🤲🏼 NEW | abuse.ch Community Hub! Earn recognition 🏅 for the malware intelligence you share, climb the leaderboards 📈, and connect with like-minded contributors who share your hunting focus 🤝. Ready to unlock your profile? Go to the Community Hub →

ThreatFox IOC Database

You are viewing the ThreatFox database entry for ip:port 45.61.164.54:8085.

Database Entry


IOC ID:2021569
IOC: 45.61.164.54:8085
IOC Type :ip:port
Threat Type :botnet_cc
Malware: OtterCookie
Confidence Level : Confidence level is elevated (75%)
Is compromised? : False
ASN:AS14956 ROUTERHOSTING
Country:- IR
First seen:2026-11-09 07:51:35 UTC
Last seen:never
UUID:5cbf84d9-dbf1-11f1-a74e-42010aa4000a
Reporter wristhulk
Reward 5 credits from ThreatFox
Tags:Cloudzy ContagiousInterview DPRK OtterCookie
Reference: https://urlhaus.abuse.ch/url/4061364/

Avatar
wristhulk
OtterCookie (Contagious Interview) C2. Payload: one-line obfuscated Node.js stealer served from GitHub raw.githubusercontent.com/ldkowmcs/ip-checkout/HEAD/10/9 (extensionless blob in a repo tree, beside a byte-identical "ip-check" Vercel template), sha256 90982bfddae56aa38c2735ba450121e38e8140da0346852ad5c9d8da5db77fe9. Static decode (webcrack) shows this IP with :8085/upload, :8086/upload and :8087. In our own run (FlareVM, Node.js 23 with its npm modules, FakeNet, 2026-11-08) node.exe connected to all three ports: 27 POST /upload to :8086, POST /api/log and /api/notify to :8087. Cloudzy VPS (Shodan InternetDB: 22 only; the C2 ports are not in its scan); whether the server answers was not tested.