Skip to main content

Unknown RAT

Malware Family

959 indicators of compromise attributed to Unknown RAT across abuse.ch threat intelligence feeds.

Domains

464

IPs

249

URLs

201

Hashes

45

Download indicators

Indicator lists for this family. Free and anonymous downloads are a 10% sample.

Domains (464)IPs (249)URLs (201)Hashes (45)

Need continuous updates instead of static lists? The same IOCs ship in the STIX/TAXII threat feed, ready for OpenCTI and MISP.

Threat types

Botnet C&CCredit-Card SkimmerpayloadPayload Delivery

Sample indicators

IndicatorType
mrr.cantdown.sudomain
nocknockart.comdomain
mrsls88.comdomain
twopintplc.comdomain
partyglacierhip.topdomain
saralkhabar.comdomain
alexsisto.comdomain
device-update.imtok.iodomain
relays.idanburuku.sbsdomain
decorare-blumen.dedomain
opalcraftsmp.comdomain
botdev.loldomain
hakimisadr.comdomain
zeuzz.dedomain
nyxarstealer.loldomain
urbancommunitycareers.comdomain
locchialaio.comdomain
winupdateservice.comdomain
signsexpressmedia.comdomain
tmbwqter.comdomain
172.245.195.198ip
163.245.210.240ip
64.89.161.167ip
209.99.184.206ip
77.91.123.220ip
62.60.226.215ip
144.172.91.242ip
216.126.227.207ip
217.217.97.36ip
195.177.94.245ip
187.124.29.11ip
209.99.184.6ip
185.174.101.132ip
45.11.181.191ip
78.40.194.67ip
5.101.81.131ip
209.99.190.206ip
89.110.110.119ip
217.217.97.172ip
79.124.8.44ip
http://193.233.113.202/api/upload-dataurl
https://github.com/charlie-60/R/raw/refs/heads/main/MasonRootkit.exeurl
https://kingo.lol/wsurl
https://lendmarkfinances.com:443/url
https://professional.baby/?p=url
https://botdev.lol/wsurl
https://yeter.lol/babayla/zor/yarisirlar/url
https://windowskernel.lol/url
https://caudflare.com:443/url
https://botdev.lol/mods/api/log-downloadurl
https://kaybol.lol/get/configurl
http://193.233.113.202/ws/clienturl
http://144.202.28.97:1337/mods/api/log-downloadurl
http://44.223.110.247:1337/?p=url
https://66.179.31.11/linux/mp.htmlurl
https://kingo.lol/mods/api/log-downloadurl
https://nelark.icu/xftaswx/res/bb.phpurl
https://zoommeetingapplicant.com/Zoom/Windows/invite.phpurl
https://essek.lol/get/configurl
https://vrdccbank.com/Doppee12.exeurl

Another file to check? Run a file hash reputation check.