OTX-693ff6c5d9a7c2b44e86affa
high
📛 Threat Title
GCleaner - C2 IP/Domain Tracker
Description
This pulse contains IOCs related to GCleaner campaigns. Additions are automatically added based on several sources like: OTX sandboxes samples, internal tools, through the use of Shodan or Censys queries, shared intel from LevelBlue partners or external feeds. Pulse contains 56 indicator(s) (IOCs). View on OTX to inspect.
Indicators of Compromise (90)
Each indicator is enriched from the IOC database, threat-intel feed corroboration (Threat Hunt) and VirusTotal. Click one to expand.
url
http://45.141.237.38
VT 1 / 92
IOC database
- Type
- url
- Value
http://45.141.237.38- First seen
- Last seen
- Attached to this threat
- Appears in
- 1 threat
Threat Hunt — feed corroboration
Not present in any configured threat-intel feed.
Flagged by 1 of 92 VirusTotal vendors
| Vendor | Verdict | Detection |
|---|---|---|
| Gridinsoft | malicious | malicious |
Details From VirusTotal
Basic Properties
| Final URL | http://45.141.237.38/ |
History
| First seen on VirusTotal | 2022-06-30 08:00 UTC |
| Last submission | 2026-08-01 07:54 UTC |
| Last analysis | 2026-08-01 07:54 UTC |
| Last modified on VirusTotal | 2026-08-01 11:51 UTC |
ipv4
45.141.237.38
VT 1 / 91
IOC database
- Type
- ipv4
- Value
45.141.237.38- First seen
- Last seen
- Attached to this threat
- Appears in
- 1 threat
Threat Hunt — feed corroboration
Not present in any configured threat-intel feed.
Flagged by 1 of 91 VirusTotal vendors
| Vendor | Verdict | Detection |
|---|---|---|
| Gridinsoft | malicious | malicious |
Details From VirusTotal
Basic Properties
| Network | 45.141.236.0/22 |
| Country | GB |
| AS owner | Community Fibre Limited |
| ASN | 201838 |
| Regional registry | RIPE NCC |
History
| Last analysis | 2026-08-01 11:06 UTC |
| Last modified on VirusTotal | 2026-08-01 11:11 UTC |
| WHOIS record date | 2026-07-06 16:47 UTC |
url
http://94.145.227.161
IOC database
- Type
- url
- Value
http://94.145.227.161- First seen
- Last seen
- Attached to this threat
- Appears in
- 1 threat
Threat Hunt — feed corroboration
Not present in any configured threat-intel feed.
Details From VirusTotal
No VirusTotal details cached for this IOC. Open the IOC page to query VirusTotal.
ipv4
94.145.227.161
IOC database
- Type
- ipv4
- Value
94.145.227.161- First seen
- Last seen
- Attached to this threat
- Appears in
- 1 threat
Threat Hunt — feed corroboration
Not present in any configured threat-intel feed.
Details From VirusTotal
No VirusTotal details cached for this IOC. Open the IOC page to query VirusTotal.
url
http://45.12.253.56/advertisting/plus.php?s=nosub&str=mixtwo&substr=mixkis
IOC database
- Type
- url
- Value
http://45.12.253.56/advertisting/plus.php?s=nosub&str=mixtwo&substr=mixkis- First seen
- Last seen
- Attached to this threat
- Appears in
- 1 threat
Threat Hunt — feed corroboration
Not present in any configured threat-intel feed.
Details From VirusTotal
No VirusTotal details cached for this IOC. Open the IOC page to query VirusTotal.
ipv4
196.251.107.248
IOC database
- Type
- ipv4
- Value
196.251.107.248- First seen
- Last seen
- Attached to this threat
- Appears in
- 2 threats
Threat Hunt — feed corroboration
Not present in any configured threat-intel feed.
Details From VirusTotal
No VirusTotal details cached for this IOC. Open the IOC page to query VirusTotal.
url
http://196.251.107.248/kont2rt/index.php
IOC database
- Type
- url
- Value
http://196.251.107.248/kont2rt/index.php- First seen
- Last seen
- Attached to this threat
- Appears in
- 2 threats
Threat Hunt — feed corroboration
Not present in any configured threat-intel feed.
Details From VirusTotal
No VirusTotal details cached for this IOC. Open the IOC page to query VirusTotal.
url
http://prettycleaner.hk/config
UrlVoid 2 / 35
IOC database
- Type
- url
- Value
http://prettycleaner.hk/config- First seen
- Last seen
- Attached to this threat
- Appears in
- 1 threat
Threat Hunt — feed corroboration
Not present in any configured threat-intel feed.
Details From VirusTotal
No VirusTotal details cached for this IOC. Open the IOC page to query VirusTotal.
url
http://prettycleaner.hk/setup.exe
UrlVoid 2 / 35
IOC database
- Type
- url
- Value
http://prettycleaner.hk/setup.exe- First seen
- Last seen
- Attached to this threat
- Appears in
- 1 threat
Threat Hunt — feed corroboration
Not present in any configured threat-intel feed.
Details From VirusTotal
No VirusTotal details cached for this IOC. Open the IOC page to query VirusTotal.
url
http://prettycleaner.hk/success
UrlVoid 2 / 35
IOC database
- Type
- url
- Value
http://prettycleaner.hk/success- First seen
- Last seen
- Attached to this threat
- Appears in
- 1 threat
Threat Hunt — feed corroboration
Not present in any configured threat-intel feed.
Details From VirusTotal
No VirusTotal details cached for this IOC. Open the IOC page to query VirusTotal.
domain
youtube4kdowloader.club
UrlVoid 4 / 35
IOC database
- Type
- domain
- Value
youtube4kdowloader.club- First seen
- Last seen
- Attached to this threat
- Appears in
- 1 threat
Threat Hunt — feed corroboration
Not present in any configured threat-intel feed.
Details From VirusTotal
No VirusTotal details cached for this IOC. Open the IOC page to query VirusTotal.
url
http://youtube4kdowloader.club/bin/progressloader.exe
UrlVoid 4 / 35
IOC database
- Type
- url
- Value
http://youtube4kdowloader.club/bin/progressloader.exe- First seen
- Last seen
- Attached to this threat
- Appears in
- 1 threat
Threat Hunt — feed corroboration
Not present in any configured threat-intel feed.
Details From VirusTotal
No VirusTotal details cached for this IOC. Open the IOC page to query VirusTotal.
domain
prettycleaner.hk
UrlVoid 2 / 35
IOC database
- Type
- domain
- Value
prettycleaner.hk- First seen
- Last seen
- Attached to this threat
- Appears in
- 1 threat
Threat Hunt — feed corroboration
Not present in any configured threat-intel feed.
Details From VirusTotal
No VirusTotal details cached for this IOC. Open the IOC page to query VirusTotal.
url
http://prettycleaner.hk/set
UrlVoid 2 / 35
IOC database
- Type
- url
- Value
http://prettycleaner.hk/set- First seen
- Last seen
- Attached to this threat
- Appears in
- 1 threat
Threat Hunt — feed corroboration
Not present in any configured threat-intel feed.
Details From VirusTotal
No VirusTotal details cached for this IOC. Open the IOC page to query VirusTotal.
url
http://45.12.253.72/default/stuk.php
IOC database
- Type
- url
- Value
http://45.12.253.72/default/stuk.php- First seen
- Last seen
- Attached to this threat
- Appears in
- 1 threat
Threat Hunt — feed corroboration
Not present in any configured threat-intel feed.
Details From VirusTotal
No VirusTotal details cached for this IOC. Open the IOC page to query VirusTotal.
url
http://45.12.253.75/dll.php
IOC database
- Type
- url
- Value
http://45.12.253.75/dll.php- First seen
- Last seen
- Attached to this threat
- Appears in
- 1 threat
Threat Hunt — feed corroboration
Not present in any configured threat-intel feed.
Details From VirusTotal
No VirusTotal details cached for this IOC. Open the IOC page to query VirusTotal.
ipv4
185.243.98.19
IOC database
- Type
- ipv4
- Value
185.243.98.19- First seen
- Last seen
- Attached to this threat
- Appears in
- 1 threat
Threat Hunt — feed corroboration
Not present in any configured threat-intel feed.
Details From VirusTotal
No VirusTotal details cached for this IOC. Open the IOC page to query VirusTotal.
url
http://91.92.241.242/info
IOC database
- Type
- url
- Value
http://91.92.241.242/info- First seen
- Last seen
- Attached to this threat
- Appears in
- 2 threats
- Description
- URL that is used for botnet Command&control (C&C) attributed to GCleaner
Threat Hunt — feed corroboration
Not present in any configured threat-intel feed.
Details From VirusTotal
No VirusTotal details cached for this IOC. Open the IOC page to query VirusTotal.
url
http://208.67.104.97
IOC database
- Type
- url
- Value
http://208.67.104.97- First seen
- Last seen
- Attached to this threat
- Appears in
- 1 threat
Threat Hunt — feed corroboration
Not present in any configured threat-intel feed.
Details From VirusTotal
No VirusTotal details cached for this IOC. Open the IOC page to query VirusTotal.
ipv4
208.67.104.97
IOC database
- Type
- ipv4
- Value
208.67.104.97- First seen
- Last seen
- Attached to this threat
- Appears in
- 1 threat
Threat Hunt — feed corroboration
Not present in any configured threat-intel feed.
Details From VirusTotal
No VirusTotal details cached for this IOC. Open the IOC page to query VirusTotal.
url
http://91.92.241.242/success
IOC database
- Type
- url
- Value
http://91.92.241.242/success- First seen
- Last seen
- Attached to this threat
- Appears in
- 2 threats
- Description
- URL that is used for botnet Command&control (C&C) attributed to GCleaner
Threat Hunt — feed corroboration
Not present in any configured threat-intel feed.
Details From VirusTotal
No VirusTotal details cached for this IOC. Open the IOC page to query VirusTotal.
url
http://91.92.241.242/dll
IOC database
- Type
- url
- Value
http://91.92.241.242/dll- First seen
- Last seen
- Attached to this threat
- Appears in
- 2 threats
- Description
- URL that is used for botnet Command&control (C&C) attributed to GCleaner
Threat Hunt — feed corroboration
Not present in any configured threat-intel feed.
Details From VirusTotal
No VirusTotal details cached for this IOC. Open the IOC page to query VirusTotal.
url
http://91.92.241.242/update
IOC database
- Type
- url
- Value
http://91.92.241.242/update- First seen
- Last seen
- Attached to this threat
- Appears in
- 2 threats
- Description
- URL that is used for botnet Command&control (C&C) attributed to GCleaner
Threat Hunt — feed corroboration
Not present in any configured threat-intel feed.
Details From VirusTotal
No VirusTotal details cached for this IOC. Open the IOC page to query VirusTotal.
ipv4
142.251.110.132
VT: VT base fetch failed: HTTPError: 429 Client Error: Too Many Requests for url: https://www.virustotal.com/api/v3/ip_addresses/142.251.110.132
IOC database
- Type
- ipv4
- Value
142.251.110.132- First seen
- Last seen
- Attached to this threat
- Appears in
- 4 threats
- Description
- Resolved from url https://shopee-588.blogspot.com/?m=1
Threat Hunt — feed corroboration
Not present in any configured threat-intel feed.
Details From VirusTotal
VirusTotal: VT base fetch failed: HTTPError: 429 Client Error: Too Many Requests for url: https://www.virustotal.com/api/v3/ip_addresses/142.251.110.132
ipv4
5.42.64.2
VT: VT base fetch failed: HTTPError: 429 Client Error: Too Many Requests for url: https://www.virustotal.com/api/v3/ip_addresses/5.42.64.2
IOC database
- Type
- ipv4
- Value
5.42.64.2- First seen
- Last seen
- Attached to this threat
- Appears in
- 1 threat
- Description
- Resolved from url http://5.42.64.2
Threat Hunt — feed corroboration
Not present in any configured threat-intel feed.
Details From VirusTotal
VirusTotal: VT base fetch failed: HTTPError: 429 Client Error: Too Many Requests for url: https://www.virustotal.com/api/v3/ip_addresses/5.42.64.2
ipv4
5.42.65.64
VT: VT base fetch failed: HTTPError: 429 Client Error: Too Many Requests for url: https://www.virustotal.com/api/v3/ip_addresses/5.42.65.64
IOC database
- Type
- ipv4
- Value
5.42.65.64- First seen
- Last seen
- Attached to this threat
- Appears in
- 1 threat
- Description
- Resolved from url http://5.42.65.64
Threat Hunt — feed corroboration
Not present in any configured threat-intel feed.
Details From VirusTotal
VirusTotal: VT base fetch failed: HTTPError: 429 Client Error: Too Many Requests for url: https://www.virustotal.com/api/v3/ip_addresses/5.42.65.64
ipv4
158.94.209.95
VT: VT base fetch failed: HTTPError: 429 Client Error: Too Many Requests for url: https://www.virustotal.com/api/v3/ip_addresses/158.94.209.95
IOC database
- Type
- ipv4
- Value
158.94.209.95- First seen
- Last seen
- Attached to this threat
- Appears in
- 1 threat
- Description
- Resolved from url http://158.94.209.95/content
Threat Hunt — feed corroboration
Not present in any configured threat-intel feed.
Details From VirusTotal
VirusTotal: VT base fetch failed: HTTPError: 429 Client Error: Too Many Requests for url: https://www.virustotal.com/api/v3/ip_addresses/158.94.209.95
ipv4
5.42.64.56
VT: VT base fetch failed: HTTPError: 429 Client Error: Too Many Requests for url: https://www.virustotal.com/api/v3/ip_addresses/5.42.64.56
IOC database
- Type
- ipv4
- Value
5.42.64.56- First seen
- Last seen
- Attached to this threat
- Appears in
- 1 threat
- Description
- Resolved from url http://5.42.64.56
Threat Hunt — feed corroboration
Not present in any configured threat-intel feed.
Details From VirusTotal
VirusTotal: VT base fetch failed: HTTPError: 429 Client Error: Too Many Requests for url: https://www.virustotal.com/api/v3/ip_addresses/5.42.64.56
ipv4
185.172.128.69
VT: VT base fetch failed: HTTPError: 429 Client Error: Too Many Requests for url: https://www.virustotal.com/api/v3/ip_addresses/185.172.128.69
IOC database
- Type
- ipv4
- Value
185.172.128.69- First seen
- Last seen
- Attached to this threat
- Appears in
- 1 threat
- Description
- Resolved from url http://185.172.128.69
Threat Hunt — feed corroboration
Not present in any configured threat-intel feed.
Details From VirusTotal
VirusTotal: VT base fetch failed: HTTPError: 429 Client Error: Too Many Requests for url: https://www.virustotal.com/api/v3/ip_addresses/185.172.128.69
ipv4
5.42.64.3
VT: VT base fetch failed: HTTPError: 429 Client Error: Too Many Requests for url: https://www.virustotal.com/api/v3/ip_addresses/5.42.64.3
IOC database
- Type
- ipv4
- Value
5.42.64.3- First seen
- Last seen
- Attached to this threat
- Appears in
- 1 threat
- Description
- Resolved from url http://5.42.64.3
Threat Hunt — feed corroboration
Not present in any configured threat-intel feed.
Details From VirusTotal
VirusTotal: VT base fetch failed: HTTPError: 429 Client Error: Too Many Requests for url: https://www.virustotal.com/api/v3/ip_addresses/5.42.64.3
ipv4
85.209.11.204
VT: VT base fetch failed: HTTPError: 429 Client Error: Too Many Requests for url: https://www.virustotal.com/api/v3/ip_addresses/85.209.11.204
IOC database
- Type
- ipv4
- Value
85.209.11.204- First seen
- Last seen
- Attached to this threat
- Appears in
- 1 threat
- Description
- Resolved from url http://85.209.11.204
Threat Hunt — feed corroboration
Not present in any configured threat-intel feed.
Details From VirusTotal
VirusTotal: VT base fetch failed: HTTPError: 429 Client Error: Too Many Requests for url: https://www.virustotal.com/api/v3/ip_addresses/85.209.11.204
ipv4
5.42.64.10
VT: VT base fetch failed: HTTPError: 429 Client Error: Too Many Requests for url: https://www.virustotal.com/api/v3/ip_addresses/5.42.64.10
IOC database
- Type
- ipv4
- Value
5.42.64.10- First seen
- Last seen
- Attached to this threat
- Appears in
- 1 threat
- Description
- Resolved from url http://5.42.64.10
Threat Hunt — feed corroboration
Not present in any configured threat-intel feed.
Details From VirusTotal
VirusTotal: VT base fetch failed: HTTPError: 429 Client Error: Too Many Requests for url: https://www.virustotal.com/api/v3/ip_addresses/5.42.64.10
ipv4
92.63.197.221
VT: VT base fetch failed: HTTPError: 429 Client Error: Too Many Requests for url: https://www.virustotal.com/api/v3/ip_addresses/92.63.197.221
IOC database
- Type
- ipv4
- Value
92.63.197.221- First seen
- Last seen
- Attached to this threat
- Appears in
- 1 threat
- Description
- Resolved from url http://92.63.197.221
Threat Hunt — feed corroboration
Not present in any configured threat-intel feed.
Details From VirusTotal
VirusTotal: VT base fetch failed: HTTPError: 429 Client Error: Too Many Requests for url: https://www.virustotal.com/api/v3/ip_addresses/92.63.197.221
ipv4
171.22.30.106
VT: VT base fetch failed: HTTPError: 429 Client Error: Too Many Requests for url: https://www.virustotal.com/api/v3/ip_addresses/171.22.30.106
IOC database
- Type
- ipv4
- Value
171.22.30.106- First seen
- Last seen
- Attached to this threat
- Appears in
- 1 threat
- Description
- Resolved from url http://171.22.30.106
Threat Hunt — feed corroboration
Not present in any configured threat-intel feed.
Details From VirusTotal
VirusTotal: VT base fetch failed: HTTPError: 429 Client Error: Too Many Requests for url: https://www.virustotal.com/api/v3/ip_addresses/171.22.30.106
ipv4
85.31.46.167
VT: VT base fetch failed: HTTPError: 429 Client Error: Too Many Requests for url: https://www.virustotal.com/api/v3/ip_addresses/85.31.46.167
IOC database
- Type
- ipv4
- Value
85.31.46.167- First seen
- Last seen
- Attached to this threat
- Appears in
- 1 threat
- Description
- Resolved from url http://85.31.46.167
Threat Hunt — feed corroboration
Not present in any configured threat-intel feed.
Details From VirusTotal
VirusTotal: VT base fetch failed: HTTPError: 429 Client Error: Too Many Requests for url: https://www.virustotal.com/api/v3/ip_addresses/85.31.46.167
ipv4
45.12.253.75
VT: VT base fetch failed: HTTPError: 429 Client Error: Too Many Requests for url: https://www.virustotal.com/api/v3/ip_addresses/45.12.253.75
IOC database
- Type
- ipv4
- Value
45.12.253.75- First seen
- Last seen
- Attached to this threat
- Appears in
- 1 threat
- Description
- Resolved from url http://45.12.253.75
Threat Hunt — feed corroboration
Not present in any configured threat-intel feed.
Details From VirusTotal
VirusTotal: VT base fetch failed: HTTPError: 429 Client Error: Too Many Requests for url: https://www.virustotal.com/api/v3/ip_addresses/45.12.253.75
ipv4
185.172.128.90
VT: VT base fetch failed: HTTPError: 429 Client Error: Too Many Requests for url: https://www.virustotal.com/api/v3/ip_addresses/185.172.128.90
IOC database
- Type
- ipv4
- Value
185.172.128.90- First seen
- Last seen
- Attached to this threat
- Appears in
- 2 threats
- Description
- Resolved from url http://185.172.128.90/cpa/ping.php?substr=two&s=ab&sub=0
Threat Hunt — feed corroboration
Not present in any configured threat-intel feed.
Details From VirusTotal
VirusTotal: VT base fetch failed: HTTPError: 429 Client Error: Too Many Requests for url: https://www.virustotal.com/api/v3/ip_addresses/185.172.128.90
ipv4
5.42.65.85
VT: VT base fetch failed: HTTPError: 429 Client Error: Too Many Requests for url: https://www.virustotal.com/api/v3/ip_addresses/5.42.65.85
IOC database
- Type
- ipv4
- Value
5.42.65.85- First seen
- Last seen
- Attached to this threat
- Appears in
- 1 threat
- Description
- Resolved from url http://5.42.65.85
Threat Hunt — feed corroboration
Not present in any configured threat-intel feed.
Details From VirusTotal
VirusTotal: VT base fetch failed: HTTPError: 429 Client Error: Too Many Requests for url: https://www.virustotal.com/api/v3/ip_addresses/5.42.65.85
ipv4
45.12.253.72
VT: VT base fetch failed: HTTPError: 429 Client Error: Too Many Requests for url: https://www.virustotal.com/api/v3/ip_addresses/45.12.253.72
IOC database
- Type
- ipv4
- Value
45.12.253.72- First seen
- Last seen
- Attached to this threat
- Appears in
- 1 threat
- Description
- Resolved from url http://45.12.253.72
Threat Hunt — feed corroboration
Not present in any configured threat-intel feed.
Details From VirusTotal
VirusTotal: VT base fetch failed: HTTPError: 429 Client Error: Too Many Requests for url: https://www.virustotal.com/api/v3/ip_addresses/45.12.253.72
ipv4
45.12.253.98
VT: VT base fetch failed: HTTPError: 429 Client Error: Too Many Requests for url: https://www.virustotal.com/api/v3/ip_addresses/45.12.253.98
IOC database
- Type
- ipv4
- Value
45.12.253.98- First seen
- Last seen
- Attached to this threat
- Appears in
- 1 threat
- Description
- Resolved from url http://45.12.253.98
Threat Hunt — feed corroboration
Not present in any configured threat-intel feed.
Details From VirusTotal
VirusTotal: VT base fetch failed: HTTPError: 429 Client Error: Too Many Requests for url: https://www.virustotal.com/api/v3/ip_addresses/45.12.253.98
ipv4
91.92.255.211
VT: VT base fetch failed: HTTPError: 429 Client Error: Too Many Requests for url: https://www.virustotal.com/api/v3/ip_addresses/91.92.255.211
IOC database
- Type
- ipv4
- Value
91.92.255.211- First seen
- Last seen
- Attached to this threat
- Appears in
- 1 threat
- Description
- Resolved from url http://91.92.255.211
Threat Hunt — feed corroboration
Not present in any configured threat-intel feed.
Details From VirusTotal
VirusTotal: VT base fetch failed: HTTPError: 429 Client Error: Too Many Requests for url: https://www.virustotal.com/api/v3/ip_addresses/91.92.255.211
ipv4
91.92.255.231
VT: VT base fetch failed: HTTPError: 429 Client Error: Too Many Requests for url: https://www.virustotal.com/api/v3/ip_addresses/91.92.255.231
IOC database
- Type
- ipv4
- Value
91.92.255.231- First seen
- Last seen
- Attached to this threat
- Appears in
- 1 threat
- Description
- Resolved from url http://91.92.255.231
Threat Hunt — feed corroboration
Not present in any configured threat-intel feed.
Details From VirusTotal
VirusTotal: VT base fetch failed: HTTPError: 429 Client Error: Too Many Requests for url: https://www.virustotal.com/api/v3/ip_addresses/91.92.255.231
ipv4
37.0.8.39
VT: VT base fetch failed: HTTPError: 429 Client Error: Too Many Requests for url: https://www.virustotal.com/api/v3/ip_addresses/37.0.8.39
IOC database
- Type
- ipv4
- Value
37.0.8.39- First seen
- Last seen
- Attached to this threat
- Appears in
- 1 threat
- Description
- Resolved from url http://37.0.8.39
Threat Hunt — feed corroboration
Not present in any configured threat-intel feed.
Details From VirusTotal
VirusTotal: VT base fetch failed: HTTPError: 429 Client Error: Too Many Requests for url: https://www.virustotal.com/api/v3/ip_addresses/37.0.8.39
ipv4
212.192.241.16
VT: VT base fetch failed: HTTPError: 429 Client Error: Too Many Requests for url: https://www.virustotal.com/api/v3/ip_addresses/212.192.241.16
IOC database
- Type
- ipv4
- Value
212.192.241.16- First seen
- Last seen
- Attached to this threat
- Appears in
- 1 threat
- Description
- Resolved from url http://212.192.241.16
Threat Hunt — feed corroboration
Not present in any configured threat-intel feed.
Details From VirusTotal
VirusTotal: VT base fetch failed: HTTPError: 429 Client Error: Too Many Requests for url: https://www.virustotal.com/api/v3/ip_addresses/212.192.241.16
ipv4
142.250.154.132
VT: VT base fetch failed: HTTPError: 429 Client Error: Too Many Requests for url: https://www.virustotal.com/api/v3/ip_addresses/142.250.154.132
IOC database
- Type
- ipv4
- Value
142.250.154.132- First seen
- Last seen
- Attached to this threat
- Appears in
- 2 threats
- Description
- Resolved from url https://drive.usercontent.google.com/download?id=1ybvidkzgygnfuu2rbjxxcydrzay5rmdy&export=download&authuser=0&confirm=t
Threat Hunt — feed corroboration
Not present in any configured threat-intel feed.
Details From VirusTotal
VirusTotal: VT base fetch failed: HTTPError: 429 Client Error: Too Many Requests for url: https://www.virustotal.com/api/v3/ip_addresses/142.250.154.132
ipv4
31.210.20.149
VT: VT base fetch failed: HTTPError: 429 Client Error: Too Many Requests for url: https://www.virustotal.com/api/v3/ip_addresses/31.210.20.149
IOC database
- Type
- ipv4
- Value
31.210.20.149- First seen
- Last seen
- Attached to this threat
- Appears in
- 1 threat
- Description
- Resolved from url http://31.210.20.149
Threat Hunt — feed corroboration
Not present in any configured threat-intel feed.
Details From VirusTotal
VirusTotal: VT base fetch failed: HTTPError: 429 Client Error: Too Many Requests for url: https://www.virustotal.com/api/v3/ip_addresses/31.210.20.149
ipv4
185.156.73.98
VT: VT base fetch failed: HTTPError: 429 Client Error: Too Many Requests for url: https://www.virustotal.com/api/v3/ip_addresses/185.156.73.98
IOC database
- Type
- ipv4
- Value
185.156.73.98- First seen
- Last seen
- Attached to this threat
- Appears in
- 1 threat
- Description
- Resolved from url http://185.156.73.98/service
Threat Hunt — feed corroboration
Not present in any configured threat-intel feed.
Details From VirusTotal
VirusTotal: VT base fetch failed: HTTPError: 429 Client Error: Too Many Requests for url: https://www.virustotal.com/api/v3/ip_addresses/185.156.73.98
ipv4
5.42.65.115
VT: VT base fetch failed: HTTPError: 429 Client Error: Too Many Requests for url: https://www.virustotal.com/api/v3/ip_addresses/5.42.65.115
IOC database
- Type
- ipv4
- Value
5.42.65.115- First seen
- Last seen
- Attached to this threat
- Appears in
- 1 threat
- Description
- Resolved from url http://5.42.65.115
Threat Hunt — feed corroboration
Not present in any configured threat-intel feed.
Details From VirusTotal
VirusTotal: VT base fetch failed: HTTPError: 429 Client Error: Too Many Requests for url: https://www.virustotal.com/api/v3/ip_addresses/5.42.65.115
ipv4
45.12.253.56
VT: VT base fetch failed: HTTPError: 429 Client Error: Too Many Requests for url: https://www.virustotal.com/api/v3/ip_addresses/45.12.253.56
IOC database
- Type
- ipv4
- Value
45.12.253.56- First seen
- Last seen
- Attached to this threat
- Appears in
- 1 threat
- Description
- Resolved from url http://45.12.253.56
Threat Hunt — feed corroboration
Not present in any configured threat-intel feed.
Details From VirusTotal
VirusTotal: VT base fetch failed: HTTPError: 429 Client Error: Too Many Requests for url: https://www.virustotal.com/api/v3/ip_addresses/45.12.253.56
url
http://85.208.136.48
IOC database
- Type
- url
- Value
http://85.208.136.48- First seen
- Last seen
- Attached to this threat
- Appears in
- 1 threat
Threat Hunt — feed corroboration
Not present in any configured threat-intel feed.
Details From VirusTotal
No VirusTotal details cached for this IOC. Open the IOC page to query VirusTotal.
url
http://85.208.136.87
IOC database
- Type
- url
- Value
http://85.208.136.87- First seen
- Last seen
- Attached to this threat
- Appears in
- 1 threat
Threat Hunt — feed corroboration
Not present in any configured threat-intel feed.
Details From VirusTotal
No VirusTotal details cached for this IOC. Open the IOC page to query VirusTotal.
url
http://91.92.241.242/service
IOC database
- Type
- url
- Value
http://91.92.241.242/service- First seen
- Last seen
- Attached to this threat
- Appears in
- 2 threats
- Description
- URL that is used for botnet Command&control (C&C) attributed to GCleaner
Threat Hunt — feed corroboration
Not present in any configured threat-intel feed.
Details From VirusTotal
No VirusTotal details cached for this IOC. Open the IOC page to query VirusTotal.
url
http://5.42.64.2
IOC database
- Type
- url
- Value
http://5.42.64.2- First seen
- Last seen
- Attached to this threat
- Appears in
- 1 threat
Threat Hunt — feed corroboration
Not present in any configured threat-intel feed.
Details From VirusTotal
No VirusTotal details cached for this IOC. Open the IOC page to query VirusTotal.
url
http://5.42.65.64
IOC database
- Type
- url
- Value
http://5.42.65.64- First seen
- Last seen
- Attached to this threat
- Appears in
- 1 threat
Threat Hunt — feed corroboration
Not present in any configured threat-intel feed.
Details From VirusTotal
No VirusTotal details cached for this IOC. Open the IOC page to query VirusTotal.
url
http://158.94.209.95/good
IOC database
- Type
- url
- Value
http://158.94.209.95/good- First seen
- Last seen
- Attached to this threat
- Appears in
- 1 threat
Threat Hunt — feed corroboration
Not present in any configured threat-intel feed.
Details From VirusTotal
No VirusTotal details cached for this IOC. Open the IOC page to query VirusTotal.
url
http://158.94.209.95/service
IOC database
- Type
- url
- Value
http://158.94.209.95/service- First seen
- Last seen
- Attached to this threat
- Appears in
- 1 threat
Threat Hunt — feed corroboration
Not present in any configured threat-intel feed.
Details From VirusTotal
No VirusTotal details cached for this IOC. Open the IOC page to query VirusTotal.
url
http://158.94.209.95/update
IOC database
- Type
- url
- Value
http://158.94.209.95/update- First seen
- Last seen
- Attached to this threat
- Appears in
- 1 threat
Threat Hunt — feed corroboration
Not present in any configured threat-intel feed.
Details From VirusTotal
No VirusTotal details cached for this IOC. Open the IOC page to query VirusTotal.
url
http://158.94.209.95/dll
IOC database
- Type
- url
- Value
http://158.94.209.95/dll- First seen
- Last seen
- Attached to this threat
- Appears in
- 1 threat
Threat Hunt — feed corroboration
Not present in any configured threat-intel feed.
Details From VirusTotal
No VirusTotal details cached for this IOC. Open the IOC page to query VirusTotal.
url
http://158.94.209.95/success
IOC database
- Type
- url
- Value
http://158.94.209.95/success- First seen
- Last seen
- Attached to this threat
- Appears in
- 1 threat
Threat Hunt — feed corroboration
Not present in any configured threat-intel feed.
Details From VirusTotal
No VirusTotal details cached for this IOC. Open the IOC page to query VirusTotal.
url
http://158.94.209.95/info
IOC database
- Type
- url
- Value
http://158.94.209.95/info- First seen
- Last seen
- Attached to this threat
- Appears in
- 1 threat
Threat Hunt — feed corroboration
Not present in any configured threat-intel feed.
Details From VirusTotal
No VirusTotal details cached for this IOC. Open the IOC page to query VirusTotal.
url
http://158.94.209.95/content
IOC database
- Type
- url
- Value
http://158.94.209.95/content- First seen
- Last seen
- Attached to this threat
- Appears in
- 1 threat
Threat Hunt — feed corroboration
Not present in any configured threat-intel feed.
Details From VirusTotal
No VirusTotal details cached for this IOC. Open the IOC page to query VirusTotal.
url
http://5.42.64.56
IOC database
- Type
- url
- Value
http://5.42.64.56- First seen
- Last seen
- Attached to this threat
- Appears in
- 1 threat
Threat Hunt — feed corroboration
Not present in any configured threat-intel feed.
Details From VirusTotal
No VirusTotal details cached for this IOC. Open the IOC page to query VirusTotal.
url
http://185.172.128.69
IOC database
- Type
- url
- Value
http://185.172.128.69- First seen
- Last seen
- Attached to this threat
- Appears in
- 1 threat
Threat Hunt — feed corroboration
Not present in any configured threat-intel feed.
Details From VirusTotal
No VirusTotal details cached for this IOC. Open the IOC page to query VirusTotal.
url
http://5.42.64.3
IOC database
- Type
- url
- Value
http://5.42.64.3- First seen
- Last seen
- Attached to this threat
- Appears in
- 1 threat
Threat Hunt — feed corroboration
Not present in any configured threat-intel feed.
Details From VirusTotal
No VirusTotal details cached for this IOC. Open the IOC page to query VirusTotal.
url
http://85.209.11.204
IOC database
- Type
- url
- Value
http://85.209.11.204- First seen
- Last seen
- Attached to this threat
- Appears in
- 1 threat
Threat Hunt — feed corroboration
Not present in any configured threat-intel feed.
Details From VirusTotal
No VirusTotal details cached for this IOC. Open the IOC page to query VirusTotal.
url
http://5.42.64.10
IOC database
- Type
- url
- Value
http://5.42.64.10- First seen
- Last seen
- Attached to this threat
- Appears in
- 1 threat
Threat Hunt — feed corroboration
Not present in any configured threat-intel feed.
Details From VirusTotal
No VirusTotal details cached for this IOC. Open the IOC page to query VirusTotal.
url
http://92.63.197.221
IOC database
- Type
- url
- Value
http://92.63.197.221- First seen
- Last seen
- Attached to this threat
- Appears in
- 1 threat
Threat Hunt — feed corroboration
Not present in any configured threat-intel feed.
Details From VirusTotal
No VirusTotal details cached for this IOC. Open the IOC page to query VirusTotal.
url
http://85.31.46.167
IOC database
- Type
- url
- Value
http://85.31.46.167- First seen
- Last seen
- Attached to this threat
- Appears in
- 1 threat
Threat Hunt — feed corroboration
Not present in any configured threat-intel feed.
Details From VirusTotal
No VirusTotal details cached for this IOC. Open the IOC page to query VirusTotal.
url
http://171.22.30.106
IOC database
- Type
- url
- Value
http://171.22.30.106- First seen
- Last seen
- Attached to this threat
- Appears in
- 1 threat
Threat Hunt — feed corroboration
Not present in any configured threat-intel feed.
Details From VirusTotal
No VirusTotal details cached for this IOC. Open the IOC page to query VirusTotal.
url
http://45.12.253.75
IOC database
- Type
- url
- Value
http://45.12.253.75- First seen
- Last seen
- Attached to this threat
- Appears in
- 1 threat
Threat Hunt — feed corroboration
Not present in any configured threat-intel feed.
Details From VirusTotal
No VirusTotal details cached for this IOC. Open the IOC page to query VirusTotal.
url
http://185.172.128.90
IOC database
- Type
- url
- Value
http://185.172.128.90- First seen
- Last seen
- Attached to this threat
- Appears in
- 1 threat
Threat Hunt — feed corroboration
Not present in any configured threat-intel feed.
Details From VirusTotal
No VirusTotal details cached for this IOC. Open the IOC page to query VirusTotal.
url
http://5.42.65.85
IOC database
- Type
- url
- Value
http://5.42.65.85- First seen
- Last seen
- Attached to this threat
- Appears in
- 1 threat
Threat Hunt — feed corroboration
Not present in any configured threat-intel feed.
Details From VirusTotal
No VirusTotal details cached for this IOC. Open the IOC page to query VirusTotal.
url
http://45.12.253.72
IOC database
- Type
- url
- Value
http://45.12.253.72- First seen
- Last seen
- Attached to this threat
- Appears in
- 1 threat
Threat Hunt — feed corroboration
Not present in any configured threat-intel feed.
Details From VirusTotal
No VirusTotal details cached for this IOC. Open the IOC page to query VirusTotal.
url
http://45.12.253.98
IOC database
- Type
- url
- Value
http://45.12.253.98- First seen
- Last seen
- Attached to this threat
- Appears in
- 1 threat
Threat Hunt — feed corroboration
Not present in any configured threat-intel feed.
Details From VirusTotal
No VirusTotal details cached for this IOC. Open the IOC page to query VirusTotal.
url
http://91.92.255.211
IOC database
- Type
- url
- Value
http://91.92.255.211- First seen
- Last seen
- Attached to this threat
- Appears in
- 1 threat
Threat Hunt — feed corroboration
Not present in any configured threat-intel feed.
Details From VirusTotal
No VirusTotal details cached for this IOC. Open the IOC page to query VirusTotal.
url
http://91.92.255.231
IOC database
- Type
- url
- Value
http://91.92.255.231- First seen
- Last seen
- Attached to this threat
- Appears in
- 1 threat
Threat Hunt — feed corroboration
Not present in any configured threat-intel feed.
Details From VirusTotal
No VirusTotal details cached for this IOC. Open the IOC page to query VirusTotal.
url
http://37.0.8.39
IOC database
- Type
- url
- Value
http://37.0.8.39- First seen
- Last seen
- Attached to this threat
- Appears in
- 1 threat
Threat Hunt — feed corroboration
Not present in any configured threat-intel feed.
Details From VirusTotal
No VirusTotal details cached for this IOC. Open the IOC page to query VirusTotal.
url
http://212.192.241.16
IOC database
- Type
- url
- Value
http://212.192.241.16- First seen
- Last seen
- Attached to this threat
- Appears in
- 1 threat
Threat Hunt — feed corroboration
Not present in any configured threat-intel feed.
Details From VirusTotal
No VirusTotal details cached for this IOC. Open the IOC page to query VirusTotal.
url
http://31.210.20.149
VT 1 / 93
IOC database
- Type
- url
- Value
http://31.210.20.149- First seen
- Last seen
- Attached to this threat
- Appears in
- 1 threat
Threat Hunt — feed corroboration
Not present in any configured threat-intel feed.
Flagged by 1 of 93 VirusTotal vendors
| Vendor | Verdict | Detection |
|---|---|---|
| SOCRadar | malicious | malware |
Details From VirusTotal
Basic Properties
| Final URL | http://31.210.20.149/ |
History
| First seen on VirusTotal | 2021-05-11 18:52 UTC |
| Last submission | 2026-05-07 19:21 UTC |
| Last analysis | 2026-05-07 19:21 UTC |
| Last modified on VirusTotal | 2026-05-09 10:00 UTC |
ipv4
91.92.241.242
VT: VT base fetch failed: HTTPError: 429 Too Many Requests for ip_addresses/91.92.241.242
IOC database
- Type
- ipv4
- Value
91.92.241.242- First seen
- Last seen
- Attached to this threat
- Appears in
- 6 threats
Threat Hunt — feed corroboration
Not present in any configured threat-intel feed.
Details From VirusTotal
VirusTotal: VT base fetch failed: HTTPError: 429 Too Many Requests for ip_addresses/91.92.241.242
url
https://drive.usercontent.google.com/download?id=1ybvidkzgygnfuu2rbjxxcydrzay5rmdy&export=download&authuser=0&confirm=t
UrlVoid 0 / 35
IOC database
- Type
- url
- Value
https://drive.usercontent.google.com/download?id=1ybvidkzgygnfuu2rbjxxcydrzay5rmdy&export=download&authuser=0&confirm=t- First seen
- Last seen
- Attached to this threat
- Appears in
- 1 threat
Threat Hunt — feed corroboration
Not present in any configured threat-intel feed.
Details From VirusTotal
No VirusTotal details cached for this IOC. Open the IOC page to query VirusTotal.
url
http://185.156.73.98/service
IOC database
- Type
- url
- Value
http://185.156.73.98/service- First seen
- Last seen
- Attached to this threat
- Appears in
- 1 threat
Threat Hunt — feed corroboration
Not present in any configured threat-intel feed.
Details From VirusTotal
No VirusTotal details cached for this IOC. Open the IOC page to query VirusTotal.
url
http://5.42.65.115
IOC database
- Type
- url
- Value
http://5.42.65.115- First seen
- Last seen
- Attached to this threat
- Appears in
- 1 threat
Threat Hunt — feed corroboration
Not present in any configured threat-intel feed.
Details From VirusTotal
No VirusTotal details cached for this IOC. Open the IOC page to query VirusTotal.
url
http://45.12.253.56
IOC database
- Type
- url
- Value
http://45.12.253.56- First seen
- Last seen
- Attached to this threat
- Appears in
- 1 threat
Threat Hunt — feed corroboration
Not present in any configured threat-intel feed.
Details From VirusTotal
No VirusTotal details cached for this IOC. Open the IOC page to query VirusTotal.
ipv4
85.208.136.48
IOC database
- Type
- ipv4
- Value
85.208.136.48- First seen
- Last seen
- Attached to this threat
- Appears in
- 1 threat
Threat Hunt — feed corroboration
Not present in any configured threat-intel feed.
Details From VirusTotal
No VirusTotal details cached for this IOC. Open the IOC page to query VirusTotal.
ipv4
85.208.136.87
IOC database
- Type
- ipv4
- Value
85.208.136.87- First seen
- Last seen
- Attached to this threat
- Appears in
- 1 threat
Threat Hunt — feed corroboration
Not present in any configured threat-intel feed.
Details From VirusTotal
No VirusTotal details cached for this IOC. Open the IOC page to query VirusTotal.
ipv4
45.9.20.13
IOC database
- Type
- ipv4
- Value
45.9.20.13- First seen
- Last seen
- Attached to this threat
- Appears in
- 1 threat
Threat Hunt — feed corroboration
Not present in any configured threat-intel feed.
Details From VirusTotal
No VirusTotal details cached for this IOC. Open the IOC page to query VirusTotal.
ipv4
85.208.136.148
IOC database
- Type
- ipv4
- Value
85.208.136.148- First seen
- Last seen
- Attached to this threat
- Appears in
- 1 threat
Threat Hunt — feed corroboration
Not present in any configured threat-intel feed.
Details From VirusTotal
No VirusTotal details cached for this IOC. Open the IOC page to query VirusTotal.
url
http://45.9.20.13
IOC database
- Type
- url
- Value
http://45.9.20.13- First seen
- Last seen
- Attached to this threat
- Appears in
- 1 threat
Threat Hunt — feed corroboration
Not present in any configured threat-intel feed.
Details From VirusTotal
No VirusTotal details cached for this IOC. Open the IOC page to query VirusTotal.
url
http://85.208.136.148
IOC database
- Type
- url
- Value
http://85.208.136.148- First seen
- Last seen
- Attached to this threat
- Appears in
- 1 threat
Threat Hunt — feed corroboration
Not present in any configured threat-intel feed.
Details From VirusTotal
No VirusTotal details cached for this IOC. Open the IOC page to query VirusTotal.
References (1)
-
OTX pulse
AlienVaulkt OTX
This pulse contains IOCs related to GCleaner campaigns. Additions are automatically added based on several sources like: OTX sandboxes samples, internal tools, through the use of Shodan or Censys queries, shared intel from LevelBlue partners or external feeds.
Remediations (8)
-
web:archive.org
Full text of "NEW" See other formats Word . the , > < br to of and a : " in you that i it he is was for - with ) on ( ? his as this ; be at but not have had from will are they -- ! all by if him one your or up her there can so out them an my when she 1 no which me were we then 2 into 5 do what get go their now said would about time quot ] [ more only back been who down like has some --- just 3 ...
-
web:arxiv.org
To bridge this gap, we present GCleaner , the first backdoor mitigation method on GNNs. GCleaner can mitigate the presence of the backdoor logic within backdoored GNNs by reversing the backdoor learning procedure, aiming to restore the model performance to a level similar to that is directly trained on the original clean dataset.
-
web:attack.mitre.org
MITRE ATT&CK ® is a globally-accessible knowledge base of adversary tactics and techniques based on real-world observations. The ATT&CK knowledge base is used as a foundation for the development of specific threat models and methodologies in the private sector, in government, and in the cybersecurity product and service community. With the creation of ATT&CK, MITRE is fulfilling its mission ...
-
web:gcleaner.github.io
GCleaner is an open-source system cleaner that helps you maintain your GNU/Linux system efficiently. Join our community of developers and contribute to this amazing project!
-
web:github.com
Automatically created C2 Feeds. Contribute to drb-ra/C2IntelFeeds development by creating an account on GitHub.
-
web:whois.domaintools.com
Research domain ownership with Whois Lookup: Get ownership info, IP address history, rank, traffic, SEO & more. Find available domains & domains for sale.
-
web:www.ccleaner.com
Explore CCleaner's knowledge base for tips, guides, and solutions to optimize your PC, Mac, or Android device effectively.
-
web:www.sonicwall.com
Overview This week, the SonicWall Capture Labs threat research team investigated a sample of GCleaner , a Themida-packed malware variant that downloads and drops additional malware, has C2 , heavy anti-analysis/anti-VM, and evasion capabilities. GCleaner will also attempt to infect removable drives by encryption or to spread to other systems. Infection Cycle The main executable has a variety of ...
AI Forensic Analysis
Only Available for Registered Users. Sign in to view.