RedTail

Malware Family

269 indicators of compromise attributed to RedTail across abuse.ch threat intelligence feeds.

Domains

IPs

240

URLs

Hashes

Download indicators

Indicator lists for this family. Free and anonymous downloads are a 10% sample.

Domains (3)IPs (240)URLs (8)Hashes (18)

Need continuous updates instead of static lists? The same IOCs ship in the STIX/TAXII threat feed, ready for OpenCTI and MISP.

Threat types

Botnet C&CpayloadPayload Delivery

Associated CVEs (3)

CVE-2017-9841CVE-2021-41773 CVE-2024-4577

Sample indicators

Indicator	Type
kiss.a-dog.top	domain
proxies.internetshadow.link	domain
proxies.internetshadow.org	domain
104.207.47.232	ip
88.162.196.213	ip
178.105.144.231	ip
92.209.188.108	ip
195.96.139.54	ip
65.49.20.67	ip
47.238.136.107	ip
167.86.72.220	ip
47.77.182.54	ip
173.177.131.92	ip
37.65.13.51	ip
47.79.37.117	ip
115.84.114.228	ip
167.94.146.49	ip
88.168.217.152	ip
220.162.198.142	ip
92.208.25.142	ip
191.44.71.181	ip
185.214.96.151	ip
45.79.5.11	ip
https://217.60.195.113/sh	url
https://121.176.14.102/sh	url
https://14.46.136.77/sh	url
http://107.189.3.150/b2f628/cronb.sh	url
http://209.141.58.166/b2f628/cronb.sh	url
http://140.99.32.48/b2f628/cronb.sh	url
http://205.185.118.246/b2f628/cronb.sh	url
http://b.9-9-8.com/brysj/cronb.sh	url
f0aa83bbbd2c75e2f71ec16029ee5fcfad59f3a8efa30a500b815f0f6c18d987	hash
ed23a8c75dc4f04acd8b68c51a0ebdb4d5cce6c06eed2451ebd0428a32d9df99	hash
3f3a11bafabb1a35db913cfe51995f2e357d049e268860175876ae5a93d23892	hash
3f3bf218089d1488617d37f8a5116bb2791eb39ce06a1b5bc9a4cdfe5e94dd39	hash
6168f5d053f4c3d413327947c37b927a759b316d68ac341908695879edcda246	hash
db7fc2fef4f644d06e378b426e9a5a5c5ac7c29fb0d09ba56903fed1dbe6843b	hash
1dab38eaba06e088ad1eb6d5e7b541c84d1ef8b198d961eb61eb19cd62dcd068	hash
a2344aa530706d76200c8c4fff2ba9b37791bee1d587ffe13732d21cd42524ea	hash
9875fb1a96f06fb4ffde6c24cbaaa15eacd9df8652756e25e6e13f125f2019ec	hash
de96a56c5508bb69c20f171a141263ebed92823eb3249dccb9db1ff350b37b31	hash
2c602147c727621c5e98525466b8ea78832abe2c3de10f0b33ce9a4adea205eb	hash
b33b415cbee7d64d4cbedda4c61d97437393b6095d53f597b5ee247b16591b6f	hash
ed8fe6eb98c8a487c631dee11ddbe11c322e446666280f7b97844d259fdb10f5	hash
7c8e7619c5398d3b857e6f72cf791e2c2e27762ddd8521eb8971c893cdb8b1fc	hash
59c29436755b0778e968d49feeae20ed65f5fa5e35f9f7965b8ed93420db91e5	hash
dbb7ebb960dc0d5a480f97ddde3a227a2d83fcaca7d37ae672e6a0a6785631e9	hash
048e374baac36d8cf68dd32e48313ef8eb517d647548b1bf5f26d2d0e2e3cdc7	hash
3625d068896953595e75df328676a08bc071977ac1ff95d44b745bbcb7018c6f	hash

Another file to check? Run a file hash reputation check.