66.220.17.200 A Haven For Swizzor
ID: 38b6c86d-f660-51d4-bcbd-1dbb0060e34f
STIX ID: report--38b6c86d-f660-51d4-bcbd-1dbb0060e34f
Feed Name: Zscaler Security Research Blog
Threat Score
This report documents active Swizzor trojan distribution: multiple malicious domains resolving to Hurricane Electric IP space (notably 66.220.17.200), domain/registrar/DNS infrastructure (Tucows, DNSMADEEASY), several PE32 payloads with MD5 hashes, URL paths used to host binaries, and observed C2/update callbacks. It highlights drive-by download and Browser Helper Object (BHO) techniques and provides IOCs for detection and remediation.
Your team is not currently subscribed to this feed. You must subscribe to it in order to see this post.