Hunt queries (Shodan, Censys, Fofa, URLScan)
-
Hunt query sharings are temporarily disabled.
Summary
TL; DR: A popular Windows info-stealer
Type: Information stealer
Targeted Operating Systems: Windows
Threat tag: win.recordbreaker
Reporting: https://malpedia.caad.fkie.fraunhofer.de/details/win.recordbreaker
Screenshots
IOCs
- 159.100.29.45:80
- 91.92.136.236:80
- 78.153.130.188:80
- 193.233.132.15:80
- 185.211.5.34:80
- 109.107.178.133:80
- 68.169.43.35:80
- 91.92.251.118:80
- 89.44.9.86:80
- 176.113.115.213:80
- 167.235.154.243:80
- 195.20.16.155:80
- 95.181.161.144:80
- 139.99.236.139:80
- 146.70.106.73:80
- 134.209.88.114:80
- 45.15.156.50:80
- 37.49.230.219:80
- 77.105.166.247:80
- 37.49.230.152:80
- 62.113.114.93:80
- 193.233.132.63:80
- 193.233.132.71:80
- 94.228.169.161:80
- 92.118.112.216:80
- 185.217.197.175:80
- 195.20.16.227:80
- 195.20.16.226:80
- 195.20.16.127:80
- 41.216.183.87:80
- 195.20.16.225:80
- 45.15.156.161:80
- 5.252.177.220:80
- 193.233.132.152:80
- 178.20.43.58:80
- 195.2.76.141:80
- 194.116.173.129:80
- 45.14.244.72:80
- 194.116.173.154:80
- 46.151.31.26:80
- 193.233.132.21:80
- 193.233.132.75:80
- 94.154.172.74:80
- 195.2.81.45:80
- 41.216.183.184:80
- 94.131.106.24:80
- 185.142.238.152:80
- 193.233.132.69:80
- 146.0.79.19:80
- 193.233.132.204:80
- 193.233.132.38:80
- 193.233.132.111:80
- 192.227.94.170:80
- 193.233.132.231:80
- 91.198.166.140:80
- 146.70.135.158:80
- 185.17.40.132:80
- 89.238.170.230:80
- 64.7.199.224:80
- 178.62.239.104:80
- 91.92.255.182:80
- 94.158.245.206:80
- 46.226.162.32:80
- 77.221.151.21:80
- 91.92.242.162:80
- 77.221.151.82:80
- 5.42.96.142:80
- 86.106.119.113:80
- 147.45.44.2:80
- 77.91.77.137:80
- 77.91.77.54:80
- 94.228.166.22:80
- 79.133.51.249:80
- 89.38.135.28:80
- 77.91.77.96:80
- 77.91.77.116:80
- 5.181.159.42:80
- 94.228.166.19:80
- 192.121.23.67:80
- 45.153.231.163:80
- 89.147.111.100:8080
- 147.45.44.25:80
- 85.28.47.116:80
- 104.194.154.198:80
- 45.80.151.52:80
- 178.17.171.77:80
- 176.113.115.103:80
- 45.80.151.223:80
- 193.187.174.250:80
- 62.204.41.87:80