51.222.96[.]108IP address
Reported by 1 independent source · first reported by Sekoia.io · last reported
Last reported 4 months ago
What the reports say
1 report, newest first · the exact sentence from each-
OysterLoader Unmasked: The Multi-Stage Evasion Loader“It maintains connectivity with three hardcoded C2 servers (85.239.53.66, 51.222.96[.]108, and 135.125.241.45) using a robust fallback mechanism that cycles through each server with three retry attempts spaced 9 seconds apart before moving to the next.”
Indicators reported together
named in the same reports- pefile[.]pein 1 report
- exp[.]namein 1 report
- 85.239.53[.]66in 1 report
- 135.125.241[.]45in 1 report
- hxxps://grandideapay[.]com/api/v2/facadein 1 report
- grandideapay[.]comin 1 report
- hxxp://nucleusgate[.]com/api/v2/facadein 1 report
- nucleusgate[.]comin 1 report
- hxxps://cardlowestgroup[.]com/api/v2/facadein 1 report
- cardlowestgroup[.]comin 1 report
- hxxps://socialcloudguru[.]com/api/v2/facadein 1 report
- socialcloudguru[.]comin 1 report
- hxxps://coretether[.]com/api/v2/facadein 1 report
- coretether[.]comin 1 report
- hxxps://registrywave[.]com/api/v2/facadein 1 report
- registrywave[.]comin 1 report
Copy these 16 indicators · defanged
Thanks — we review every report.