Indicators are what attackers leave behind. Stolen credentials are what they arrive with.

TLP:WHITE67 IOCs

MuddyWater: ClickFix to Telegram & PatchAgent Backdoor

Ransom-ISAC

Published July 15, 2026Original Report

Threat Actors

Malware Families

Diamond Model

Adversary(2)

Infrastructure(6)

Capability(2)

Victim

Indicators of Compromise

Indicators of Compromise67

Type	Indicator	Confidence	Score	First Seen
SHA256	a01634a49545e05dcb1624aec62184f1f45c9224e4d356d191971914a4668a5a file-hashintel-blogmalware	High	85	Jul 29, 26
URL	http://185.228.83.217/land/?id=9228023&__cf_chl_rt_tk=0WTT341v83OfTlu9_sVt0mpCGs8eiXGuXRj0LgIbMkt4-1759406441-1.0.1.1-cKgxnjeNC3bilN23wwtGd4ZTe00EYBZDCXqqw55zKFcc aptespionageexploit	High	58	Oct 9, 26
SHA256	f051f14146e69ffd2f22c48c5126f53e8a94e2ce86b9adb46de0fb5230d46538 botnetfile-hashintel-blog	High	85	Jul 29, 26
URL	http://185.228.83.217:8443/api/cmd/d654b82b intel-blogmalwarenetwork	High	58	Oct 9, 26
SHA256	be8cc24348cd36f001cef3554a2e20faba192fddb72c4188c14a22789a9d484f file-hashintel-blogmalware	Medium	53	Oct 9, 26
URL	http://46.30.188.99:8443/api/cmd/bfaf34b8 intel-blogmalwarenetwork	High	58	Oct 9, 26
SHA256	155275fdade744919de3d657a16c197b2f736764c14129e27e8517aed824f84e file-hashintel-blogmalware	Medium	53	Oct 9, 26
MD5	cc17bcc7fe575a59b90e88841fe76dbc file-hashintel-blogloader	Medium	53	Oct 9, 26
Domain	bx.digitech.ru intel-blogmalwarenetwork	High	58	Oct 9, 26
SHA256	90f2ac28649c8877379014012263125fdb86489ccc8d6cc80180437dbdf3be8c file-hashintel-blogmalware	High	85	Jul 29, 26
SHA256	8d0c4a2565d38c923a50bb5daf512a7b80633643c65b5464d665e5f71b8fbd55 file-hashintel-blogmalware	High	85	Jul 29, 26
URL	http://185.228.83.217:8443/api/cmd/50ee0d88 intel-blogmalwarenetwork	High	58	Oct 9, 26
SHA256	70c2a120148a8d0e40f4abfb54578561c38a9b4ce0ea6cf6067b925e319806e0 file-hashintel-blogmalware	Medium	53	Oct 9, 26
SHA256	fbefbd142aa9e842754ad914e9a3b14a60129fe8b9863db23e2c8c697b5923aa file-hashintel-blogmalware	High	85	Jul 29, 26
URL	https://185.228.83.217:8443/api/cmd/532ec2dd intel-blogmalwarenetwork	High	58	Oct 9, 26
SHA256	c0daec5c4417c16de8bced454b51cc02c0ee57ff66257b9516d6ae69ecf539ef file-hashintel-blogloader	High	85	Jul 29, 26
SHA256	7e4549de761b5bdb361bf22e3f3069539400448094c45d2e84175d76b6553853 file-hashintel-blogmalware	High	85	Jul 29, 26
SHA256	6d36bfa3e893c11294e3421de9e836e0fe68f97b20fa9d9eebbfb66d79136caf file-hashintel-blogmalware	Medium	53	Oct 9, 26
SHA256	e88d528e951c55e3f5dcd8e1f10a161ab5f5d64f8663f65fd49d4558aea3274b file-hashintel-blogmalware	Medium	53	Oct 9, 26
MD5	230bb7c97fbb1e96d9ebee43cfa09024 file-hashintel-blogmalware	Medium	53	Oct 9, 26
SHA256	aaea67f04f2a6b3ae212b3565b108b92cce157eff1c77b455fe2eadb57c86fb5 file-hashintel-blogmalware	Medium	53	Oct 9, 26
SHA256	b32a924d0fdcf00c928a595826e93f1e338db0a7c50ceb8284add5a1cc4eb09a file-hashintel-blogmalware	Medium	53	Oct 9, 26
SHA256	bf38ae8c1b495b2a547337759969967a8bf632f5adbbd9a9bb7c724007d684b8 botnetfile-hashintel-blog	High	85	Jul 29, 26
IP	46.30.188.99 intel-blogmalwarenetwork	High	58	Oct 9, 26
SHA256	3ca8ae1d0a0682c941d71b722171f69cde2abff6f5f3092c6af56d001d01c070 file-hashintel-blogmalware	Medium	53	Oct 9, 26
MD5	e736cadfc8ef27a6d7bbb3a4585abd50 file-hashintel-blogmalware	Medium	53	Oct 9, 26
URL	https://seo-conference.by/wp-themes/Cloudflare/Verification/UserID6389452515832 intel-blogmalwarenetwork	High	58	Oct 9, 26
SHA256	59bfe9bc385ad69f50793ce4a53397316d7a875a7148a63c16df9b674c6cda64 file-hashintel-blogmalware	Medium	53	Oct 9, 26
SHA256	f123bfdf0dff864b36c92e4ea7963d86f18c4cff0a29ed186e9f6eec940fa6b5 file-hashintel-blogmalware	Medium	53	Oct 9, 26
URL	http://185.228.83.217:8443/api/cmd/e99899fa intel-blogmalwarenetwork	High	58	Oct 9, 26
SHA256	48e455d24aede6586d5fe2af3ba5eabd15f53ff68de7fb38a4021f0b61f3c2d4 file-hashintel-blogmalware	Medium	53	Oct 9, 26
SHA256	7af3c84441f40b8a7f6660e1e78bd8806c715ec1b466fd62916466d50224797a file-hashintel-blogmalware	Medium	53	Oct 9, 26
IP	92.53.69.246 intel-blogmalwarenetwork	High	58	Oct 9, 26
IP	41.216.188.46 intel-blogmalwarenetwork	High	58	Oct 9, 26
SHA256	28e55dc62f9a9c9938c3b48b2d17a33d6fa96e74c1e9d31f5c685fef8c39b217 file-hashintel-blogmalware	Medium	53	Oct 9, 26
IP	185.183.34.168 active scanactive scanningbad web bot	Medium	46	Jul 1, 23
MD5	d4a0b5b1f5d4f43ff01360d2f16f171b file-hashintel-blogmalware	Medium	53	Oct 9, 26
URL	http://185.228.83.217:8443/api/cmd/532ec2dd intel-blogmalwarenetwork	High	58	Oct 9, 26
SHA256	5d9190292acdd48ba0fc35080f7e7448f3cdf0d79199a4d23f0f49b5341fdf29 file-hashintel-blogmalware	Medium	53	Oct 9, 26
SHA256	d60b04ecea3adb58b4369d4e52121377a9bc28fa1a29b69ceee60144c47492a2 file-hashintel-blogmalware	High	85	Jul 29, 26
MD5	728edd84b46d32d1fd520aa735f8611e file-hashintel-blogmalware	Medium	53	Oct 9, 26
MD5	3895302964bcb46729c61f82a798ef96 file-hashintel-blogmalware	Medium	53	Oct 9, 26
SHA256	d36deee39830bfb111b50bf8315a4de292812e0d2aafd5fc8666c9db11e8e590 file-hashintel-blogmalware	Medium	53	Oct 9, 26
URL	http://185.228.83.217:8443/api/cmd/f3821897 intel-blogmalwarenetwork	High	58	Oct 9, 26
SHA256	515332a4fada0648a84c6d683e36363918f23f03ef7bf97e936c795829a9623f file-hashintel-blogmalware	Medium	53	Oct 9, 26
SHA256	f552f87811e0ac4c6757926e79bbf3a38fe6648634aaadb5a01f6e87e3a4951a file-hashintel-blogmalware	High	85	Jul 29, 26
SHA256	27a5d818f690b4c0b1679381ee48ffafb8d3b4ad6247797c32698bd6992a224f file-hashintel-blogmalware	Medium	53	Oct 9, 26
SHA256	a8d63e598ea6a8eaf7d34eeb240ca75e9b89c18df88fe4d43b3ff3d53a723f4b file-hashintel-blogmalware	Medium	53	Oct 9, 26
SHA256	5c33e3dfa983e99e0dc1618fdf7893c43182d6ef079f34fe3c94887b63ab274c file-hashintel-blogloader	High	85	Jul 29, 26
SHA256	e792788fef507ae1fde22cf0c38c0569dc13c6fb8f23b79937cd1f606fa8394c file-hashintel-blogloader	Medium	53	Oct 9, 26
SHA256	816f1f4df1f3964c807ea3606a6319a7872b6de54dd9286c1fed4982d6982af6 botnetfile-hashintel-blog	High	85	Jul 29, 26
URL	http://185.228.83.217:8443/api/checkin intel-blogmalwarenetwork	High	58	Oct 9, 26
SHA256	d45e5ea038841b4c4ae8ea4199ed8bee6cdf9926640bf02458f0820c394cddd3 file-hashintel-blogmalware	Medium	53	Oct 9, 26
SHA256	a556272456a474721a285f28dba2219f154147f5869932f45408774fead54fca file-hashintel-blogmalware	Medium	53	Oct 9, 26
SHA1	07fd805ebc2f09187af49f45e8726eb62bb85bfe file-hashintel-blogmalware	Medium	53	Oct 9, 26
SHA256	af5a2f1b7e388d4fb49d72e8f453fda673472ad603bf72aee4869a34b37f535a file-hashintel-blogmalware	High	85	Jul 29, 26
URL	http://46.30.188.99:8443/api/cmd/ intel-blogmalwarenetwork	High	58	Oct 9, 26
SHA256	a361e7885c36bacb3fd9cb068da207c3b9329962cac022d06e28923939f575e8 file-hashindicatorintel-blog	Medium	43	Jul 17, 26
URL	http://46.30.188.99:8443/api/checkin intel-blogmalwarenetwork	High	58	Oct 9, 26
SHA256	8d217ad2ff7ed9e162cbd20bd207562f7e4f50d3e4d1f36ab01d653380176d16 file-hashintel-blogmalware	Medium	53	Oct 9, 26
SHA256	78906623ce30eba7174e99d7f9d1df5fe69d1fdd7d5eb36329963e29b65bef2e file-hashintel-blogmalware	High	85	Jul 29, 26
SHA256	5ce2d378811c84c085f39d0ce264d03138cbdd46ae752adb1b8d2373f6873bae file-hashintel-blogmalware	Medium	53	Oct 9, 26
SHA256	080e5ded51c69bcb1a173bbf035a4ed48d259e2f0343115f8e0bcd8a932d57eb file-hashintel-blogmalware	Medium	53	Oct 9, 26
SHA256	151dd3d4f9228cf88d67b9e165f8da2bd0baa7e9e46bc3621c1a02e89e7d8feb exfiltrationfile-hashintel-blog	Medium	53	Oct 9, 26
SHA256	fbc2b2bc5365528b68b60a150e85407c0f51952b95c272ac7d85714fd1e0e8bd file-hashintel-blogmalware	High	85	Jul 29, 26
SHA256	bc9c4e81bc9acd2a93de62ba696009084594161da3db5eddc4774a006d8bd07e file-hashintel-blogmalware	High	85	Jul 29, 26
IP	31.57.219.68 intel-blogmalwarenetwork	High	58	Oct 9, 26

IOC Relationship Graph

IOC Relationship Graph67 total IOCs

SHA256URLMD5DomainIPSHA1

scroll to zoom · drag to pan · click IOC to open