🤲🏼 NEW | abuse.ch Community Hub! Earn recognition 🏅 for the malware intelligence you share, climb the leaderboards 📈, and connect with like-minded contributors who share your hunting focus 🤝. Ready to unlock your profile? Go to the Community Hub →

ThreatFox IOC Database

You are viewing the ThreatFox database entry for domain www.sx8vuz4smtdol7pg.com.

Database Entry


IOC ID:1964524
IOC: www.sx8vuz4smtdol7pg.com
IOC Type :domain
Threat Type :botnet_cc
Malware: Coruna
Confidence Level : Confidence level is high (90%)
Is compromised? : False
ASN:AS55933 CLOUDIE-AS-AP
Country:- HK
First seen:2026-10-14 05:43:25 UTC
Last seen:never
UUID:41c967f7-c757-11f1-bd13-42010aa4000a
Reporter Daydream
Reward 5 credits from ThreatFox
Tags:Coruna DGA ios PLASMAGRID
Reference: https://github.com/dominion2/reverse-engineering-and-malware-analysis/blob/master/report/darksword-coruna-implants-and-dga.md

Avatar
Daydream
Coruna / PLASMAGRID core implant (iOS) server names, reporting pool (upload). Produced by the implant's domain generator from seed 68ad45c5f822d346d27fcc28fba5ce88 found in samples 170515dc93120111760cc8c9e1deefb9a81939d123749d15f13ad5eca55042da and aa3934340337aaceee150fd8e2acaa5b5da71a59161585594e53d0477d9d87c6 (MurmurHash2 + xorshift32, 512 fixed names per seed, used as https://www.<name>). These 47 of the 512 were registered and resolving on 2026-10-13, all as CNAMEs into the yunray.ai CDN (2a5c62d7.yunray.ai, 4edc881b.yunray.ai, cf97fc53.yunray.ai, fa369b0c.yunray.ai). The CDN addresses are shared and are not submitted. Generator re-implemented and checked by resolution only; servers not contacted.