Payload download host
177.104.169.18
This address has not connected to a sensor. It is the download host named inside captured dropper payloads.
Named in captured payloads
Dropper payloads captured by the sensors told them to fetch malware from this host. The host itself has not connected to a sensor; it is the download target in 3 captured payloads.
| File | SHA-256 | VirusTotal | Via | First seen |
|---|---|---|---|---|
| chain_redis.sh | 719070d44807e5c2... | 1/75 | interactive session | 2026-10-21 |
| [http]://177[.]104[.]169[.]18/tj/stage/chain_redis.sh?t=6291faefb6bfab92c9c5837ea99f34b0 | ||||
| x12345 | b20f39fc00d242e7... | 39/75 | interactive session | 2026-10-20 |
| [http]://177[.]104[.]169[.]18:88/look/xmrig.bin | ||||
| c2.php | 68bf25bb54fd2fa3... | 0/75 | interactive session | 2026-10-20 |
| [http]://177[.]104[.]169[.]18/tj/c2.php?a=boot&t=6291faefb6bfab92c9c5837ea99f34b0 | ||||