ThreatFox IOC Database
You are viewing the ThreatFox database entry for ip:port 31.210.20.129:9004.
Database Entry
This IOC expired
This IOC is an old IOC and hence has expired on 2026-09-15 10:39:25 UTC. We therefore refrain from exporting it into our datasets. As a result, this database entry is purely informational and has no impact.
| IOC ID: | 837725 |
|---|---|
| IOC: | 31.210.20.129:9004 |
| IOC Type : | ip:port |
| Threat Type : | botnet_cc |
| Malware: | Vjw0rm |
| Confidence Level : | Confidence level is high (100%) |
| Is compromised? : | False |
| ASN: | AS14178 Megacable_Comunicaciones_de_Mexico_S.A._de_C.V. |
| Country: |  MX |
| First seen: | 2022-07-14 23:35:45 UTC |
| Last seen: | never |
| UUID: | aeef8b95-03cd-11ed-8b02-42010aa4000a |
| Reporter |  AndreGironda |
| Reward | 5 credits from ThreatFox |
| Tags: | Vjw0rm |
| Reference: | https://tria.ge/220714-3f73qaegg6 |
AndreGironda
MITRE T1566.001Date: Thu, 14 Jul 2022 17:00-17:30 -0400 (EDT)
Received: from atl4mhob17.registeredsite.com (209.17.115.110)
From: ups express <info999@frment.com>
Reply-To: ups express <info999@frment.com>
Message-ID: <2076899802.32480.1657833989028@webmail.networksolutionsemail.com>
Subject: order delivery
MIME-Version: 1.0
Content-Type: multipart/mixed; boundary="----=_Part_32478_303995080.1657833989022"
X-Priority: 3
Importance: Normal
X-Mailer: Open-Xchange Mailer v7.10.2-Rev26
X-Originating-Client: open-xchange-appsuite
To: undisclosed-recipients:;
Return-Path: info999@frment.com
Attachment Name: eReceipt.img
ISO-9660 Image SHA256: e4c3ea9d24912b5b72e985d400a1736860967fd3da97bc421b1a64a53c5152f7
Contained JavaScript Dropper Name: eReceipt.js
JS Dropper SHA256: 44aec011118a0f9692f2f7a53d9dfeb70835c8c1cf80338f48833c65d625ad80
VjW0rm JavaScript Payload SHA256: df98e80ff023dca7531957d8bb381fdee45268b52c1291d784cd2099ae1fd3a4
Calling Card SHA256: 758e4e99009829dcfd512bb28b2f5a11bb99fdaac232a59f261e226ff76260a8
Calling Card contents --
// Coded by v_B01 | Sliemerez -> Twitter : Sliemerez