Skip to main content

CountLoader

Malware Family

378 indicators of compromise attributed to CountLoader across abuse.ch threat intelligence feeds.

Domains

65

IPs

10

URLs

2

Hashes

301

Download indicators

Indicator lists for this family. Free and anonymous downloads are a 10% sample.

Need continuous updates instead of static lists? The same IOCs ship in the STIX/TAXII threat feed, ready for OpenCTI and MISP.

Threat types

Botnet C&CPayload Delivery

Sample indicators

IndicatorType
diospfj.cyoudomain
brownhc.cyoudomain
shenyac.cyoudomain
snconor.vgdomain
windows-telemetry.ccdomain
rostov-uga.comdomain
alpha-centavr.ccdomain
files-storage.ccdomain
airdefence.gldomain
network-defender.ccdomain
hosting-control.ccdomain
captcha-verification.ccdomain
police-center.vgdomain
favourite-guide.ccdomain
s3-python.ccdomain
magnusworkspace.comdomain
node2-py-store.comdomain
memory-shield.vgdomain
googie-services.vgdomain
pos-terminal.vgdomain
134.122.38.224ip
104.248.198.130ip
31.57.118.10ip
176.65.132.185ip
217.156.66.151ip
94.26.106.134ip
85.121.148.13ip
37.221.66.207ip
31.56.176.201ip
194.76.226.162ip
https://windows-telemetry.cc/api/submiturl
https://msgrouppolicy.vg/url
1416b7f11709753962b3214d17bd76b44b63c39490f6364963a345ef0cc4699dhash
7f626bf4cb03e3f03e27313d2701b70a8f533096d8b1f12e714ddc61fcaf7ee5hash
b8fb3957d39cf0fc092bf066683d6bac33343e99b5ac9f198f5378e4e6056a7chash
51c41d5d8024ad4d026cd7b8a54cd65be31daff721a5696e569bf3924a9fc1f8hash
fd5639a721613412c47af04829814d9b5808156d6196b95a5739a27b3324c8b0hash
354078865d8ba88d386fb4590bec1ae8e91a2eeef9827c59faa896bd9e044339hash
a13d177582320fd9879c6bfe56907a59693deac07139fdbffd874b05e4c2fdbdhash
3aef5773707bcd2ac1d33b4ab18be2341f4f6f40acf784837ebc9222770facf8hash
691a6e46a7c0e2f2a0a5ae4e7d5c64deb03e230d0202cb4bed82e27188c485d2hash
968a2eea5410179d80bc792a42b180ac97f0c34323ce6f43c435bfaa72b31dbahash
a7733878c28243059c112f76bcacde975e1874817c665bbde0f07174e395c055hash
462dee7c6980414d4b0774a46b38bb54da2d64b11b6f191137e1433c9b6a81bfhash
91a4278df997ad37ead2333b61cea248891201378436ae6a22b3954761341ab1hash
eb8e5b18dbb7dedcb01baa3a772313f775ce0cfeb370cbd815e2f7b382596ba7hash
f4cbfa1d48ee398e983eab2fc604e96c77c44334208c724c1217337335bdfdf8hash
b591ba89df977e1df340db28d2db7ad447b7647a0cf20e61fa48b67298e44eb5hash
6370b0bf653168199cd75957cc1cb02a9f50871882c87a31ba091de6ba4a0d49hash
3f57ab217e58e2bdaae00774a80805d03a9e32a4a9513ce0670b0eecb4dc71fehash
4ee17ce2e1ce0ede59dceabbba28265923ce4e25ddb002617e3cc8f13cfff6a3hash
f061a7c86a39411cd19ba983a15953c37df9ce31e6b01babc264421a5658780chash

Another file to check? Run a file hash reputation check.