Trusted Design

THE XDEDIC MARKETPLACE

概要

“xDedic” is a trading platform where cybercriminals can purchase any of over 70,000 hacked servers from all around the internet. It appears to be run by a Russian-speaking group of hackers. The forum provides members with tools to patch RDP (Remote Desktop Protocol) servers to support multiple user logins, as well as other hacking tools, such as proxy installers and sysinfo collectors. The main goal of the xDedic forum is to facilitate the buying and selling of credentials for hacked servers which are available through RDP. From governmental networks to corporations, it is possible to find almost anything on xDedic for as little as 6 USD per server. This one-time cost provides a malicious "customer" with access to all the data on the server and endless other possibilities, such as using the access to launch further attacks.

Created: 2026-02-23

Indicators

• URL - http://191.101.31.126/ptest.php -
• URL - http://191.101.31.126/test_servers.xml -
• URL - http://37.49.224.144/ptest.php -
• FileHash-MD5 - f661b50d45400e7052a2427919e2f777 -
• URL - http://37.49.224.144/test_servers.xml -
• URL - http://q96b7b7.strangled.net:32973 -
• URL - http://q968787.strangled.net:32973 -
• URL - http://q96b7b7.mooo.com:32973 -
• URL - http://191.101.31.126/sp.php -
• URL - http://37.49.224.144:8189/manual_result -
• hostname - q968787.homenet.org -
• FileHash-MD5 - e8691fa5872c528cd8e72b82e7880e98 -
• URL - http://q968787.ignorelist.com:32973 -
• URL - http://q968787.homenet.org:32973 -
• URL - http://q968787.mooo.com:32973 -
• URL - http://q96b7b7.ignorelist.com:32973 -
• hostname - q968787.mooo.com -
• hostname - q968787.ignorelist.com -
• hostname - q96b7b7.mooo.com -
• URL - http://37.49.224.144/sp.php -
• hostname - q96b7b7.ignorelist.com -
• URL - http://37.49.224.144/gfileset.php -
• hostname - q968787.strangled.net -
• FileHash-MD5 - e8cc69231e209db7968397e8a244d104 -
• URL - http://q96b7b7.homenet.org:32973 -
• hostname - q96b7b7.homenet.org -
• URL - http://191.101.31.126:8189/manual_result -
• YARA - 9ec1deca5c281fd01d95b0079d1c0fc9b041cf7f -
• URL - http://191.101.31.126/gfileset.php -
• FileHash-MD5 - a53847a51561a7e76fd034043b9aa36d -
• FileHash-MD5 - fac495be1c71012682ebb27092060b43 -
• hostname - q96b7b7.strangled.net -

類似Pulses

• Botnet bruteforcing Point Of Sale terminals via Remote Desktop (2014) (score: 0.58)
• TrickBot Is Hand-Picking Private Banks (score: 0.54)
• Dridex is Back and Targeting the UK (score: 0.52)
• Banking Trojan "Shifu" Distributed via Malicious Word Documents (score: 0.52)
• 20160915 - Dridex Trojan (score: 0.52)

このPulseに関連する脅威アクター (事実ベース)

このPulseに関連する脅威アクター (推論ベース)

Related CVEs

このPulseに見つかったCVEはありません。

Pulse – 脅威アクター グラフ

---

← Pulse一覧に戻る