Skip to content
THE HUNTER’S LEDGER
IOC Feed
Help Desks to Host Shells Across Brazil's Public Sector
25 indicators extracted from this investigation's feed. Filter by type, then copy or download exactly what is on screen.
Raw JSON feedFull reportDetection rules
25 shown
TypeIndicatorConfidenceAction
ipv4 209.99.185.148HIGHBLOCK
ipv4 38.180.16.98HIGHBLOCK
ipv4 38.180.196.193MODERATEMONITOR
domain dump2.shDEFINITE
domain relay.javaLOWHUNT
domain relay.java.newDEFINITE
domain v487918523.localLOWHUNT
url http://209.99.185.148:8146/e/a38243f90dc30f99/MODERATEBLOCK
url http://209.99.185.148:8146/p/a38243f90dc30f99MODERATEBLOCK
url http://38.180.16.98/HIGHBLOCK
url http://38.180.16.98:80/Relay.java.newHIGHBLOCK
sha256 0ce2e8a961c564e9d76c2f59662c1107b33e2c32922e39a4c0d900e79722e7bcHIGHHUNT
sha256 86c0fa7d4fe1740e02a845fe18f85de91b234321b21d7804944f3248395968bcDEFINITE
sha256 986f697d2ef67a38e25c6a17cdecd7bb50148f2c2993864c748e3504d3d747f0DEFINITE
sha1 3b6e9d04e14fcb1d5ad1642fc990b6afdccdf5bcHIGHHUNT
sha1 4693349e740f3ef6a03444a735d5c73745ec8836HIGHHUNT
path /tmp/Q.classMODERATEHUNT
path /tmp/dbg2.txtLOWHUNT
path /tmp/glpi107HIGHHUNT
path /tmp/glpi107.tgzHIGHHUNT
path /tmp/glpwnmeHIGHHUNT
path /tmp/oraq.pyHIGHHUNT
path /tmp/pg42.b64LOWHUNT
path /tmp/svc.pyHIGHHUNT
path /tmp/updMODERATEHUNT

28 further values in this feed are not shown above, because they are not an indicator type that can be recognised reliably by shape: command names, fingerprints and behavioural patterns among them. They are all in the raw JSON, which remains the complete record.

Licensed CC BY 4.0, free to use commercially with attribution to The Hunters Ledger.