🤲🏼 NEW | abuse.ch Community Hub! Earn recognition 🏅 for the malware intelligence you share, climb the leaderboards 📈, and connect with like-minded contributors who share your hunting focus 🤝. Ready to unlock your profile? Go to the Community Hub →

ThreatFox IOC Database

You are viewing the ThreatFox database entry for ip:port 64.7.199.7:22.

Database Entry

Add tag Delete this IOC  Report False Positive Export IOC (JSON)    Export IOC (CSV)
IOC ID:1967849
IOC: 64.7.199.7:22
IOC Type :ip:port
Threat Type :botnet_cc
Malware: Unknown malware
Confidence Level : Confidence level is elevated (75%)
Is compromised? : False
ASN:AS399629 BLNWX
Country:- NL
First seen:2026-10-15 18:37:35 UTC
Last seen:never
UUID:c560fa5a-c8bb-11f1-bd13-42010aa4000a
Reporter devmihaylov
Reward 5 credits from ThreatFox
Tags:BL-Networks c2 operator-server pycached RAT
Reference: https://any.run/report/9b43bb4e22b438ef28ea41f29c755d71a825950c70a11fa9c569dd02bca91129/2af2b954-72a8-475d-b94c-a726d8ded008

Avatar
devmihaylov
Host named "Oberon Server" in the RAT author's own VS Code SFTP config (pycached/server/.vscode/sftp.json, root over SSH, upload on save to /root), left inside the stage 2 cabinet of IMG_958742253158.scr next to the C2 server source. That server code listens on 5000 for implants and 5001 for operators, and the address sits on BL Networks (AS399629), the same network as the msvci[.]com download server.