THE HUNTER’S LEDGER
IOC Feed
Flask C2 & MSSQL CLR Backdoor on a Windows Post-Exploitation Staging Host
42 indicators extracted from this investigation's feed. Filter by type, then copy or download exactly what is on screen.
Raw JSON feedFull reportDetection rules
42 shown
TypeIndicator
ipv4 67.215.232.25
url http://67.215.232.25:1337/
url http://67.215.232.25:5000/
url http://67.215.232.25:8080/api/heartbeat
url http://67.215.232.25:8080/api/report
url http://67.215.232.25:8080/health
sha256 30a11ac0b6828fd1c808c46d1c5ae9a4050b48a2fa7e860d146d871bc7c9bb98
sha256 3e59379f585ebf0becb6b4e06d0fbbf806de28a4bb256e837b4555f1b4245571
sha256 596778a449881a64c08e6f152b8966c1b7a2c9096071662708ccb54f4b7f129c
sha256 602dbcf4008c585582d5e5d5c8ddb1932fdee07a14308e9cbf937904f31df1f7
sha256 6e592a38f93f7119e4b28214ef90bd74bc602a411099454329be4a0c3b482245
sha256 8524fbc0d73e711e69d60c64f1f1b7bef35c986705880643dd4d5e17779e586d
sha256 8a48236180c30d5ba4b44faae8abf906ad9937192e8ff85136da659de111b920
sha256 9a8e9d587b570d4074f1c8317b163aa8d0c566efd88f294d9d85bc7776352a28
sha256 9c5d53208d324f6f14e3417fe072be9b0f29aa35299f99c30bbaf602790b7480
sha256 a4778d50307de4ab13e48de90d72b7c5e19b4f9356a611a9faf95cfda0523c46
sha256 a7029ef2b6a541ef2b7508e1316d3c2efd3493108975ee457bcdb73043a25262
sha256 c13bb6f7898423ad218937be8aeb400f41db857ac350093e837a5eed06ae31dc
sha256 cac1bda7429c3b6320af4638b9dd367aaca3815877a1bb96b17f1ab769c9c7f6
sha256 db36351b2a948bda4eb5fb6ed40d850d70a9d149380ad6a12869c36beb9f042c
sha256 eb689aea9673cc025f91d8376da07e849519d19071609a60c193776d8eca8b54
md5 545a81240793f9ca97306fa5b3ad76df
md5 567531f08180ab3963b70889578118a3
md5 576d6e02a47c807b9063948ee683350c
md5 818cfde69b098e3348e8c7125e83915f
md5 959a83047e80ab68b368fdb3f4c6e4ea
md5 f9a28c458284584a93b14216308d31bd
path C:\poc_wer.txt
filename cmd_exec.dll
filename cmd_exece.dll
filename cve-2026-20817_poc.exe
filename e.exe
filename ep.exe
filename jp.exe
filename miss.asp
filename npcinfolist1.aspx
filename ntapidotnet.dll
filename rogueoxidresolver.exe
filename roguepotato.exe
filename rubeus.exe
filename sharpsuccessor.exe
filename sweetpotato.exe

13 further values in this feed are not shown above, because they are not an indicator type that can be recognised reliably by shape: command names, fingerprints and behavioural patterns among them. They are all in the raw JSON, which remains the complete record.

Licensed CC BY 4.0, free to use commercially with attribution to The Hunters Ledger.