{ "Event": { "uuid": "125e14b3-c05b-5d46-a15d-e4b86f112070", "info": "Open Directory at 193.56.255.154 — XiebroC2 v3.1 & Covenant C2", "date": "2026-04-03", "threat_level_id": 1, "analysis": 2, "timestamp": 1791704580, "publish_timestamp": 1791704580, "published": true, "Orgc": { "name": "The Hunters Ledger", "uuid": "8bc8284b-deb5-546c-a233-57ea34b2ea0d" }, "Tag": [ { "name": "tlp:clear", "colour": "#ffffff" }, { "name": "hunters-ledger:topic=\"C2\"", "colour": "#58a6ff" }, { "name": "hunters-ledger:topic=\"Multi-Family\"", "colour": "#58a6ff" }, { "name": "hunters-ledger:topic=\"Open Dir\"", "colour": "#58a6ff" }, { "name": "hunters-ledger:topic=\"Injection\"", "colour": "#58a6ff" }, { "name": "misp-galaxy:mitre-attack-pattern=\"Obfuscated Files or Information - T1027\"", "colour": "#0088cc" }, { "name": "misp-galaxy:mitre-attack-pattern=\"Masquerading - T1036\"", "colour": "#0088cc" }, { "name": "misp-galaxy:mitre-attack-pattern=\"Process Injection - T1055\"", "colour": "#0088cc" }, { "name": "misp-galaxy:mitre-attack-pattern=\"Process Hollowing - T1055.012\"", "colour": "#0088cc" }, { "name": "misp-galaxy:mitre-attack-pattern=\"PowerShell - T1059.001\"", "colour": "#0088cc" }, { "name": "misp-galaxy:mitre-attack-pattern=\"Windows Command Shell - T1059.003\"", "colour": "#0088cc" }, { "name": "misp-galaxy:mitre-attack-pattern=\"Web Protocols - T1071.001\"", "colour": "#0088cc" }, { "name": "misp-galaxy:mitre-attack-pattern=\"Deobfuscate/Decode Files or Information - T1140\"", "colour": "#0088cc" }, { "name": "misp-galaxy:mitre-attack-pattern=\"Symmetric Cryptography - T1573.001\"", "colour": "#0088cc" }, { "name": "misp-galaxy:mitre-attack-pattern=\"Reflective Code Loading - T1620\"", "colour": "#0088cc" } ], "Attribute": [ { "uuid": "f1828c83-c965-5928-a574-4ec0a454a0f6", "type": "link", "category": "External analysis", "value": "https://the-hunters-ledger.com/hunting-detections/open-directory-193-56-255-154-xiebroc2-detections/", "to_ids": false, "comment": "Detection rules, The Hunters Ledger", "timestamp": 1791704580 }, { "uuid": "fc325936-7d07-5fc7-90a8-4713ca267c5f", "type": "link", "category": "External analysis", "value": "https://the-hunters-ledger.com/ioc-feeds/opendirectory-193-56-255-154-20260403-iocs.json", "to_ids": false, "comment": "IOC feed (JSON), The Hunters Ledger", "timestamp": 1791704580 }, { "uuid": "56923268-4548-5391-b9e1-655f11036ad1", "type": "link", "category": "External analysis", "value": "https://the-hunters-ledger.com/reports/open-directory-193-56-255-154-xiebroc2/", "to_ids": false, "comment": "Report, The Hunters Ledger", "timestamp": 1791704580 }, { "uuid": "72bd8cb1-f7d4-5d4c-89ae-c57cda02813f", "type": "link", "category": "External analysis", "value": "https://the-hunters-ledger.com/stix/open-directory-193-56-255-154-xiebroc2.json", "to_ids": false, "comment": "STIX 2.1 bundle, The Hunters Ledger", "timestamp": 1791704580 }, { "uuid": "2fcb41cd-23fe-5c22-8405-be3590e39efd", "type": "url", "category": "Network activity", "value": "http://193.56.255.154:443/en-us/docs.html", "to_ids": true, "comment": "url: http://193.56.255.154:443/en-us/docs.html. Covenant stager C2 POST path, random path selected from pool [confidence 80/100]", "timestamp": 1791704580 }, { "uuid": "65af0eee-ecaf-51ac-877a-2435d6744d5e", "type": "url", "category": "Network activity", "value": "http://193.56.255.154:443/en-us/index.html", "to_ids": true, "comment": "url: http://193.56.255.154:443/en-us/index.html. Covenant stager probe GET, random path selected from pool; masquerades as Microsoft Docs URL [confidence 80/100]", "timestamp": 1791704580 }, { "uuid": "3d62e3ae-68c5-5f00-b3dc-f911c935d02a", "type": "url", "category": "Network activity", "value": "http://193.56.255.154:443/en-us/test.html", "to_ids": true, "comment": "url: http://193.56.255.154:443/en-us/test.html. Covenant stager C2 POST path, random path selected from pool [confidence 80/100]", "timestamp": 1791704580 }, { "uuid": "79646a9b-d616-5418-ad8b-96b35594a089", "type": "ip-dst", "category": "Network activity", "value": "193.56.255.154", "to_ids": true, "comment": "ipv4: 193.56.255.154. Covenant C2 HTTP listener, cleartext HTTP on port 443 (not HTTPS); both GruntStager builds connect here for three-phase key exchange and Grunt payload delivery | Open directory staging server. All four malicious samples hosted here; HTTP file serving | XiebroC2 v3.1 TCP C2, hardcoded in main.exe binary; AES-128-ECB encrypted binary protocol; 4-byte LE length prefix framing; jittered 0-5 second reconnect beacon [confidence 80/100]", "timestamp": 1791704580 }, { "uuid": "533eea02-a8d7-5f40-8766-9e783b13bc0b", "type": "snort", "category": "Network activity", "value": "alert http $HOME_NET any -> $EXTERNAL_NET any (msg:\"THL DETECT OpenDirectory-XiebroC2-Covenant Covenant GruntStager Chrome-41-Windows-7 UA Masquerade With /en-us/ URI (Cleartext HTTP C2 Indicator)\"; flow:established,to_server; http.user_agent; content:\"Windows NT 6.1\"; nocase; content:\"Chrome/41.0.2228.0\"; nocase; http.uri; content:\"/en-us/\"; startswith; threshold:type limit,track by_src,count 1,seconds 3600; reference:url,the-hunters-ledger.com/hunting-detections/open-directory-193-56-255-154-xiebroc2-detections/; classtype:trojan-activity; sid:9000102; rev:5; metadata:author The_Hunters_Ledger, date 2026-04-03;)", "to_ids": true, "comment": "Covenant GruntStager Masquerade: Chrome 41 Windows 7 UA With /en-us/ URI | TIER: Detection | robustness 2 | confidence HIGH | ATT&CK T1071.001, T1036 | rule hash bca92b59 | https://the-hunters-ledger.com/hunting-detections/open-directory-193-56-255-154-xiebroc2-detections/", "timestamp": 1791704580, "Tag": [ { "name": "hunters-ledger:tier=\"Detection\"", "colour": "#4ade80" } ] }, { "uuid": "7e8186af-da6b-5696-ac93-1a9be1d9715e", "type": "snort", "category": "Network activity", "value": "alert http $HOME_NET any -> $EXTERNAL_NET any (msg:\"THL DETECT OpenDirectory-XiebroC2-Covenant Covenant GruntStager HTTP C2 Beacon (Campaign Session Token in POST Body)\"; flow:established,to_server; http.method; content:\"POST\"; http.uri; content:\"/en-us/\"; startswith; http.request_body; content:\"session=75db-99b1-25fe4e9afbe58696-320bea73\"; threshold:type limit,track by_src,count 1,seconds 3600; reference:url,the-hunters-ledger.com/hunting-detections/open-directory-193-56-255-154-xiebroc2-detections/; classtype:trojan-activity; sid:9000101; rev:4; metadata:author The_Hunters_Ledger, date 2026-04-03;)", "to_ids": true, "comment": "Covenant GruntStager C2 Beacon: Campaign Session Token in HTTP POST | TIER: Detection | robustness 2 | confidence HIGH | ATT&CK T1071.001 | rule hash ac96967f | https://the-hunters-ledger.com/hunting-detections/open-directory-193-56-255-154-xiebroc2-detections/", "timestamp": 1791704580, "Tag": [ { "name": "hunters-ledger:tier=\"Detection\"", "colour": "#4ade80" } ] }, { "uuid": "4102cb89-512b-59f0-abcc-2b91011fd8dd", "type": "sigma", "category": "Payload installation", "value": "title: Covenant C2 GruntStager HTTP Beacon — Campaign Session Token Detected\nid: d9a4b257-3f81-4e7c-b5d8-6c2e9f0a4b73\nstatus: experimental\ndescription: >-\n Detects HTTP requests whose query string contains the Covenant C2 listener session token\n 75db-99b1-25fe4e9afbe58696-320bea73, hardcoded in both GruntHTTP.exe\n (Build 1) and the PE embedded in GruntHTTP.ps1 (Build 2). This token is a\n listener-level constant that appears in every registration and\n command-exchange request from any host executing either stager build,\n making it the highest-value single network detection for this campaign.\n The Chrome 41 / Windows 7 masquerade User-Agent observed alongside this\n token in the same traffic is additional corroborating context, not a\n required condition for this rule.\nreferences:\n - https://the-hunters-ledger.com/hunting-detections/open-directory-193-56-255-154-xiebroc2-detections/\n - https://github.com/cobbr/Covenant\nauthor: The Hunters Ledger\ndate: 2026-04-03\ntags:\n - attack.command-and-control\n - attack.t1071.001\n - detection.emerging-threats\n - stp.3\nlogsource:\n category: proxy\ndetection:\n selection:\n c-uri-query|contains: 'session=75db-99b1-25fe4e9afbe58696-320bea73'\n condition: selection\nfalsepositives:\n - No legitimate proxy traffic is expected to contain this specific session token value\nlevel: high", "to_ids": false, "comment": "Covenant C2 GruntStager HTTP Beacon: Campaign Session Token Detected | TIER: Hunting | robustness 1 | confidence LOW | ATT&CK T1071.001 | rule hash c66eee70 | https://the-hunters-ledger.com/hunting-detections/open-directory-193-56-255-154-xiebroc2-detections/", "timestamp": 1791704580, "Tag": [ { "name": "hunters-ledger:tier=\"Hunting\"", "colour": "#4ade80" } ] }, { "uuid": "2827a433-5834-583f-bc25-73f2b725052c", "type": "sigma", "category": "Payload installation", "value": "title: PowerShell Fileless Loader — Deflate Decode with Reflective Assembly Load\nid: e2c8d419-6a37-4f5b-8e90-4d1b7c5e2f85\nstatus: experimental\ndescription: >-\n Detects PowerShell ScriptBlocks combining Base64 decoding, Deflate\n decompression via System.IO.DeflateStream, and reflective in-memory\n execution via Reflection.Assembly::Load() — the technique used by the\n GruntHTTP.ps1 Covenant delivery wrapper analyzed in this campaign. The\n rule tests four substrings in one ScriptBlock (DeflateStream, Reflection.Assembly,\n FromBase64String and MemoryStream); it does not test the Load call itself. The\n combination is a durable technique fingerprint independent of any\n specific Covenant listener configuration, but legitimate software\n deployment tooling occasionally combines the same primitives, so this is\n a Hunting-tier lead requiring analyst triage rather than a high-confidence\n alert.\nreferences:\n - https://the-hunters-ledger.com/hunting-detections/open-directory-193-56-255-154-xiebroc2-detections/\n - https://github.com/cobbr/Covenant\nauthor: The Hunters Ledger\ndate: 2026-04-03\ntags:\n - attack.execution\n - attack.stealth\n - attack.t1059.001\n - attack.t1140\n - attack.t1620\n - detection.emerging-threats\nlogsource:\n category: ps_script\n product: windows\ndetection:\n selection_decode_chain:\n ScriptBlockText|contains|all:\n - 'DeflateStream'\n - 'Reflection.Assembly'\n - 'FromBase64String'\n - 'MemoryStream'\n condition: selection_decode_chain\nfalsepositives:\n - Legitimate software deployment scripts that compress and load .NET assemblies via PowerShell (uncommon but possible in enterprise environments with custom tooling)\n - Security research or red team tooling other than Covenant that uses the same delivery pattern\n - PowerShell-based application packaging tools that compress payloads with Deflate and load them reflectively\nlevel: medium", "to_ids": false, "comment": "PowerShell Fileless Loader: Deflate Decode with Reflective Assembly Load | TIER: Hunting | robustness 2 | confidence MODERATE | ATT&CK T1059.001, T1140, T1620 | rule hash 3200910a | https://the-hunters-ledger.com/hunting-detections/open-directory-193-56-255-154-xiebroc2-detections/", "timestamp": 1791704580, "Tag": [ { "name": "hunters-ledger:tier=\"Hunting\"", "colour": "#4ade80" } ] }, { "uuid": "f2a80204-2577-5a94-a5a2-c78121ff0777", "type": "sigma", "category": "Payload installation", "value": "title: Process Outside a .NET Host List Loading the Windows CLR at Runtime\nid: a3f7c821-5e4b-4d09-bc21-7f3a9e5c8d04\nstatus: experimental\ndescription: >-\n Detects any process whose image is not on a short list of .NET toolchain\n hosts loading mscoree.dll or clr.dll. The XiebroC2 v3.1 inline-assembly\n command hosts the CLR in-process through the vendored go-clr library, and\n that load would match; so would every other managed application that is\n not on the list. The rule tests nothing that identifies a Go binary or\n XiebroC2, so it is a scoping lead, not an alert. The event fires whether\n or not the .NET assembly payload was written to disk.\nreferences:\n - https://the-hunters-ledger.com/hunting-detections/open-directory-193-56-255-154-xiebroc2-detections/\n - https://github.com/Ne0nd0g/go-clr\nauthor: The Hunters Ledger\ndate: 2026-04-03\ntags:\n - attack.stealth\n - attack.execution\n - attack.t1620\n - detection.emerging-threats\n - stp.3\nlogsource:\n category: image_load\n product: windows\ndetection:\n selection:\n ImageLoaded|endswith:\n - '\\mscoree.dll'\n - '\\clr.dll'\n filter_legitimate_dotnet_hosts: # sourced: Microsoft-shipped .NET toolchain host executables (documented platform defaults)\n Image|endswith:\n - '\\dotnet.exe'\n - '\\msbuild.exe'\n - '\\powershell.exe'\n - '\\pwsh.exe'\n - '\\csc.exe'\n - '\\vbc.exe'\n - '\\cmstp.exe'\n - '\\installutil.exe'\n - '\\regsvcs.exe'\n - '\\regasm.exe'\n - '\\mscorsvw.exe'\n - '\\ngen.exe'\n - '\\dfsvc.exe'\n - '\\ieinstal.exe'\n - '\\PresentationHost.exe'\n condition: selection and not filter_legitimate_dotnet_hosts\nfalsepositives:\n - Any managed (.NET Framework) application whose image is not in the filter list, which is most managed desktop and service software\n - Legitimate applications built with Go that embed .NET interop via documented COM interop mechanisms (rare but possible in enterprise software)\n - Custom in-house Go tooling that intentionally hosts the CLR for legitimate automation purposes\n - Security research tools or red team frameworks other than XiebroC2 that use go-clr\nlevel: low", "to_ids": false, "comment": "Process Outside a .NET Host List Loading the Windows CLR at Runtime | TIER: Hunting | robustness 2 | confidence HIGH | ATT&CK T1620 | rule hash 5f653f94 | https://the-hunters-ledger.com/hunting-detections/open-directory-193-56-255-154-xiebroc2-detections/", "timestamp": 1791704580, "Tag": [ { "name": "hunters-ledger:tier=\"Hunting\"", "colour": "#4ade80" } ] }, { "uuid": "c5195d54-a49a-5b9e-992b-c996708e9a5e", "type": "sigma", "category": "Payload installation", "value": "title: Shell Process Spawned from main.exe (XiebroC2 Implant Parent-Child Pattern)\nid: c5e1f730-8b24-4c9d-a2e7-3f6b8d1e5c92\nstatus: experimental\ndescription: >-\n Detects a cmd.exe, powershell.exe, or pwsh.exe child process spawned from\n a parent process named main.exe, the parent-child pattern produced when\n the XiebroC2 v3.1 Go implant executes its shell, OSshell, or\n OSpowershell commands. Static and behavioral analysis of the implant\n indicates these shells are spawned with a hidden window\n (CREATE_NO_WINDOW), but Sysmon process-creation telemetry does not\n expose window-visibility flags, so this rule anchors on the parent-child\n relationship alone. main.exe is a common generic filename also produced\n by legitimate Go/Rust/C build tooling, so this is a Hunting-tier lead\n requiring analyst triage, not a high-confidence alert.\nreferences:\n - https://the-hunters-ledger.com/hunting-detections/open-directory-193-56-255-154-xiebroc2-detections/\nauthor: The Hunters Ledger\ndate: 2026-04-03\ntags:\n - attack.execution\n - attack.t1059.001\n - attack.t1059.003\n - detection.emerging-threats\nlogsource:\n category: process_creation\n product: windows\ndetection:\n selection_parent:\n ParentImage|endswith: '\\main.exe'\n selection_child:\n Image|endswith:\n - '\\cmd.exe'\n - '\\powershell.exe'\n - '\\pwsh.exe'\n condition: selection_parent and selection_child\nfalsepositives:\n - Legitimate Go-based tooling or software distribution systems named main.exe that spawn shell subprocesses as part of normal operation\n - Development or build environments where a Go binary named main.exe orchestrates build steps via cmd.exe\nlevel: medium", "to_ids": false, "comment": "Shell Process Spawned from main.exe (XiebroC2 Implant Parent-Child Pattern) | TIER: Hunting | robustness 1 | confidence MODERATE | ATT&CK T1059.001, T1059.003 | rule hash e669e3e1 | https://the-hunters-ledger.com/hunting-detections/open-directory-193-56-255-154-xiebroc2-detections/", "timestamp": 1791704580, "Tag": [ { "name": "hunters-ledger:tier=\"Hunting\"", "colour": "#4ade80" } ] }, { "uuid": "0b6c62d3-c0ce-52ca-98a0-d82154a71874", "type": "yara", "category": "Payload installation", "value": "rule MALW_Covenant_PSFilelessLoader_GruntHTTP {\n meta:\n description = \"Detects the GruntHTTP.ps1 PowerShell fileless loader that delivers Covenant GruntStager Build 2 via Base64+Deflate decoding and Reflection.Assembly::Load(). Anchored on the hardcoded Covenant session token alongside the decompression and reflective-loading pattern — a combination unique to this loader and not found in legitimate PowerShell scripts.\"\n license = \"CC BY 4.0 - https://creativecommons.org/licenses/by/4.0/\"\n author = \"The Hunters Ledger\"\n reference = \"https://the-hunters-ledger.com/hunting-detections/open-directory-193-56-255-154-xiebroc2-detections/\"\n date = \"2026-04-03\"\n hash1 = \"cff2d990f0988e9c90f77d0a62c72ca8e9bf567f0c143fdc3a914dce65edec98\"\n hash2 = \"a79cd499c68482e73852db2c70d4e06251a29d95\"\n hash3 = \"ac9b16b8bdf544db92f325a0901c5544\"\n family = \"Covenant\"\n malware_type = \"PowerShell Loader\"\n campaign = \"OpenDirectory-XiebroC2-Covenant-193.56.255.154\"\n id = \"b0a99479-67aa-5506-a4f2-5b1c7fa901fd\"\n strings:\n $s1 = \"75db-99b1-25fe4e9afbe58696-320bea73\" ascii\n $s2 = \"DeflateStream\" ascii\n $s3 = \"Reflection.Assembly\" ascii\n $s4 = \"FromBase64String\" ascii\n $s5 = \"MemoryStream\" ascii\n condition:\n filesize < 100KB and\n $s1 and\n all of ($s2, $s3, $s4, $s5)\n}", "to_ids": true, "comment": "Covenant PowerShell Fileless Loader: GruntHTTP.ps1 | TIER: Detection | robustness 2 | confidence HIGH | ATT&CK T1059.001, T1027, T1140, T1620 | rule hash 662711e9 | https://the-hunters-ledger.com/hunting-detections/open-directory-193-56-255-154-xiebroc2-detections/", "timestamp": 1791704580, "Tag": [ { "name": "hunters-ledger:tier=\"Detection\"", "colour": "#4ade80" } ] }, { "uuid": "3d012acd-c426-5660-a128-7f8025bc307d", "type": "yara", "category": "Payload installation", "value": "rule RAT_Covenant_GruntStager_OpenDirectory {\n meta:\n description = \"Detects both Covenant C2 GruntStager builds (the standalone GruntHTTP.exe PE stager and the PE extracted from the GruntHTTP.ps1 PowerShell wrapper) via a shared listener-level session token and build ID, combined with a Covenant framework identifier. Both builds share a single Covenant listener and produce identical values for the token and build ID fields.\"\n license = \"CC BY 4.0 - https://creativecommons.org/licenses/by/4.0/\"\n author = \"The Hunters Ledger\"\n reference = \"https://the-hunters-ledger.com/hunting-detections/open-directory-193-56-255-154-xiebroc2-detections/\"\n date = \"2026-04-03\"\n hash1 = \"3aa45ceff7070ae6d183c5aa5f0d771a79c7cf37fe21a3906df976bee497bf20\"\n hash2 = \"f0f4715a6d7063e7811502e9591f8265af0a2af6\"\n hash3 = \"7cfe0a039b61ec049b53e8e664036a6e\"\n family = \"Covenant\"\n malware_type = \"C2 Stager\"\n campaign = \"OpenDirectory-XiebroC2-Covenant-193.56.255.154\"\n id = \"3b6d459e-9f21-5052-b637-19d99758695b\"\n strings:\n $s1 = \"75db-99b1-25fe4e9afbe58696-320bea73\" ascii wide\n $s2 = \"a19ea23062db990386a3a478cb89d52e\" ascii\n $s3 = \"GruntStager\" ascii wide\n $s4 = \"CovenantCertHash\" ascii wide\n $s5 = \"// Hello World! {0}\" ascii\n $s6 = \"SESSIONID=1552332971750\" ascii\n condition:\n uint16(0) == 0x5A4D and\n filesize < 50KB and\n $s1 and $s2 and\n 1 of ($s3, $s4, $s5, $s6)\n}", "to_ids": true, "comment": "Covenant C2 GruntStager Combined Build Detection | TIER: Detection | robustness 2 | confidence HIGH | ATT&CK T1071.001 | rule hash a4a869ec | https://the-hunters-ledger.com/hunting-detections/open-directory-193-56-255-154-xiebroc2-detections/", "timestamp": 1791704580, "Tag": [ { "name": "hunters-ledger:tier=\"Detection\"", "colour": "#4ade80" } ] }, { "uuid": "45f216a8-dd6f-5dd2-af87-77ee90a27d14", "type": "yara", "category": "Payload installation", "value": "rule RAT_XiebroC2_v31_Go_TCP_Implant {\n meta:\n description = \"Detects XiebroC2 v3.1 Go TCP implant via a combination of hardcoded AES-128-ECB key, source-code typo in its pclntab symbol table (WindosVersion), vendored offensive go-clr CLR hosting library import, and unique RunPE PE-parser error strings. All seven distinct indicators are static compile-time artifacts embedded in any binary built from XiebroC2 3.1 source; the rule requires any 3 of the seven to avoid dependence on any single renameable or rotatable literal. The AES key counts once; an earlier version also declared its hex bytes as a second string, so one occurrence of the key counted twice.\"\n license = \"CC BY 4.0 - https://creativecommons.org/licenses/by/4.0/\"\n author = \"The Hunters Ledger\"\n reference = \"https://the-hunters-ledger.com/hunting-detections/open-directory-193-56-255-154-xiebroc2-detections/\"\n date = \"2026-04-03\"\n family = \"XiebroC2\"\n malware_type = \"RAT\"\n campaign = \"OpenDirectory-XiebroC2-Covenant-193.56.255.154\"\n id = \"90df8d57-e457-57d1-b7c5-2b318c32508e\"\n strings:\n $s1 = \"QWERt_CSDMAHUATW\" ascii\n $s2 = \"main/Helper/sysinfo.WindosVersion\" ascii\n $s3 = \"github.com/Ne0nd0g/go-clr\" ascii\n $s4 = \"DOS image header magic string was not MZ\" ascii\n $s5 = \"PE Signature string was not PE\" ascii\n $s6 = \"ClientUnstaller\" ascii\n $s7 = \"NtQueryInformationProcess returned NTSTATUS:\" ascii\n condition:\n uint16(0) == 0x5A4D and\n filesize < 25MB and\n 3 of ($s1, $s2, $s3, $s4, $s5, $s6, $s7)\n}", "to_ids": true, "comment": "XiebroC2 v3.1 Go TCP Implant: Source-Code Artifact Combination | TIER: Detection | robustness 2 | confidence HIGH | ATT&CK T1573.001, T1620, T1055.012, T1055 | rule hash caa51ebf | https://the-hunters-ledger.com/hunting-detections/open-directory-193-56-255-154-xiebroc2-detections/", "timestamp": 1791704580, "Tag": [ { "name": "hunters-ledger:tier=\"Detection\"", "colour": "#4ade80" } ] }, { "uuid": "2e4d8766-4d63-50f2-aa39-3cbd5f5da767", "type": "yara", "category": "Payload installation", "value": "rule RAT_XiebroC2_v31_PaddedConfig_Structural {\n meta:\n description = \"Detects XiebroC2 v3.1's binary-patchable configuration format — a space-padded fixed-width IPv4 literal (20+ trailing spaces) paired with one of two source-artifact strings (the `main/Helper/sysinfo.WindosVersion` symbol, or the public go-clr library path that other Go tools also carry). XiebroC2 stores its C2 address as a fixed-width field so operators can binary-patch a new IP into a compiled build without recompilation; this structural pattern is independent of any single C2 IP value and survives infrastructure rotation, unlike a rule anchored on 193.56.255.154 alone.\"\n license = \"CC BY 4.0 - https://creativecommons.org/licenses/by/4.0/\"\n author = \"The Hunters Ledger\"\n reference = \"https://the-hunters-ledger.com/hunting-detections/open-directory-193-56-255-154-xiebroc2-detections/\"\n date = \"2026-04-03\"\n family = \"XiebroC2\"\n malware_type = \"RAT\"\n campaign = \"OpenDirectory-XiebroC2-Covenant-193.56.255.154\"\n id = \"116b89d8-ee1b-50f2-b45e-9f09332ddb67\"\n strings:\n $re_ip = /[0-9]{1,3}\\.[0-9]{1,3}\\.[0-9]{1,3}\\.[0-9]{1,3} {20,}/ ascii\n $anchor1 = \"github.com/Ne0nd0g/go-clr\" ascii\n $anchor2 = \"main/Helper/sysinfo.WindosVersion\" ascii\n condition:\n uint16(0) == 0x5A4D and\n filesize < 25MB and\n $re_ip and 1 of ($anchor1, $anchor2)\n}", "to_ids": false, "comment": "XiebroC2 v3.1 Binary-Patchable Config: Padded-IPv4 Structural Pattern | TIER: Hunting | robustness 2 | confidence MODERATE | rule hash 3e689be7 | https://the-hunters-ledger.com/hunting-detections/open-directory-193-56-255-154-xiebroc2-detections/", "timestamp": 1791704580, "Tag": [ { "name": "hunters-ledger:tier=\"Hunting\"", "colour": "#4ade80" } ] } ], "Object": [] } }