Skip to content
THE HUNTER’S LEDGER
IOC Feed
Flask C2 & MSSQL CLR Backdoor on a Windows Post-Exploitation Staging Host
42 indicators extracted from this investigation's feed. Filter by type, then copy or download exactly what is on screen.
Raw JSON feedFull reportDetection rules
42 shown
TypeIndicatorConfidenceAction
ipv4 67.215.232.25HIGHBLOCK
url http://67.215.232.25:1337/HIGHBLOCK
url http://67.215.232.25:5000/MODERATEBLOCK
url http://67.215.232.25:8080/api/heartbeatHIGHBLOCK
url http://67.215.232.25:8080/api/reportHIGHBLOCK
url http://67.215.232.25:8080/healthHIGHBLOCK
sha256 30a11ac0b6828fd1c808c46d1c5ae9a4050b48a2fa7e860d146d871bc7c9bb98HIGHBLOCK
sha256 3e59379f585ebf0becb6b4e06d0fbbf806de28a4bb256e837b4555f1b4245571HIGHBLOCK
sha256 596778a449881a64c08e6f152b8966c1b7a2c9096071662708ccb54f4b7f129cHIGHMONITOR
sha256 602dbcf4008c585582d5e5d5c8ddb1932fdee07a14308e9cbf937904f31df1f7HIGHBLOCK
sha256 6e592a38f93f7119e4b28214ef90bd74bc602a411099454329be4a0c3b482245HIGHBLOCK
sha256 8524fbc0d73e711e69d60c64f1f1b7bef35c986705880643dd4d5e17779e586dHIGHBLOCK
sha256 8a48236180c30d5ba4b44faae8abf906ad9937192e8ff85136da659de111b920HIGHBLOCK
sha256 9a8e9d587b570d4074f1c8317b163aa8d0c566efd88f294d9d85bc7776352a28HIGHBLOCK
sha256 9c5d53208d324f6f14e3417fe072be9b0f29aa35299f99c30bbaf602790b7480HIGHBLOCK
sha256 a4778d50307de4ab13e48de90d72b7c5e19b4f9356a611a9faf95cfda0523c46HIGHBLOCK
sha256 a7029ef2b6a541ef2b7508e1316d3c2efd3493108975ee457bcdb73043a25262DEFINITEBLOCK
sha256 c13bb6f7898423ad218937be8aeb400f41db857ac350093e837a5eed06ae31dcHIGHBLOCK
sha256 cac1bda7429c3b6320af4638b9dd367aaca3815877a1bb96b17f1ab769c9c7f6HIGHBLOCK
sha256 db36351b2a948bda4eb5fb6ed40d850d70a9d149380ad6a12869c36beb9f042cHIGHBLOCK
sha256 eb689aea9673cc025f91d8376da07e849519d19071609a60c193776d8eca8b54HIGHBLOCK
md5 545a81240793f9ca97306fa5b3ad76dfHIGHHUNT
md5 567531f08180ab3963b70889578118a3HIGHHUNT
md5 576d6e02a47c807b9063948ee683350cHIGHHUNT
md5 818cfde69b098e3348e8c7125e83915fMODERATEHUNT
md5 959a83047e80ab68b368fdb3f4c6e4eaHIGHHUNT
md5 f9a28c458284584a93b14216308d31bdHIGHHUNT
path C:\poc_wer.txtMODERATEHUNT
filename cmd_exec.dllHIGHHUNT
filename cmd_exece.dllDEFINITEBLOCK
filename cve-2026-20817_poc.exeHIGHBLOCK
filename e.exeHIGHBLOCK
filename ep.exeHIGHBLOCK
filename jp.exeHIGHBLOCK
filename miss.aspHIGHBLOCK
filename npcinfolist1.aspxHIGHBLOCK
filename ntapidotnet.dllHIGHMONITOR
filename rogueoxidresolver.exeHIGHBLOCK
filename roguepotato.exeHIGHBLOCK
filename rubeus.exeHIGHBLOCK
filename sharpsuccessor.exeHIGHBLOCK
filename sweetpotato.exeHIGHBLOCK

13 further values in this feed are not shown above, because they are not an indicator type that can be recognised reliably by shape: command names, fingerprints and behavioural patterns among them. They are all in the raw JSON, which remains the complete record.

Licensed CC BY 4.0, free to use commercially with attribution to The Hunters Ledger.