IOC Radar
SHA256HighVerifiedSignal 96/100

44d1b3689ea3188249b2d008020bec2dc2c5d82d25eeff708c1d776e0801ecf6

Location
GermanyGermany
First Seen
Jan 10, 2026
Last Seen
May 27, 2026
Jan 10
First Seen
157d ago
May 27
Last Seen
20d ago
5
Reports
source reports
96%
Confidence
high
Found in 5 reports. Confidence: high. · Confidence scores are heuristic. Verify before acting on results.
SHA-256 Hash
SHA-256 file hash — primary identifier for malware samples.
MISP Category
Artifacts Dropped
Hash Algorithm
SHA256
Confidence
96%
Signal Score
96 / 100
IDS Rule
No
Threat Context
Tags
MITRE ATT&CK

MITRE ATT&CK TTPs

64 techniques

Feed Intelligence Summary

5 reports96% confidence
5
Source reports
96%
Confidence score
Category tags
ableacceptaccess typeactiveactive scanactive scanningadbhoney honeypotalertsamerica flagapi callapisasciiascii textattackav detectionav detectionsbackdoorbaidubccwpbodybotnetbotnet activitybrute forcecallscctvck idck matrixck techniquesclickclick-based attackcommandcommand and controlcommunication protocolcompromised systemconpotconpot honeypotcontrolcontrol attcontrol defensecowriecowrie honeypotcredential accesscredential harvestingcredential stuffingdata exfiltrationdata store exposureddosddos attacksdecoy systemdefense evasiondemodionaeadionaea honeypotdistributed attacksdns attackdvreabi4 versionelfemaileuropeevasionexecutable fileexploitexploitationexploitation activityfalcon sandboxfilefile-hashfilesformatgermanyguest systemhoneytrap honeypothttp attackhybridics securityidentity & access exploitationids detectionsindicatorindicators showindustrial control systemsinjection activityinput validation bypassinternet of thingsiot botnetiot devicesiot securityiot/ics attackipphoney honeypotipv4ipv4 addis__elfkvt49llamplearnlinuxlogolsb executablemac catalinamailoney honeypotmalicious activitymalicious linksmalicious softwaremalicious trafficmalwaremalware behaviourmalware capturemedium riskmipsmipsi versionmiraimirai botnetmitre attmodelmsb executablename tacticsnetwork activitynetwork devicenetwork securitynorth americanumbernvropenopen threatpasspassive dnspathpath traversalphishingphishing attackphishing trappolandprocess injectionpulse pulsesreadsreconnaissancerelated pulsesremoteremote accessresearchedresource hijackingreverse dnsrolerole titlerouterscanning activityscanning hostsearchsentrypeer botnetservicesftpsftp attackshell executionshellshocksipsocial engineeringsourcespamsshssh attackssh monitoringsysvt1003t1007t1010t1012t1021.004t1027t1033t1040t1041t1047t1055t1057t1059t1059.004t1068t1071t1071.001t1072t1078t1082t1083t1087.003t1088t1105t1106t1110.002t1113t1114.003t1129t1133t1190t1203t1204.001t1204.002t1205t1205.001t1210t1222t1480t1486t1496t1497t1498t1499.001t1499.002t1499.003t1546t1558t1562t1565t1566.001t1566.002t1566.003t1566.004t1569t1571t1574t1583.005t1587.001t1595t1595.001t1595.002t1595.003t1614tannertelecommunicationsthreat actorthreat detectionthreat intelligencetoolstor nodetypetype indicatorunitedunited statesunixurlsuser executionusrbinls lusrbinrm fusrbinrm rfvaluevoipvoip attackweak credentialsweb application attackweb application exploitationweb securityweb serverwindirx86 x8664x8632yara detectionszero

Activity Timeline

1 total obs
May 27May 27

Threat Activity Heatmap

· Peak: 2026-05-27
Less
More
Mon
Wed
Fri
Jun
·
·
Jul
·
·
·
Aug
·
·
·
Sep
·
·
·
·
Oct
·
·
·
Nov
·
·
·
Dec
·
·
·
·
Jan
·
·
·
Feb
·
·
·
Mar
·
·
·
·
Apr
·
·
·
May
·
·
·
Jun
·
24h
0
Dormant
7d
0
Dormant
30d
1
Minimal
3mo
1
Minimal
Threat ScoreHigh Risk
96
SIGNAL
Signal Score
96%
Confidence
5
Reports
First seenJan 10, 2026
Last seenMay 27, 2026
Verified IOC

VirusTotal

Not checked

WHOIS

description
ELF 64-bit LSB executable, x86-64, version 1 (SYSV), statically linked, stripped
references
https://darfe.es/ciberwiki/index.php?title=Mirai, https://www.virustotal.com/gui/collection/8b6c8d2f11238971579bf5dfefe4bcbca4a616b60d196d0f3867673e7d3c717c/iocs, https://eurotarget.com/ RondoDox • HoneyPotBot • Mirai, iocsheelcode.txt • gvt.sh, Backdoor:Linux/Shellshock: 74.194.191.52 scanning_host | CC=US ASN=AS19108 suddenlink communications, Backdoor:Linux/Shellshock: http://74.194.191.52/rondo.lol, Backdoor:Linux/Shellshock: http://74.194.191.52/rondo.qre.sh Title: ASCII text, Backdoor:Linux/Shellshock: [email protected] delivery_email Title: script maker |Role: delivery_email, https://www.trendmicro.com/en_us/research/25/j/rondodox.ht, https://hybrid-analysis.com/sample/b16e15764b8bc06c5c3f9f19bc8b99fa48e7894aa5a6ccdad65da49bbf564793/68e525dfa7741665f50a76e1, https://hybrid-analysis.com/sample/b16e15764b8bc06c5c3f9f19bc8b99fa48e7894aa5a6ccdad65da49bbf564793/692846ca04b2d8dd8c03abfb, https://hybrid-analysis.com/sample/b16e15764b8bc06c5c3f9f19bc8b99fa48e7894aa5a6ccdad65da49bbf564793/690d8770d8501d79170bd2bd, Related to https://otx.alienvault.com/pulse/6967bc8b26b69d4dc2604a13, 74-194-191- 52.htvlcmta01.com.d yn.suddenlink.net | EuroTarget Research blocked, [email protected], 74.194.191.52, nttp://74.194.191.52/rondo.armv51, http://74.194.191.52/rondo.armv6l, http://74.194.191.52/rondo.mipsel, http://74.194.191.52/rondo.mips, https://otx.alienvault.com/indicator/ip/74.194.191.52

Export & API

STIX 2.1 Bundle
CSV Export
Permalink

IOC Journey

high
First detected 5 months ago · Last seen 20 days ago
Appeared in 5 threat reports