THE HUNTER’S LEDGER
IOC Feed
OpenStrike Beacon Toolkit (172.105.0.126)
60 indicators extracted from this investigation's feed. Filter by type, then copy or download exactly what is on screen.
Raw JSON feedFull reportDetection rules
60 shown
TypeIndicator
ipv4 172.105.0.126
url https://172.105.0.126:8443/qz99
url https://172.105.0.126:8443/register
url https://172.105.0.126:8443/submit
url https://172.105.0.126:8443/submit.php
url https://172.105.0.126:8443/updates
sha256 485abd7c34af8ab8a11b01d97feee822e1400b6cbc6b87a01e8218fc4ad52e17
sha256 544b59fe4d490cc413bb20d03a5cf87d55892929a59cbdfff6fb06c4ee0cee5f
sha256 68768be9ace9152c7c9cc36d8104ebf7523ba3e8e0104cabc4c8f75e1f7d3d3c
sha256 6a8e365c48a9b64770e23ea85eb1ea2ed39b69c632e92d19125d10fa50874b0f
sha256 74d1b5b84a650a7bb1b0c1dca0be556b74567537c80a764cbf777814358ab279
sha256 7a1a7659ec4201ecbca782bcedf9d4079265137279a490368309df3bd39297a4
sha256 7d6a17754f086b53ee294f5ccd60b0127f921520ce7b64fea0aebb47114fb5d2
sha256 807e24403bb5cb8407a69ff4f12a455e81609b1fcf4720cf00134b9d520136a9
sha256 821f815fab92fee03e2be44ad5370a953db085cd359a99519a2ddb7316b0d273
sha256 8301a685c8f3d770420c760f495fa930eae6a03a6721e946f3ce28f6fc144449
sha256 ab68ce00f8a08e0f13df2499db5e413000fda23c6fd40f23a4d4d6c71d8060c3
sha256 d04914a1c62f7592143aa70a3746733580a6e7345073d79d1bbcd312d87d05d0
sha256 eed84220ed7365b87d504f7709bd89ba2e255159d52f214f40a435ff78696eb6
sha1 16f41067a8ee08c44225dc83fd0f2478011b076e
sha1 220fb15655d3da8ad9459627830f49bb8692d8ff
sha1 5ee00147140b084f93d2144c2ee5c0d4d125ff1c
sha1 720ea472060e080145927d33e18dca9b8b1eafa5
sha1 8c314ca8541a2892c3f8806a9d4f96c9dcd40f08
sha1 a6d73ca85703cb5bcda00701fdc4b39def3d7ab2
sha1 add3893c3652947ff821a6da5fad774cc041bb73
sha1 b74e59c6059409be507d13a76097790daf96677d
sha1 bf0ea1994d97aa9631865e776a83f409572ec03f
sha1 c0e4fa5c39b8811b1ca8f67f0ba2fa7be2dd6684
sha1 db5be4a8378095719380c70b4fe6f4237036e1cb
sha1 db9a7aead00e61f9822d2ad2f36138e7b8443588
sha1 f04720fa343d2f97cef9d8685a8d251580a3a12c
md5 0cc90a5e2c53d0efd6b99c9643d07fbb
md5 208dc00007353101648fa35f98d5898e
md5 2a6a3d499bb3c666f3b4bc5905a866f3
md5 4c5d776616a5e7aab984f8ed7553bac2
md5 80c082dd0ae07df89e0c19ee84a050b6
md5 8254c3d05de0d95361839257287eb517
md5 96f9adb7ee00c44bc5f523d1f1dc8715
md5 98958a6a6141feb8b804ee83f2e88e7c
md5 baa697da0a79bcb544b0d42a49914e44
md5 cd7ce7bae3d7a5cf081a6ffd2445175b
md5 d677794618461b3bf7d405a8297d5df4
md5 e2d95d8a23eac6c9ba0192dc1fee958e
md5 e92d7d35bb04dff0d709e8e3fbd4156f
path /opt/openstrike/lib
path /tmp/bof_runner.so
path C:\cs_final.dat
path C:\openstrike
path C:\payload.bin
path C:\payload.dat
path C:\test_ret.bin
filename beacon.exe
filename beacon_patched.x64.dll
filename bof_runner.dll
filename dbg_loader.exe
filename run.exe
filename sc_loader.exe
filename stager.exe
filename veh_loader.exe

20 further values in this feed are not shown above, because they are not an indicator type that can be recognised reliably by shape: command names, fingerprints and behavioural patterns among them. They are all in the raw JSON, which remains the complete record.

Licensed CC BY 4.0, free to use commercially with attribution to The Hunters Ledger.