5f22f4c4fdb36c4f0ea3248abb00521e39008c1fb4c97e1b4a9c7b9ef0b691c2SHA-256 hash
Reported by 1 independent source · first reported by Group-IB · last reported
Last reported 13 months ago
What the reports say
1 report, newest first · the exact sentence from each-
Tracking MuddyWater in Action: Infrastructure, Malware and Operations during 2025“The first public sample was observed to be uploaded from Israel (wtsapi.dll – 5f22f4c4fdb36c4f0ea3248abb00521e39008c1fb4c97e1b4a9c7b9ef0b691c2) and it also comes with the Fooder loader which will be described later, and its C2 domain is netivtech.org which we will examine in grea…”
Indicators reported together
named in the same reports- 40dead1e1d831076…5af71a9b5e05in 1 report
- filetransfer[.]ioin 1 report
- sync[.]comin 1 report
- f782dfdc7ce624f9…561c8af13db0in 1 report
- hxxps://netivtech[.]org/registerin 1 report
- netivtech[.]orgin 1 report
- hxxps://netivtech[.]org/imalivein 1 report
- hxxps://netivtech[.]org/requestin 1 report
- hxxp://46.101.36[.]39:443/imalivein 1 report
- 46.101.36[.]39in 1 report
- hxxp://46.101.36[.]39/registerin 1 report
- hxxp://46.101.36[.]39:443/requestin 1 report
- hxxps://netivtech[.]org/rq13in 1 report
- hxxps://netivtech[.]org/adadin 1 report
- hxxps://netivtech[.]org/aq36in 1 report
- 162.255.119[.]28in 1 report
- www.netivtech[.]orgin 1 report
- 91.195.240[.]19in 1 report
- 104.21.81[.]7in 1 report
- 172.67.136[.]150in 1 report
Copy these 20 indicators · defanged
Thanks — we review every report.