ThreatFox IOC Database
You are viewing the ThreatFox database entry for url https://www2.tencent-qq-com.cf:443/match.
Database Entry
This IOC expired
This IOC is an old IOC and hence has expired on 2026-09-13 01:15:01 UTC. We therefore refrain from exporting it into our datasets. As a result, this database entry is purely informational and has no impact.
| IOC ID: | 310116 |
|---|---|
| IOC: | https://www2.tencent-qq-com.cf:443/match |
| IOC Type : | url |
| Threat Type : | botnet_cc |
| Malware: | Cobalt Strike |
| Malware alias: | Agentemis, BEACON, CobaltStrike, cobeacon |
| Confidence Level : | Confidence level is moderate (50%) |
| Is compromised? : | False |
| First seen: | 2022-01-21 14:36:51 UTC |
| Last seen: | never |
| UUID: | 92ac27dc-7ac7-11ec-8ab6-42010aa4000a |
| Reporter |  NexusFuzzy |
| Reward | 5 credits from ThreatFox |
| Tags: | CobaltStrike |
NexusFuzzy
[ Download URL of Beacon ]https://192.3.41.128:443/
[ Extracted Beacon Config ]
BeaconType: ['HTTPS']
Port: 443
SleepTime: 60000
MaxGetSize: 1048576
Jitter: 0
MaxDNS: 255
PublicKey: b"0\x81\x9f0\r\x06\t*\x86H\x86\xf7\r\x01\x01\x01\x05\x00\x03\x81\x8d\x000\x81\x89\x02\x81\x81\x00\x93RR{'\xbfs\xfc\xc9$W\xcf\x8c\xb1\x89N\xbd\x11\x04\xda\x18]\x18\xdc\xeb(\xf1Y\xd7IX\xd0\xaeez\x00>\xbanI\xc4D\x84h-0\xa08\x12\x98\xe1\xab\x92\x1d`\x8b?\xdaC\x07z\xb4n&\x8a\x11`\xa6-(!\xb7\xf0\xbb\xa5\xd9lN\xa0\x85\x81\xb2\xbba{\xf8\x0eS\x89\xf4T\xce\xf54`\xb5\xe3+\xbf\x04[]\x97\x861\xf1\xe0\xaa)0_\xc0\xb4\xe0.xl\x1f\x88\x8d\x83\x99|\r\xce\xb0C\xbf\x02\x03\x01\x00\x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"
PublicKey_MD5: 79b6e333634c506f6f710dde179796ed
C2Server: 192.3.41.128,/match
UserAgent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 5.2; Trident/4.0; .NET CLR 2.0.50727)
HttpPostUri: /submit.php
Malleable_C2_Instructions: []
HttpGet_Metadata: {'ConstHeaders': [], 'ConstParams': [], 'Metadata': ['base64', 'header "Cookie"'], 'SessionId': [], 'Output': []}
HttpPost_Metadata: {'ConstHeaders': ['Content-Type: application/octet-stream'], 'ConstParams': [], 'Metadata': [], 'SessionId': ['parameter "id"'], 'Output': ['print']}
SpawnTo: b'\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00'
PipeName:
DNS_Idle: 0.0.0.0
DNS_Sleep: 0
SSH_Host: Not Found
SSH_Port: Not Found
SSH_Username: Not Found
SSH_Password_Plaintext: Not Found
SSH_Password_Pubkey: Not Found
SSH_Banner: Host: www2.tencent-qq-com.cf
HttpGet_Verb: GET
HttpPost_Verb: POST
HttpPostChunk: 0
Spawnto_x86: %windir%\syswow64\rundll32.exe
Spawnto_x64: %windir%\sysnative\rundll32.exe
CryptoScheme: 0
Proxy_Config: Not Found
Proxy_User: Not Found
Proxy_Password: Not Found
Proxy_Behavior: Use IE settings
Watermark: 305419896
bStageCleanup: False
bCFGCaution: False
KillDate: 0
bProcInject_StartRWX: True
bProcInject_UseRWX: True
bProcInject_MinAllocSize: 0
ProcInject_PrependAppend_x86: Empty
ProcInject_PrependAppend_x64: Empty
ProcInject_Execute: ['CreateThread', 'SetThreadContext', 'CreateRemoteThread', 'RtlCreateUserThread']
ProcInject_AllocationMethod: VirtualAllocEx
ProcInject_Stub: b'\xa5l\x818d\xaf\x87\x8aL\x10\x08<\xa1W\x8e\n'
bUsesCookies: True
HostHeader: Host: www2.tencent-qq-com.cf
smbFrameHeader: Not Found
tcpFrameHeader: Not Found
headersToRemove: Not Found
DNS_Beaconing: Not Found
DNS_get_TypeA: Not Found
DNS_get_TypeAAAA: Not Found
DNS_get_TypeTXT: Not Found
DNS_put_metadata: Not Found
DNS_put_output: Not Found
DNS_resolver: Not Found
DNS_strategy: Not Found
DNS_strategy_rotate_seconds: Not Found
DNS_strategy_fail_x: Not Found
DNS_strategy_fail_seconds: Not Found