35Indicatorsin this feed

14sha256

14filename

3pattern

2path

2ipv4

Raw JSON feed Full report Detection rules

Values are shown defanged, and copying or downloading from this table gives the defanged form. The exact values are in the raw JSON. 35 shown

Type	Indicator	Confidence	Action
ipv4	`199[.]247[.]13[.]103`	HIGH	BLOCK
ipv4	`199[.]247[.]13[.]103:8000`	HIGH	BLOCK
sha256	`02a98b325408f623e192d569d6cb11a60aaf61a114a5c4f35bbfd1dcbe56d69c`	HIGH	BLOCK
sha256	`1046cf19fb280684236193059805005bb8b1f3ad3b6fe7ca2b35d9dea8523273`	HIGH	BLOCK
sha256	`1bfbefa4ff4d0df3ee0090b5079cf84ed2e8d5377ba5b7a30afd88367d57b9ff`	HIGH	HUNT
sha256	`2dcc37be26344f68e3124c3fd5ca5ca1ec672d2933c6db5f7c57222f6f9117d1`	HIGH	HUNT
sha256	`44e83f84a5d5219e2f7c3cf1e4f02489cae81361227f46946abe4b8d8245b879`	HIGH	HUNT
sha256	`7033ee65a125bec39860af0cef8d64f46a0cf7e579baab5d57e31d83367333f9`	HIGH	BLOCK
sha256	`863a7a843b30d5252a84e5b03e850236fce4cac1954be4227c1cf396138759a5`	HIGH	BLOCK
sha256	`9a8e9d587b570d4074f1c8317b163aa8d0c566efd88f294d9d85bc7776352a28`	HIGH	HUNT
sha256	`b95c849d510e5cf8fdbb8bfcae2ca36a8a0c1f383c783fae74d95bece46f084f`	HIGH	HUNT
sha256	`cc3b5d073dd879275e274177d7293a9737dc76407bdabe0cc667bf0eaf3c7f1f`	MODERATE	HUNT
sha256	`e0691216a96faa65a66c8e9de47cbe1f87d9a8c5a1417ea8e126a4c4fe1944cb`	HIGH	HUNT
sha256	`e788f829b1a0141a488afb5f82b94f13035623609ca3b83f0c6985919cd9e83b`	HIGH	HUNT
sha256	`fbf97f4fc02266d2904b125ac6f55199c0e2855374646659b27e63bdf9cf5490`	HIGH	BLOCK
sha256	`fe0445f870c905ff33fc75223ce709992f8bb219d2fff6acd3775518b894a025`	HIGH	BLOCK
path	`/tmp/pwned_root.txt`	HIGH	HUNT
path	`\\.\pipe\SvcUtil\pipe\epmapper`	HIGH	HUNT
filename	`PwnKit`	MODERATE	HUNT
filename	`chisel.exe`	HIGH	HUNT
filename	`dnsplugin.c`	HIGH	HUNT
filename	`dnsplugin.dll`	HIGH	BLOCK
filename	`exploit_pwnkit.__rev2`	HIGH	BLOCK
filename	`exploit_pwnkit.c`	HIGH	HUNT
filename	`exploit_pwnkit_static`	HIGH	BLOCK
filename	`godpotato-net4.exe`	HIGH	HUNT
filename	`ly4k_pwnkit.py`	HIGH	HUNT
filename	`pwnkit.c`	HIGH	HUNT
filename	`pwnkit.so`	HIGH	BLOCK
filename	`rubeus.exe`	HIGH	HUNT
filename	`svcutil.exe`	HIGH	BLOCK
filename	`svcutil_clean.exe`	HIGH	BLOCK
pattern	`AAAAC3NzaC1lZDI1NTE5AAAAIBRxk25ztgApbSSf7FcT9W91dyNBQyDn4GmhBOHUGndz`	HIGH	HUNT
pattern	`cyberstrike`	HIGH	HUNT
pattern	`pentest@cyberstrike`	HIGH	HUNT

3 further values in this feed are not shown above, because they are not an indicator type that can be recognised reliably by shape: command names, fingerprints and behavioural patterns among them. They are all in the raw JSON, which remains the complete record.

Do not block

These values came out of this investigation, but blocking them would break something legitimate, whether a shared service, a bystander's infrastructure, or the victim's own equipment. They are listed here because they still matter for hunting, and they are deliberately excluded from the copy and download buttons above.

Type	Indicator	Why it stays off a blocklist
domain	`fr[.]bastaniqifi[.]ir`	Passive DNS (VirusTotal) shows an A record from this name to the case IP, TTL 300, last modified 2026-10-07, inside a set of country-labelled .ir hostnames that all point to different hosts and look like a VPN or proxy node fleet. A scan-history export scoped to the apex domain did not show the record, which neither confirms nor contradicts the passive-DNS result; Whether the workbench operator runs that fleet, rents a node in it or only shares an address with it is not established: LOW as a link to the operator. The directory on :8000 was first seen 2026-09-26. The record's first appearance is not known; its last-modified date is 7 October 2026. The address has had other tenants. Context only, do not block.

Licensed CC BY 4.0, free to use commercially with attribution to The Hunters Ledger.