🤲🏼 NEW | abuse.ch Community Hub! Earn recognition 🏅 for the malware intelligence you share, climb the leaderboards 📈, and connect with like-minded contributors who share your hunting focus 🤝. Ready to unlock your profile? Go to the Community Hub →

ThreatFox IOC Database

You are viewing the ThreatFox database entry for ip:port 172.94.99.29:1408.

Database Entry


IOC ID:1958240
IOC: 172.94.99.29:1408
IOC Type :ip:port
Threat Type :botnet_cc
Malware: XWorm
Confidence Level : Confidence level is high (100%)
Is compromised? : False
ASN:AS3223 VOXILITY
Country:- RO
First seen:2026-10-09 10:48:33 UTC
Last seen:never
UUID:fe8acf39-c3bf-11f1-bd13-42010aa4000a
Reporter Anonymous
Reward 10 credits from Saber
10 credits from anonymous
Tags:RAT XWorm

Avatar
Anonymous
C2 extracted from the decrypted config of an XWorm V7.4 sample delivered via a trojanized FL Studio installer (WinRAR SFX - batch/PowerShell - AutoIt loader - Donut shellcode injected into charmap.exe). Payload SHA-256: b40f09448637008ec3f11fca8d235def1a304e96dc21760b51fbfa4e0f569f7c. Victim in Brazil, infected 2026-09-29.