ThreatFox IOC Database
You are viewing the ThreatFox database entry for url http://93.174.93.178/request.
Database Entry
This IOC expired
This IOC is an old IOC and hence has expired on 2026-08-10 01:15:01 UTC. We therefore refrain from exporting it into our datasets. As a result, this database entry is purely informational and has no impact.
| IOC ID: | 395815 |
|---|---|
| IOC: | http://93.174.93.178/request |
| IOC Type : | url |
| Threat Type : | botnet_cc |
| Malware: | Arkei Stealer |
| Malware alias: | ArkeiStealer |
| Confidence Level : | Confidence level is high (100%) |
| Is compromised? : | False |
| ASN: | AS202425 INT-NETWORK |
| Country: |  NL |
| First seen: | 2022-03-16 18:45:34 UTC |
| Last seen: | 2022-04-07 14:51:34 UTC |
| UUID: | 4344d529-a559-11ec-a022-42010aa4000a |
| Reporter |  AndreGironda |
| Reward | 5 credits from ThreatFox |
| Tags: | Arkei Arkei Stealer ArkeiStealer |
| Reference: | https://tria.ge/220316-w6lh3sffe3 |
AndreGironda
MITRE T1566.002Date: Wed, 16 Mar 2022 11:00-12:00 +0000
Received: from e226-2.smtp-out.us-east-2.amazonses.com (23.251.226.2)
From: Alejandra Rodriguez <administracion@ventaelcruce.com>
Subject: RV: URGENT R E Q U E S T-ADTEC SELANGOR
Message-ID: <010f017f927d77c3-59ddfa7d-2ef0-4817-a89a-f6c16b00f6e6-000000@us-east-2.amazonses.com>
MIME-Version: 1.0
Content-Type: multipart/related; boundary="----=_NextPart_000_0012_3CECB50C.0AAE5245"
Feedback-ID: 1.us-east-2.89vjSVtNDTJMWkyDgQ4opZezUYV6dU3sh2EJOqD6Kkk=:AmazonSES
X-SES-Outgoing: 2022.03.16-23.251.226.2
Return-Path: 010f017f927d77c3-59ddfa7d-2ef0-4817-a89a-f6c16b00f6e6-000000@us-east-2.amazonses.com
Message Body URL 1: hXXps://educaplus-zg[.]com/file-share/VENTAEL%20CRUCE%20RFQ%20DI-1013%20-%20Revised.xll
Message Body URL 2: hXXps://educaplus-zg[.]com/file-share/zSPECIFICATION_16_03_202264.xll
XLL 1 SHA256: c939ce949377b0bda7de743d59d8495fe403f35dac0bce0cf4972bf1c42484a3
XLL 2 SHA256: aaa77ce4b5341185c016e9cc4f28c16b5e3f8e544f3dff6a66e33718c2775088
Stage 1 URL: hXXps://transfer[.]sh/get/cuSkTt/tff3Ap-score.rtf
Stage 2 URL: hXXps://transfer[.]sh/get/kXdRTW/tff3Ap-raw.txt
Stage 3 URL: hXXps://transfer[.]sh/get/Gijovn/3Wtxd6xl-raw.txt
Stage 4 URL: hXXps://transfer[.]sh/get/4wLuM6/3Wtxd6xl-score.rtf
Stage 5 URL: hXXp://93[.]174.93.178/Winquas[.]exe
QuasarRAT Stage 1 Executable SHA256: d98deb2215b2df92adfafb1dd1bfd359370a616f3da4f866ce9571a7ce5d529e
QuasarRAT Stage 2 Executable SHA256: 97092cf0cf39bb1ca792c06fa3289771eb2d6719d7f484d3b17ab17d4f4e0d58
Stage 3 Executable SHA256: fa5fefcac71773b09294ef0f23484f1b35468638b1b66eb065e1fc76aff1e63f
ArkeiStealer Stage 4 Executable SHA256: 476f75d5c7c1805b1f9465bf79f65b4f3d0629a719344762bace276f3be0d45b
ArkeiStealer QuasarRAT Stage 5 Executable SHA256: 62a13677711dce7db36d530ea43bf22891e37b62850cb4362c4967a6e739a198
ArkeiStealer Stage 6 Executable SHA256: 2ecc673fc0e9b6dc4ffbfd2daa142a76cc1e9d0851b95822a4ff9ae9159f3eac