216.73.216.6

Indicator (IOC)

stix Revoked AlienVault · Published 20/12/2025 20:00 · Modified 20/12/2025 22:13

Essential information

Value / Name
1df11bc19aa52b623bdf15380e3fded56d8eb6fb7b53a2240779864b1a6474ad
Confidence
100/100
Revoked
Yes
Valid from
26/10/2022 09:11
Valid until
29/01/2024 08:11
Pattern type
stix
Published
20/12/2025 20:00
Modified
20/12/2025 22:13
Author / Source
AlienVault

Description

UPX

Pattern

[file:hashes.'SHA-256' = '1df11bc19aa52b623bdf15380e3fded56d8eb6fb7b53a2240779864b1a6474ad']

Labels / Tags

Labels: blackbyte exbyte exfiltration golang infostealer raas ransomware

Marking (TLP)

TLP:CLEAR

Related entities

Reports and intrusion sets linked to this IOC.

Intrusion sets (1)

  • BlackByte Hecamede
    The MITRE Corporation Confidence 100

    [BlackByte](https://attack.mitre.org/groups/G1043) is a ransomware threat actor operating since at least 2021. [BlackByte](https://attack.mitre.org/groups/G1043) is associated with several versions of ransomware also labeled [BlackByte Ransomware](https://attack.mitre.org/software/S1180). [BlackByte](https://attack.mitre.org/groups/G1043) ransomware operations initially used…

    First seen 01/01/1970 · Last seen 16/11/5138 ·