93.115.25.139 Threat Intelligence and Host Information
Share on:General
This page contains threat intelligence information for the IPv4 address 93.115.25.139 and was generated either as a result of observed malicious activity or as an information gathering exercise to assist with enrichment of security events and context. All information is gathered passively through aggregation of public sources, or observations through activity upon honeynets. The host score is calculated through a series of statistically weighted values and machine learning which takes into account metadata such as host information, frequency, volume and global distribution of malicious activity, association with other known malicious hosts or networks, proxying or anonymising behaviour such as with tor exit nodes, residential proxies or VPN services, and many other attributes. These values are historical and indicative only - and should not be taken to be an accurate representation of the users, businesses or networks in which they reside.
Potentially Malicious Host 🟡 50/100
Host and Network Information
- Mitre ATT&CK IDs: T1003 - OS Credential Dumping, T1021 - Remote Services, T1027 - Obfuscated Files or Information, T1049 - System Network Connections Discovery, T1059 - Command and Scripting Interpreter, T1070 - Indicator Removal on Host, T1090 - Proxy, T1112 - Modify Registry, T1133 - External Remote Services, T1176 - Browser Extensions, T1190 - Exploit Public-Facing Application, T1203 - Exploitation for Client Execution, T1486 - Data Encrypted for Impact, T1490 - Inhibit System Recovery, T1530 - Data from Cloud Storage Object, T1531 - Account Access Removal, T1537 - Transfer Data to Cloud Account, T1562 - Impair Defenses, T1566 - Phishing
- Tags: AA22-321A, CVE-2021-31207, CVE-2021-34473, CVE-2021-34523, Hive, OSINT, Ransomware, T1059, T1112, T1486, T1490, T1566, UsCert, anna paula, application, associated, avunknown, bitcoin, cert, cisa, close, computer security, csirt, currc3adculo, cyber risks, cyber security, cybersecurity, download, enterprise, exchange server, fortios, from email, headers, hive, hive ransomware, hta file, install, iocs, june, malspam email, malware, microsoft, mitre att, msi file, november, powershell, protocol, ransomware, rclone, remote desktop, sample hive, security, summary, system, tuesday, turn, u. s. computer emergency readiness, uscert, utf8, vesrion1, vpns, zip archive
-
JARM: 29d29d00029d29d00042d42d0000002059a3b916699461c5923779b77cf06b
-
View other sources: Spamhaus VirusTotal
- Country: Lithuania
- Network: AS16125 uab cherry servers
- Noticed: 1 times
- Protcols Attacked: Anonymous Proxy
- Countries Attacked: Australia, Canada, New Zealand, United Kingdom of Great Britain and Northern Ireland, United States of America
Malware Detected on Host
Count: 7 112b4f8ecbf707edf19acf1fc99cde930efc7464bd15a78dc656625d8c0c4ee4 cab2d533659973a3017ce4be237029a9b15a22c0d92e3ed1eef7d5662c8f39cc 5b010e11357f29b917ffa7622e67ea07bf9c86272d90449925bc67a798965ca4 f22edfbb09faa15d9f45c23a7c33acf782b24f47133d30a94e709498df8ce68e fc8932344ba0d7d1a6b5b6bd7bf72ad0b2dc7d917c34043fdc3ac793910b5030 fa7f9da26b28aa0ea55cfed26e39dd3544bdc8077ffe48f0360f01277b604082 44d370f942987d9128b412435dbc50a22566c8fdce819d84568c4c1606c3e466
Open Ports Detected
Map
Whois Information
- inetnum: 93.115.25.0 - 93.115.25.255
- netname: Dedicated_servers
- country: LT
- admin-c: CN4113-RIPE
- tech-c: CN4113-RIPE
- status: ASSIGNED PA
- mnt-by: DUOMENUCENTRAS-MNT
- created: 2018-03-28T06:30:31Z
- last-modified: 2022-03-09T08:53:16Z
- role: Cherry Servers NOC
- address: Tilzes g. 74
- address: LT-76140 Siauliai
- address: Lithuania
- nic-hdl: CN4113-RIPE
- mnt-by: DUOMENUCENTRAS-MNT
- created: 2017-07-26T11:35:29Z
- last-modified: 2020-04-29T11:20:41Z
- admin-c: LL378-RIPE
- tech-c: LL378-RIPE
- route: 93.115.25.0/24
- origin: AS16125
- mnt-by: DUOMENUCENTRAS-MNT
- created: 2018-01-11T13:08:05Z
- last-modified: 2018-01-11T13:08:05Z