Skip to content
THE HUNTER’S LEDGER
IOC Feed
Shadow RAT & XWorm Open Directory Campaign
47 indicators extracted from this investigation's feed. Filter by type, then copy or download exactly what is on screen.
Raw JSON feedFull reportDetection rules
47 shown
TypeIndicatorConfidenceFP risk
ipv4 151.245.112.70HIGH
ipv4 185.11.145.145MODERATEmoderate
ipv4 185.11.145.254MODERATEmoderate
ipv4 187.124.244.54HIGH
domain 9wpzaeak.strike.bzHIGH
domain bluewiin.comMODERATE
domain breakingsecurity.onlineHIGH
domain epgoldsecurity.comHIGH
domain harrismanlieb.inkHIGH
domain latssko.comHIGH
domain ns2.harrismanlieb.inkHIGH
domain ns2.latssko.comHIGH
sha256 0eb87ee4523f90210730ac6040ee9c5551408a93bb3a1454cd79aaf26a7744ed
sha256 240e2575f20c75c6b5e2ea69bc0f0d9675ffd3fea315ca818bcbee2572ee972fHIGH
sha256 291543374d0ee4f983132128dcef16ebc8c058f07b1dc1b1f7d7e11d189fd42aHIGH
sha256 3a4b0f50ea3eac55e22cbf24d873f9a1632d8f71e1fba91178c539030626ab32HIGH
sha256 5a23f8394640cb9e40658446a04c0bbae82dc93d0470e1b2a406a90fd2520382
sha256 6682f3b4568807b0e57acbf2acd627e25be44304cac9241f2b51efa892aaab0cHIGH
sha256 82b9a2009deb589583ec0c1532dd9e37ea0bf3825d6bb5d4a8371d393487faf2
sha256 b7fa1e5cefb7f5ad367271f29bde8558566c17da169b5dac797c79beb3fc4531HIGH
sha1 3ef537af9aad6edc6792d53e25124a1649e5f655HIGH
sha1 7aa3fe6ebcb4ecc1a61568a0eab0d2b08d802b4dHIGH
sha1 7bb190d425645f02724329c6f909432e2441cc70HIGH
sha1 97dc71a09a26eaf63c56b6ff2ba582aa3a994d6f
sha1 ad4e81b84f3c6f8b30863f90e8a09631112b0f5bHIGH
sha1 b759384f0c34d0d4a241cf3614e246d5b974f2fbHIGH
sha1 d498af82aba3f8d9be1a5df2bcd07ae5a4011883HIGH
sha1 e69e32522835f37f18095e219385057b6bbdc959HIGH
md5 7e2fe58934874e442cfa183a34ceb24cHIGH
md5 8090c32b447f955e276ad8f005ea4775HIGH
md5 ca2e595881e56dbf63cf891ee14300cdHIGH
md5 e4736090733ca81eeabdb16b4b8f9cc3HIGH
md5 f162419fce4eb4dff92be342c47662c2HIGH
path %APPDATA%\Microsoft\Windows\Start Menu\Programs\Startup\XWormClient.lnkHIGH
path %APPDATA%\SubDir\$77Client.exeHIGH
path %APPDATA%\SubDir\Client.exeHIGH
path %AppData%\XWormClient.exeHIGH
path %TEMP%\Log.tmpMODERATE
path %TEMP%\LogsMODERATE
registry HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\RunHIGH
filename client.exeMODERATEmoderate
filename shadoclient.exeHIGH
filename shadow.common.dllHIGH
filename shadowclient.exeHIGH
filename usb.exeMODERATEmoderate
filename xwormclient.exeHIGH
filename xwormclient2.exeHIGH

29 further values in this feed are not shown above, because they are not an indicator type that can be recognised reliably by shape: command names, fingerprints and behavioural patterns among them. They are all in the raw JSON, which remains the complete record.

Do not block

These values came out of this investigation, but blocking them would break something legitimate, whether a shared service, a bystander's infrastructure, or the victim's own equipment. They are listed here because they still matter for hunting, and they are deliberately excluded from the copy and download buttons above.

TypeIndicatorWhy it stays off a blocklist
url http://ip-api.com/line/?fields=hosting XWorm anti-analysis callback, queries legitimate API to detect hosting/datacenter IPs. If response is 'true', malware exits silently.

Licensed CC BY 4.0, free to use commercially with attribution to The Hunters Ledger.