Configured Stealc endpoint draws POSTs; shared loader host remains unobserved
A Stealc v2 sample posted to its configured URL at 196.251.107.130 and received an HTTP 200 response in one sandbox report. A second executable lists the same IP with a different path, but no request to that URL is documented, leaving an infrastructure link rather than a demonstrated attack chain.
An executable sent an HTTP POST to 196.251.107.130/16b022998f754137b60a.php, and a sandbox recorded an HTTP 200 response. A different executable listed the same IP address in its extracted configuration—but with /api.php as the path. That overlap raises a more useful question than whether the address is suspicious: does it connect two programs in an attack chain, or identify a host with distinct, separately evidenced roles? CTX Threat Intelligence’s records support the second reading.
Members-only article
This story is members-only. Sign in to read the full body, indicators of compromise, and VirusTotal context.
Sign in to read