ThreatFox IOC Database

You are viewing the ThreatFox database entry for domain kieronellisonhikslumberparty.ru.

Database Entry

Add tag Delete this IOC  Report False Positive Export IOC (JSON)    Export IOC (CSV)
IOC ID:1866978
IOC: kieronellisonhikslumberparty.ru
IOC Type :domain
Threat Type :botnet_cc
Malware: Aisuru
Confidence Level : Confidence level is high (100%)
Is compromised? : False
First seen:2026-08-02 06:55:02 UTC
Last seen:never
UUID:389e8dc0-8de4-11f1-8325-42010aa4000a
Reporter deepfield
Reward 5 credits from ThreatFox
Tags:airashi AISURU botnet DDoS gen2-lite Mirai

Avatar
deepfield
Aisuru gen2-lite DNS-TXT C2 dead drop, hardcoded in the encrypted config table of an ARM ELF bot (config index 2). TXT-only, no A record. The TXT value is base64 which, once decoded and XORed with 0xCAFEBABE, yields the C2 IPv4; the bot then connects on hardcoded port 8001. Recovered by static analysis and config decryption.