THE HUNTER’S LEDGER
IOC Feed
Rovodev AI-Co-Authored Mirai Variant + Matrix C2 (87.106.143.220)
53 indicators extracted from this investigation's feed. Filter by type, then copy or download exactly what is on screen.
Raw JSON feedFull reportDetection rules
53 shown
TypeIndicator
ipv4 165.227.175.161
ipv4 188.166.194.243
ipv4 80.211.111.10
ipv4 80.211.94.16
ipv4 87.106.143.220
ipv4 87.106.54.213
url http://80.211.94.16/Naku.mips
url http://87.106.143.220/bot.sh
sha256 0c77fee765a40486c396e9b14f6eb9a787c4c5d9261669b60ab35fed7fe1a626
sha256 33c50d71a1d9e6aa2598942893809dbfa617a2a0e86044b36b83802b382d7652
sha256 435da9f5fcecdbad48b6d1e572f70c122a80be7c0586492ce65d46cfb928cbee
sha256 47731b72ca73003af7770a8be876e8f41ffde37a76337eb34630d114727888e9
sha256 4809a7ee9f5dbcbe86cfbd77a45e2a268a37bcc947e8e1621164df653597948b
sha256 4a02f11edda477fc6c629a3bc857b05948fff70912f73f264779c3b36ff60fa9
sha256 58ef3f244dab408fac7117606843a3dbcfb0754b2032a5950e977bc1811c0313
sha256 595f4315f00c2fce839eabe9880f669990256d6638fb148996872e37ffc9b28a
sha256 63f0da53daac05df184c96949bcfa2e5d0d5fee425900a75ae58662479c14099
sha256 64afc3b3a02706ffcf4255bda4519f8c1c66daaaf937a2641fd14a551a34e383
sha256 64ca12cae6f5e520abb4158da3bbc14e909c2128748ae0c5806fa4206cc14260
sha256 65eb951a0b4a0fd1e524137bbd3052255497cccac380beb11661beb45ac9b489
sha256 79b01dd6e9e808b8e14c9a7dd2751264dd4d5fd96508de383c0fdbfd81a814dc
sha256 81748f0236319c678db39945ec77fffe1b33e84ffa9731b2836b911f8e83a5cc
sha256 8aca22aa0fc77775521eaa916f490d7a433fd8f0c0f8104bb113f6127be0e530
sha256 921e4c1d86813838d40010e82a8f374a70b91f06008db5182d1ec6c2da672c09
sha256 9d4d5ea53045d98d288b54e2208f562642a913126c16b9d8eedafab450dbb9b7
sha256 9e70449b2aafc71c7ff16ece42053fb41b92394cdb88ce799f60d50b4fbefa9e
sha256 9eece9f46bc420b53884d4292622621c9960459c1d7a73635420771e7d0aa1fa
sha256 a19b972688158e361e8646ec17556ec46bf84f0cd24fb8707e4df85cb9d9a6d2
sha256 afd49e3ceb20a8e861fa4804b6ea988f8aefd6942f84973f32b8e24c7df03410
sha256 b7d999255a12da91f23453ec940cdc52b64e59c6e205f227ceae98a83027de20
sha256 c899c7435335dd37bfd45eefe5cd353802649c627dd26ea3e5dd26119fe4d6d3
sha256 d1086ab3c06764ffd81492b4c723bda83bac19dc101c8542bc566e5888c92da3
sha256 d3fd9994b16dc9b14c29f7faf7b5f6c84f44b06fccf82f0031a0871ce5e20e17
sha256 d888a16cd6aa76f62a329906db4f241e6bc23ff5f21d61e754ade8ccab6da0d0
sha256 e091a8cb3286e61f87a0d515705d79f8eebdbc64accc9e147ca48f35aa85ce2c
sha256 e4d3d361ba8b25f8effcf7786b32185cf7255059fcf55b2509101779703a15aa
sha256 e9e0eafc89e4a9db796c63bb4fdc5c0fd1106f8b9c234fb57e51a7934f2b8d8e
sha256 ec948aef742c01f91b41df9b19b0ecca3bc8ecf962e2360aee181b9b89abfc78
sha256 ee24f4f0fb9795bca8daba73f99bf1846fe5cdb400f5345ef4a4476b20ab5bc4
sha256 ef693f29b4ae47b1aa5920237946c3b0518ce84dd37e6fd6c6ee2e3e9dd6cd44
sha256 f63bb6b25c8db035173eb257a3e5d459352aff31734991637c66ea4167bf55fc
sha256 f90658253261f8dc63446dac49a88baa0742f46a2f5448fb330acb58017980ef
sha256 fba4072941038d27a28a1089ab24d9c3e22f0db19994f3c12c688085903a6ded
path /bin/busybox SORA
path /dev/misc/watchdog
path /dev/watchdog
path /etc/cron.d/.cache_update
path /etc/init.d/sysupdate
path /etc/rc.local
path /etc/systemd/system/system-update.service
path /root/.rovodev/
path /root/matrix/
path /tmp/pandora_bot

68 further values in this feed are not shown above, because they are not an indicator type that can be recognised reliably by shape: command names, fingerprints and behavioural patterns among them. They are all in the raw JSON, which remains the complete record.

Licensed CC BY 4.0, free to use commercially with attribution to The Hunters Ledger.