🤲🏼 NEW | abuse.ch Community Hub! Earn recognition 🏅 for the malware intelligence you share, climb the leaderboards 📈, and connect with like-minded contributors who share your hunting focus 🤝. Ready to unlock your profile? Go to the Community Hub →

ThreatFox IOC Database

You are viewing the ThreatFox database entry for domain ewababa.sbs.

Database Entry

Add tag Delete this IOC  Report False Positive Export IOC (JSON)    Export IOC (CSV)
IOC ID:2019973
IOC: ewababa.sbs
IOC Type :domain
Threat Type :botnet_cc
Malware: Unknown Stealer
Confidence Level : Confidence level is high (100%)
Is compromised? : False
ASN:AS48753 GOOGLE-CLOUD-PLATFORM
Country:- US
First seen:2026-11-08 07:47:45 UTC
Last seen:never
UUID:d533c19b-db1d-11f1-a74e-42010aa4000a
Reporter LoneNco
Reward 10 credits from asdasdasdasd3e2
Tags:ens etherhiding ewa IRAHook java minecraft stealer
Reference: https://bazaar.abuse.ch/sample/80a4f9250bf9a8dca131a0a2b1b9525e9338aa79c8d9d295bc61dd61db965ddf/

Avatar
LoneNco
C2 config of the 'ewa'/irahook Java infostealer (stage 2 of fake Minecraft Fabric mods, e.g. loader 66cd0c8614ada8ef7600c0903ca4795b2f97162c6ef1c4718b1a26879865aab3). Recovered by decrypting AES-GCM ENS text records on el.turko.eth (resolver 0xf29100983e058b709f3d539b0c765937b804ac15) with the sample's own code. Record 'ewa' -> wss://ewababa.sbs/ws (WebSocket C2); record 'windowskernel' -> Discord exfil webhook; also Telegram exfil bots: bot ID 9197003515 (chat 8806136549) and bot ID 8377690969 (chat 7667295419), tokens withheld and reported to Telegram. Observed 2026-11-08.