🤲🏼 NEW | abuse.ch Community Hub! Earn recognition 🏅 for the malware intelligence you share, climb the leaderboards 📈, and connect with like-minded contributors who share your hunting focus 🤝. Ready to unlock your profile? Go to the Community Hub →

ThreatFox IOC Database

You are viewing the ThreatFox database entry for ip:port 94.156.154.12:80.

Database Entry

Add tag Delete this IOC  Report False Positive Export IOC (JSON)    Export IOC (CSV)
IOC ID:2019947
IOC: 94.156.154.12:80
IOC Type :ip:port
Threat Type :botnet_cc
Malware: SmartLoader
Confidence Level : Confidence level is high (90%)
Is compromised? : False
ASN:AS207957 ServHost-AS
Country:- UA
First seen:2026-11-08 07:26:59 UTC
Last seen:never
UUID:97ca9732-db18-11f1-a74e-42010aa4000a
Reporter wristhulk
Reward 5 credits from ThreatFox
Tags:Github LuaJIT SmartLoader ZeroBrane
Reference: https://apiiro.com/blog/never-deleted-only-re-pointed/

Avatar
wristhulk
SmartLoader hardcoded C2, from our own sandbox run (Win10Lab, 2026-11-07) of Application.zip (sha256 d30e0fa1fae39d77ae0599d5f45ea1b826ac834fbc6b112071543df19a60618a, served from github.com/sussybaka123A/app): a trojanized ZeroBrane Studio whose spec/cpp.lua starts bin\lua.exe (LuaJIT 2.0.4) on the obfuscated cfg/user-data.lua. The payload checked ip-api.com/json/, then POSTed a full-screen BMP screenshot (multipart, 6.2 MB) to http://94.156.154.12/api/NTE3YjdjNWU1NjYzNjU2YTA1N2Y=, then read its dead-drop C2 from Polygon contract 0x1823A9a0Ec8e0C25dD957D0841e3D41a4474bAdc getData() (currently http://144.31.108.193, already listed).