{
  "metadata": {
    "generator": "Bulwark Black IOC Extractor",
    "source": "https://bulwarkblack.com/ahsaycbs-webshell-miner-backup-server-defense/",
    "fang": "live",
    "exported_at": "2026-10-12T01:04:36Z",
    "total": 28,
    "categories": 7
  },
  "iocs": {
    "IPv4": [
      "104.234.26.10",
      "107.191.47.199",
      "123.202.208.37",
      "177.4.12.11",
      "185.220.236.49",
      "38.60.252.110",
      "51.195.127.124"
    ],
    "IPv4:Port": [
      "51.195.127.124:8029"
    ],
    "ASN": [
      "AS134677",
      "AS140227",
      "AS154177",
      "AS20473",
      "AS38136",
      "AS9269"
    ],
    "Domains": [
      "aliyuncs.com",
      "imagefiles-backup.oss-ap-southeast-7.aliyuncs.com",
      "xmr.kryptex.network"
    ],
    "URLs": [
      "http://imagefiles-backup.oss-ap-southeast-7.aliyuncs.com",
      "http://imagefiles-backup.oss-ap-southeast-7.aliyuncs.com/javas/Office/win/Taskgmr.ps1",
      "http://imagefiles-backup.oss-ap-southeast-7.aliyuncs.com/javas/Office/win/WinRing0x64.sys",
      "http://imagefiles-backup.oss-ap-southeast-7.aliyuncs.com/javas/Office/win/config.json",
      "http://imagefiles-backup.oss-ap-southeast-7.aliyuncs.com/javas/Office/win/edge.exe",
      "http://imagefiles-backup.oss-ap-southeast-7.aliyuncs.com/javas/Office/win/msedge.exe"
    ],
    "sha256": [
      "05f69ae6b2b89c1c4dcf836bff032232f11bf0109f2b498e2345045d06139034",
      "481728a7c9c4c02be07051d9c1958d902ea6397ebb8952ab83944818e3d25d21",
      "4dcb0202fe8b2d4d7b183764e38184cd6ed50132786cc7e7d1f7f4bce1dd6f3d"
    ],
    "CVEs": [
      "CVE-2026-105133",
      "CVE-2026-105134"
    ]
  }
}