ThreatFox IOC Database
You are viewing the ThreatFox database entry for ip:port 14.224.174.212:80.
Database Entry
This IOC is of poor quality
Our automated checks indicate that this IOC is of poor quality. We therefore refrain from exporting it into our datasets. As a result, this database entry is purely informational and has no impact.
This IOC expired
This IOC is an old IOC and hence has expired on 2026-09-15 10:39:25 UTC. We therefore refrain from exporting it into our datasets. As a result, this database entry is purely informational and has no impact.
| IOC ID: | 1246553 |
|---|---|
| IOC: | 14.224.174.212:80 |
| IOC Type : | ip:port |
| Threat Type : | payload_delivery |
| Malware: | WannaCryptor |
| Malware alias: | Wana Decrypt0r, WannaCry, WannaCrypt, Wcry |
| Confidence Level : | Confidence level is high (100%) |
| Is compromised? : | False |
| ASN: | AS45899 VNPT-AS-VN |
| Country: |  VN |
| First seen: | 2024-03-17 12:28:47 UTC |
| Last seen: | never |
| UUID: | c9df530c-e458-11ee-b6e8-42010aa4000a |
| Reporter |  Sekuro_io |
| Reward | 5 credits from ThreatFox |
| Tags: | CryptoRansomware dll Ransomware WannaCry Win32 |
Sekuro_io
Attempting to browse to the IP brings the user to an open directory where can be downloaded that contain live malware samples.The most notable file in the directory was Ransomware.WannaCry_Plus.zip.
When extracted with the password "infected", using tools the SHA256 hash that is generated from the file is the following 55504677f82981962d85495231695d3a92aa0b31ec35a957bd9cbbef618658e3, which is detected by 64 vendors on Virus Total as Ransomware.