Skip to content
THE HUNTER’S LEDGER
IOC Feed
Open Directory at 193.56.255.154 — XiebroC2 v3.1 & Covenant C2
20 indicators extracted from this investigation's feed. Filter by type, then copy or download exactly what is on screen.
Raw JSON feedFull reportDetection rules
20 shown
TypeIndicatorConfidence
ipv4 193.56.255.154HIGH
url http://193.56.255.154:443/en-us/docs.htmlHIGH
url http://193.56.255.154:443/en-us/index.htmlHIGH
url http://193.56.255.154:443/en-us/test.htmlHIGH
sha256 3aa45ceff7070ae6d183c5aa5f0d771a79c7cf37fe21a3906df976bee497bf20HIGH
sha256 cff2d990f0988e9c90f77d0a62c72ca8e9bf567f0c143fdc3a914dce65edec98HIGH
sha256 ed4d2a1f86b73e6a3f2d5378ba93a044f8c760307acfd3b99a0fa3c0b94fd107HIGH
sha256 fc93712d44850bc730e1e4cf0f678a902e8f60a5d710b4bc19b0ab0b2fb79a95HIGH
sha1 7a502bd0e7fe586b97498058a72287dfd22f8d44HIGH
sha1 a79cd499c68482e73852db2c70d4e06251a29d95HIGH
sha1 f0f4715a6d7063e7811502e9591f8265af0a2af6HIGH
md5 0e12e94cc5b7e591e02f8afab1dac7d1HIGH
md5 2ac67005d80a76c77417086375e444d1HIGH
md5 7cfe0a039b61ec049b53e8e664036a6eHIGH
md5 a19ea23062db990386a3a478cb89d52eDEFINITE
md5 ac9b16b8bdf544db92f325a0901c5544HIGH
filename extracted_payload.binHIGH
filename grunthttp.exeHIGH
filename grunthttp.ps1HIGH
filename main.exeHIGH

26 further values in this feed are not shown above, because they are not an indicator type that can be recognised reliably by shape: command names, fingerprints and behavioural patterns among them. They are all in the raw JSON, which remains the complete record.

Licensed CC BY 4.0, free to use commercially with attribution to The Hunters Ledger.