216.73.217.22

Indicator (IOC)

stix Revoked AlienVault · Published 21/12/2025 01:12 · Modified 21/12/2025 06:36

Essential information

Value / Name
e1ad173e49eee1194f2a55afa681cef7c3b8f6c26572f474dec7a42e9f0cdc9d
Confidence
100/100
Revoked
Yes
Valid from
20/09/2024 13:10
Valid until
16/09/2025 21:04
Pattern type
stix
Published
21/12/2025 01:12
Modified
21/12/2025 06:36
Author / Source
AlienVault

Description

No description.

Pattern

[file:hashes.'SHA-256' = 'e1ad173e49eee1194f2a55afa681cef7c3b8f6c26572f474dec7a42e9f0cdc9d']

Labels / Tags

Labels: basewalk cyvera console foxshell httpsnoop liontail oatboat oilrig pipesnoop plugx scarred manticore shroudedsnooper unc1860 windows api

Marking (TLP)

TLP:CLEAR

Related entities

Reports and intrusion sets linked to this IOC.

Intrusion sets (3)

  • OilRig COBALT GYPSYIRN2
    The MITRE Corporation Confidence 100

    [OilRig](https://attack.mitre.org/groups/G0049) is a suspected Iranian threat group that has targeted Middle Eastern and international victims since at least 2014. The group has targeted a variety of sectors, including …

    First seen 01/01/1970 · Last seen 16/11/5138 Published 16/12/2025 19:39 · Modified 27/03/2026 01:13
  • ShroudedSnooper
    AlienVault Confidence 100
    First seen 01/01/1970 · Last seen 16/11/5138 Published 21/12/2025 01:12 · Modified 21/12/2025 01:12
  • UNC1860
    AlienVault Confidence 100
    First seen 01/01/1970 · Last seen 16/11/5138 Published 21/12/2025 06:33 · Modified 21/12/2025 06:33