🤲🏼 NEW | abuse.ch Community Hub! Earn recognition 🏅 for the malware intelligence you share, climb the leaderboards 📈, and connect with like-minded contributors who share your hunting focus 🤝. Ready to unlock your profile? Go to the Community Hub →

ThreatFox IOC Database

You are viewing the ThreatFox database entry for url https://telemetry-relay.kartohaantoha36-6a9.workers.dev/file/91d24fc2484303b7ae90.

Database Entry


IOC ID:1971720
IOC: https://telemetry-relay.kartohaantoha36-6a9.workers.dev/file/91d24fc2484303b7ae90
IOC Type :url
Threat Type :payload_delivery
Malware: Unknown RAT
Confidence Level : Confidence level is high (100%)
Is compromised? : False
ASN:AS13335 CLOUDFLARENET
Country:- US
First seen:2026-10-18 06:10:52 UTC
Last seen:never
UUID:1f5b83e8-ca4a-11f1-bd13-42010aa4000a
Reporter Daydream
Reward 5 credits from ThreatFox
Tags:etherhiding funrat MaksRAT minecraft PussyRAT TON
Reference: https://bazaar.abuse.ch/sample/7c997959c5f233b07bed777d6477ad2cee3c316447dd4bff3ed77f952211d70d/

Avatar
Daydream
FunRAT stage-2 JAR payload delivery URLs extracted from the on-chain transaction history of Tact TON smart contract EQChU6Zxa_y2fKeeCaSDubGcFZizRdRVSArwAh6qJtfe9NKZ (hardcoded as TACT_ADDR in 7c997959c5f233b07bed777d6477ad2cee3c316447dd4bff3ed77f952211d70d DupeMod.jar), updated by operator TON wallet EQB_vWVWJ5Z8uqO0thN_smTPG21MN2Z61XTBQ_KC96QC1PP1.