🤲🏼 NEW | abuse.ch Community Hub! Earn recognition 🏅 for the malware intelligence you share, climb the leaderboards 📈, and connect with like-minded contributors who share your hunting focus 🤝. Ready to unlock your profile? Go to the Community Hub →

ThreatFox IOC Database

You are viewing the ThreatFox database entry for domain funtar.vercel.app.

Database Entry


IOC ID:1971716
IOC: funtar.vercel.app
IOC Type :domain
Threat Type :botnet_cc
Malware: Unknown RAT
Confidence Level : Confidence level is high (100%)
Is compromised? : False
ASN:AS16509 AMAZON-02
Country:- US
First seen:2026-10-18 06:10:55 UTC
Last seen:never
UUID:1c95033a-ca4a-11f1-bd13-42010aa4000a
Reporter Daydream
Reward 5 credits from ThreatFox
Tags:etherhiding funrat MaksRAT minecraft PussyRAT TON
Reference: https://bazaar.abuse.ch/sample/7c997959c5f233b07bed777d6477ad2cee3c316447dd4bff3ed77f952211d70d/

Avatar
Daydream
FunRAT (MaksRAT / PussyRAT) fallback C2 domain resolved from TON smart contract EQAuM1fAQJiMW-VykYDkRzn99ejJw81fIjnb9Eg3-_BWwlzY (getMessage() method), hardcoded inside Skidfuscator-obfuscated core.Coffe / core.core in 7c997959c5f233b07bed777d6477ad2cee3c316447dd4bff3ed77f952211d70d (DupeMod.jar) and be28f507fbaa4ae0b17b55d9ee9d9df63862a8530bf4cf49802d6bda53d35e40 (4000.jar). Deployed by operator TON wallet EQBBL4mLkytKdInyqg-cb4unkC1fUeIV4vr3LFmjfqtDG1tX.