Skip to content
THE HUNTER’S LEDGER
IOC Feed
AdaptixC2 Open Directory Exposure (45.130.148.125)
73 indicators extracted from this investigation's feed. Filter by type, then copy or download exactly what is on screen.
Raw JSON feedFull reportDetection rules
73 shown
TypeIndicatorConfidenceFP risk
ipv4 45.130.148.125
url http://45.130.148.125:80/api/v1/statusHIGH
url http://45.130.148.125:80/content.htmlHIGH
url http://45.130.148.125:80/jquery-3.3.1.min.jsHIGHMODERATE, match in combination with destination IP 45.130.148.125 and either X-Beacon-Id header or Firefox 20 stock UA, NOT alone
url http://45.130.148.125:80/updates/check.phpHIGH
sha256 144247b20c1f2aaf9ad5bedd1672a7ebd6041c9237d8931d1822e27c0562420bHIGH
sha256 1bfbefa4ff4d0df3ee0090b5079cf84ed2e8d5377ba5b7a30afd88367d57b9ffHIGH
sha256 20fcb557c7c4ada8173576b56aadc8f917c668b9e4b2aaf05fb90375147fd27fHIGH
sha256 277ff28006eac42319597abb10ae51541b5e6b06884c135a111416c833144973HIGH
sha256 29955ba1e2193047ee5f4561445f81e218ae4de1a295f8fd296ad536bf381f17HIGH
sha256 316f9165ba23b968d33966cd2cef70b10b9e5973117b3864b51048292bbb6742HIGH
sha256 358edb5d7e3e38c2da0a2ef323a281283aa96d47a8649014d114923b06866c12HIGH
sha256 4b41f36f82db6da8767a0a1c2997c8242d80b2d10a8f1d28c252a9306ec152b5HIGH
sha256 507e8666c239397561c58609f7ea569c9c49ddbb900cd260e7e42b02d03cfd87HIGH
sha256 5bc6603e47ddaea79b8050ea1c076d9d9c2d06a9f350f698d5147fbbbe4e7bacHIGH
sha256 5db5e7f655c4ee94411df8110d1b6d02bb15574ac199fa7a553ce6c3cb25bf03HIGH
sha256 5ea265ad3e6429cd2e8d9831360f7e2be9b8ba5a5b32a4a60c5c956a3f8fb285HIGH
sha256 5f10b9b68fcc2e3a15ee5b7dd996f2fadf5a1b65c7c73120abb6ec315c38d756HIGH
sha256 61c0810a23580cf492a6ba4f7654566108331e7a4134c968c2d6a05261b2d8a1HIGH
sha256 8524fbc0d73e711e69d60c64f1f1b7bef35c986705880643dd4d5e17779e586dHIGH
sha256 8b5c0ec2718474c6959d39d36113efd01e42e1776103d2a90b3bedb4c6a091bbHIGH
sha256 9a8e9d587b570d4074f1c8317b163aa8d0c566efd88f294d9d85bc7776352a28HIGH
sha256 af5c3a5f68323ac68b258dae37c20e48f594118d08479f92a78bd54d26debd9aHIGH
sha256 b4ffd7ca8f5505fd7b71882c67712e896c9d170a3b3b581baba78ee5d1c2b858HIGH
sha256 cb5a07900a7a01a7619e3391c0a2b59f81a8d8784c66698bb02263faef9311a1HIGH
sha256 ce709770ac09b79ed9894542a140e76a897bf897bd27855e11cc0ece7194114fHIGH
sha256 d9be165fc7009fc273039790375bf2447ebab1b7d73c88b064e1be1df43673b6HIGH
sha256 dc06d62ee95062e714f2566c95b8edaabfd387023b1bf98a09078b84007d5268MODERATE
sha256 e55fd33ba5316622c42021f39c246c9055acaeca180779816a44b93454513c01HIGH
sha256 e8fbec25db4f9d95b5e8f41cca51a4b32be8674a4dea7a45b6f7aeb22dbc38dbHIGH
sha256 ec54e9e5802423d17f1390a25a811b7779c33d8e7ad942cd731dfd366998eccbHIGH
sha256 f091c63809e27e7d2ef3c3506f5c59563817a7876b737e3995540b051b225e51MODERATE
sha256 f68507d88b007817901ffe3537a2d3935de53344ddfb6f0838d4141e3c02e07dHIGH
sha256 f887e04ce6c43da608cfcb45e51398305bb3912ee9d88ac7569c917e245d404aHIGH
sha256 fd9e3ad797022df67a406e1bb1bf1db57e2a14f66c668e22104a16bc735efc4eHIGH
sha1 913fe64e088d5db2185d392965bf4cd3dd1d9495HIGH
sha1 a4b80bf370f704d6843e69433bfb5c06274f57dfHIGH
md5 4cfec38bf3c1557ad25faba737f8e275HIGH
md5 63cb3b95faad6b28fcce52a6aa698ff2HIGH
md5 f443b9ce7e0658900f6a7ff0991cdee6HIGH
md5 f67fc0b1a6e0c3b07adb524e2db8774fHIGH
path /tmp/si_build/obj/Release/net472/si_build.pdbHIGH
path \\.\pipe\%08lxHIGH
filename adrecon.ps1HIGH
filename agent.binHIGH
filename agent.exeHIGH
filename agent.x64.binHIGH
filename agent.x64.dllHIGH
filename agent.x64.exeHIGH
filename amsi_bypass.ps1HIGH
filename beacon.ps1HIGH
filename beacon_shellcode.binHIGH
filename certify.exeHIGH
filename chisel.exeHIGH
filename download_exec.ps1HIGH
filename embedded_dll.binHIGH
filename godpotato.exeHIGH
filename gopher.x64.exeHIGH
filename injector.dllHIGH
filename lazagne.exeHIGH
filename mimikatz.exeHIGH
filename msupdate.dllHIGH
filename nc.exeHIGH
filename powerview.ps1HIGH
filename printspoofer.exeHIGH
filename rubeus.exeHIGH
filename runascs.exeHIGH
filename seatbelt.exeHIGH
filename sharpdpapi.exeHIGH
filename sharphound.exeMODERATE
filename sharphound.ps1HIGH
filename sharpsecdump.exeHIGH
filename winpeas.exeHIGH

56 further values in this feed are not shown above, because they are not an indicator type that can be recognised reliably by shape: command names, fingerprints and behavioural patterns among them. They are all in the raw JSON, which remains the complete record.

Licensed CC BY 4.0, free to use commercially with attribution to The Hunters Ledger.