🤲🏼 NEW | abuse.ch Community Hub! Earn recognition 🏅 for the malware intelligence you share, climb the leaderboards 📈, and connect with like-minded contributors who share your hunting focus 🤝. Ready to unlock your profile? Go to the Community Hub →

ThreatFox IOC Database

You are viewing the ThreatFox database entry for domain beenetprotect.com.

Database Entry

Add tag Delete this IOC  Report False Positive Export IOC (JSON)    Export IOC (CSV)
IOC ID:1975125
IOC: beenetprotect.com
IOC Type :domain
Threat Type :botnet_cc
Malware: Unknown Stealer
Confidence Level : Confidence level is high (100%)
Is compromised? : False
ASN:AS210644 AEZA-AS
Country:- RU
First seen:2026-10-20 08:27:24 UTC
Last seen:never
UUID:997bdecf-cc4f-11f1-bd13-42010aa4000a
Reporter Anonymous
Reward 10 credits from asdasdasdasd3e2
Tags:fake-movie infostealer torrent

Avatar
Anonymous
Infostealer distributed as a fake movie via torrent (limetorrents), file name "The Odyssey 2026 1080p WEB H264-EDITH.exe", unsigned, no version info. Observed 2026-10-18 09:04 UTC (Sysmon). On execution: DNS query to www.youtube.com (connectivity check), fetch from gist.githubusercontent.com (likely dead-drop config), then repeated HTTPS connections to C2 beenetprotect.com -> 109.120.179.122:443 (AS210644 Aeza Group). Spawns chrome.exe and msedge.exe with "--no-first-run --disable-gpu" (browser credential/cookie theft). Process exits after ~30 s, no persistence observed. Stolen browser session was later abused to send Facebook Messenger spam to the victim's contacts.