SmartApeSG

Malware Family

168 indicators of compromise attributed to SmartApeSG across abuse.ch threat intelligence feeds.

Domains

IPs

URLs

Hashes

Download indicators

Indicator lists for this family. Free and anonymous downloads are a 10% sample.

Domains (76)IPs (10)URLs (71)Hashes (11)

Need continuous updates instead of static lists? The same IOCs ship in the STIX/TAXII threat feed, ready for OpenCTI and MISP.

Threat types

Botnet C&CpayloadPayload Delivery

Sample indicators

Indicator	Type
elderberryloft.net	domain
hazelcolonnade.net	domain
sedgeoriel.co	domain
buttresshalcyon.top	domain
briarvelarium.top	domain
umbergalleon.top	domain
loggiaelm.top	domain
amberalcove.top	domain
silenttunnelzone.top	domain
heatherkiln.top	domain
groceryhomerecipes.com	domain
winterberrycanto.co	domain
marooncloister.info	domain
crimsonroundel.info	domain
www.restaurant-leuehof.ch	domain
aspentraverse.co	domain
sallowcloister.co	domain
hollyarcade.org	domain
dockmemoir.co	domain
sunstonekeystone.info	domain
178.156.164.194	ip
5.78.196.67	ip
5.78.222.200	ip
144.208.127.215	ip
144.208.127.163	ip
216.120.201.140	ip
216.120.201.13	ip
203.96.177.124	ip
104.225.129.77	ip
104.225.129.185	ip
https://tamarisknave.co/logout/oauth-schema.js	url
https://peridotskerry.top/user/health-effect.js	url
https://lindenplumb.top/user/refresh-html	url
https://buttresshalcyon.top/policy/oauth-validator.js	url
http://indigocrest.top/middleware/scope-runtime.js	url
https://loggiaelm.top/realm/reset-response.js	url
https://hornbeamcairn.top/endpoint/handler-stylesheet.js	url
https://indigocrest.top/middleware/scope-runtime.js	url
https://amberalcove.top/realm/health-service	url
https://laurelcloister.top/role/logout-header.js	url
https://silenttunnelzone.top/token/token-controller.js	url
https://privetbelvedere.net/proxy/legacy-thread.js	url
https://profile.cobaltwayfinder.org/reset/auth-runtime	url
https://spindlewoodatlas.co/private/scope-worker.js	url
https://bayberrygalleon.cc/gateway/principal-cache.js	url
https://witchelmlexicon.org/route/login-effect.js	url
https://larchfable.cloud/verify/api-theme.js	url
https://ginkgoloft.co/redirect/proxy-transpiler.js	url
https://dockmemoir.co/alias/handler-hook.js	url
https://sorrelapse.best/verify/profile-asset.js	url
4eae39295458ac7a02bb837e0c82eecda3925f50dae684168bc0b203a89c53e2	hash
5ff519ad6347e7df1bb14e2bc15d72f4b26290da2e642c8a65fb8d4736f23022	hash
045479ee61a4b0035941606b5efb1d9fdd7dc8c82b8982bd6ea2228a1f2fbf27	hash
4bc79922cb13d5ea727818222b14f28c69ae6fd161212ed4e136ff7456c4d652	hash
7d1526c3d109fc9da176120ecb5209c4fde8b68a208584d2253cf116fd167eb6	hash
16cfe58eab4573ff575c563839e65474da5569247d55fbb59fd56f2684cec610	hash
8e1ed8998519001d4f4af8e1fe9381950cf9c2501ca1b25c414712d29966aee6	hash
97f3bdf6db1c274da0e5e653ef59f49514f6d7ed531138f487912d1f9a8fac1c	hash
0ae3916addf8682d9b571a8602b1936eb2afd095872246fa9417223edad697f8	hash
9aa80f91500e7aef0123e9a10c31a4683433aacd99717b3ddd6796c06a2d16f7	hash

Another file to check? Run a file hash reputation check.