njrat botnet controller @35.193.121.248

The host at this IP address is obviously operated by cybercriminals. It is running a malware botnet controller which is being used to control infected computers (bots) around the globe using a trojan horse.

Malware botnet controller located at 35.193.121.248 on port 5005 TCP:
$ telnet 35.193.121.248 5005
Trying 35.193.121.248…
Connected to 35.193.121.248.
Escape character is ‘^]’

$ nslookup 35.193.121.248
248.121.193.35.bc.googleusercontent.com

$ dig +short cf7563ad8eb0.duckdns.org
35.193.121.248

Referencing malware samples:
MD5 c3f284b8f34b7ee83f4a9573d62eb2a2

Опубликовано
В рубрике google.com

Добавить комментарий

Ваш адрес email не будет опубликован.