Raw JSON feed Full report Detection rules

14 shown

Type	Indicator
ipv4	`185.208.159.182`
url	`https://pastebin.com/raw/bzg5zj8n`
sha256	`2c4387ce18be279ea735ec4f0092698534921030aaa69949ae880e41a5c73766`
sha256	`950aadba6993619858294599b3458d5d2221f10fe72b3db3e49883d496a705bb`
sha1	`944d9e8d6f02375b31908ee05a0164fbb4804108`
sha1	`dc795961c8e63782fc0f53c08e7ca2e593df99fa`
md5	`28bf5a76144fbc4b5f7f02dfee4e2c17`
md5	`b5491b58348600c2766f86a5af2b867f`
path	`%AppData%\SubDir\Client.exe`
path	`C:\Users\\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\conhost.lnk`
path	`C:\Users\\conhost.exe`
registry	`HKCU\Software\Microsoft\Windows\CurrentVersion\Run`
registry	`HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tree\RuntimeBroker`
filename	`client.exe`

19 further values in this feed are not shown above, because they are not an indicator type that can be recognised reliably by shape: command names, fingerprints and behavioural patterns among them. They are all in the raw JSON, which remains the complete record.

Do not block

These values came out of this investigation, but blocking them would break something legitimate, whether a shared service, a bystander's infrastructure, or the victim's own equipment. They are listed here because they still matter for hunting, and they are deliberately excluded from the copy and download buttons above.

Type	Indicator	Why it stays off a blocklist
domain	`api.ipify.org`	The backup IP-discovery call, made immediately after the ipwho.is lookup as part of the same pre-beacon reconnaissance step. ipify is a widely embedded public utility API, so the destination carries no operator signal by itself; what is distinctive is an unattended process making both lookups in sequence and then opening an encrypted connection to a fixed C2 address roughly four minutes later.
domain	`ipwho.is`	A free, public IP-lookup service the implant calls to verify internet connectivity and discover the victim host's external IP address before contacting C2. The service is general-purpose and is queried by a very large number of unrelated legitimate applications; blocking it breaks those and does not impede the operator, who can substitute any of dozens of equivalent endpoints. Hunt for the lookup followed minutes later by an outbound connection to a fixed C2 address, not for the destination on its own.

Licensed CC BY 4.0, free to use commercially with attribution to The Hunters Ledger.