#StagedC2 - Twitter Hashtag

TomU | I'm still here... til the end 🕊️🇨🇭 @c_APT_ure

11 months ago

Looks like same C2 was used a while back... https://t.co/3E55xvtScM 22 days ago #StagedC2 config observed at Thu Jul 31 00:39:06 2025 UTC, located at hXXps://pastebin[.com/raw/wRGJEgeV C2: 193.187.90.27:61447 Thanks @pmelson !

1

3

0

233

Paul Melson @pmelson

almost 2 years ago

It’s rare for @ScumBots to see both the #StagedC2 file and the malware binary that uses it, but this week that happened. The C2 config was almost a whole week ahead of the payload.

pmelson's tweet photo. It’s rare for @ScumBots to see both the #StagedC2 file and the malware binary that uses it, but this week that happened. The C2 config was almost a whole week ahead of the payload. https://t.co/kgWEvDlkhI

0

26

8

4

3K

ScumBots @ScumBots

almost 2 years ago

#StagedC2 config observed at Thu Sep 5 15:40:04 2024 UTC, located at hXXps://pastebin[.]com/raw/sx8X1a6G C2: 4[.]tcp[.]eu[.]ngrok[.]io:16570 (IP: 3.121.139.82)

0

2

0

1

139

ScumBots @ScumBots

almost 2 years ago

#StagedC2 config observed at Tue Aug 20 18:21:07 2024 UTC, located at hXXps://pastebin[.]com/raw/BiC80pfU C2: 6[.]tcp[.]eu[.]ngrok[.]io:14569 (IP: 18.197.239.109)

0

1

0

212

ScumBots @ScumBots

almost 2 years ago

#StagedC2 config observed at Tue Aug 20 08:33:07 2024 UTC, located at hXXps://pastebin[.]com/raw/1rTkriMw C2: french-wallet[.]gl[.]at[.]ply[.]gg:63886 (IP: 147.185.221.19)

0

121

ScumBots @ScumBots

almost 2 years ago

#StagedC2 config observed at Sat Jul 27 18:59:08 2024 UTC, located at hXXps://pastebin[.]com/raw/XQV8H48q C2: 147[.]185[.]221[.]18:34323

0

1

0

159

ScumBots @ScumBots

about 2 years ago

#StagedC2 config observed at Tue Jul 9 13:33:03 2024 UTC, located at hXXps://pastebin[.]com/raw/yAUA39gK C2: could-tex[.]gl[.]at[.]ply[.]gg:11942 (IP: 147.185.221.17)

0

2

0

125

Top Tweets for #StagedC2

Last Seen Hashtags on Sotwe

Trends for you

Most Popular Users