IOC Radar
SHA256MediumSignal 42/100

56b6eaacab819f6199b96b06510eebeb30f99adcd559e3c87111a18d1ca6ed76

Location
GermanyGermany
First Seen
Jan 16, 2025
Last Seen
Dec 3, 2025
Jan 16
First Seen
531d ago
Dec 3
Last Seen
211d ago
3
Reports
source reports
42%
Confidence
medium
Found in 3 reports. Confidence: medium. · Confidence scores are heuristic. Verify before acting on results.
SHA-256 Hash
SHA-256 file hash — primary identifier for malware samples.
MISP Category
Artifacts Dropped
Hash Algorithm
SHA256
Confidence
42%
Signal Score
42 / 100
IDS Rule
No
Threat Context
Tags
MITRE ATT&CK

MITRE ATT&CK TTPs

62 techniques

Feed Intelligence Summary

3 reports42% confidence
3
Source reports
42%
Confidence score
Category tags
active scanningapplication attackapplication layer protocolasiaattackauthentication attackbazarcallbotnetbrute forcebrute force attackcommand and controlcommunication protocolcompromise attemptcredential accesscredential brute forcecredential brute forcingcredential harvestingcredential stuffingdata encryptiondata exfiltrationdatabase brute forcedenial of servicedistributed attacksenumerationeuropeexploitfile-hashftpftp brute forcegermanyhttp brute forcehttp scannerhttpsicedidindiaindicatorinitial accesslateral movementlogin attemptlogin brute forcemalicious activitymalicious network activitymalicious softwaremalspammalwaremalware distributionnetwork attacksnetwork enumerationnetwork intrusionnetwork intrusion attemptnetwork probenetwork probingnetwork protocolnetwork reconnaissancenetwork scanningnetwork securitynetwork service scanningnorth americapassword attackpassword attackspassword crackingphishing attackpossible credential stuffingpossible malicious activitypotential intrusionprocess injectionprotocol exploitationreconnaissancereconnaissance activityremote accessremote servicesresearchedservice exploitation attemptsmb brute forcesmtp brute forcesmtp enumerationsocial engineeringssh attacksyn port scansyn scansystem accesssystem discoveryt1005t1016t1018t1021t1021.001t1021.002t1021.003t1021.006t1040t1046t1047t1048t1053t1055t1059t1059.001t1059.004t1059.005t1059.006t1068t1070t1071t1071.001t1076t1077t1078t1083t1087t1110t1110.001t1110.002t1110.003t1110.004t1133t1136t1187t1190t1199t1204t1486t1496t1499.002t1499.003t1539t1555t1563t1565t1566t1566.001t1566.002t1566.003t1573t1588t1588.002t1589t1589.002t1589.003t1592t1595t1595.001t1595.002t1595.003tcp protocoltcp scantcp scanningtelnet threatthreat actorudp port scanudp scanunauthorized accessunauthorized access attemptunited statesvalid accountsweb traffic

Activity Timeline

1 total obs
Dec 3Dec 3

Threat Activity Heatmap

· Peak: 2025-12-03
Less
More
Mon
Wed
Fri
Jun
Jul
·
·
·
Aug
·
·
·
Sep
·
·
·
·
Oct
·
·
·
Nov
·
·
·
Dec
·
·
·
·
Jan
·
·
·
Feb
·
·
·
Mar
·
·
·
·
Apr
·
·
·
May
·
·
·
Jun
·
·
·
24h
0
Dormant
7d
0
Dormant
30d
0
Dormant
3mo
0
Dormant
Threat ScoreMedium Risk
42
SIGNAL
Signal Score
42%
Confidence
3
Reports
First seenJan 16, 2025
Last seenDec 3, 2025

VirusTotal

Not checked

WHOIS

references
https://www.trendmicro.com/en_us/research/21/d/a-spike-in-bazarcall-and-icedid-activity.html, https://labs.inquest.net/iocdb

Export & API

STIX 2.1 Bundle
CSV Export
Permalink

IOC Journey

medium
First detected 1 year ago · Last seen 7 months ago
Appeared in 3 threat reports