🤲🏼 NEW | abuse.ch Community Hub! Earn recognition 🏅 for the malware intelligence you share, climb the leaderboards 📈, and connect with like-minded contributors who share your hunting focus 🤝. Ready to unlock your profile? Go to the Community Hub →

ThreatFox IOC Database

You are viewing the ThreatFox database entry for ip:port 178.104.232.30:15766.

Database Entry


IOC ID:1970541
IOC: 178.104.232.30:15766
IOC Type :ip:port
Threat Type :botnet_cc
Malware: Unknown RAT
Confidence Level : Confidence level is moderate (50%)
Is compromised? : False
ASN:AS24940 HETZNER-AS
Country:- DE
First seen:2026-10-17 05:33:02 UTC
Last seen:never
UUID:7156741a-c9ba-11f1-bd13-42010aa4000a
Reporter Daydream
Reward 5 credits from ThreatFox
Tags:dotNET fake-cheat Qt5Widgets sideloading TeamSpeak
Reference: https://bazaar.abuse.ch/sample/30fc0956603edd1949fc222b3278fbd5bc9de3cd799cba9379605537e8e4788c/

Avatar
Daydream
Hardcoded TCP C2 of a .NET RAT delivered by a fake-cheat kit: signed TeamSpeak 3 installer side-loading a trojanized Qt5Widgets.dll with an encrypted second stage (AES-CBC TCP traffic, time-gated to 2026-09-01), as described in the MalwareBazaar comment on 30fc0956 by its reporter. Not observed live by us. Both addresses are Hetzner Cloud (NBG1, DE). The same kit layout (signed TeamSpeak installer, trojanized Qt5Widgets.dll, opaque manifest file, ~73 MB padding) appears in DvnX.zip (sha256 8f7fa43654fbf7cce0f32ba0f4d586f40d4f73e61eb7e1f632b547b31676f1bb, URLhaus 3948114).