Indicators are what attackers leave behind. Stolen credentials are what they arrive with.
67 IOCs
MuddyWater: ClickFix to Telegram & PatchAgent Backdoor
Threat Actors
Malware Families
Excerpt
MuddyWater: ClickFix to Telegram & PatchAgent Backdoor | Ransom-ISAC Blog - Ransom-ISAC Skip to main content Suspected cyber incident? Get support → About Blog Partners Membership L.O.C.K. S.T.A.R. Threat Summit · Recordings Login Back to Blog Threat Intelligence 45 min read July 15, 2026 Iran Phishing APT MuddyWater MuddyWater: ClickFix to Telegram & PatchAgent Backdoor Full reverse engineering of a three-stage PatchAgent loader chain assessed as MuddyWater-linked…
Read the original report →Diamond Model
Adversary(2)
Infrastructure(6)
Capability(2)
Victim
Indicators of Compromise
Open the mindmap →67 indicators
| Type | Indicator | Confidence | Score | First Seen |
|---|---|---|---|---|
| SHA256 | a01634a49545e05dcb1624aec62184f1f45c9224e4d356d191971914a4668a5a | High | Score 85/100 | First seen |
| URL | http://185.228.83.217/land/?id=9228023&__cf_chl_rt_tk=0WTT341v83OfTlu9_sVt0mpCGs8eiXGuXRj0LgIbMkt4-1759406441-1.0.1.1-cKgxnjeNC3bilN23wwtGd4ZTe00EYBZDCXqqw55zKFcc | High | Score 58/100 | First seen |
| SHA256 | f051f14146e69ffd2f22c48c5126f53e8a94e2ce86b9adb46de0fb5230d46538 | High | Score 85/100 | First seen |
| URL | http://185.228.83.217:8443/api/cmd/d654b82b | High | Score 58/100 | First seen |
| SHA256 | be8cc24348cd36f001cef3554a2e20faba192fddb72c4188c14a22789a9d484f | Medium | Score 53/100 | First seen |
| URL | http://46.30.188.99:8443/api/cmd/bfaf34b8 | High | Score 58/100 | First seen |
| SHA256 | 155275fdade744919de3d657a16c197b2f736764c14129e27e8517aed824f84e | Medium | Score 53/100 | First seen |
| MD5 | cc17bcc7fe575a59b90e88841fe76dbc | Medium | Score 53/100 | First seen |
| Domain | bx.digitech.ru | High | Score 58/100 | First seen |
| SHA256 | 90f2ac28649c8877379014012263125fdb86489ccc8d6cc80180437dbdf3be8c | High | Score 85/100 | First seen |
| SHA256 | 8d0c4a2565d38c923a50bb5daf512a7b80633643c65b5464d665e5f71b8fbd55 | High | Score 85/100 | First seen |
| URL | http://185.228.83.217:8443/api/cmd/50ee0d88 | High | Score 58/100 | First seen |
| SHA256 | 70c2a120148a8d0e40f4abfb54578561c38a9b4ce0ea6cf6067b925e319806e0 | Medium | Score 53/100 | First seen |
| SHA256 | fbefbd142aa9e842754ad914e9a3b14a60129fe8b9863db23e2c8c697b5923aa | High | Score 85/100 | First seen |
| URL | https://185.228.83.217:8443/api/cmd/532ec2dd | High | Score 58/100 | First seen |
| SHA256 | c0daec5c4417c16de8bced454b51cc02c0ee57ff66257b9516d6ae69ecf539ef | High | Score 85/100 | First seen |
| SHA256 | 7e4549de761b5bdb361bf22e3f3069539400448094c45d2e84175d76b6553853 | High | Score 85/100 | First seen |
| SHA256 | 6d36bfa3e893c11294e3421de9e836e0fe68f97b20fa9d9eebbfb66d79136caf | Medium | Score 53/100 | First seen |
| SHA256 | e88d528e951c55e3f5dcd8e1f10a161ab5f5d64f8663f65fd49d4558aea3274b | Medium | Score 53/100 | First seen |
| MD5 | 230bb7c97fbb1e96d9ebee43cfa09024 | Medium | Score 53/100 | First seen |
| SHA256 | aaea67f04f2a6b3ae212b3565b108b92cce157eff1c77b455fe2eadb57c86fb5 | Medium | Score 53/100 | First seen |
| SHA256 | b32a924d0fdcf00c928a595826e93f1e338db0a7c50ceb8284add5a1cc4eb09a | Medium | Score 53/100 | First seen |
| SHA256 | bf38ae8c1b495b2a547337759969967a8bf632f5adbbd9a9bb7c724007d684b8 | High | Score 85/100 | First seen |
| IP | 46.30.188.99 | High | Score 58/100 | First seen |
| SHA256 | 3ca8ae1d0a0682c941d71b722171f69cde2abff6f5f3092c6af56d001d01c070 | Medium | Score 53/100 | First seen |
| MD5 | e736cadfc8ef27a6d7bbb3a4585abd50 | Medium | Score 53/100 | First seen |
| URL | https://seo-conference.by/wp-themes/Cloudflare/Verification/UserID6389452515832 | High | Score 58/100 | First seen |
| SHA256 | 59bfe9bc385ad69f50793ce4a53397316d7a875a7148a63c16df9b674c6cda64 | Medium | Score 53/100 | First seen |
| SHA256 | f123bfdf0dff864b36c92e4ea7963d86f18c4cff0a29ed186e9f6eec940fa6b5 | Medium | Score 53/100 | First seen |
| URL | http://185.228.83.217:8443/api/cmd/e99899fa | High | Score 58/100 | First seen |
| SHA256 | 48e455d24aede6586d5fe2af3ba5eabd15f53ff68de7fb38a4021f0b61f3c2d4 | Medium | Score 53/100 | First seen |
| SHA256 | 7af3c84441f40b8a7f6660e1e78bd8806c715ec1b466fd62916466d50224797a | Medium | Score 53/100 | First seen |
| IP | 92.53.69.246 | High | Score 58/100 | First seen |
| IP | 41.216.188.46 | High | Score 58/100 | First seen |
| SHA256 | 28e55dc62f9a9c9938c3b48b2d17a33d6fa96e74c1e9d31f5c685fef8c39b217 | Medium | Score 53/100 | First seen |
| IP | 185.183.34.168 | Medium | Score 46/100 | First seen |
| MD5 | d4a0b5b1f5d4f43ff01360d2f16f171b | Medium | Score 53/100 | First seen |
| URL | http://185.228.83.217:8443/api/cmd/532ec2dd | High | Score 58/100 | First seen |
| SHA256 | 5d9190292acdd48ba0fc35080f7e7448f3cdf0d79199a4d23f0f49b5341fdf29 | Medium | Score 53/100 | First seen |
| SHA256 | d60b04ecea3adb58b4369d4e52121377a9bc28fa1a29b69ceee60144c47492a2 | High | Score 85/100 | First seen |
| MD5 | 728edd84b46d32d1fd520aa735f8611e | Medium | Score 53/100 | First seen |
| MD5 | 3895302964bcb46729c61f82a798ef96 | Medium | Score 53/100 | First seen |
| SHA256 | d36deee39830bfb111b50bf8315a4de292812e0d2aafd5fc8666c9db11e8e590 | Medium | Score 53/100 | First seen |
| URL | http://185.228.83.217:8443/api/cmd/f3821897 | High | Score 58/100 | First seen |
| SHA256 | 515332a4fada0648a84c6d683e36363918f23f03ef7bf97e936c795829a9623f | Medium | Score 53/100 | First seen |
| SHA256 | f552f87811e0ac4c6757926e79bbf3a38fe6648634aaadb5a01f6e87e3a4951a | High | Score 85/100 | First seen |
| SHA256 | 27a5d818f690b4c0b1679381ee48ffafb8d3b4ad6247797c32698bd6992a224f | Medium | Score 53/100 | First seen |
| SHA256 | a8d63e598ea6a8eaf7d34eeb240ca75e9b89c18df88fe4d43b3ff3d53a723f4b | Medium | Score 53/100 | First seen |
| SHA256 | 5c33e3dfa983e99e0dc1618fdf7893c43182d6ef079f34fe3c94887b63ab274c | High | Score 85/100 | First seen |
| SHA256 | e792788fef507ae1fde22cf0c38c0569dc13c6fb8f23b79937cd1f606fa8394c | Medium | Score 53/100 | First seen |
| SHA256 | 816f1f4df1f3964c807ea3606a6319a7872b6de54dd9286c1fed4982d6982af6 | High | Score 85/100 | First seen |
| URL | http://185.228.83.217:8443/api/checkin | High | Score 58/100 | First seen |
| SHA256 | d45e5ea038841b4c4ae8ea4199ed8bee6cdf9926640bf02458f0820c394cddd3 | Medium | Score 53/100 | First seen |
| SHA256 | a556272456a474721a285f28dba2219f154147f5869932f45408774fead54fca | Medium | Score 53/100 | First seen |
| SHA1 | 07fd805ebc2f09187af49f45e8726eb62bb85bfe | Medium | Score 53/100 | First seen |
| SHA256 | af5a2f1b7e388d4fb49d72e8f453fda673472ad603bf72aee4869a34b37f535a | High | Score 85/100 | First seen |
| URL | http://46.30.188.99:8443/api/cmd/ | High | Score 58/100 | First seen |
| SHA256 | a361e7885c36bacb3fd9cb068da207c3b9329962cac022d06e28923939f575e8 | Medium | Score 43/100 | First seen |
| URL | http://46.30.188.99:8443/api/checkin | High | Score 58/100 | First seen |
| SHA256 | 8d217ad2ff7ed9e162cbd20bd207562f7e4f50d3e4d1f36ab01d653380176d16 | Medium | Score 53/100 | First seen |
| SHA256 | 78906623ce30eba7174e99d7f9d1df5fe69d1fdd7d5eb36329963e29b65bef2e | High | Score 85/100 | First seen |
| SHA256 | 5ce2d378811c84c085f39d0ce264d03138cbdd46ae752adb1b8d2373f6873bae | Medium | Score 53/100 | First seen |
| SHA256 | 080e5ded51c69bcb1a173bbf035a4ed48d259e2f0343115f8e0bcd8a932d57eb | Medium | Score 53/100 | First seen |
| SHA256 | 151dd3d4f9228cf88d67b9e165f8da2bd0baa7e9e46bc3621c1a02e89e7d8feb | Medium | Score 53/100 | First seen |
| SHA256 | fbc2b2bc5365528b68b60a150e85407c0f51952b95c272ac7d85714fd1e0e8bd | High | Score 85/100 | First seen |
| SHA256 | bc9c4e81bc9acd2a93de62ba696009084594161da3db5eddc4774a006d8bd07e | High | Score 85/100 | First seen |
| IP | 31.57.219.68 | High | Score 58/100 | First seen |
IOC Relationship Graph
Building graph…