216.73.217.22

Quad7 botnet operators

· Published 21/12/2025 07:00 · Modified 21/12/2025 07:00 · Source: AlienVault

Essential information

Confidence
100/100
Published
21/12/2025 07:00
Modified
21/12/2025 07:00
Updated at
21/12/2025 07:00
Revoked
No
Author / Source
AlienVault
Resource level
—
Primary motivation
—
Related entities
2 reports, 19 attack patterns (mitre), 9 malware, 6 indicators

Description

No description.

Marking (TLP)

TLP:CLEAR

Related entities

Attack patterns, malware, vulnerabilities, indicators and other entities linked to this intrusion set.

Reports (2)

Attack patterns (MITRE) (19)

  • T1608 uses
    Stage Capabilities
  • T1595 uses
    Active Scanning
  • T1071 uses
    Application Layer Protocol
  • T1543 uses
    Create or Modify System Process
  • T1043 uses
    Commonly Used Port
  • T1021.004 uses
    SSH
  • T1105 uses
    Ingress Tool Transfer
  • T1587 uses
    Develop Capabilities
  • T1189 uses
    Drive-by Compromise
  • T1190 uses
    Exploit Public-Facing Application
  • T1573 uses
    Encrypted Channel
  • T1090 uses
    Proxy
  • Rogue Domain Controller uses
    T1207
  • T1594 uses
    Search Victim-Owned Websites
  • T1518 uses
    Software Discovery
  • T1583 uses
    Acquire Infrastructure
  • T1133 uses
    External Remote Services
  • T1213 uses
    Data from Information Repositories
  • T1505 uses
    Server Software Component

Malware (9)

  • zylogin uses
    Family
    Published 10/09/2024 08:07 · Modified 10/09/2024 08:07
  • axlogin uses
    Family
    Published 10/09/2024 08:07 · Modified 10/09/2024 08:07
  • FsyNet uses
    Family
    Published 10/09/2024 08:07 · Modified 10/09/2024 08:07
  • rlogin uses
    Family
    Published 10/09/2024 08:07 · Modified 10/09/2024 08:07
  • xlogin uses
    Family
    Published 10/09/2024 08:07 · Modified 10/09/2024 08:07
  • HAMMERTOSS
  • UPDTAE uses
    Family
    Published 10/09/2024 08:07 · Modified 10/09/2024 08:07
  • HAMMERTOSS - S0037 uses
    Family
    Published 10/09/2024 08:07 · Modified 10/09/2024 08:07
  • alogin uses
    Family
    Published 10/09/2024 08:07 · Modified 10/09/2024 08:07

Indicators (6)

  • http://151.236.20.30:80 indicates
  • http://45.77.44.119:80 indicates
  • http://158.247.194.125:80 indicates
  • ff17e9bcc1ed16985713405b95745e47674ec98e3c6c889df797600718a35b2c indicates
  • http://103.57.248.202:81 indicates
  • http://103.140.239.63:80 indicates