ThreatFox IOC Database

You are viewing the ThreatFox database entry for ip:port 194.147.140.4:8181.

Database Entry

This IOC expired

This IOC is an old IOC and hence has expired on 2026-06-04 01:15:01 UTC. We therefore refrain from exporting it into our datasets. As a result, this database entry is purely informational and has no impact.

IOC ID:	839980
IOC:	194.147.140.4:8181
IOC Type :	ip:port
Threat Type :	botnet_cc
Malware:	NetWire RC
Malware alias:	NetWeird, NetWire, Recam
Confidence Level :	Confidence level is high (100%)
Is compromised? :	False
ASN:	AS208476 AS-ROOTLINK
Country:	IT
First seen:	2022-07-28 16:47:26 UTC
Last seen:	never
UUID:	f6407c1b-0e94-11ed-8499-42010aa4000a
Reporter	AndreGironda
Reward	5 credits from ThreatFox
Tags:	NetWire
Reference:	https://tria.ge/220728-tzgv7shhej

AndreGironda

MITRE T1566.001
Date: Thu, 28 Jul 2022 07:00-07:30 +0100
Received: from mailout02.t-online.de (194.25.134.17)
Content-Type: multipart/mixed; boundary="===============0920869032=="
MIME-Version: 1.0
Subject: Transaction (Receipt) from Signature Flight Support.
To: Recipients <support1@signatureflightsupport.com>
From: "Signature Flight Support" <Monika.Ploch@t-online.de>
Message-ID: <1oGwt9-1T6Pbk0@fwd71.t-online.de>
X-TOI-EXPURGATEID: 150726::1658989302-01452C5E-E676A04E/19/7578733926 SUSPECT MAIL-COUNT
X-TOI-MSGID: 62a70a66-30b3-459b-a96f-e2e8a5f58ce9
Return-Path: Monika.Ploch@t-online.de
Attachment Name: SignatureReceipt-7786-MEM01.html
HTML Smuggling SHA256: 7a240976c42ca80fc1c9a6101b943e4f56a6dede9017b74bb8cbee3eddba7b37
hXXps://poiasj5[.]tk/SignatureReceipt-7786-MEM01/SignatureReceipt-7786-MEM01.rar
Password -- 2110
Downloaded Rarfile SHA256: bc0f071623db383ae76a2326bcc9a3308fd720d6acd39bb18ef39efe07de09b5
Uncompressed JavaScript Dropper Name: SignatureReceipt-7786-MEM01.js
JS Dropper SHA256: ed35c68140708c925b977f312b250bc247ddabcd52151be10d6d655d1ffe3b12
Netwire from JS Dropper Executable SHA256: 4aee6fa588692eb4735fbe7f13c643daefc23a10a0a64820e1d307501c548c55