ThreatFox IOC Database
You are viewing the ThreatFox database entry for domain streelifes.duckdns.org.
Database Entry
This IOC expired
This IOC is an old IOC and hence has expired on 2026-08-10 01:15:01 UTC. We therefore refrain from exporting it into our datasets. As a result, this database entry is purely informational and has no impact.
| IOC ID: | 553279 |
|---|---|
| IOC: | streelifes.duckdns.org |
| IOC Type : | domain |
| Threat Type : | botnet_cc |
| Malware: | STRRAT |
| Confidence Level : | Confidence level is high (100%) |
| Is compromised? : | False |
| First seen: | 2022-05-12 17:40:01 UTC |
| Last seen: | never |
| UUID: | 8cf05ddf-d21a-11ec-ae87-42010aa4000a |
| Reporter |  AndreGironda |
| Reward | 5 credits from ThreatFox |
| Tags: | STRRAT |
| Reference: | https://tria.ge/220512-vwlweshcaq |
AndreGironda
MITRE T1566.002Date: Thu, 12 May 2022 19:30-20:00 +0300
Received: from vm450642.stark-industries.solutions (185.250.148.242)
Message-Id: <202205121646.24CGkGCe024341@vm450642.stark-industries.solutions>
Mime-Version: 1.0
From: "eRev, Inc <quickbooks@notification.intuit.com>"
ReplyTo:
Subject: Invoice from eRev Inc
Content-Type: text/html; charset=UTF-8
Content-Transfer-Encoding: base64
Return-Path: root@vm450642.stark-industries.solutions
Message Body URL: hXXps://agrouphostning.pages[.]dev/PAYMENT_RECEIPT_INV8938464944.zip
Downloaded Zipfile Name: PAYMENT_RECEIPT_INV8938464944.zip
Zipfile SHA256: 65caf68cce79fa953e7fea1f7be0ee3e14104f23ea16c10560fb9af9617ce4eb
Unzipped Data File Name: PAYMENT_RECEIPT_INV8938464944.jar
Data File SHA256: e3be7066e6922d7460dea80ca5b7fef8f4abc7b1f056d8f329c03b306e8ca9b0
Carved Java Archive File SHA256: 03b029a198a9eba2c91ab9940267ea12d48dd41326e7681b85dff13ba754aa89
Loaded DLL SHA256: a66959bec2ef5af730198db9f3b3f7cab0d4ae70ce01bec02bf1d738e6d1ee7a