Skip to content
THE HUNTER’S LEDGER
IOC Feed
Sliver C2 Windows Post-Exploitation Staging, 193.233.202.17
369 indicators extracted from this investigation's feed. Filter by type, then copy or download exactly what is on screen.
Raw JSON feedFull reportDetection rules
369 shown
TypeIndicatorConfidenceAction
ipv4 146.103.127.44MODERATEMONITOR
ipv4 193.233.202.17DEFINITEBLOCK
ipv4 38.110.228.125MODERATEMONITOR
domain bdqbs2lz6u.bakHIGH
domain itemrange.comHIGHBLOCK
domain publisherresolution.comDEFINITEBLOCK
domain resumeacceptable.comHIGHBLOCK
domain simultaneouslypower.comHIGHBLOCK
domain wiselystarting.comHIGHBLOCK
domain www.itemrange.comMODERATEBLOCK
url http://193.233.202.17:39287/cons_c1.0.1.msiDEFINITEBLOCK
url http://193.233.202.17:42099/ws_new31847.exeDEFINITEBLOCK
url http://193.233.202.17:42718/add_dns_from_37.ps1DEFINITEBLOCK
url http://193.233.202.17:42718/gp.b64DEFINITEBLOCK
url http://193.233.202.17:42718/task_39.ps1DEFINITEBLOCK
url http://193.233.202.17:44321/cons_c1.0.1.msiDEFINITEBLOCK
url http://193.233.202.17:8080/DEFINITEBLOCK
url http://193.233.202.17:8088/DEFINITEBLOCK
url http://193.233.202.17:8088/slv_beacon_sc.binDEFINITEBLOCK
url https://itemrange.com
url https://publisherresolution.com
url https://resumeacceptable.com
url https://simultaneouslypower.com
url https://wiselystarting.com
sha256 06e29cf9ac468976f04208ea5e5563ce57f67ba42093750e967c87a14dad0978DEFINITE
sha256 0f56c703e9b7ddeb90646927bac05a5c6d95308c8e13b88e5d4f4b572423e036HIGH
sha256 0f56ff5ce9d6732eaa67688af2c94a8f320fb85bf4cb04ba372b735858b9d49cDEFINITE
sha256 136dd810f217c0dd70f8352328c2ea6c43865f8ef79713d77d68c1d9bdbf822dDEFINITE
sha256 1411edc3a80165e4f2bffaa126d7389dfc978f54760c90d6e8fd5a04b69e258aHIGH
sha256 15f69ef1918db303ca2f92eec7f99768adf1195e6f6fe56492fae37cc735216aDEFINITE
sha256 16d465948fed0a2cdf75aa0478d2f4038852e6cc07f3fac3b78ac0bb2eca8ff0HIGH
sha256 173994299ea7cdf873fbbe1ec42953b8b45995f519f14bc702d0a7b9338efc32DEFINITE
sha256 201bcb3d98923856227ed102b5f92c5ebd268e715a9bfc2e62ba1fe7faa0bc5fDEFINITE
sha256 204affae86fda4fea1ceb24f3e95cd7ab457169d36e9df0f05775f123de2b31eDEFINITE
sha256 28fad4e208ca97ba16180157bf7a565e1f6a40ebcb5900c0bda5a8947bafe66dDEFINITE
sha256 294043345ec46527acf4c56635de6f781036aff1a1dbdc3925ba4525372633eeDEFINITE
sha256 2c8df3fdb19ea1884d32457a10049cb6ca80498e0e162b3b34977ad2b82fe6edDEFINITE
sha256 2fc083274c15d5c87b3d769e797498f36e43dede21f48a21b53422c90d960f21DEFINITE
sha256 31332d7417c777e7e52bd4d9c491cb6213c97ab16e051bf29eaf8b2a18c06ef4DEFINITE
sha256 318bb406f9cf61cf310c84706f090bdaad29d481a783a37be185bf709a791b4cDEFINITE
sha256 3467dd1d846b46ab41dfc1111960f1a7ec54cf75d4a6339929d8448c477b0d35DEFINITE
sha256 35a3dfd53d1a8f73165747555ea264f815fde2d75fbbab0b6b513793cb39868bHIGHHUNT
sha256 35c419760696d9013b31dafc5b05682e38ffa5190f631d3a3c5f1c3a1ad85b61DEFINITE
sha256 37a28e5532cf7de88af570cdcbf6dc0db96b14c37ff84d285d89e6635ad91c05DEFINITE
sha256 3953b770e1da9816e876e8df6b11e1e020e2f5cdad016da1d191e095ea628d80DEFINITE
sha256 39be3938eb198ab57802edcf67554dad007f01dd9148dadee39279bfd09cfee2DEFINITE
sha256 3d531def7ecef3f29b4542eb28db21e7ebae4da29c77cd762147135f5a014f87DEFINITE
sha256 4104ed9fe73c3b582f8366751ad7c496c2b0f7a4a6b3f069802b5af9b5bd44baDEFINITE
sha256 42d5fc0c36977e0a4ad40ba0771b3cdc9bdd9c73c89d68844bc8e510c0657226DEFINITE
sha256 4352ad707e262d4913d690bc95eb3d38c72ff43100c9a7a96ce4cefa6705dabdDEFINITE
sha256 467cb247fc8545a5b6be227853252b46984f94a54e8c4260932573304d61f6ceDEFINITE
sha256 6016d1a56674d621dc8206c7162e3e30959f9bec930f30db2accf3601779bc9aDEFINITE
sha256 607e0456e7022e5f9f4829b0a2c658f0834fb642be3ab7ce68ed009b01e06f97DEFINITE
sha256 61252f5123b38cf4db37f9171d94779013cdcdc553564b10a33ad9e3f1a75926HIGH
sha256 6172a5128528ee34147a9683f17192921c1059d8bddc66fbce46de8ddc33b556HIGH
sha256 61c0810a23580cf492a6ba4f7654566108331e7a4134c968c2d6a05261b2d8a1DEFINITE
sha256 68675be7d0b110878c4fd7682e2e72911c66a9c2b43df91266a0e647067d4954DEFINITE
sha256 689036d2dc675b3d95a4139b8097685f6e2e5c8520e7a5a615801aba00a8b85aDEFINITE
sha256 69cd12d92acf261c7f738c92d09e39dbcf60ec6ad66b261924b3dc93178b5ed3DEFINITE
sha256 6a7d945fccd3f739e3f54efd5624240c9a1b80de81b859756bb2207f4d044003HIGH
sha256 728c38979cdda97d5e82ece602698bf5132725f9f28b8cc0bc5fbd2316c9a044DEFINITE
sha256 731c9bfeb6816b6acb79cabf7edfeee3b7177c5f3dc76803c5907d7bf8cee808DEFINITE
sha256 756c2096f54c5497110c9d854625c3ed592873e566d532077cd7adb4d10d4addDEFINITE
sha256 79bb633438d8e9c67b0ee55925d5fa2e81880ddb872c89f957935b001c56a9a4HIGH
sha256 7a1b0508afe806ce7f0ace0894cf46d159466f6874d5271a39e2c149c6ec4b9fDEFINITE
sha256 7f91141bba37457b09088b039e21d82abe420bdc3b585970dba71dfe5cbeb25dDEFINITE
sha256 81d5debff647121e47913098757214ddd163710a240224fa92a03af9623ecf81DEFINITE
sha256 8524fbc0d73e711e69d60c64f1f1b7bef35c986705880643dd4d5e17779e586dHIGH
sha256 86881b8e9d197ac2f734792de48d5dfaebe7cafb6e35d49c5dd7fe6eb697230eHIGH
sha256 8823f98a6774b1dc812687476e0866f31b1601f4c42b880bd9a7f57a309d27b4DEFINITE
sha256 88ad6a37051cbaef75de8c6e3fe22351df40ba064677a6a3f53d4cc156ad1eb6DEFINITE
sha256 921376cf81f2a5eca3d9b44cdb6ff2df0a1a685bf47518d5f86e45576c997b60DEFINITE
sha256 978c9818e766f1df9c3e7b4ad3a3f2df4ef204524b9ad8e45154311148b057dbDEFINITE
sha256 97c90575e9d2209d40e38a31d2aafd543a9f09d52b2e329c1e2206472886a895HIGH
sha256 9a8e9d587b570d4074f1c8317b163aa8d0c566efd88f294d9d85bc7776352a28DEFINITE
sha256 9bc742d339a08ff88ae26363bd9b73cf027762f1856e0e7f30d86feccfb5c3efDEFINITE
sha256 9e5f7294234e21b3be083bb875d27f51514cf158e507ae11594459d9cc879f58DEFINITE
sha256 a2363e2f464694cb4bb8f487d33ea378764790a1c742bce98a03db5f52f4cd06DEFINITE
sha256 a332835be163d968d287f2c6ff566d75b087abcedc16021607403803b7b3416eMODERATE
sha256 a53150f1214665cf8122a3fa2f953c863be2f5c0f81a0d25f603a91689f713ebDEFINITE
sha256 a95da28fd2c077f7bbafe536b3821efd55f7d73ade8a8b5337327f11c5ef44caDEFINITE
sha256 aaec49b549aecf2119e1d20bf6dd7efbd74cd2ed2f6aaefed39e780e0815b5d4DEFINITE
sha256 acfe23f94e5b98a217a93bf414c8f1a99d0463b1d143fff7a3ab5dae436fe19cDEFINITE
sha256 b0e31e430faecdb65f1df82502506f4b155e11c2f2bf53e5014ffb5ce1ed8f75DEFINITE
sha256 b5c056a04d77c781b06dd3f2c8cbc13fadcdd9d78644755d82f322d3b7806f70DEFINITE
sha256 bcf24d50ca3a2b4e74438537755a1778617bdf02273098b82a3ce5e89bf5724bLOW
sha256 bd61c2880920bbfb86c12df439dd1ca0258a10e532433698fd029aef2a5b33f2DEFINITE
sha256 c115b1a69fe49cab4826a3f05ec5e37c693c135e8ea8c5f6492c0bc8c475f1b3HIGH
sha256 c1761a1b640f2bb1a0140923e255f26ad9b79a9005475ff1551e9a297a48811cDEFINITE
sha256 cef3e10ae4735a7017b3fe982d7385e3c3ce0cde286fb7572dbf885df73f8041DEFINITE
sha256 d13c5f858a8add3ff968a382a85f2dbe8e9fb0283086163d27b69178e4d5ee36DEFINITE
sha256 d546e500ef662b2c0def984b233e37c4b11de28bf5280df24d1d3300a7fa7b84DEFINITE
sha256 d7028280e815612b893c6f0620a4fa2ae63aa5c5bba9988b5223b81b7bf21798DEFINITE
sha256 e122fb629f5f09789d83ef1b8b41238d329f7d8efd84d38080d01bef2bad5d8bDEFINITE
sha256 e788f829b1a0141a488afb5f82b94f13035623609ca3b83f0c6985919cd9e83bDEFINITE
sha256 eaec6a177523f2effbabbba6159fe886d284e246e7b1464eb137ae9481ed65caDEFINITE
sha256 ee6807a8abfabced22ee026e178a28da64d13cc3408e224394ff6e5782fb9e1dDEFINITE
sha256 eee674bd0bcd2416367ad692e72122de31b710f13f35e2ceb8a52317920d00caDEFINITE
sha256 f03e1d0951f4d0744939a0cc7da7730ab367ec9420c1a77cc7f97dc0932de652DEFINITE
sha256 f4c87a1df04274b7497cbf9a4619b946c915cf5210b6e2eaa2fee1629f4ff196DEFINITE
sha256 f609621698eaad8c4683750fe8bd0e242349be3eea408da593151ff877ed8ab6DEFINITE
sha256 fa046adb30d00c56d640419a12deef8395ff5d40d6e083c1c8388ebd7b435ef4DEFINITE
sha256 fb94688ed37dfcb985a8a4d720230e5150956e1788d579b0a54b53a153fd2f2eHIGH
sha256 fdf0fae99d3b8ddd21aac288c2b38b6ac8a0e0eff99706b82ed5e921db9ddb0eDEFINITE
sha256 fe54dbceee81d09d3d2881136f8a702423f9c25acf4fd8fea44b36111134eaf4HIGH
sha1 02d2f00766fa45b914a5b32d6677f36c916203a0
sha1 0e7057a20a34462d03632c5550259a8959ed3149
sha1 12bc49435971a15c901ad71c7e0b15888098a480
sha1 188098b9caf3bc4d1b68dcad50d2e1cbd2e9d519
sha1 25805ac7956fd0e51ba59934fb9a49d766f89545
sha1 29a0233b8ad76c4afa58c3762a44494f06ef8805
sha1 2ac8c7101042720b11fe75bcb1a174ba9c07c3ac
sha1 2c8fd002f768ff6dc23b334f09c753f7f57af372
sha1 2cfa3a3bbdb24d66e974bbeff2582e309c0ff830
sha1 2e7efea9a0ecd10fcf5f6c3da70129a4e82c5430
sha1 2f35ddac6482f18fc997f2f39075c68b90ca7311
sha1 33a09b40f8f3a647e2f1b26f075091e421e6419e
sha1 35ca77675b5a406c4900caa93337020d07eeff46
sha1 36fb8d4021e3c755830be0f66ebe74d0d2eb3a37
sha1 3b93437edbc45206932e9562431b1b362fcacbf2
sha1 4085fdd2fcfe3d722facf396990674dd14f80e67
sha1 42234e5190e0e25a2893797754864299983642c0
sha1 47183a554ea74f0bbd6271451e4a73bd41e9f362
sha1 4b7de21331c0a4154a951dc68c4386154575a04c
sha1 4fee45e167d7e35710cfd2c3ff914851f830a427
sha1 522e7674cd1f6ecd375166c3c1732414dbd64ce0
sha1 54d18e7ee7502a343eab46fe8abcddc5815be062
sha1 56b91302fb68794db6bbebf320373fbbaa4cab2e
sha1 595fe7c5c382d096cbc3f798a405fa1bdff380b7
sha1 5a0f26f2a01111d983862047072be7375d6b623d
sha1 5bf323cb53f3c67ba53ac04b0db264079dc5bc07
sha1 5ce92796599966aa6f566f91fbb74a2e428abe08
sha1 60285f6776cc3ff20872feeee7f2fd0b3b04410d
sha1 60c2decd1de6b5651b91367803baf87e23279ecd
sha1 668c40bb6c792b3502b4eefd0916febc8dbd5182
sha1 67d42931f48c5af1227585df1143bcdd7f7c9eac
sha1 68b939dc7e5b9071e3b7f8a376ca3210809143b8
sha1 6ae10f0e10e5f5d9a60be0f915e92c52c80d8e2b
sha1 6c280d0312ce01fecfc0447bc6b1073a5473ce65
sha1 703e5dc305008e8d1e462a8404bdc31e28f71da2
sha1 7d97faf46b4da1fbb5e534df025b22ccf41d955a
sha1 7fb5c46a90fb27b53ccea1b6fec486baaf63266c
sha1 8562d55255f9cd3dc36eb0e247cccd931d592249
sha1 8848b617942f71e87ab9c5e57d56550e9fb32e12
sha1 88ec2a71225a1749383953596b7cae43a34c02ec
sha1 89b7e37d1c5c2c6bfbeb5e6978565910e998f237
sha1 8a82195b031e322a8fd69da3e3e1b0f01dc1af36
sha1 8d1ddc02460d80d50e13e5d5dadcfb192a6a2fab
sha1 90e66a19e668b77499b846ae10c58ef35117eed0
sha1 9280c50bb26fd0cc28c7a761acef5fc742edaf74
sha1 99b52013487a1b21e2031fffdbd9d5c7d5697a78
sha1 9cc91f37130b34354eab0a9af58cd4e81e2edd81
sha1 9dd99bc68e60132f32fc33617deb9583c8cebb51
sha1 a176fce8809d0d75f6fb02dfc237e35884881502
sha1 a2a8c85ae57521e1aa93d466b31096e217f4cd6f
sha1 a5452c96f717af74228217db51a1b9e067b8c007
sha1 a7f4141eaad1aa39594322b0b99dfca16c23390a
sha1 a8ca03e0d328f9229db53a83620ee82db4eef873
sha1 ab485c551144fc3b6f9692d13182ae92c6fb9848
sha1 ac819eaeac74f7cd8d39834ef3d1d1de399f03d0
sha1 ad564329de735b1a29ad772bc5bd62ff720cc6b4
sha1 b1cf4359f0a6385d680c70bdeaec08aacd1cd286
sha1 b3976255a0809b1985bb97a69deeb2cbb0644dfb
sha1 b62cfa5cd03a0c4df831800f67291a93e981c883
sha1 b90fcdb8c9f3bb4620ec9d25bd8abc71033344e5
sha1 c0408da553d905857ac4f559b0438b99316f1bda
sha1 c213a67fd8dc8e3f29857bdab83083459bb6ab75
sha1 c70038b39594531d3b5f56b3553800687e6b3a51
sha1 c787636df481e1075db49c96d696de8dc6198e26
sha1 c78da3566bb7a63b66216c7649187bf81ff9d462
sha1 ca7854a3a4e24370b31991fc6f599e6b26f9065b
sha1 d2490257d18fd28f57eed637ceaf348fa21db1e4
sha1 d32956610c9959e6085eb3c968b089974802fab0
sha1 d87a33503d3a48ad52a83744a6c8e1255f572d66
sha1 db5e1ccaaa7ce6e73c67ea0fd037355205c8f361
sha1 e348c0567ef9a7aad7b4af3e1830f1a4c797bdcc
sha1 e3b6ea8c46fa831cec6f235a5cf48b38a4ae8d69
sha1 e702d3147f76f5bdc4afd140e33dc7e3975c79cb
sha1 eaca979848b1c2ff6df166ea199b3cb6b7cb1f15
sha1 f0a955dc3c37a7da490b1b08a9b66b39abe6faf8
sha1 f70f8c4bb655f3570d78b717cc9945182d59c814
sha1 fb49bdcc5cd75b8eb7784f16ce8504fee637b39c
md5 02bcdf44e34cd9aca5abf617427d7bfb
md5 0316840f7df8f75c4039909d55eb1549
md5 04262ed28fd9b4f4691b2655b2f5c0ed
md5 049002830b73321e8efce7899d4eaa92
md5 098989965749e8d42a314f5ae102b82a
md5 0b43d183fa64803608385806501750a7
md5 0bae3972c232d6c174d5f68ced16319d
md5 0f25cb54d2dc89b414a14db202b06ba6
md5 108da75de148145b8f056ec0827f1665
md5 11553dc59be466f48fed7dbb436ff05f
md5 130b72b54799233f0aeb203f160ebc90
md5 1a9880cc5cf5a9301377e1734d211c38
md5 1b62875e961999bd2157ac88de6e83de
md5 1e309fc39e9866edf6f44fa315fbdf70
md5 1fdb1dd742674d3939f636c3fc4b761f
md5 2000c9cd74d0770a4cfd97282cdc9abd
md5 23a4301d524fccaef630e627fced1d94
md5 29ea4a5c24c739727d46941a471f80d2
md5 29efd64dd3c7fe1e2b022b7ad73a1ba5
md5 2df218a390e8fe1cf17797f2c5caec29
md5 2e4fbb0e2472cb7a7e13cfc6fbb1905c
md5 33172fc2d6e7615b7ca75a493447b4ce
md5 3b8b9c081499c90e13e8916513bb8a28
md5 3c916891a76120c4e10ab4674a8d5720
md5 3d77fc5aaab483e67053b416da222ccc
md5 49017561ae06882b7ff28d66783e2051
md5 4b690f3ce585df982a042917b82642c8
md5 4d9e61fe5d105e4d6d26ac67f7228742
md5 4e52a44f01adf41d62bc8cae34dd788a
md5 4ff3ed6143b932a8760c32cb693905a9
md5 57bc34640bc2d53d7e4d2a053d0bbea3
md5 5dec764af6862185aa56d3d6bffa736f
md5 5e7fc055d261c685d3aa05aca81e610f
md5 6084305556def1a61dd69959884af971
md5 61973b73a6366f58c8e90118af3da7ee
md5 621db49ebc24092045d7181cf8690cf3
md5 6776bfe983932598134e3eb1a2d99d14
md5 68608c531dd4240e7f5a5dd0cb2a3610
md5 69b7f4ba9ce91a6e403270abcfd882ad
md5 712da3dbc5ea34854345e71bb8d98ea8
md5 71e5be231b66e94ab0cfc20be0b1e1ba
md5 7517f2c1b04183224e73c54789cf37d5
md5 757c54783a367c7c490186fcf5bb35ce
md5 7875a8100de57420cc403ebc530c6764
md5 791883be0daf24cdd0a01483e8474173
md5 7ba3108234b3556a7b536bee391143a3
md5 7fb996df101d57a8a41507df380d4983
md5 808502752ca0492aca995e9b620d507b
md5 868f2d9f2ea65e6e0ed6a66133ec3468
md5 8836546c46bf376ab009eb876bc3c793
md5 90fe1319b8b05eb5e782fb334f5c2924
md5 97b8693e32bfa03dd7eabd701849d972
md5 986f1db25b7d9ca73b002fa28cf09346
md5 999466cff181b66907c6fc2d80f5c8b3
md5 a03253a991d34640f00c560b89011805
md5 a2baad151034951068e20dfdd742b36e
md5 a39eb85eb5622a28e0e368fefa9da939
md5 aa68d12c3135afbdc019739ef1d21358
md5 ab31b24a0f7c4d23ebc1ee2ac0140d68
md5 ade6fecfa408be036364e2b9b15441ae
md5 b531927f303aed4fa98c9e42b9c5eca7
md5 bd1eaea733425cd21a51a652c429951d
md5 bf1e31c305f210ed15f2635ca1ae321e
md5 c2d457ad8ac36fc9f18d45bffcd450c2MODERATE
md5 c6cd2ac9aaa07392b5a18cea0b465bf4
md5 c8a7a1e830d6850b2529471310d1c803
md5 c9ab81d0e67295058636f951f7ce4e3a
md5 d3a4a2df6a7d4e92bfc5d0d78fd9cd1a
md5 d7359a6e562aa9c300c8af412f8f79ba
md5 d766a554e5ab46a43b848b0d22df65f1
md5 dd5c8c955b2fa584e2c7e17c6f4f1455
md5 dfdf55484962e2a70a6255868d91bc37
md5 efa54088ecb950d5ee152610ff5d636e
md5 f26c3cd4209492b699131d29b76d941a
md5 f34d5f2d4577ed6d9ceec516c1f5a744MODERATE
md5 f4f4467128df3962670243b5b0b99f8c
md5 f5639c56f86b715f6223c7a14c06d519
md5 f665292c392bffa3bebbe17dcec03e17
md5 f66a37432cc8698eb693d2d4dc46d51e
path %APPDATA%\.node_bot_id
path %APPDATA%\svchost.log
path C:\ProgramData\add_dns.ps1
path C:\ProgramData\chisel.exe
path C:\ProgramData\csvc.exe
path C:\ProgramData\nc64.exe
path C:\ProgramData\sam39t.bak
path C:\ProgramData\sec39t.bak
path C:\ProgramData\svchost_upd.exe
path C:\ProgramData\sys39t.bak
path C:\ProgramData\upd.exe
path C:\ProgramData\wsu.exe
path C:\Windows\Tasks\gp.b64
path C:\Windows\Temp\acl_out.txt
path C:\Windows\Temp\ccen2_out.txt
path C:\Windows\Temp\ccen_out.txt
path C:\Windows\Temp\cons_update.msi
path C:\Windows\Temp\cu.msi
path C:\Windows\Temp\inj_out.txt
path C:\Windows\Temp\injf_out.txt
path C:\Windows\Temp\injfs_out.txt
path C:\Windows\Temp\ls.dmp
registry HKCU\Software\Microsoft\Windows\CurrentVersion\RunHIGH
registry HKCU\Software\sZ918iBd\K2WvqvNWIbHIGH
registry HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\SystemHIGH
registry HKLM\SYSTEM\CurrentControlSet\Control\LsaHIGH
registry HKLM\System\CurrentControlSet\Control\Terminal ServerHIGH
registry HKLM\System\CurrentControlSet\Control\Terminal Server\WinStations\RDP-TcpHIGH
filename acl_enum.ps1DEFINITE
filename add_dns_from_37.ps1DEFINITE
filename add_dns_publisherres.ps1DEFINITE
filename add_publisherresolution.ps1DEFINITE
filename adduser.ps1DEFINITE
filename arc39_new.exeDEFINITE
filename assa161_new.exeDEFINITE
filename bkshell.exeMODERATE
filename ccenum.ps1DEFINITE
filename ccenum2.ps1DEFINITE
filename chisel.exeDEFINITE
filename chisel_new.exeDEFINITE
filename cons_c1.0.1.msiDEFINITE
filename da_shell_12.exeDEFINITE
filename da_shell_173.exeDEFINITE
filename da_shell_35.exeDEFINITE
filename da_shell_36.exeDEFINITE
filename da_shell_37.exeDEFINITE
filename da_shell_39.exeDEFINITE
filename dep.ps1DEFINITE
filename dep2.ps1DEFINITE
filename dep3.batDEFINITE
filename dep4.batDEFINITE
filename dep8.batDEFINITE
filename deploy.cmdDEFINITE
filename deploy2.cmdDEFINITE
filename deploy_all.batDEFINITE
filename dns_add_publisherres.ps1DEFINITE
filename download_and_exec.ps1DEFINITE
filename efspot.exeHIGH
filename fix_uac.batDEFINITE
filename getsys.exeHIGH
filename gp.exeDEFINITE
filename gp_reflect.ps1DEFINITE
filename gp_run.ps1HIGH
filename inject_from_fs01.ps1DEFINITE
filename inject_fs_v2.ps1DEFINITE
filename inject_sliver.ps1DEFINITE
filename jedb5rox.cmdHIGH
filename jlfywzakn99jpgu.xmlHIGH
filename jp.exeHIGH
filename ld.ps1DEFINITE
filename ligolo_agent.exeDEFINITE
filename mimi64.exeDEFINITE
filename ms16032.ps1DEFINITE
filename nc64.exeHIGH
filename pb161_new.exeDEFINITE
filename pb39_new.exeDEFINITE
filename ps64.exeHIGH
filename rragent.exeDEFINITE
filename rtunnel2.exeLOW
filename run_chisel.batDEFINITE
filename s.exeDEFINITE
filename s443.exeDEFINITE
filename s443tls.exeDEFINITE
filename slv_beacon_sc.binHIGH
filename svc37.exeDEFINITE
filename svcefs.exeDEFINITE
filename svchost_update.exeDEFINITE
filename svcload.exeDEFINITE
filename sys37.exeDEFINITE
filename task39.xmlHIGH
filename task39_archive.xmlDEFINITE
filename task39_exec.xmlHIGH
filename task39_now.xmlHIGH
filename task39_past.xmlHIGH
filename task_39.ps1DEFINITE
filename task_useradd.xmlHIGH
filename upd443.exeDEFINITE
filename update.exeDEFINITE
filename webtitan_whitelist.ps1DEFINITE
filename ws35.exeDEFINITE
filename ws36.exeDEFINITE
filename ws37.exeDEFINITE
filename ws_3srv.exeDEFINITE
filename ws_new31847.exeDEFINITE
filename ws_shell52500.exeDEFINITE
filename wt_pg_whitelist.ps1DEFINITE
filename wt_whitelist.ps1DEFINITE
filename yugkag9mvnkwylo.binHIGH

137 further values in this feed are not shown above, because they are not an indicator type that can be recognised reliably by shape: command names, fingerprints and behavioural patterns among them. They are all in the raw JSON, which remains the complete record.

Do not block

These values came out of this investigation, but blocking them would break something legitimate, whether a shared service, a bystander's infrastructure, or the victim's own equipment. They are listed here because they still matter for hunting, and they are deliberately excluded from the copy and download buttons above.

TypeIndicatorWhy it stays off a blocklist
ipv4 147.135.84.14 SHARED HOSTING
ipv4 77.110.126.46 OPERATOR FALLBACK C2, UNDERLYING HOST OWNERSHIP NOT ESTABLISHED
domain dcdivas.com One of 106 contacted domains on a single unrelated file. NOT CHECKED as a link, never LOW
domain eth-mainnet.public.blastapi.io PUBLIC ETHEREUM RPC
domain eth.drpc.org PUBLIC ETHEREUM RPC
domain eth.merkle.io PUBLIC ETHEREUM RPC
domain ethereum-rpc.publicnode.com PUBLIC ETHEREUM RPC
domain gorus.space Arrived on the secondary operator address in a later hosting window than the operator's April use. Shared registrar is thin evidence given that registrar's size. NOT CHECKED
domain mainnet.gateway.tenderly.co PUBLIC ETHEREUM RPC
domain n8n-nether.nafer.ru Dropped. A later tenant on a recycled address, not implicated in this campaign
domain nodejs.org LEGITIMATE VENDOR
domain rpc.flashbots.net PUBLIC ETHEREUM RPC
domain rpc.mevblocker.io PUBLIC ETHEREUM RPC
url http://localhost:3000 A development leftover in the bot's fallback configuration, not reachable infrastructure
url https://nodejs.org/dist/v18.17.0/node-v18.17.0-win-x64.zip LEGITIMATE VENDOR DOWNLOAD
sha256 0019dfc4b32d63c1392aa264aed2253c1e0c2fb09216f8e2cc269bbfb8bb49b5 A 9-byte package-index cache file, 0 of 61 engines malicious, submitted 3,346 times from 1,540 sources since 2009. Relationship noise, not a campaign artifact
sha256 033729fe4f6aadc1ba38de00013f7b0e5e1bf5d540df00872931053488ed79bd destoryed.exe. Not in the served directory, first seen eleven days after capture, and its 106 contacted domains include google.com, github.com and dropbox.com. The whole adjacent-ecosystem reading built on it is retracted
sha256 a84f6fe166a238c48c5ccebe5312bb63311476fbf14cd81883f3329c36b1362d An unheld family member surfaced only by relationship data on the secondary address, with no second line of evidence. Recorded as a lead, kept out of the feed
md5 2196848d251b217de8b2c037e356c11d MEASURED at 3,645 distinct hosts with a working control, and nothing in that corpus associates it with Sliver. Commodity Go TLS. Grade INSUFFICIENT. Do not author a detection rule on it

Licensed CC BY 4.0, free to use commercially with attribution to The Hunters Ledger.