🤲🏼 NEW | abuse.ch Community Hub! Earn recognition 🏅 for the malware intelligence you share, climb the leaderboards 📈, and connect with like-minded contributors who share your hunting focus 🤝. Ready to unlock your profile? Go to the Community Hub →

ThreatFox IOC Database

You are viewing the ThreatFox database entry for url https://thisisafalsepositive.st/cdn/v2/9f4e7a2c1b8d.png.

Database Entry

Add tag Delete this IOC  Report False Positive Export IOC (JSON)    Export IOC (CSV)
IOC ID:1942902
IOC: https://thisisafalsepositive.st/cdn/v2/9f4e7a2c1b8d.png
IOC Type :url
Threat Type :payload_delivery
Malware: Unknown Stealer
Confidence Level : Confidence level is high (100%)
Is compromised? : False
ASN:AS57724 DDOS-GUARD
Country:- RU
First seen:2026-09-30 13:18:43 UTC
Last seen:never
UUID:b1ddccaf-bccf-11f1-a463-42010aa4000a
Reporter C0RSA
Reward 5 credits from ThreatFox
Tags:etherhiding minecraft SilentNet
Reference: https://bazaar.abuse.ch/sample/1e19cc08db84fe1979744d3d4c6cb694e4f29ef13f10dab8a13407fbaf0e07b7/

Avatar
C0RSA
silentnet stage-2 stego payload URL. PNG carrying a portable-Python stealer (main.py -> AppHost/app.pyd, mypyc-compiled). C2 host resolved at runtime via EtherHiding - Polygon contract 0x9c0a507300fd902787bb193d80fca5ce6e1bff9a (selector 0xce6d41de). Served only with header X-Edge-Cache-Revalidate: stale-if-error.