ThreatFox IOC Database
You are viewing the ThreatFox database entry for ip:port 109.238.87.241:8787.
Database Entry
| IOC ID: | 1971001 |
|---|---|
| IOC: | 109.238.87.241:8787 |
| IOC Type : | ip:port |
| Threat Type : | botnet_cc |
| Malware: | Hermes |
| Confidence Level : | Confidence level is high (100%) |
| Is compromised? : | False |
| ASN: | AS55286 SERVER-MANIA |
| Country: |  CA |
| First seen: | 2026-10-17 11:05:50 UTC |
| Last seen: | never |
| UUID: | 3d7eb1bb-c9f3-11f1-bd13-42010aa4000a |
| Reporter |  iocmonster |
| Reward | 5 credits from ThreatFox |
| Tags: | hermes hermes-stealer |
iocmonster
Hermes is a new Infostealer/RAT/Botnet tool advertised on hacker forums since August 21st.Its "recovery module" (stealer) does an ABE bypass / COM Hijacking in order to access Chromium browser credentials and browsing history, reads Gecko (Firefox) browser data, clipboard history, mail client configurations, clipboard history. It exfiltrates data from 1Password (v8 and legacy), Bitwarden Desktop, KeePass 2.x + XC, with many crypto wallets supported: Electrum, Exodus, Ledger Live (+legacy), MetaMask (Chrome/Edge/Flask), Coinbase Wallet, Binance, Coin98. It steals data and credentials from Telegram, Discord, Steam specifically (including from LevelDB).
Hermes includes RAT capabilities like: Desktop live streaming over WebRTC, HVNC, process management, file management, clipboard history access, keylogger, taking screenshots, remote shell, further malware download, recovery (stealer capabilities described above), user context execution.
The malware refuses to run on systems with a Russian locale. Some Hermes panels are available publicly: Censys Search: web.endpoints.http.html_title="Hermes Panel" and web.endpoints.port=8700)