162.251.95.44
- hash: 7443
- file: 45.200.8.110
- hash: 4505
- file: 5.252.176.136
- hash: 9090
- file: 206.188.196.135
- hash: 8443
- file: 104.238.57.234
- hash: 443
- file: 51.158.70.117
- hash: 80
- file: 144.24.16.54
- hash: 80
- file: 54.254.249.67
- hash: 443
- file: 78.183.223.252
- hash: 443
- file: 46.246.6.18
- hash: 9000
- file: 103.147.185.18
- hash: 8848
- file: 46.246.6.14
- hash: 2222
- file: 1.94.105.216
- hash: 8000
- file: 47.108.136.43
- hash: 8888
- file: 77.105.147.118
- hash: 50555
- file: 178.73.218.22
- hash: 2000
- file: 45.66.231.254
- hash: 8008
- file: 34.126.174.34
- hash: 3000
- file: 34.126.174.34
- hash: 20000
- file: 34.126.174.34
- hash: 888
- file: 178.124.152.84
- hash: 8443
- file: 88.17.27.121
- hash: 443
- url: http://92.204.170.238/ktcweovz.exe
- url: http://92.204.170.238/obdaiofi.exe
- url: https://122.51.183.116/%e5%a4%8d%e5%8f%a4%e6%94%bb%e7%95%a5.exe
- url: https://122.51.183.116/svohost.exe
- url: http://194.156.98.18/h.exe
- url: http://194.156.98.18/httpd.exe
- url: https://194.156.98.18/assets/css/tailwindcss/version_1.1.0/min/tailwind.min.css
- url: https://www.belindadavisbranchlaw.com/article.php
- url: http://47.92.75.135/g.pixel
- url: http://101.43.109.204:8888/en_us/all.js
- url: http://39.100.182.56/en_us/all.js
- url: https://14.103.51.225:8443/ca
- url: http://8.130.114.243/dpixel
- file: 5.59.248.211
- hash: 9506
- url: https://www.bemiva.it/article.php
- url: https://api.yukklzwo.vip/5en1bjq8aauym2zgoy3k/ll_9354efa.js
- domain: api.yukklzwo.vip
- url: https://qq.yukklzwo.vip/5en1bjq8aauym2zgoy3k/ll_9354efa.js
- domain: qq.yukklzwo.vip
- url: https://aa.yukklzwo.vip/5en1bjq8aauym2zgoy3k/ll_9354efa.js
- domain: aa.yukklzwo.vip
- file: 188.208.141.211
- hash: 443
- url: https://23.95.65.198/visit.js
- url: http://123.207.213.191/activity
- url: https://cs.xfdaili.com/pixel.gif
- url: http://106.53.213.253:8081/updates.rss
- url: http://192.144.219.118/load
- url: https://wnaz.shop/activity
- url: http://43.138.30.109:9999/cx
- url: https://43.153.222.28:4545/load
- url: https://185.196.8.93/gv.css
- file: 189.18.237.15
- hash: 8081
- url: http://192.210.194.42:808/visit.js
- url: http://43.143.111.123:81/match
- url: http://95.214.234.74/dpixel
- url: http://43.143.111.123:6666/pixel
- url: http://121.43.174.203/dot.gif
- url: https://35.225.182.42/visit.js
- url: https://54.249.35.233/__utm.gif
- file: 54.249.35.233
- hash: 443
- url: https://39.101.77.24/ga.js
- file: 39.101.77.24
- hash: 443
- url: http://139.59.214.140:447/activity
- url: http://114.55.119.40/cx
- file: 114.55.119.40
- hash: 80
- url: http://testgk.oss-cn-beijing.aliyuncs.com/wiki/doc
- domain: testgk.oss-cn-beijing.aliyuncs.com
- url: http://43.198.87.72/updates.rss
- url: http://106.14.69.133:88/activity
- url: http://47.120.60.201:8011/dot.gif
- url: http://74.211.106.191/jquery-3.3.1.min.js
- file: 74.211.106.191
- hash: 80
- url: http://23.94.49.188:555/activity
- url: http://36.133.13.63:8003/jquery-3.3.1.min.js
- url: https://d2kw3fh12wz47k.cloudfront.net/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
- domain: d2kw3fh12wz47k.cloudfront.net
- file: 34.206.138.66
- hash: 443
- url: https://arbiankroos.com/_/scs/mail-static/_/js/
- domain: arbiankroos.com
- url: http://124.223.101.175/dot.gif
- url: http://c1.redteam.club:6666/cx
- domain: c1.redteam.club
- url: http://c2.redteam.club:6666/cm
- domain: c2.redteam.club
- url: http://c3.redteam.club:6666/pixel.gif
- domain: c3.redteam.club
- file: 1.117.64.149
- hash: 6666
- url: http://106.53.48.69:3333/cm
- url: http://1.12.181.224/activity
- file: 91.92.253.215
- hash: 1912
- url: http://47.108.106.118:8001/j.ad
- url: https://110.40.138.5/__utm.gif
- url: http://156.238.234.187:6379/g.pixel
- url: http://54.249.35.233/ptj
- file: 54.249.35.233
- hash: 80
- domain: pcapi-server.com
- domain: solutionhub.cc
- file: 5.101.50.209
- hash: 443
- file: 185.251.91.91
- hash: 443
- file: 43.255.241.232
- hash: 5555
- domain: juderule.africa
- domain: www.dpm-sael.com
- hash: 273332a7e82a1808f3f3f13de3882870692919b2
- hash: 0f1032dd6e6e984bd0e31d1edb45e027b12d0ec1976505dd6a4d1dd2351931ac
- hash: 2bf102e6b31cd60a79a900979e7c04a2
- hash: 549e7a8c8e998d3b7f85e61a7171685af231e780
- hash: 76650fb8aeaf679cd204ca347026a67767ab8d9c27f65597b275d8d57327e096
- hash: a9c37f81cd9a181dab2262d2f8456a76
- hash: 8d628dec0d699f1ae4006fc4902209fa9d30b0a2
- hash: 93aa308ad98dbf7a242ff3d06c2ba50ece83cbf909a17887bc441788a942e3a4
- hash: 67fc91937026fa8c1f0d96c42c50ec87
- hash: b4e871ca1b111a12f09db58484e5a90255e6f104
- hash: 4f9289ac6c38a0b6d80173c6b645e6d70d415a8291017f89c852b2468175bde8
- hash: 1d2c968c22903392601d409cfe0af1af
- hash: 42f4eb3e00d258e61cf98a125d025692ac68c88a
- hash: d56ddb9b2cb85e97a55f366aa00f53ffa566a6aa42964e56646cfb58663afd68
- hash: 1a047b9b776d41ec61cc91286c27be07
- hash: 81dc532f21c8be7217f5473b63a4ddde835d55e8
- hash: c2e57fb2b8206bd9b5d05d8a9b0d2e78082dd303ee6364b288d568fcd48900f7
- hash: ccd55adce3f0b0885c8e5acc7df26c6a
- hash: 0bf023f02385a117a61803064b0012035f57139f
- hash: 6e48181d4ffbd2958b47bf84e9335118d9eff0d34e58091c62d9838a17899ae9
- hash: 8d84f5becf22d3bceb322273fa2ac133
- hash: edc90c93dcee5d6ded2ea173dbb099d97e631f6b
- hash: d9afd43ff9f29e05064ce006cf0bda621b917851f4017b2186127fee603850c6
- hash: 6a5790f128089879ae9fd8a9cce40b57
- hash: fb9bedbcb0758af5ec77b248915aba7ab2e3e504
- hash: a4fc6ef06617c607c0b4d532e7df102e1dbe7416b28402e214672cbae1188302
- hash: 928ecc7808c79c7a4ca63a1730cee20a
- hash: 730c80921d14df0b67a163583ba838e7038a5a54
- hash: 4a45b99ba18fc60bbe3bf3ca42a0c1e9ab35597a1863c4010f2477bfded40963
- hash: 94a199c5872b9f03acc3ad7ffb076ec5
- hash: 1515edade6814e5bb2642d63d7dd87fcc6f67bf7
- hash: c31957e7f7c20119847fc9fc963ff30b67082f0cbb4389d89be6e19762111a83
- hash: d59caca462dcc8483ca9029f11be6d8a
- hash: 0f69f54846e26167777e3d56939adc72ddcb545c
- hash: 230280a480e2b4301c9beed0e5519c1f72f8c5a2d4193b5f69d7a02f6884bb16
- hash: fdaa4171e6b15af5628a055bc7a7bca1
- hash: ccb27bc5570fd160601d8009727296a12c579f66
- hash: 52a37eb90b8f3a1d164717415b58cf9bac1db1caa1f8aa57224089811cf50960
- hash: 7b9956e820cfd64a02a13af88b5237af
- hash: 6db12fae968037afc24f9877656db62e990c9ad4
- hash: a76cc5f77ac3607e1252bc4a61bd7fd036646e0585736fa88a8961edb2b73aef
- hash: 7439c3808f6f807008b772efadbe1b91
- hash: 260e091ddb29ef328f54045fa9828be5145c8ef0
- hash: 1dd97881cd53e8039e8c343990524ff21292be0e9deb7ec5ad078bfe945c0189
- hash: cdebf59de3ab5531db44072fc981b800
- hash: a728c89f5afe447c63aa5ec80e8e70c98b105553
- hash: 1adc34ccf3cc5851de0c7968bb182815a4ba913364d47f72436b526b7ec0618d
- hash: 9c39e700a95a5444c8d9e013547d615d
- hash: b6c19f2eadfb56d31b8cbc6e1a009e0c2d7ab83d
- hash: a9ab55c115d897c0488d6b68d02d858c973e1a607d8886b1ac4183dbc02c3155
- hash: 8d1e1b7fe8a180c56f9261907565ae61
- hash: 0e6546d7a7f237a4c094e24810fd4ab29ab6a970
- hash: 83b2f6c63dc3ec6cea64755ce2042ff747d52571daaef8a47934e00378f0afd3
- hash: 1ed6f9d578e14edad0bf47edf1f6269f
- hash: 2acc780d12e23361398c5ffebaa750dab279a6c8
- hash: 8d3ea6fd9b769b04d83d80ee89013b4e12f51f76b7e5a60321d88321540846c9
- hash: 3e5668f79e1467999bfe4000fdf1858b
- hash: 6dff405c8ca73bc41afa0be7a41f71f3e13df98e
- hash: 6bea8fb52d0dd24e86ea0baf07828878cdfb4f1fab4d64933bbba237d0ea21bc
- hash: 75b4a0e21d50909e18bb815d17b54275
- hash: 761f9bb97f92889e93843a13c796e00fdb9eb50f
- hash: b96c94f2fb7072f885b94cbbf77e849b608df0b60b99819b4a0aeaf8761d3b47
- hash: b2846b84204417271b632f7ff5498ef2
- hash: e04b02d0e26c1c5c4b2d07c0b9b8f87fce5204c2
- hash: b1a24dc1965d0695bd97c27ddb5c4b078ebf9cfcb4a3bf5bcdb79b00801598ac
- hash: a165fc410a576e641dd6442581eca6de
- hash: 8fc0cb81e049ff1d7a77ed49851a259d803f6f03
- hash: f78712b4a17f41e16f6e6d0a9abcd0dade9f25227939beaf8ba8de0cdca838b8
- hash: 3d175fa04c173a448511478f531f6ec7
- hash: 8027ca74a08e02dc096a9a3f92081bd5a7a20c67
- hash: 307ec11b5a2a83aa2787b8f3cbecb4ea93868a3b3982ebbd5392f3efe9141c78
- hash: e37cf85193275925afdb82a266069174
- hash: 1c28d0a969cd8db92202cfe923d18e39d9c305be
- hash: 7f12d621d13d212ed99ef23b8fa1b34337a4491f8df52dd3e5c0b9f3568f2c1b
- hash: 5e30ff1d98cb47c26d6b0a3c0449f11c
- hash: 0b3926a1a98b87938b94f8ffd511f7319a576990
- hash: c3e5a543f13e20484325ba5a08fd8993880f8282ed5a40e30c97fcf2aea91fa1
- hash: bb4b3fd0c725a96ba871f77f9604fa69
- hash: 4911e2fd81a78c402c0638b6705e26af73deb3d1
- hash: 85eeb40d3c63e7452b85dd1f64ad8c6a959baf5f392719ee709d8093404782db
- hash: 3464c6b50ffdf4e9cad35a423868fa17
- hash: e782a9abdd7ceed63a6a10b83a16c278400f9b32
- hash: 6f5b287c87ff655d6d07686fc8328e1c7e4dd2ca99caca5c757300a8d4b1940b
- hash: 1f89375dede098a5f59710c111594b8d
- hash: 0cf0d409f644c3712299b0c91ea249537d51ff45
- hash: 249ff1abee706220f65aa47ef1c839a44b54979466ac531231858c6cf8e50e99
- hash: cc5b6e9deec470d26e074859ca794aca
- hash: e7079a4aa2715132d6ea4ac4e7997effea00e979
- hash: 0b9145613da75b127de6d9f0094a7b2813e3c8c651aec50aee83c1e722e63be3
- hash: 5cb029f745b0691ec119a958319c31ef
- hash: 0be4983558b5b48bf0b1a1ec129cb380939c84ae
- hash: 5fda36bec5b1d5ec526e5b044a6b30b7afa1d0d5465ffa7c470efc9358ebc4b5
- hash: bcc06a7faf92224142143e13eaf78cf1
- hash: 1aab2b69eb9f918d1e0a23a82a98411709ee2fdb
- hash: 477ca1add0f03886c3bb29c4f03ffd2aa4d5c2a0fb3346fe46890c25347a8d7c
- hash: b41d067615ca60ffe4253297866d79be
- hash: d511085323362fbabb71473128ac23e4eb3f01a5
- hash: fd310dd65cf99f9392307b0b7fe8e3c4c45ad5019a321107abbfbd9c6c571de0
- hash: 077bd05ea32a3eed0e3f0a289dfa1087
- hash: 1b2b8d0d6dc3859eeaca02af3a8e2f42a3853699
- hash: 953dbb09953afb206f8fad0d62883a572f75e39c3fc5177332bf970c59c77278
- hash: 0ad650cec0d9769edca2602786dc04fc
- hash: ac11a7300dbec0d2b67e549b97d3a1ab4e30c94a
- hash: e7c888a111eeb26eec94afc97e0f9b838fda41ab74e083cb5b94f06800890d2d
- hash: 8e32f87b4f51fac392122d3c43b2e54f
- hash: d3c3b40dc5d8f3bfc71c7cd2be06e346ab694fdd
- hash: 5e3cae26ee0d86cf2c2660baf9d0fc27227173cc8440a94abe5c85a698e0293f
- hash: 747f49b526a931e987825204c1473a27
- hash: 7e1572f43015ae80ee15354bce184ac0f75e6e67
- hash: 5a92d770d34718ab6624c95d586269cb9d144803cb0f94ea91b78344360eb5cf
- hash: 1a3037dced4fbdc13c75a4a4a34183a5
- hash: ee695635a4bbb2ac00f0a5907387856fd7912f41
- hash: 260a3fd20510a8338f7f3f579d8d6a5ff3d131e1f91c0cd63e3e42824cead6f4
- hash: 9307fdf2f39399a86fd7d4b3e24f8d8e
- hash: cde7c40944ce1313dcbf06c8c11aebeaf8c5be10
- hash: 2cd82067ffbfee95350ffc5d93b1da648d5d6f1d77cbaf3b5b5c5653711bdf45
- hash: e63ebad1d9e6d8f7cbc8c6bfb3c15789
- hash: b026ad1bbd93ba9f30776c823d3c9c954dd9f975
- hash: b87126fd409621a4d510dda005cd84e254d491274661cf22238b271412ff860b
- hash: 794107dd168bd98d7c9f65a9f693a07e
- hash: cfce5320daedaca6a494bd9cb05f762b1f1ae9e2
- hash: 2b60a60cc965883183d2a376c5136c088d29da5238dff2ac9223149064e31fde
- hash: 1b9787c8ff728714561b4137c22536bd
- hash: 2dc7e29e08c0f0cef40c88046f416290de43797e
- hash: 73a4bbb85f8d199377afd2ea10ef5d4467e22e1dccb23275f176ea564d3e1ef8
- hash: 61bacdb8e8f052c36ae36e8548a13c8a
- hash: 24ddd5e2c7e96e52e00f5a6e2b29e4b100d0c578
- hash: a77d96f186d1cc96dc589f4a6d55b45c9c04c77072fd504a720f437412ff93cb
- hash: 92d4e2ef88e5aafb72ddde13e84b549a
- hash: 5d8e5e35fe9edd166b13e592fafe08a74b14455c
- hash: b129237b16973abf537877e13216d3565238ea99b5ddc1b38890c235457c50c1
- hash: ab0e0ab3d5709e3831dcaa08b6c8a9db
- hash: d7b6c018c99448014fe6199244956eafb69405d3
- hash: a173db1e8568fc4b00f326d52af0fea19c59639c486d9975589edfd8f1a11da1
- hash: 9cc0e7d568d15f8f23b06c68ad71be62
- hash: 843de82efbd8d17d96733251ce723540a2c05e59
- hash: 947ef875bd33912333be6b33291752cfc2c29393adbaa5ce78cdfa0b3aefc75d
- hash: 1f4e76e35124c2fa6c41a96a30f6124a
- hash: ac0f26d23fecf8da223739c639dad8e9475533f3
- hash: 9b05e5b29809ad9f77127c4bc9e563257b68175bf55aff7ec85b858cb01c8684
- hash: b958d6940edc44e8d99a9e5c074acd5a
- hash: 2ec570c00f3da4058ee39878320d507cde066868
- hash: f0a1308efe7bcf1be384db385b8183f48c5f1c2432da2322263b90f01a0820aa
- hash: 9cc158711bee10773a3259aaafb62857
- hash: 5005f12bccee6cfe6781c925749eeae92f4f039a
- hash: 36ca73fac0f3955bf525b4c7c72f1a5630be6f66f5726801ca3976829f8ce94b
- hash: 15d520c0449be451ebc0fe3884fb0be1
- hash: 5ca1fdf11531cd40a11790b465ad88c461400b98
- hash: 6c82b1e394b7da24e62f03c745c0ceb907f49f0a43d032f9b3bc53ef8179e7a2
- hash: b4616e8edec84cdb65e9753e97b0f803
- hash: f6a97876f399aba9d4c8867bdae6e17d16510eb7
- hash: 494c2e3f9d7b369ac1f7f471a170f31d421ee5027af82f1c5e32227860e00404
- hash: 175d1d82db92cdcde93d44ea8cd76a06
- hash: 33ad1f1d1b139b6f2ffe3fe0c7a94f61e4ec7088
- hash: a1b36b37454873c6afe0f5822e343a029b9724ee07ec6ae4243d5a688e9a84c7
- hash: be101f8181d00ee2196fbc988d85d7d3
- hash: 5d07d9e8172869c875d600b3acb1e338b0d6ad0f
- hash: 65fa4b4c8ba39ca1e2e853cf6bccf1737cc350e362d9ff7bb04dc0dae75a103f
- hash: 1b0f8cd0a0f9788b131ccf3f2a6d6d9b
- hash: 7365f1258d8527867af36ab19d7fac84edcc2b46
- hash: 78f40dbc06bf9e63d2322bad4b70fefb29d6060292f91c12d82cbae449ed4d77
- hash: e18a6528feb2a80af9a1cc435ed30bed
- hash: 4ff159383923c10c97875f7cca192dcae0203ce9
- hash: 29c8a6f9f4ff78e6019fbf55c882966f7af611b7c470cebe763b0c356756f351
- hash: 1b56ac299e10b84c9d04416ed1b309a2
- hash: 4919910c4fa32c1acc844f358feeb00f015b0cc5
- hash: ed14a8886c207595360dbc904914f5113a656951d9aafc748d56d0e9b8f70742
- hash: 40094e123c89625468665c8c196c2ffd
- hash: 8d82a1882e40d797afc6af7b1d63cc67c40bbfdd
- hash: 4def22c51fea8c4114321733ca506efced17ea426f1c5a518905a93f6c20fa34
- hash: 64d9a7da3f1aa599a9656fb0894fabeb
- hash: 6071f929619b0046206d783afebaccaae3106ebb
- hash: f55dcabe5c7666954e6a626ad7bed40010a3f598d8ef3efcfb68135d29b2767d
- hash: 2d54d9c5710c8a2d09111644b8c6f76c
- hash: 3baa8426a26eccd61d570a9046332fdc1206497d
- hash: 6a070aa1de79b9a6230c4f54aaa6edb1f351ceef949d2572c23c28325d3330f0
- hash: b356a7017f5374d105bd0af22915ac50
- hash: 167ed46dabab3bfaf30029b09ee1b16a05130ca8
- hash: 3724853be234af96fc81211c901194d667d5750574859e073e475f3752ab7ee5
- hash: 9d502a4212fd8573768be94873b24625
- hash: 2fc5533d312696182f0400348f6a7c05fd6e0fb9
- hash: 6f73393dfb236ab191e8b247573693f6d2913bf59a95541488d0fa6037f9e589
- hash: f5b3ee4ba93ac550818ffc3245e63da8
- hash: 072dd71ea12a57bdef11b663bce746878f4585ec
- hash: 82eddb35f29fcef506f76342077d1bcbe38689680a9efd6d7a58b08479d13f28
- hash: e5114c7a45a7b3c658c4ae212ac089e5
- hash: 7dfb4c70ef7d73c8618ce8799d414ba3c3fe9684
- hash: 49274bd66a4d53ca004a0a58c15496292a323f229b9712e5f3994af5c307bc0a
- hash: 33bc360990c66beea144ae48d17504a6
- hash: 80cb04179fe16032b99ca054d1bca515bd079f928db6ae002ddfcfb3ebb236f4
- hash: 23d23d9bfe66cfcca000342ec36c54f6bbc138a5a50fc1a4f9de28dcf7be72bb
- hash: fe83c58c10bf7a111e0334e729d4417f63cd22f53cdafc00622a21cb456cbdaf
- hash: bb939a5d9535a87231e5a91e1f23121159c7bd6f38013a69d3313dda4a424f41
- hash: 75f31b87ec554f90de7b8481b62908e50d83176e3a7d74e7564ae9f7c16388ee
- hash: 86329825eaf86f08f84bfc3ddd8870b5c05f47a43aba3695eea5ca4c7a0ee00b
- hash: 39df3cbc48867b449d4828185b06f2e4d647562724da9205a46f5fd5763e6545
- hash: f49fc0151c871c2e0544b32f7c238c810988e9bd63cd2d691adb8f3a34ec02fb
- hash: f0ec07e537c7bf74abbc66af82e1f273fceca81467e1d74ed69514107421de61
- hash: ed3dc0a914abcaa078502209d2091a585c623044a7309e139b39a9d093264420
- hash: e77df90c6642d268ece623b00aae363c8075d9715ddbed1d808d4561772532ec
- hash: dacf76612ec19aa3f80f070321abac8830e376981ccd5ec4eebd1ba017c6e462
- hash: d524227a19b56c6cbeafe88f619999433dd20b1d09d374a79f6e721686c70515
- hash: 99c3ad8c8368e37f91ee3afc68707e9f3bf8a3568148a52a30b185c74fc3ceab
- hash: 8dbccd1c7bdb8da3a34c2a4ac5c62fb6774ce2abac29caf899039d19a5d27555
- hash: 89d5d25cd020213d6426f13296765683202542062cdcfb10b611d46a65d38d0f
- hash: 6f19b81c0a43cadb5d5447e3dc0485c04fd400d4a0656ff4af092ab9faac7213
- hash: 6eecadfd2838192c745cf88fa82ed4e96d9f27b15f1372ab24a5e94fdba22978
- hash: 559122ff10dc062b44d239d7867a47266f0b8b1088df6551dcfa0f75eb1014bb
- hash: 5422c0223694ab7ffdb4968db24177c7bb0426e29b32b0f810192258c0af61da
- hash: 3521381fadca86cfc577e8aa81ecff5f3453102559bb7e86d903d9b87db1456c
- hash: 0c286126eae5d8d419bac3830831dbcfd0deb2b375d21666de4eac3c9824f4a8
- hash: 050c70c13b2fbffe4c003fadaa6561dcd3d2d78352e14b7f8498653d32631201
- hash: 49042e86af4503a917b8408c4faab2759688065a429015a2c90430fa7371291f
- hash: 1277a2276ba8cf81383cf7cdf68638f04627b0748165dd9c34a8f222abf39050
- hash: 35d386e662508b9089b14ddf8ceebfb968baffd37f5e9a771da80a40f0bb5b75
- hash: 0e003ce0c1861c844c553377c325babf7a9df7f56ddbd8e0eabd75e1816a58eb
- hash: a97b49a5796ffeb59416acf31fd256d8990092350bc36b3a5baf9f1e78e3f48f
- hash: 30a52c561659e1499e4e5518e16a44b01dcf479e459d3bebb426aee16e971c09
- hash: 50258d28e57d1470e34bcb97075ac5d97c236918d3cc1f728830fd9a5e70b25b
- hash: f4ab048f183a7269468b0cb8509668831e3d8f816e1be3162a0734c83c488c97
- hash: 8ff0fa4fa960b53d6bbb74459628e38e248d942563155444b16c4987b5187bb8
- hash: d9dc76fcec48e47d8a10afa9ee40af17b856bff408bbc3eb36f5d362364a8d4c
- hash: f77428745e66a5ba3dfdac0086b513de80e3a01579f0b7f40658d90e6bda976c
- hash: a9f3da04b2557601ad57146a0efbfd0a975a881c09841edaef53a7d02ed848f3
- hash: 1a95e485f4ae28b3526839f632e2d199d0652ba9e05215138a8e6fc9df0299ac
- hash: f8a42260874653f5bbcffb14cb8a59176e89bbe54d50e2727087e6a46ca12e91
- hash: d6988ffe9f646f959400d60e700e617493ef83e1f32dd8d7b85e5c1790d8bc6c
- hash: 374290f4bc29e1d5a3295b8f23c281393075beae64db51cd5a5e96c03f9ef8b0
- hash: 85eabe0053da09958088dde25cfb55028b578c5327cbdd213a58563683413ee9
- hash: 3592f60e97f29ab2d4e60ed3604d154c4455f59c318723aa0d25dd6a5c255f66
- hash: 49691df1941f383a519f87b72d504014b93e45bbf5de5fadf2b46e9f7d3a942b
- hash: 06b5199b7753075d90d3adf5d33adcef9b1c3254d0471a70c282e2cc1391f1b1
- hash: df8bec134952b484b17a72f1fc97428e3b458e117be44cd1c2e21ce88ee88649
- hash: 12b1d0212363628cb57d2379017b94d6bf91029b37b2dcee592a564952855694
- hash: eab2a5792346b8b55180359658308c54766541505b88f55cbdf86add05edffd5
- hash: e0a44f25632730e54db070a4508bdaf73621f4dc7f61987df2051d5d4b512ed7
- hash: b56d3e6d1b59e49bbec7d67b46efdabcd4f63113d4937e713c017a5c8307c1f9
- hash: fe014092ae92e8372849bed9f5cf33946e8d918bdc50feddc1316bc837414ba8
- hash: 20004bfe92247a39144a04dfa3ed12131f0b439870a73b8b1f92747c0f1babfd
- hash: 1114c728eef27aee82bd1d205d9f35cc41ae20c1491f01bc1bcfa9d8fdc50bf9
- hash: 411b5d34c6d956ff1a2a50b67b08522203ae522d4d6407857699c1777cfdd105
- hash: c84bbfce14fdc65c6e738ce1196d40066c87e58f443e23266d3b9e542b8a583e
- hash: 2f64b1074d236fe522aae38bd2ed223a67d545e11c8e44636a075ada9912b621
- hash: cfe6e1b1bb92f207921c81129ddd21dd904dc78bf8a59676e6d719a7cae8fca7
- hash: 3d686d48bf794ce3814f7001c4f5916733acf2eeab5140e373e0bd863f105a25
- hash: abb458ad81038c5edd4909f4b41a2d05bfcaf6ea25e439679c988ed479e42862
- hash: 564da53b4bfb006eab7b88023aec9551d8d68da31dd567442dc35f1ff807e78e
- url: https://49.235.118.195/cx
- url: https://185.196.8.93/tab_home_active.css
- url: https://temp.sftech.shop:8443/antdesign3.js
- domain: temp.sftech.shop
- url: http://121.36.255.43/push
- url: http://trusted-updates.germanywestcentral.cloudapp.azure.com/c/msdownload/update/others/2020/06/29136400_
- domain: trusted-updates.germanywestcentral.cloudapp.azure.com
- url: https://43.138.30.109:7777/dot.gif
- url: http://47.93.53.140/pixel
- url: https://cdn.wnza.shop/api/3
- domain: cdn.wnza.shop
- file: 188.166.252.88
- hash: 7443
- file: 13.201.63.1
- hash: 7443
- file: 124.163.194.70
- hash: 4506
- file: 178.209.99.214
- hash: 8443
- file: 154.12.56.138
- hash: 443
- file: 164.90.194.34
- hash: 443
- file: 116.62.142.170
- hash: 443
- file: 172.104.157.219
- hash: 443
- file: 63.250.56.42
- hash: 8443
- file: 81.43.24.131
- hash: 443
- file: 94.156.8.20
- hash: 443
- file: 150.158.53.58
- hash: 9200
- file: 118.161.12.237
- hash: 443
- file: 45.241.39.172
- hash: 995
- file: 38.12.36.54
- hash: 8888
- file: 158.58.172.127
- hash: 8888
- file: 49.113.77.12
- hash: 8888
- file: 34.122.213.13
- hash: 80
- file: 45.66.231.254
- hash: 4444
- file: 45.66.231.254
- hash: 6006
- file: 45.66.231.254
- hash: 7777
- file: 34.126.174.34
- hash: 3002
- hash: c36f650adbd3d2274ff5b8a86874d845293041710e149e96b7cc11f584b22dd6
- hash: 560eb48d1b2104f4dc3b1607bf42b35e35dfe81272675040df305e0dc85ce33e
- hash: 8f8d76d157e5e4dbd7210cb19ce27b3734147c430a534143c97b90c1f5e35249
- hash: 00890b5ad6b94fd73a0f36ccba0d36cd198899c648c9331363dbd1140196fb3a
- hash: 419e2c52b87ba2817d5001a4581b909adc557a9661184c55e40fc9ebc2a5f8e7
- hash: 1abef22287ce3d4f8cf5a682532152813722677114b6c8e5f0a3db92fc45861a
- hash: 9090b682c6219cb43f01d5b3342356ae85685992fac80e5e08667b54439932ea
- url: https://unwielldyzpwo.shop/api
- url: https://civilizzzationo.shop/api
- file: 45.129.0.115
- hash: 443
- url: https://205.198.64.65/pixel
ThreatFox IOCs for 2024-07-04
Medium
Published: Thu Jul 04 2024 (07/04/2024, 00:00:00 UTC)
Source: ThreatFox
Vendor/Project: type
Product: osint
Description
ThreatFox IOCs for 2024-07-04
AI-Powered Analysis
AILast updated: 06/19/2025, 13:32:32 UTC
Technical Analysis
The provided threat intelligence report titled "ThreatFox IOCs for 2024-07-04" relates to a malware threat categorized under the OSINT (Open Source Intelligence) product type. The report is sourced from ThreatFox and was published on July 4, 2024. The threat is classified with a medium severity level and is tagged as type:osint with a TLP (Traffic Light Protocol) white classification, indicating that the information is publicly shareable without restriction. The technical details include a threat level of 2, an analysis rating of 1, and a distribution rating of 3, suggesting moderate threat presence and distribution. However, no specific affected versions, CWE identifiers, patch links, or known exploits in the wild are reported. Additionally, no specific indicators of compromise (IOCs) such as file hashes, IP addresses, or domains are provided in the report. The absence of detailed technical indicators and exploit information implies that this threat intelligence entry serves primarily as a general alert or collection of IOCs related to malware activity rather than a detailed vulnerability or exploit analysis. The threat's nature as OSINT-related malware suggests it may be involved in reconnaissance, data gathering, or information leakage activities, potentially targeting publicly available data or leveraging open-source tools for malicious purposes. Given the lack of detailed technical specifics, the threat appears to be in an early or observational stage without confirmed active exploitation or widespread impact at this time.
Potential Impact
For European organizations, the medium severity malware threat categorized under OSINT-related activity could pose risks primarily related to information confidentiality and potential data leakage. If the malware is designed to collect or exfiltrate open-source intelligence, it may lead to unauthorized disclosure of sensitive organizational data, strategic plans, or intellectual property. This could undermine competitive advantage, damage reputations, or provide adversaries with actionable intelligence. The absence of known exploits in the wild and lack of specific indicators reduces the immediate risk of widespread disruption or system compromise. However, organizations involved in sectors with high strategic importance—such as government agencies, defense contractors, critical infrastructure operators, and large multinational corporations—may be more attractive targets for such reconnaissance malware. The impact on integrity and availability appears limited based on current information, but the potential for escalation or use as a foothold for further attacks cannot be discounted. Overall, the threat may contribute to an increased attack surface by enabling adversaries to gather intelligence that facilitates subsequent targeted attacks or social engineering campaigns.
Mitigation Recommendations
To mitigate risks associated with this OSINT-related malware threat, European organizations should implement targeted measures beyond generic cybersecurity hygiene: 1. Enhance Monitoring of OSINT Channels: Regularly monitor open-source intelligence platforms and threat intelligence feeds for emerging IOCs and malware signatures related to this threat. 2. Harden Data Exposure Controls: Review and restrict the amount of sensitive information publicly available through corporate websites, social media, and other open channels to reduce the effectiveness of OSINT gathering. 3. Deploy Advanced Endpoint Detection: Utilize endpoint detection and response (EDR) solutions capable of identifying anomalous behaviors consistent with reconnaissance or data exfiltration activities. 4. Conduct Threat Hunting Exercises: Proactively search internal networks for signs of this malware or related suspicious activity, even in the absence of known IOCs. 5. Employee Awareness and Training: Educate staff on the risks of OSINT-based attacks and social engineering tactics that may leverage information gathered by such malware. 6. Network Segmentation and Least Privilege: Limit lateral movement opportunities by segmenting networks and enforcing least privilege access controls, reducing the impact if reconnaissance malware gains a foothold. 7. Collaborate with Threat Intelligence Sharing Communities: Participate in European and sector-specific intelligence sharing groups to receive timely updates and share findings related to this threat.
Affected Countries
Need more detailed analysis?Get Pro
Pro Feature
For access to advanced analysis and higher rate limits, contact root@offseq.com
Technical Details
- Threat Level
- 2
- Analysis
- 1
- Distribution
- 3
- Uuid
- f2b9c5b5-ac35-44ef-b794-edbb9d618e4b
- Original Timestamp
- 1720137786
Indicators of Compromise
File
| Value | Description | Copy |
|---|---|---|
file79.110.62.16 | RedLine Stealer botnet C2 server (confidence level: 100%) | |
file178.78.19.238 | NjRAT botnet C2 server (confidence level: 75%) | |
file91.222.173.204 | DarkGate botnet C2 server (confidence level: 100%) | |
file94.156.71.43 | RedLine Stealer botnet C2 server (confidence level: 100%) | |
file105.154.107.145 | NjRAT botnet C2 server (confidence level: 100%) | |
file77.91.77.180 | RisePro botnet C2 server (confidence level: 100%) | |
file47.237.84.207 | Cobalt Strike botnet C2 server (confidence level: 100%) | |
file47.237.84.207 | Cobalt Strike botnet C2 server (confidence level: 100%) | |
file144.22.38.242 | Meterpreter botnet C2 server (confidence level: 100%) | |
file144.22.38.242 | Meterpreter botnet C2 server (confidence level: 100%) | |
file144.22.38.242 | Meterpreter botnet C2 server (confidence level: 100%) | |
file39.96.33.40 | WhiteSnake Stealer botnet C2 server (confidence level: 100%) | |
file124.222.81.106 | Cobalt Strike botnet C2 server (confidence level: 100%) | |
file8.130.102.101 | Cobalt Strike botnet C2 server (confidence level: 100%) | |
file47.101.136.3 | Cobalt Strike botnet C2 server (confidence level: 100%) | |
file117.72.47.134 | Cobalt Strike botnet C2 server (confidence level: 100%) | |
file49.232.56.252 | Cobalt Strike botnet C2 server (confidence level: 100%) | |
file103.108.41.148 | Cobalt Strike botnet C2 server (confidence level: 100%) | |
file59.110.28.63 | Cobalt Strike botnet C2 server (confidence level: 100%) | |
file35.225.182.42 | Cobalt Strike botnet C2 server (confidence level: 100%) | |
file154.201.87.164 | Cobalt Strike botnet C2 server (confidence level: 100%) | |
file8.130.114.243 | Cobalt Strike botnet C2 server (confidence level: 100%) | |
file35.225.182.42 | Cobalt Strike botnet C2 server (confidence level: 100%) | |
file47.103.36.17 | Cobalt Strike botnet C2 server (confidence level: 100%) | |
file8.130.33.181 | Cobalt Strike botnet C2 server (confidence level: 100%) | |
file1.92.89.193 | Cobalt Strike botnet C2 server (confidence level: 100%) | |
file205.198.64.65 | Cobalt Strike botnet C2 server (confidence level: 100%) | |
file47.99.78.222 | Cobalt Strike botnet C2 server (confidence level: 100%) | |
file154.201.78.34 | Cobalt Strike botnet C2 server (confidence level: 100%) | |
file107.172.46.157 | Cobalt Strike botnet C2 server (confidence level: 100%) | |
file159.75.164.94 | Cobalt Strike botnet C2 server (confidence level: 100%) | |
file124.221.66.51 | Cobalt Strike botnet C2 server (confidence level: 100%) | |
file103.108.41.146 | Cobalt Strike botnet C2 server (confidence level: 100%) | |
file172.86.124.64 | Cobalt Strike botnet C2 server (confidence level: 100%) | |
file142.171.177.156 | Cobalt Strike botnet C2 server (confidence level: 100%) | |
file1.12.181.224 | Cobalt Strike botnet C2 server (confidence level: 100%) | |
file54.174.120.223 | Cobalt Strike botnet C2 server (confidence level: 100%) | |
file47.94.133.210 | Cobalt Strike botnet C2 server (confidence level: 100%) | |
file54.174.120.223 | Cobalt Strike botnet C2 server (confidence level: 100%) | |
file139.159.163.30 | Cobalt Strike botnet C2 server (confidence level: 100%) | |
file31.192.108.40 | Cobalt Strike botnet C2 server (confidence level: 100%) | |
file39.101.71.208 | Cobalt Strike botnet C2 server (confidence level: 100%) | |
file103.108.41.147 | Cobalt Strike botnet C2 server (confidence level: 100%) | |
file172.93.218.178 | Remcos botnet C2 server (confidence level: 75%) | |
file45.77.172.240 | Brute Ratel C4 botnet C2 server (confidence level: 50%) | |
file13.40.7.10 | Unknown malware botnet C2 server (confidence level: 50%) | |
file162.251.95.44 | Unknown malware botnet C2 server (confidence level: 50%) | |
file45.200.8.110 | Deimos botnet C2 server (confidence level: 50%) | |
file5.252.176.136 | BianLian botnet C2 server (confidence level: 50%) | |
file206.188.196.135 | Havoc botnet C2 server (confidence level: 50%) | |
file104.238.57.234 | Havoc botnet C2 server (confidence level: 50%) | |
file51.158.70.117 | Havoc botnet C2 server (confidence level: 50%) | |
file144.24.16.54 | Havoc botnet C2 server (confidence level: 50%) | |
file54.254.249.67 | Havoc botnet C2 server (confidence level: 50%) | |
file78.183.223.252 | QakBot botnet C2 server (confidence level: 50%) | |
file46.246.6.18 | DCRat botnet C2 server (confidence level: 50%) | |
file103.147.185.18 | DCRat botnet C2 server (confidence level: 50%) | |
file46.246.6.14 | DCRat botnet C2 server (confidence level: 50%) | |
file1.94.105.216 | Unknown malware botnet C2 server (confidence level: 50%) | |
file47.108.136.43 | Unknown malware botnet C2 server (confidence level: 50%) | |
file77.105.147.118 | Unknown malware botnet C2 server (confidence level: 50%) | |
file178.73.218.22 | AsyncRAT botnet C2 server (confidence level: 50%) | |
file45.66.231.254 | AsyncRAT botnet C2 server (confidence level: 50%) | |
file34.126.174.34 | AsyncRAT botnet C2 server (confidence level: 50%) | |
file34.126.174.34 | AsyncRAT botnet C2 server (confidence level: 50%) | |
file34.126.174.34 | AsyncRAT botnet C2 server (confidence level: 50%) | |
file178.124.152.84 | NetSupportManager RAT botnet C2 server (confidence level: 50%) | |
file88.17.27.121 | NetSupportManager RAT botnet C2 server (confidence level: 50%) | |
file5.59.248.211 | Mirai botnet C2 server (confidence level: 75%) | |
file188.208.141.211 | Cobalt Strike botnet C2 server (confidence level: 100%) | |
file189.18.237.15 | Cobalt Strike payload delivery server (confidence level: 100%) | |
file54.249.35.233 | Cobalt Strike botnet C2 server (confidence level: 100%) | |
file39.101.77.24 | Cobalt Strike botnet C2 server (confidence level: 100%) | |
file114.55.119.40 | Cobalt Strike botnet C2 server (confidence level: 100%) | |
file74.211.106.191 | Cobalt Strike botnet C2 server (confidence level: 100%) | |
file34.206.138.66 | Cobalt Strike botnet C2 server (confidence level: 100%) | |
file1.117.64.149 | Cobalt Strike botnet C2 server (confidence level: 100%) | |
file91.92.253.215 | RedLine Stealer botnet C2 server (confidence level: 100%) | |
file54.249.35.233 | Cobalt Strike botnet C2 server (confidence level: 100%) | |
file5.101.50.209 | FAKEUPDATES payload delivery server (confidence level: 100%) | |
file185.251.91.91 | FAKEUPDATES payload delivery server (confidence level: 100%) | |
file43.255.241.232 | NjRAT botnet C2 server (confidence level: 100%) | |
file188.166.252.88 | Unknown malware botnet C2 server (confidence level: 50%) | |
file13.201.63.1 | Unknown malware botnet C2 server (confidence level: 50%) | |
file124.163.194.70 | Deimos botnet C2 server (confidence level: 50%) | |
file178.209.99.214 | Deimos botnet C2 server (confidence level: 50%) | |
file154.12.56.138 | Deimos botnet C2 server (confidence level: 50%) | |
file164.90.194.34 | BianLian botnet C2 server (confidence level: 50%) | |
file116.62.142.170 | BianLian botnet C2 server (confidence level: 50%) | |
file172.104.157.219 | Havoc botnet C2 server (confidence level: 50%) | |
file63.250.56.42 | Havoc botnet C2 server (confidence level: 50%) | |
file81.43.24.131 | Havoc botnet C2 server (confidence level: 50%) | |
file94.156.8.20 | Havoc botnet C2 server (confidence level: 50%) | |
file150.158.53.58 | Havoc botnet C2 server (confidence level: 50%) | |
file118.161.12.237 | QakBot botnet C2 server (confidence level: 50%) | |
file45.241.39.172 | QakBot botnet C2 server (confidence level: 50%) | |
file38.12.36.54 | Unknown malware botnet C2 server (confidence level: 50%) | |
file158.58.172.127 | Unknown malware botnet C2 server (confidence level: 50%) | |
file49.113.77.12 | Unknown malware botnet C2 server (confidence level: 50%) | |
file34.122.213.13 | Unknown malware botnet C2 server (confidence level: 50%) | |
file45.66.231.254 | AsyncRAT botnet C2 server (confidence level: 50%) | |
file45.66.231.254 | AsyncRAT botnet C2 server (confidence level: 50%) | |
file45.66.231.254 | AsyncRAT botnet C2 server (confidence level: 50%) | |
file34.126.174.34 | AsyncRAT botnet C2 server (confidence level: 50%) | |
file45.129.0.115 | Unidentified 111 (Latrodectus) botnet C2 server (confidence level: 75%) |
Hash
| Value | Description | Copy |
|---|---|---|
hash1912 | RedLine Stealer botnet C2 server (confidence level: 100%) | |
hash1337 | NjRAT botnet C2 server (confidence level: 75%) | |
hash80 | DarkGate botnet C2 server (confidence level: 100%) | |
hash80 | RedLine Stealer botnet C2 server (confidence level: 100%) | |
hash10000 | NjRAT botnet C2 server (confidence level: 100%) | |
hash50500 | RisePro botnet C2 server (confidence level: 100%) | |
hash8001 | Cobalt Strike botnet C2 server (confidence level: 100%) | |
hash8002 | Cobalt Strike botnet C2 server (confidence level: 100%) | |
hash4444 | Meterpreter botnet C2 server (confidence level: 100%) | |
hash5555 | Meterpreter botnet C2 server (confidence level: 100%) | |
hash6666 | Meterpreter botnet C2 server (confidence level: 100%) | |
hash8080 | WhiteSnake Stealer botnet C2 server (confidence level: 100%) | |
hash8888 | Cobalt Strike botnet C2 server (confidence level: 100%) | |
hash801 | Cobalt Strike botnet C2 server (confidence level: 100%) | |
hash443 | Cobalt Strike botnet C2 server (confidence level: 100%) | |
hash80 | Cobalt Strike botnet C2 server (confidence level: 100%) | |
hash8000 | Cobalt Strike botnet C2 server (confidence level: 100%) | |
hash9001 | Cobalt Strike botnet C2 server (confidence level: 100%) | |
hash443 | Cobalt Strike botnet C2 server (confidence level: 100%) | |
hash443 | Cobalt Strike botnet C2 server (confidence level: 100%) | |
hash80 | Cobalt Strike botnet C2 server (confidence level: 100%) | |
hash80 | Cobalt Strike botnet C2 server (confidence level: 100%) | |
hash80 | Cobalt Strike botnet C2 server (confidence level: 100%) | |
hash80 | Cobalt Strike botnet C2 server (confidence level: 100%) | |
hash8888 | Cobalt Strike botnet C2 server (confidence level: 100%) | |
hash9999 | Cobalt Strike botnet C2 server (confidence level: 100%) | |
hash443 | Cobalt Strike botnet C2 server (confidence level: 100%) | |
hash443 | Cobalt Strike botnet C2 server (confidence level: 100%) | |
hash443 | Cobalt Strike botnet C2 server (confidence level: 100%) | |
hash80 | Cobalt Strike botnet C2 server (confidence level: 100%) | |
hash8888 | Cobalt Strike botnet C2 server (confidence level: 100%) | |
hash2095 | Cobalt Strike botnet C2 server (confidence level: 100%) | |
hash9001 | Cobalt Strike botnet C2 server (confidence level: 100%) | |
hash443 | Cobalt Strike botnet C2 server (confidence level: 100%) | |
hash443 | Cobalt Strike botnet C2 server (confidence level: 100%) | |
hash80 | Cobalt Strike botnet C2 server (confidence level: 100%) | |
hash80 | Cobalt Strike botnet C2 server (confidence level: 100%) | |
hash8888 | Cobalt Strike botnet C2 server (confidence level: 100%) | |
hash81 | Cobalt Strike botnet C2 server (confidence level: 100%) | |
hash8080 | Cobalt Strike botnet C2 server (confidence level: 100%) | |
hash8080 | Cobalt Strike botnet C2 server (confidence level: 100%) | |
hash8088 | Cobalt Strike botnet C2 server (confidence level: 100%) | |
hash9001 | Cobalt Strike botnet C2 server (confidence level: 100%) | |
hash44555 | Remcos botnet C2 server (confidence level: 75%) | |
hash8443 | Brute Ratel C4 botnet C2 server (confidence level: 50%) | |
hash7443 | Unknown malware botnet C2 server (confidence level: 50%) | |
hash7443 | Unknown malware botnet C2 server (confidence level: 50%) | |
hash4505 | Deimos botnet C2 server (confidence level: 50%) | |
hash9090 | BianLian botnet C2 server (confidence level: 50%) | |
hash8443 | Havoc botnet C2 server (confidence level: 50%) | |
hash443 | Havoc botnet C2 server (confidence level: 50%) | |
hash80 | Havoc botnet C2 server (confidence level: 50%) | |
hash80 | Havoc botnet C2 server (confidence level: 50%) | |
hash443 | Havoc botnet C2 server (confidence level: 50%) | |
hash443 | QakBot botnet C2 server (confidence level: 50%) | |
hash9000 | DCRat botnet C2 server (confidence level: 50%) | |
hash8848 | DCRat botnet C2 server (confidence level: 50%) | |
hash2222 | DCRat botnet C2 server (confidence level: 50%) | |
hash8000 | Unknown malware botnet C2 server (confidence level: 50%) | |
hash8888 | Unknown malware botnet C2 server (confidence level: 50%) | |
hash50555 | Unknown malware botnet C2 server (confidence level: 50%) | |
hash2000 | AsyncRAT botnet C2 server (confidence level: 50%) | |
hash8008 | AsyncRAT botnet C2 server (confidence level: 50%) | |
hash3000 | AsyncRAT botnet C2 server (confidence level: 50%) | |
hash20000 | AsyncRAT botnet C2 server (confidence level: 50%) | |
hash888 | AsyncRAT botnet C2 server (confidence level: 50%) | |
hash8443 | NetSupportManager RAT botnet C2 server (confidence level: 50%) | |
hash443 | NetSupportManager RAT botnet C2 server (confidence level: 50%) | |
hash9506 | Mirai botnet C2 server (confidence level: 75%) | |
hash443 | Cobalt Strike botnet C2 server (confidence level: 100%) | |
hash8081 | Cobalt Strike payload delivery server (confidence level: 100%) | |
hash443 | Cobalt Strike botnet C2 server (confidence level: 100%) | |
hash443 | Cobalt Strike botnet C2 server (confidence level: 100%) | |
hash80 | Cobalt Strike botnet C2 server (confidence level: 100%) | |
hash80 | Cobalt Strike botnet C2 server (confidence level: 100%) | |
hash443 | Cobalt Strike botnet C2 server (confidence level: 100%) | |
hash6666 | Cobalt Strike botnet C2 server (confidence level: 100%) | |
hash1912 | RedLine Stealer botnet C2 server (confidence level: 100%) | |
hash80 | Cobalt Strike botnet C2 server (confidence level: 100%) | |
hash443 | FAKEUPDATES payload delivery server (confidence level: 100%) | |
hash443 | FAKEUPDATES payload delivery server (confidence level: 100%) | |
hash5555 | NjRAT botnet C2 server (confidence level: 100%) | |
hash273332a7e82a1808f3f3f13de3882870692919b2 | XWorm payload (confidence level: 95%) | |
hash0f1032dd6e6e984bd0e31d1edb45e027b12d0ec1976505dd6a4d1dd2351931ac | XWorm payload (confidence level: 95%) | |
hash2bf102e6b31cd60a79a900979e7c04a2 | XWorm payload (confidence level: 95%) | |
hash549e7a8c8e998d3b7f85e61a7171685af231e780 | Formbook payload (confidence level: 95%) | |
hash76650fb8aeaf679cd204ca347026a67767ab8d9c27f65597b275d8d57327e096 | Formbook payload (confidence level: 95%) | |
hasha9c37f81cd9a181dab2262d2f8456a76 | Formbook payload (confidence level: 95%) | |
hash8d628dec0d699f1ae4006fc4902209fa9d30b0a2 | AsyncRAT payload (confidence level: 95%) | |
hash93aa308ad98dbf7a242ff3d06c2ba50ece83cbf909a17887bc441788a942e3a4 | AsyncRAT payload (confidence level: 95%) | |
hash67fc91937026fa8c1f0d96c42c50ec87 | AsyncRAT payload (confidence level: 95%) | |
hashb4e871ca1b111a12f09db58484e5a90255e6f104 | Loki Password Stealer (PWS) payload (confidence level: 95%) | |
hash4f9289ac6c38a0b6d80173c6b645e6d70d415a8291017f89c852b2468175bde8 | Loki Password Stealer (PWS) payload (confidence level: 95%) | |
hash1d2c968c22903392601d409cfe0af1af | Loki Password Stealer (PWS) payload (confidence level: 95%) | |
hash42f4eb3e00d258e61cf98a125d025692ac68c88a | Remcos payload (confidence level: 95%) | |
hashd56ddb9b2cb85e97a55f366aa00f53ffa566a6aa42964e56646cfb58663afd68 | Remcos payload (confidence level: 95%) | |
hash1a047b9b776d41ec61cc91286c27be07 | Remcos payload (confidence level: 95%) | |
hash81dc532f21c8be7217f5473b63a4ddde835d55e8 | RedLine Stealer payload (confidence level: 95%) | |
hashc2e57fb2b8206bd9b5d05d8a9b0d2e78082dd303ee6364b288d568fcd48900f7 | RedLine Stealer payload (confidence level: 95%) | |
hashccd55adce3f0b0885c8e5acc7df26c6a | RedLine Stealer payload (confidence level: 95%) | |
hash0bf023f02385a117a61803064b0012035f57139f | NjRAT payload (confidence level: 95%) | |
hash6e48181d4ffbd2958b47bf84e9335118d9eff0d34e58091c62d9838a17899ae9 | NjRAT payload (confidence level: 95%) | |
hash8d84f5becf22d3bceb322273fa2ac133 | NjRAT payload (confidence level: 95%) | |
hashedc90c93dcee5d6ded2ea173dbb099d97e631f6b | AsyncRAT payload (confidence level: 95%) | |
hashd9afd43ff9f29e05064ce006cf0bda621b917851f4017b2186127fee603850c6 | AsyncRAT payload (confidence level: 95%) | |
hash6a5790f128089879ae9fd8a9cce40b57 | AsyncRAT payload (confidence level: 95%) | |
hashfb9bedbcb0758af5ec77b248915aba7ab2e3e504 | Stealerium payload (confidence level: 95%) | |
hasha4fc6ef06617c607c0b4d532e7df102e1dbe7416b28402e214672cbae1188302 | Stealerium payload (confidence level: 95%) | |
hash928ecc7808c79c7a4ca63a1730cee20a | Stealerium payload (confidence level: 95%) | |
hash730c80921d14df0b67a163583ba838e7038a5a54 | Agent Tesla payload (confidence level: 95%) | |
hash4a45b99ba18fc60bbe3bf3ca42a0c1e9ab35597a1863c4010f2477bfded40963 | Agent Tesla payload (confidence level: 95%) | |
hash94a199c5872b9f03acc3ad7ffb076ec5 | Agent Tesla payload (confidence level: 95%) | |
hash1515edade6814e5bb2642d63d7dd87fcc6f67bf7 | SigLoader payload (confidence level: 95%) | |
hashc31957e7f7c20119847fc9fc963ff30b67082f0cbb4389d89be6e19762111a83 | SigLoader payload (confidence level: 95%) | |
hashd59caca462dcc8483ca9029f11be6d8a | SigLoader payload (confidence level: 95%) | |
hash0f69f54846e26167777e3d56939adc72ddcb545c | Stealc payload (confidence level: 95%) | |
hash230280a480e2b4301c9beed0e5519c1f72f8c5a2d4193b5f69d7a02f6884bb16 | Stealc payload (confidence level: 95%) | |
hashfdaa4171e6b15af5628a055bc7a7bca1 | Stealc payload (confidence level: 95%) | |
hashccb27bc5570fd160601d8009727296a12c579f66 | Remcos payload (confidence level: 95%) | |
hash52a37eb90b8f3a1d164717415b58cf9bac1db1caa1f8aa57224089811cf50960 | Remcos payload (confidence level: 95%) | |
hash7b9956e820cfd64a02a13af88b5237af | Remcos payload (confidence level: 95%) | |
hash6db12fae968037afc24f9877656db62e990c9ad4 | RedLine Stealer payload (confidence level: 95%) | |
hasha76cc5f77ac3607e1252bc4a61bd7fd036646e0585736fa88a8961edb2b73aef | RedLine Stealer payload (confidence level: 95%) | |
hash7439c3808f6f807008b772efadbe1b91 | RedLine Stealer payload (confidence level: 95%) | |
hash260e091ddb29ef328f54045fa9828be5145c8ef0 | RedLine Stealer payload (confidence level: 95%) | |
hash1dd97881cd53e8039e8c343990524ff21292be0e9deb7ec5ad078bfe945c0189 | RedLine Stealer payload (confidence level: 95%) | |
hashcdebf59de3ab5531db44072fc981b800 | RedLine Stealer payload (confidence level: 95%) | |
hasha728c89f5afe447c63aa5ec80e8e70c98b105553 | Formbook payload (confidence level: 95%) | |
hash1adc34ccf3cc5851de0c7968bb182815a4ba913364d47f72436b526b7ec0618d | Formbook payload (confidence level: 95%) | |
hash9c39e700a95a5444c8d9e013547d615d | Formbook payload (confidence level: 95%) | |
hashb6c19f2eadfb56d31b8cbc6e1a009e0c2d7ab83d | Kutaki payload (confidence level: 95%) | |
hasha9ab55c115d897c0488d6b68d02d858c973e1a607d8886b1ac4183dbc02c3155 | Kutaki payload (confidence level: 95%) | |
hash8d1e1b7fe8a180c56f9261907565ae61 | Kutaki payload (confidence level: 95%) | |
hash0e6546d7a7f237a4c094e24810fd4ab29ab6a970 | Vidar payload (confidence level: 95%) | |
hash83b2f6c63dc3ec6cea64755ce2042ff747d52571daaef8a47934e00378f0afd3 | Vidar payload (confidence level: 95%) | |
hash1ed6f9d578e14edad0bf47edf1f6269f | Vidar payload (confidence level: 95%) | |
hash2acc780d12e23361398c5ffebaa750dab279a6c8 | Agent Tesla payload (confidence level: 95%) | |
hash8d3ea6fd9b769b04d83d80ee89013b4e12f51f76b7e5a60321d88321540846c9 | Agent Tesla payload (confidence level: 95%) | |
hash3e5668f79e1467999bfe4000fdf1858b | Agent Tesla payload (confidence level: 95%) | |
hash6dff405c8ca73bc41afa0be7a41f71f3e13df98e | Formbook payload (confidence level: 95%) | |
hash6bea8fb52d0dd24e86ea0baf07828878cdfb4f1fab4d64933bbba237d0ea21bc | Formbook payload (confidence level: 95%) | |
hash75b4a0e21d50909e18bb815d17b54275 | Formbook payload (confidence level: 95%) | |
hash761f9bb97f92889e93843a13c796e00fdb9eb50f | Formbook payload (confidence level: 95%) | |
hashb96c94f2fb7072f885b94cbbf77e849b608df0b60b99819b4a0aeaf8761d3b47 | Formbook payload (confidence level: 95%) | |
hashb2846b84204417271b632f7ff5498ef2 | Formbook payload (confidence level: 95%) | |
hashe04b02d0e26c1c5c4b2d07c0b9b8f87fce5204c2 | Formbook payload (confidence level: 95%) | |
hashb1a24dc1965d0695bd97c27ddb5c4b078ebf9cfcb4a3bf5bcdb79b00801598ac | Formbook payload (confidence level: 95%) | |
hasha165fc410a576e641dd6442581eca6de | Formbook payload (confidence level: 95%) | |
hash8fc0cb81e049ff1d7a77ed49851a259d803f6f03 | Formbook payload (confidence level: 95%) | |
hashf78712b4a17f41e16f6e6d0a9abcd0dade9f25227939beaf8ba8de0cdca838b8 | Formbook payload (confidence level: 95%) | |
hash3d175fa04c173a448511478f531f6ec7 | Formbook payload (confidence level: 95%) | |
hash8027ca74a08e02dc096a9a3f92081bd5a7a20c67 | MetaStealer payload (confidence level: 95%) | |
hash307ec11b5a2a83aa2787b8f3cbecb4ea93868a3b3982ebbd5392f3efe9141c78 | MetaStealer payload (confidence level: 95%) | |
hashe37cf85193275925afdb82a266069174 | MetaStealer payload (confidence level: 95%) | |
hash1c28d0a969cd8db92202cfe923d18e39d9c305be | RedLine Stealer payload (confidence level: 95%) | |
hash7f12d621d13d212ed99ef23b8fa1b34337a4491f8df52dd3e5c0b9f3568f2c1b | RedLine Stealer payload (confidence level: 95%) | |
hash5e30ff1d98cb47c26d6b0a3c0449f11c | RedLine Stealer payload (confidence level: 95%) | |
hash0b3926a1a98b87938b94f8ffd511f7319a576990 | RokRAT payload (confidence level: 95%) | |
hashc3e5a543f13e20484325ba5a08fd8993880f8282ed5a40e30c97fcf2aea91fa1 | RokRAT payload (confidence level: 95%) | |
hashbb4b3fd0c725a96ba871f77f9604fa69 | RokRAT payload (confidence level: 95%) | |
hash4911e2fd81a78c402c0638b6705e26af73deb3d1 | RokRAT payload (confidence level: 95%) | |
hash85eeb40d3c63e7452b85dd1f64ad8c6a959baf5f392719ee709d8093404782db | RokRAT payload (confidence level: 95%) | |
hash3464c6b50ffdf4e9cad35a423868fa17 | RokRAT payload (confidence level: 95%) | |
hashe782a9abdd7ceed63a6a10b83a16c278400f9b32 | RokRAT payload (confidence level: 95%) | |
hash6f5b287c87ff655d6d07686fc8328e1c7e4dd2ca99caca5c757300a8d4b1940b | RokRAT payload (confidence level: 95%) | |
hash1f89375dede098a5f59710c111594b8d | RokRAT payload (confidence level: 95%) | |
hash0cf0d409f644c3712299b0c91ea249537d51ff45 | RokRAT payload (confidence level: 95%) | |
hash249ff1abee706220f65aa47ef1c839a44b54979466ac531231858c6cf8e50e99 | RokRAT payload (confidence level: 95%) | |
hashcc5b6e9deec470d26e074859ca794aca | RokRAT payload (confidence level: 95%) | |
hashe7079a4aa2715132d6ea4ac4e7997effea00e979 | RokRAT payload (confidence level: 95%) | |
hash0b9145613da75b127de6d9f0094a7b2813e3c8c651aec50aee83c1e722e63be3 | RokRAT payload (confidence level: 95%) | |
hash5cb029f745b0691ec119a958319c31ef | RokRAT payload (confidence level: 95%) | |
hash0be4983558b5b48bf0b1a1ec129cb380939c84ae | RokRAT payload (confidence level: 95%) | |
hash5fda36bec5b1d5ec526e5b044a6b30b7afa1d0d5465ffa7c470efc9358ebc4b5 | RokRAT payload (confidence level: 95%) | |
hashbcc06a7faf92224142143e13eaf78cf1 | RokRAT payload (confidence level: 95%) | |
hash1aab2b69eb9f918d1e0a23a82a98411709ee2fdb | RokRAT payload (confidence level: 95%) | |
hash477ca1add0f03886c3bb29c4f03ffd2aa4d5c2a0fb3346fe46890c25347a8d7c | RokRAT payload (confidence level: 95%) | |
hashb41d067615ca60ffe4253297866d79be | RokRAT payload (confidence level: 95%) | |
hashd511085323362fbabb71473128ac23e4eb3f01a5 | RedLine Stealer payload (confidence level: 95%) | |
hashfd310dd65cf99f9392307b0b7fe8e3c4c45ad5019a321107abbfbd9c6c571de0 | RedLine Stealer payload (confidence level: 95%) | |
hash077bd05ea32a3eed0e3f0a289dfa1087 | RedLine Stealer payload (confidence level: 95%) | |
hash1b2b8d0d6dc3859eeaca02af3a8e2f42a3853699 | Agent Tesla payload (confidence level: 95%) | |
hash953dbb09953afb206f8fad0d62883a572f75e39c3fc5177332bf970c59c77278 | Agent Tesla payload (confidence level: 95%) | |
hash0ad650cec0d9769edca2602786dc04fc | Agent Tesla payload (confidence level: 95%) | |
hashac11a7300dbec0d2b67e549b97d3a1ab4e30c94a | Formbook payload (confidence level: 95%) | |
hashe7c888a111eeb26eec94afc97e0f9b838fda41ab74e083cb5b94f06800890d2d | Formbook payload (confidence level: 95%) | |
hash8e32f87b4f51fac392122d3c43b2e54f | Formbook payload (confidence level: 95%) | |
hashd3c3b40dc5d8f3bfc71c7cd2be06e346ab694fdd | Stealc payload (confidence level: 95%) | |
hash5e3cae26ee0d86cf2c2660baf9d0fc27227173cc8440a94abe5c85a698e0293f | Stealc payload (confidence level: 95%) | |
hash747f49b526a931e987825204c1473a27 | Stealc payload (confidence level: 95%) | |
hash7e1572f43015ae80ee15354bce184ac0f75e6e67 | KrakenKeylogger payload (confidence level: 95%) | |
hash5a92d770d34718ab6624c95d586269cb9d144803cb0f94ea91b78344360eb5cf | KrakenKeylogger payload (confidence level: 95%) | |
hash1a3037dced4fbdc13c75a4a4a34183a5 | KrakenKeylogger payload (confidence level: 95%) | |
hashee695635a4bbb2ac00f0a5907387856fd7912f41 | Agent Tesla payload (confidence level: 95%) | |
hash260a3fd20510a8338f7f3f579d8d6a5ff3d131e1f91c0cd63e3e42824cead6f4 | Agent Tesla payload (confidence level: 95%) | |
hash9307fdf2f39399a86fd7d4b3e24f8d8e | Agent Tesla payload (confidence level: 95%) | |
hashcde7c40944ce1313dcbf06c8c11aebeaf8c5be10 | XWorm payload (confidence level: 95%) | |
hash2cd82067ffbfee95350ffc5d93b1da648d5d6f1d77cbaf3b5b5c5653711bdf45 | XWorm payload (confidence level: 95%) | |
hashe63ebad1d9e6d8f7cbc8c6bfb3c15789 | XWorm payload (confidence level: 95%) | |
hashb026ad1bbd93ba9f30776c823d3c9c954dd9f975 | SmokeLoader payload (confidence level: 95%) | |
hashb87126fd409621a4d510dda005cd84e254d491274661cf22238b271412ff860b | SmokeLoader payload (confidence level: 95%) | |
hash794107dd168bd98d7c9f65a9f693a07e | SmokeLoader payload (confidence level: 95%) | |
hashcfce5320daedaca6a494bd9cb05f762b1f1ae9e2 | Formbook payload (confidence level: 95%) | |
hash2b60a60cc965883183d2a376c5136c088d29da5238dff2ac9223149064e31fde | Formbook payload (confidence level: 95%) | |
hash1b9787c8ff728714561b4137c22536bd | Formbook payload (confidence level: 95%) | |
hash2dc7e29e08c0f0cef40c88046f416290de43797e | Remcos payload (confidence level: 95%) | |
hash73a4bbb85f8d199377afd2ea10ef5d4467e22e1dccb23275f176ea564d3e1ef8 | Remcos payload (confidence level: 95%) | |
hash61bacdb8e8f052c36ae36e8548a13c8a | Remcos payload (confidence level: 95%) | |
hash24ddd5e2c7e96e52e00f5a6e2b29e4b100d0c578 | RokRAT payload (confidence level: 95%) | |
hasha77d96f186d1cc96dc589f4a6d55b45c9c04c77072fd504a720f437412ff93cb | RokRAT payload (confidence level: 95%) | |
hash92d4e2ef88e5aafb72ddde13e84b549a | RokRAT payload (confidence level: 95%) | |
hash5d8e5e35fe9edd166b13e592fafe08a74b14455c | SigLoader payload (confidence level: 95%) | |
hashb129237b16973abf537877e13216d3565238ea99b5ddc1b38890c235457c50c1 | SigLoader payload (confidence level: 95%) | |
hashab0e0ab3d5709e3831dcaa08b6c8a9db | SigLoader payload (confidence level: 95%) | |
hashd7b6c018c99448014fe6199244956eafb69405d3 | Luca Stealer payload (confidence level: 95%) | |
hasha173db1e8568fc4b00f326d52af0fea19c59639c486d9975589edfd8f1a11da1 | Luca Stealer payload (confidence level: 95%) | |
hash9cc0e7d568d15f8f23b06c68ad71be62 | Luca Stealer payload (confidence level: 95%) | |
hash843de82efbd8d17d96733251ce723540a2c05e59 | KPOT Stealer payload (confidence level: 95%) | |
hash947ef875bd33912333be6b33291752cfc2c29393adbaa5ce78cdfa0b3aefc75d | KPOT Stealer payload (confidence level: 95%) | |
hash1f4e76e35124c2fa6c41a96a30f6124a | KPOT Stealer payload (confidence level: 95%) | |
hashac0f26d23fecf8da223739c639dad8e9475533f3 | Cobalt Strike payload (confidence level: 95%) | |
hash9b05e5b29809ad9f77127c4bc9e563257b68175bf55aff7ec85b858cb01c8684 | Cobalt Strike payload (confidence level: 95%) | |
hashb958d6940edc44e8d99a9e5c074acd5a | Cobalt Strike payload (confidence level: 95%) | |
hash2ec570c00f3da4058ee39878320d507cde066868 | Agent Tesla payload (confidence level: 95%) | |
hashf0a1308efe7bcf1be384db385b8183f48c5f1c2432da2322263b90f01a0820aa | Agent Tesla payload (confidence level: 95%) | |
hash9cc158711bee10773a3259aaafb62857 | Agent Tesla payload (confidence level: 95%) | |
hash5005f12bccee6cfe6781c925749eeae92f4f039a | Ghost RAT payload (confidence level: 95%) | |
hash36ca73fac0f3955bf525b4c7c72f1a5630be6f66f5726801ca3976829f8ce94b | Ghost RAT payload (confidence level: 95%) | |
hash15d520c0449be451ebc0fe3884fb0be1 | Ghost RAT payload (confidence level: 95%) | |
hash5ca1fdf11531cd40a11790b465ad88c461400b98 | Ghost RAT payload (confidence level: 95%) | |
hash6c82b1e394b7da24e62f03c745c0ceb907f49f0a43d032f9b3bc53ef8179e7a2 | Ghost RAT payload (confidence level: 95%) | |
hashb4616e8edec84cdb65e9753e97b0f803 | Ghost RAT payload (confidence level: 95%) | |
hashf6a97876f399aba9d4c8867bdae6e17d16510eb7 | Agent Tesla payload (confidence level: 95%) | |
hash494c2e3f9d7b369ac1f7f471a170f31d421ee5027af82f1c5e32227860e00404 | Agent Tesla payload (confidence level: 95%) | |
hash175d1d82db92cdcde93d44ea8cd76a06 | Agent Tesla payload (confidence level: 95%) | |
hash33ad1f1d1b139b6f2ffe3fe0c7a94f61e4ec7088 | Cobalt Strike payload (confidence level: 95%) | |
hasha1b36b37454873c6afe0f5822e343a029b9724ee07ec6ae4243d5a688e9a84c7 | Cobalt Strike payload (confidence level: 95%) | |
hashbe101f8181d00ee2196fbc988d85d7d3 | Cobalt Strike payload (confidence level: 95%) | |
hash5d07d9e8172869c875d600b3acb1e338b0d6ad0f | Cobalt Strike payload (confidence level: 95%) | |
hash65fa4b4c8ba39ca1e2e853cf6bccf1737cc350e362d9ff7bb04dc0dae75a103f | Cobalt Strike payload (confidence level: 95%) | |
hash1b0f8cd0a0f9788b131ccf3f2a6d6d9b | Cobalt Strike payload (confidence level: 95%) | |
hash7365f1258d8527867af36ab19d7fac84edcc2b46 | Meterpreter payload (confidence level: 95%) | |
hash78f40dbc06bf9e63d2322bad4b70fefb29d6060292f91c12d82cbae449ed4d77 | Meterpreter payload (confidence level: 95%) | |
hashe18a6528feb2a80af9a1cc435ed30bed | Meterpreter payload (confidence level: 95%) | |
hash4ff159383923c10c97875f7cca192dcae0203ce9 | Meterpreter payload (confidence level: 95%) | |
hash29c8a6f9f4ff78e6019fbf55c882966f7af611b7c470cebe763b0c356756f351 | Meterpreter payload (confidence level: 95%) | |
hash1b56ac299e10b84c9d04416ed1b309a2 | Meterpreter payload (confidence level: 95%) | |
hash4919910c4fa32c1acc844f358feeb00f015b0cc5 | Cobalt Strike payload (confidence level: 95%) | |
hashed14a8886c207595360dbc904914f5113a656951d9aafc748d56d0e9b8f70742 | Cobalt Strike payload (confidence level: 95%) | |
hash40094e123c89625468665c8c196c2ffd | Cobalt Strike payload (confidence level: 95%) | |
hash8d82a1882e40d797afc6af7b1d63cc67c40bbfdd | Cobalt Strike payload (confidence level: 95%) | |
hash4def22c51fea8c4114321733ca506efced17ea426f1c5a518905a93f6c20fa34 | Cobalt Strike payload (confidence level: 95%) | |
hash64d9a7da3f1aa599a9656fb0894fabeb | Cobalt Strike payload (confidence level: 95%) | |
hash6071f929619b0046206d783afebaccaae3106ebb | MetaStealer payload (confidence level: 95%) | |
hashf55dcabe5c7666954e6a626ad7bed40010a3f598d8ef3efcfb68135d29b2767d | MetaStealer payload (confidence level: 95%) | |
hash2d54d9c5710c8a2d09111644b8c6f76c | MetaStealer payload (confidence level: 95%) | |
hash3baa8426a26eccd61d570a9046332fdc1206497d | Formbook payload (confidence level: 95%) | |
hash6a070aa1de79b9a6230c4f54aaa6edb1f351ceef949d2572c23c28325d3330f0 | Formbook payload (confidence level: 95%) | |
hashb356a7017f5374d105bd0af22915ac50 | Formbook payload (confidence level: 95%) | |
hash167ed46dabab3bfaf30029b09ee1b16a05130ca8 | AsyncRAT payload (confidence level: 95%) | |
hash3724853be234af96fc81211c901194d667d5750574859e073e475f3752ab7ee5 | AsyncRAT payload (confidence level: 95%) | |
hash9d502a4212fd8573768be94873b24625 | AsyncRAT payload (confidence level: 95%) | |
hash2fc5533d312696182f0400348f6a7c05fd6e0fb9 | Agent Tesla payload (confidence level: 95%) | |
hash6f73393dfb236ab191e8b247573693f6d2913bf59a95541488d0fa6037f9e589 | Agent Tesla payload (confidence level: 95%) | |
hashf5b3ee4ba93ac550818ffc3245e63da8 | Agent Tesla payload (confidence level: 95%) | |
hash072dd71ea12a57bdef11b663bce746878f4585ec | Remcos payload (confidence level: 95%) | |
hash82eddb35f29fcef506f76342077d1bcbe38689680a9efd6d7a58b08479d13f28 | Remcos payload (confidence level: 95%) | |
hashe5114c7a45a7b3c658c4ae212ac089e5 | Remcos payload (confidence level: 95%) | |
hash7dfb4c70ef7d73c8618ce8799d414ba3c3fe9684 | Loki Password Stealer (PWS) payload (confidence level: 95%) | |
hash49274bd66a4d53ca004a0a58c15496292a323f229b9712e5f3994af5c307bc0a | Loki Password Stealer (PWS) payload (confidence level: 95%) | |
hash33bc360990c66beea144ae48d17504a6 | Loki Password Stealer (PWS) payload (confidence level: 95%) | |
hash80cb04179fe16032b99ca054d1bca515bd079f928db6ae002ddfcfb3ebb236f4 | Remcos payload (confidence level: 100%) | |
hash23d23d9bfe66cfcca000342ec36c54f6bbc138a5a50fc1a4f9de28dcf7be72bb | Remcos payload (confidence level: 100%) | |
hashfe83c58c10bf7a111e0334e729d4417f63cd22f53cdafc00622a21cb456cbdaf | Remcos payload (confidence level: 100%) | |
hashbb939a5d9535a87231e5a91e1f23121159c7bd6f38013a69d3313dda4a424f41 | Remcos payload (confidence level: 100%) | |
hash75f31b87ec554f90de7b8481b62908e50d83176e3a7d74e7564ae9f7c16388ee | Remcos payload (confidence level: 100%) | |
hash86329825eaf86f08f84bfc3ddd8870b5c05f47a43aba3695eea5ca4c7a0ee00b | Remcos payload (confidence level: 100%) | |
hash39df3cbc48867b449d4828185b06f2e4d647562724da9205a46f5fd5763e6545 | Remcos payload (confidence level: 100%) | |
hashf49fc0151c871c2e0544b32f7c238c810988e9bd63cd2d691adb8f3a34ec02fb | Remcos payload (confidence level: 100%) | |
hashf0ec07e537c7bf74abbc66af82e1f273fceca81467e1d74ed69514107421de61 | Remcos payload (confidence level: 100%) | |
hashed3dc0a914abcaa078502209d2091a585c623044a7309e139b39a9d093264420 | Remcos payload (confidence level: 100%) | |
hashe77df90c6642d268ece623b00aae363c8075d9715ddbed1d808d4561772532ec | Remcos payload (confidence level: 100%) | |
hashdacf76612ec19aa3f80f070321abac8830e376981ccd5ec4eebd1ba017c6e462 | Remcos payload (confidence level: 100%) | |
hashd524227a19b56c6cbeafe88f619999433dd20b1d09d374a79f6e721686c70515 | Remcos payload (confidence level: 100%) | |
hash99c3ad8c8368e37f91ee3afc68707e9f3bf8a3568148a52a30b185c74fc3ceab | Remcos payload (confidence level: 100%) | |
hash8dbccd1c7bdb8da3a34c2a4ac5c62fb6774ce2abac29caf899039d19a5d27555 | Remcos payload (confidence level: 100%) | |
hash89d5d25cd020213d6426f13296765683202542062cdcfb10b611d46a65d38d0f | Remcos payload (confidence level: 100%) | |
hash6f19b81c0a43cadb5d5447e3dc0485c04fd400d4a0656ff4af092ab9faac7213 | Remcos payload (confidence level: 100%) | |
hash6eecadfd2838192c745cf88fa82ed4e96d9f27b15f1372ab24a5e94fdba22978 | Remcos payload (confidence level: 100%) | |
hash559122ff10dc062b44d239d7867a47266f0b8b1088df6551dcfa0f75eb1014bb | Remcos payload (confidence level: 100%) | |
hash5422c0223694ab7ffdb4968db24177c7bb0426e29b32b0f810192258c0af61da | Remcos payload (confidence level: 100%) | |
hash3521381fadca86cfc577e8aa81ecff5f3453102559bb7e86d903d9b87db1456c | Remcos payload (confidence level: 100%) | |
hash0c286126eae5d8d419bac3830831dbcfd0deb2b375d21666de4eac3c9824f4a8 | Remcos payload (confidence level: 100%) | |
hash050c70c13b2fbffe4c003fadaa6561dcd3d2d78352e14b7f8498653d32631201 | Remcos payload (confidence level: 100%) | |
hash49042e86af4503a917b8408c4faab2759688065a429015a2c90430fa7371291f | Remcos payload (confidence level: 100%) | |
hash1277a2276ba8cf81383cf7cdf68638f04627b0748165dd9c34a8f222abf39050 | Remcos payload (confidence level: 100%) | |
hash35d386e662508b9089b14ddf8ceebfb968baffd37f5e9a771da80a40f0bb5b75 | Remcos payload (confidence level: 100%) | |
hash0e003ce0c1861c844c553377c325babf7a9df7f56ddbd8e0eabd75e1816a58eb | Remcos payload (confidence level: 100%) | |
hasha97b49a5796ffeb59416acf31fd256d8990092350bc36b3a5baf9f1e78e3f48f | Remcos payload (confidence level: 100%) | |
hash30a52c561659e1499e4e5518e16a44b01dcf479e459d3bebb426aee16e971c09 | DCRat payload (confidence level: 100%) | |
hash50258d28e57d1470e34bcb97075ac5d97c236918d3cc1f728830fd9a5e70b25b | DCRat payload (confidence level: 100%) | |
hashf4ab048f183a7269468b0cb8509668831e3d8f816e1be3162a0734c83c488c97 | DCRat payload (confidence level: 100%) | |
hash8ff0fa4fa960b53d6bbb74459628e38e248d942563155444b16c4987b5187bb8 | DCRat payload (confidence level: 100%) | |
hashd9dc76fcec48e47d8a10afa9ee40af17b856bff408bbc3eb36f5d362364a8d4c | DCRat payload (confidence level: 100%) | |
hashf77428745e66a5ba3dfdac0086b513de80e3a01579f0b7f40658d90e6bda976c | DCRat payload (confidence level: 100%) | |
hasha9f3da04b2557601ad57146a0efbfd0a975a881c09841edaef53a7d02ed848f3 | DCRat payload (confidence level: 100%) | |
hash1a95e485f4ae28b3526839f632e2d199d0652ba9e05215138a8e6fc9df0299ac | DCRat payload (confidence level: 100%) | |
hashf8a42260874653f5bbcffb14cb8a59176e89bbe54d50e2727087e6a46ca12e91 | DCRat payload (confidence level: 100%) | |
hashd6988ffe9f646f959400d60e700e617493ef83e1f32dd8d7b85e5c1790d8bc6c | DCRat payload (confidence level: 100%) | |
hash374290f4bc29e1d5a3295b8f23c281393075beae64db51cd5a5e96c03f9ef8b0 | DCRat payload (confidence level: 100%) | |
hash85eabe0053da09958088dde25cfb55028b578c5327cbdd213a58563683413ee9 | DCRat payload (confidence level: 100%) | |
hash3592f60e97f29ab2d4e60ed3604d154c4455f59c318723aa0d25dd6a5c255f66 | DCRat payload (confidence level: 100%) | |
hash49691df1941f383a519f87b72d504014b93e45bbf5de5fadf2b46e9f7d3a942b | DCRat payload (confidence level: 100%) | |
hash06b5199b7753075d90d3adf5d33adcef9b1c3254d0471a70c282e2cc1391f1b1 | DCRat payload (confidence level: 100%) | |
hashdf8bec134952b484b17a72f1fc97428e3b458e117be44cd1c2e21ce88ee88649 | DCRat payload (confidence level: 100%) | |
hash12b1d0212363628cb57d2379017b94d6bf91029b37b2dcee592a564952855694 | DCRat payload (confidence level: 100%) | |
hasheab2a5792346b8b55180359658308c54766541505b88f55cbdf86add05edffd5 | DCRat payload (confidence level: 100%) | |
hashe0a44f25632730e54db070a4508bdaf73621f4dc7f61987df2051d5d4b512ed7 | DCRat payload (confidence level: 100%) | |
hashb56d3e6d1b59e49bbec7d67b46efdabcd4f63113d4937e713c017a5c8307c1f9 | DCRat payload (confidence level: 100%) | |
hashfe014092ae92e8372849bed9f5cf33946e8d918bdc50feddc1316bc837414ba8 | DCRat payload (confidence level: 100%) | |
hash20004bfe92247a39144a04dfa3ed12131f0b439870a73b8b1f92747c0f1babfd | DCRat payload (confidence level: 100%) | |
hash1114c728eef27aee82bd1d205d9f35cc41ae20c1491f01bc1bcfa9d8fdc50bf9 | DCRat payload (confidence level: 100%) | |
hash411b5d34c6d956ff1a2a50b67b08522203ae522d4d6407857699c1777cfdd105 | DCRat payload (confidence level: 100%) | |
hashc84bbfce14fdc65c6e738ce1196d40066c87e58f443e23266d3b9e542b8a583e | DCRat payload (confidence level: 100%) | |
hash2f64b1074d236fe522aae38bd2ed223a67d545e11c8e44636a075ada9912b621 | DCRat payload (confidence level: 100%) | |
hashcfe6e1b1bb92f207921c81129ddd21dd904dc78bf8a59676e6d719a7cae8fca7 | DCRat payload (confidence level: 100%) | |
hash3d686d48bf794ce3814f7001c4f5916733acf2eeab5140e373e0bd863f105a25 | DCRat payload (confidence level: 100%) | |
hashabb458ad81038c5edd4909f4b41a2d05bfcaf6ea25e439679c988ed479e42862 | DCRat payload (confidence level: 100%) | |
hash564da53b4bfb006eab7b88023aec9551d8d68da31dd567442dc35f1ff807e78e | DCRat payload (confidence level: 100%) | |
hash7443 | Unknown malware botnet C2 server (confidence level: 50%) | |
hash7443 | Unknown malware botnet C2 server (confidence level: 50%) | |
hash4506 | Deimos botnet C2 server (confidence level: 50%) | |
hash8443 | Deimos botnet C2 server (confidence level: 50%) | |
hash443 | Deimos botnet C2 server (confidence level: 50%) | |
hash443 | BianLian botnet C2 server (confidence level: 50%) | |
hash443 | BianLian botnet C2 server (confidence level: 50%) | |
hash443 | Havoc botnet C2 server (confidence level: 50%) | |
hash8443 | Havoc botnet C2 server (confidence level: 50%) | |
hash443 | Havoc botnet C2 server (confidence level: 50%) | |
hash443 | Havoc botnet C2 server (confidence level: 50%) | |
hash9200 | Havoc botnet C2 server (confidence level: 50%) | |
hash443 | QakBot botnet C2 server (confidence level: 50%) | |
hash995 | QakBot botnet C2 server (confidence level: 50%) | |
hash8888 | Unknown malware botnet C2 server (confidence level: 50%) | |
hash8888 | Unknown malware botnet C2 server (confidence level: 50%) | |
hash8888 | Unknown malware botnet C2 server (confidence level: 50%) | |
hash80 | Unknown malware botnet C2 server (confidence level: 50%) | |
hash4444 | AsyncRAT botnet C2 server (confidence level: 50%) | |
hash6006 | AsyncRAT botnet C2 server (confidence level: 50%) | |
hash7777 | AsyncRAT botnet C2 server (confidence level: 50%) | |
hash3002 | AsyncRAT botnet C2 server (confidence level: 50%) | |
hashc36f650adbd3d2274ff5b8a86874d845293041710e149e96b7cc11f584b22dd6 | Phobos payload (confidence level: 100%) | |
hash560eb48d1b2104f4dc3b1607bf42b35e35dfe81272675040df305e0dc85ce33e | Phobos payload (confidence level: 100%) | |
hash8f8d76d157e5e4dbd7210cb19ce27b3734147c430a534143c97b90c1f5e35249 | Phobos payload (confidence level: 100%) | |
hash00890b5ad6b94fd73a0f36ccba0d36cd198899c648c9331363dbd1140196fb3a | Phobos payload (confidence level: 100%) | |
hash419e2c52b87ba2817d5001a4581b909adc557a9661184c55e40fc9ebc2a5f8e7 | Phobos payload (confidence level: 100%) | |
hash1abef22287ce3d4f8cf5a682532152813722677114b6c8e5f0a3db92fc45861a | Phobos payload (confidence level: 100%) | |
hash9090b682c6219cb43f01d5b3342356ae85685992fac80e5e08667b54439932ea | Phobos payload (confidence level: 100%) | |
hash443 | Unidentified 111 (Latrodectus) botnet C2 server (confidence level: 75%) |
Url
| Value | Description | Copy |
|---|---|---|
urlhttps://starjod.xyz/website.php | Unknown malware payload delivery URL (confidence level: 100%) | |
urlhttp://a0996099.xsph.ru/l1nc0in.php | DCRat botnet C2 (confidence level: 100%) | |
urlhttps://www.antonina.campi.spotkaniakultur.com/article.php | GootLoader payload delivery URL (confidence level: 100%) | |
urlhttp://47.237.84.207:9777/ptj | Cobalt Strike botnet C2 (confidence level: 100%) | |
urlhttp://47.236.69.44:8002/ie9compatviewlist.xml | Cobalt Strike botnet C2 (confidence level: 100%) | |
urlhttp://144.22.38.242/4444.apk | Meterpreter payload delivery URL (confidence level: 100%) | |
urlhttp://144.22.38.242/4444.elf | Meterpreter payload delivery URL (confidence level: 100%) | |
urlhttp://144.22.38.242/4444.exe | Meterpreter payload delivery URL (confidence level: 100%) | |
urlhttp://144.22.38.242/5555.exe | Meterpreter payload delivery URL (confidence level: 100%) | |
urlhttp://144.22.38.242/6666.apk | Meterpreter payload delivery URL (confidence level: 100%) | |
urlhttps://www.arkadiuszkedziora.pl/article.php | GootLoader payload delivery URL (confidence level: 100%) | |
urlhttp://92.204.170.238/ktcweovz.exe | RemCom payload delivery URL (confidence level: 100%) | |
urlhttp://92.204.170.238/obdaiofi.exe | RemCom payload delivery URL (confidence level: 100%) | |
urlhttps://122.51.183.116/%e5%a4%8d%e5%8f%a4%e6%94%bb%e7%95%a5.exe | Ghost RAT payload delivery URL (confidence level: 50%) | |
urlhttps://122.51.183.116/svohost.exe | Ghost RAT payload delivery URL (confidence level: 100%) | |
urlhttp://194.156.98.18/h.exe | Cobalt Strike payload delivery URL (confidence level: 100%) | |
urlhttp://194.156.98.18/httpd.exe | Cobalt Strike payload delivery URL (confidence level: 100%) | |
urlhttps://194.156.98.18/assets/css/tailwindcss/version_1.1.0/min/tailwind.min.css | Cobalt Strike botnet C2 (confidence level: 100%) | |
urlhttps://www.belindadavisbranchlaw.com/article.php | GootLoader payload delivery URL (confidence level: 100%) | |
urlhttp://47.92.75.135/g.pixel | Cobalt Strike botnet C2 (confidence level: 100%) | |
urlhttp://101.43.109.204:8888/en_us/all.js | Cobalt Strike botnet C2 (confidence level: 100%) | |
urlhttp://39.100.182.56/en_us/all.js | Cobalt Strike botnet C2 (confidence level: 100%) | |
urlhttps://14.103.51.225:8443/ca | Cobalt Strike botnet C2 (confidence level: 100%) | |
urlhttp://8.130.114.243/dpixel | Cobalt Strike botnet C2 (confidence level: 100%) | |
urlhttps://www.bemiva.it/article.php | GootLoader payload delivery URL (confidence level: 100%) | |
urlhttps://api.yukklzwo.vip/5en1bjq8aauym2zgoy3k/ll_9354efa.js | Cobalt Strike botnet C2 (confidence level: 100%) | |
urlhttps://qq.yukklzwo.vip/5en1bjq8aauym2zgoy3k/ll_9354efa.js | Cobalt Strike botnet C2 (confidence level: 100%) | |
urlhttps://aa.yukklzwo.vip/5en1bjq8aauym2zgoy3k/ll_9354efa.js | Cobalt Strike botnet C2 (confidence level: 100%) | |
urlhttps://23.95.65.198/visit.js | Cobalt Strike botnet C2 (confidence level: 100%) | |
urlhttp://123.207.213.191/activity | Cobalt Strike botnet C2 (confidence level: 100%) | |
urlhttps://cs.xfdaili.com/pixel.gif | Cobalt Strike botnet C2 (confidence level: 100%) | |
urlhttp://106.53.213.253:8081/updates.rss | Cobalt Strike botnet C2 (confidence level: 100%) | |
urlhttp://192.144.219.118/load | Cobalt Strike botnet C2 (confidence level: 100%) | |
urlhttps://wnaz.shop/activity | Cobalt Strike botnet C2 (confidence level: 100%) | |
urlhttp://43.138.30.109:9999/cx | Cobalt Strike botnet C2 (confidence level: 100%) | |
urlhttps://43.153.222.28:4545/load | Cobalt Strike botnet C2 (confidence level: 100%) | |
urlhttps://185.196.8.93/gv.css | Cobalt Strike botnet C2 (confidence level: 100%) | |
urlhttp://192.210.194.42:808/visit.js | Cobalt Strike botnet C2 (confidence level: 100%) | |
urlhttp://43.143.111.123:81/match | Cobalt Strike botnet C2 (confidence level: 100%) | |
urlhttp://95.214.234.74/dpixel | Cobalt Strike botnet C2 (confidence level: 100%) | |
urlhttp://43.143.111.123:6666/pixel | Cobalt Strike botnet C2 (confidence level: 100%) | |
urlhttp://121.43.174.203/dot.gif | Cobalt Strike botnet C2 (confidence level: 100%) | |
urlhttps://35.225.182.42/visit.js | Cobalt Strike botnet C2 (confidence level: 100%) | |
urlhttps://54.249.35.233/__utm.gif | Cobalt Strike botnet C2 (confidence level: 100%) | |
urlhttps://39.101.77.24/ga.js | Cobalt Strike botnet C2 (confidence level: 100%) | |
urlhttp://139.59.214.140:447/activity | Cobalt Strike botnet C2 (confidence level: 100%) | |
urlhttp://114.55.119.40/cx | Cobalt Strike botnet C2 (confidence level: 100%) | |
urlhttp://testgk.oss-cn-beijing.aliyuncs.com/wiki/doc | Cobalt Strike botnet C2 (confidence level: 100%) | |
urlhttp://43.198.87.72/updates.rss | Cobalt Strike botnet C2 (confidence level: 100%) | |
urlhttp://106.14.69.133:88/activity | Cobalt Strike botnet C2 (confidence level: 100%) | |
urlhttp://47.120.60.201:8011/dot.gif | Cobalt Strike botnet C2 (confidence level: 100%) | |
urlhttp://74.211.106.191/jquery-3.3.1.min.js | Cobalt Strike botnet C2 (confidence level: 100%) | |
urlhttp://23.94.49.188:555/activity | Cobalt Strike botnet C2 (confidence level: 100%) | |
urlhttp://36.133.13.63:8003/jquery-3.3.1.min.js | Cobalt Strike botnet C2 (confidence level: 100%) | |
urlhttps://d2kw3fh12wz47k.cloudfront.net/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books | Cobalt Strike botnet C2 (confidence level: 100%) | |
urlhttps://arbiankroos.com/_/scs/mail-static/_/js/ | Cobalt Strike botnet C2 (confidence level: 100%) | |
urlhttp://124.223.101.175/dot.gif | Cobalt Strike botnet C2 (confidence level: 100%) | |
urlhttp://c1.redteam.club:6666/cx | Cobalt Strike botnet C2 (confidence level: 100%) | |
urlhttp://c2.redteam.club:6666/cm | Cobalt Strike botnet C2 (confidence level: 100%) | |
urlhttp://c3.redteam.club:6666/pixel.gif | Cobalt Strike botnet C2 (confidence level: 100%) | |
urlhttp://106.53.48.69:3333/cm | Cobalt Strike botnet C2 (confidence level: 100%) | |
urlhttp://1.12.181.224/activity | Cobalt Strike botnet C2 (confidence level: 100%) | |
urlhttp://47.108.106.118:8001/j.ad | Cobalt Strike botnet C2 (confidence level: 100%) | |
urlhttps://110.40.138.5/__utm.gif | Cobalt Strike botnet C2 (confidence level: 100%) | |
urlhttp://156.238.234.187:6379/g.pixel | Cobalt Strike botnet C2 (confidence level: 100%) | |
urlhttp://54.249.35.233/ptj | Cobalt Strike botnet C2 (confidence level: 100%) | |
urlhttps://49.235.118.195/cx | Cobalt Strike botnet C2 (confidence level: 100%) | |
urlhttps://185.196.8.93/tab_home_active.css | Cobalt Strike botnet C2 (confidence level: 100%) | |
urlhttps://temp.sftech.shop:8443/antdesign3.js | Cobalt Strike botnet C2 (confidence level: 100%) | |
urlhttp://121.36.255.43/push | Cobalt Strike botnet C2 (confidence level: 100%) | |
urlhttp://trusted-updates.germanywestcentral.cloudapp.azure.com/c/msdownload/update/others/2020/06/29136400_ | Cobalt Strike botnet C2 (confidence level: 100%) | |
urlhttps://43.138.30.109:7777/dot.gif | Cobalt Strike botnet C2 (confidence level: 100%) | |
urlhttp://47.93.53.140/pixel | Cobalt Strike botnet C2 (confidence level: 100%) | |
urlhttps://cdn.wnza.shop/api/3 | Cobalt Strike botnet C2 (confidence level: 100%) | |
urlhttps://unwielldyzpwo.shop/api | Lumma Stealer botnet C2 (confidence level: 100%) | |
urlhttps://civilizzzationo.shop/api | Lumma Stealer botnet C2 (confidence level: 100%) | |
urlhttps://205.198.64.65/pixel | Cobalt Strike botnet C2 (confidence level: 100%) |
Domain
| Value | Description | Copy |
|---|---|---|
domainapi.yukklzwo.vip | Cobalt Strike botnet C2 domain (confidence level: 100%) | |
domainqq.yukklzwo.vip | Cobalt Strike botnet C2 domain (confidence level: 100%) | |
domainaa.yukklzwo.vip | Cobalt Strike botnet C2 domain (confidence level: 100%) | |
domaintestgk.oss-cn-beijing.aliyuncs.com | Cobalt Strike botnet C2 domain (confidence level: 100%) | |
domaind2kw3fh12wz47k.cloudfront.net | Cobalt Strike botnet C2 domain (confidence level: 100%) | |
domainarbiankroos.com | Cobalt Strike botnet C2 domain (confidence level: 100%) | |
domainc1.redteam.club | Cobalt Strike botnet C2 domain (confidence level: 100%) | |
domainc2.redteam.club | Cobalt Strike botnet C2 domain (confidence level: 100%) | |
domainc3.redteam.club | Cobalt Strike botnet C2 domain (confidence level: 100%) | |
domainpcapi-server.com | Unknown malware botnet C2 domain (confidence level: 100%) | |
domainsolutionhub.cc | Unknown malware botnet C2 domain (confidence level: 100%) | |
domainjuderule.africa | Remcos botnet C2 domain (confidence level: 100%) | |
domainwww.dpm-sael.com | Remcos botnet C2 domain (confidence level: 100%) | |
domaintemp.sftech.shop | Cobalt Strike botnet C2 domain (confidence level: 100%) | |
domaintrusted-updates.germanywestcentral.cloudapp.azure.com | Cobalt Strike botnet C2 domain (confidence level: 100%) | |
domaincdn.wnza.shop | Cobalt Strike botnet C2 domain (confidence level: 100%) |
Threat ID: 682c7abbe3e6de8ceb7494cf
Added to database: 5/20/2025, 12:51:07 PM
Last enriched: 6/19/2025, 1:32:32 PM
Last updated: 8/12/2025, 2:04:42 AM
Views: 13
Related Threats
Silent Watcher: Dissecting Cmimai Stealer's VBS Payload
MediumMalwareWed Aug 13 2025
CastleLoader Analysis
MediumMalwareWed Aug 13 2025
The Dark Side of Parental Control Apps
MediumMalwareWed Aug 13 2025
Uncovering a Web3 Interview Scam
MediumMalwareWed Aug 13 2025
Distribution of SmartLoader Malware via Github Repository Disguised as a Legitimate Project
MediumMalwareWed Aug 13 2025
Actions
PRO
Updates to AI analysis are available only with a Pro account. Contact root@offseq.com for access.
Please log in to the Console to use AI analysis features.
External Links
Need enhanced features?
Contact root@offseq.com for Pro access with improved analysis and higher rate limits.