All Detections

CRPx0 Tor-Bridged C2 via Clearnet Relay 207.180.29.236:8080

avatar
Ibrahim Saud@tektrix
updated 25 days ago000

Detects network communication with a known CRPx0 clearnet relay (207.180.29.236:8080) coupled with evidence of local Tor SOCKS5 proxy activity (ports 9050/9150) on the same host, indicating the bridging of traffic to an onion-hosted C2 server.

YARA-L