{ "id": "989487e6-2d81-4738-be77-2db04a23d411", "created_at": "2026-04-10T03:21:03.546403Z", "updated_at": "2026-04-10T03:22:19.153179Z", "deleted_at": null, "sha1_hash": "9b2f51a0a041090af77ae6a7bd9942e8cf4382e9", "title": "Recent LiteHTTP activities and IOCs", "llm_title": "", "authors": "", "file_creation_date": "0001-01-01T00:00:00Z", "file_modification_date": "0001-01-01T00:00:00Z", "file_size": 150117, "plain_text": "Recent LiteHTTP activities and IOCs\r\nBy Viriback\r\nPublished: 2018-06-29 ยท Archived: 2026-04-10 02:55:01 UTC\r\nView Larger Image\r\nThis post serves as a dump of IOCs seen in the last 90 days related to LiteHTTP malware. The interest into\r\nLiteHTTP came from a bump in sighting in the month of may 2018.\r\nOne particular instance of a control panel was seen repeatedly in my research on virustotal. Multiple samples were\r\nseen for the first time in May on the platform. They were calling out to : hxxp://topksa[.]net/Panel/page[.]php\r\nThe panel of those samples was : hxxp://topksa[.]net/Panel/login/\r\nhttps://viriback.com/recent-litehttp-activities-and-iocs/\r\nPage 1 of 6\n\nA total of 106 LiteHTTP malware samples were seen from May 2nd, 2018 to May 20th, 2018. The panel is still\r\nlive at moment of writing this but sightings of new samples on VT has stopped since May 20th, 2018.\r\nI also saw some other LiteHTTP panels that have been active since the 1st of April 2018, which the IOCs will be\r\nlisted below:\r\nhttp://topksa.net/Panel/login/\r\ntopksa.net\r\n212.237.55.178\r\n79dae4a5b199281f924722be1f3ca1ce\r\n67615ff09fb36efbdb2b37bb7a594d88\r\n7747340fe0465e80910abdaa202abfe5\r\na39733bbaf88069e793f3f6b4937b545\r\n5268dfbcc1b98498480cf648d52cf5c6\r\n042b604594887802b08e4d79f29d1eb6\r\n0523a8c5c9e3e31a2ad32f6c77b1447b\r\nhttps://viriback.com/recent-litehttp-activities-and-iocs/\r\nPage 2 of 6\n\n067abd137f315170fee9c1a1ece78df7\r\n0975201adbdc0331e24b43b9d40ea520\r\n520e7563015cf54d0b8bf003025bb56b\r\n589e9608e2ee2852e145e3470fd0d7e6\r\n643f27afbddb0ee532720c54cc0abd18\r\n64f2d05dfe9a5760594a6c6439b63100\r\n6c1d8b229bb02ee9ab3562fa8c268534\r\n733be540fd11365c3b2b8bd38914f8a0\r\n741d1f46b2b2d253b3dcd66f9f39485a\r\n7f0909ead4bd5d8f471e9f4f5b5d89c1\r\n9720c546cd771d3440aa14cb2c17df84\r\n99d0c5262e99cd6b43eb33438399e016\r\nbb293f81679dcbd098102fe707902377\r\nccbd0192a391ec97bbaa6778285a22b4\r\nce8e383c7c315ee27a4a2c53d494ff33\r\necc9511440e1cadb2864f4b757eb52bf\r\neee5d8ba1c06afaaa5a0d1563cf9e2db\r\n49f56083538e4f0aa43873781132bd61\r\n500d9aaaa485b73610c3aec1fa686a3b\r\n63fe05d7b1951fd4660dd1857430796b\r\n768a0e0e27749d94ea4675abe4de1a8d\r\nbbf5f31d7a41d45cc68e667471c63871\r\nc2a5ab21a6e2a349fd173337cd1e0a48\r\nd3d83a8a744cb862ec67eb771d9d984a\r\ndfe58df1e543c014ac1b166402fd0e2a\r\n23f4c86f255d2cd1c85962d6552520fc\r\n306c76bb087b95ceae7a7399a2e41f4e\r\n3c84d0927a75e75b28ff4553a192b5e2\r\n418e32f2188ce2a38d1dbbf1ef05efeb\r\n490e10e390ae6995e83d4e49cb10cea4\r\n4e50a38741609c418ef2884f62e0d4af\r\n4f901b87e938ba01516313c71e6dc8a5\r\n7c86374250574fc13eaa2efb3fd9a786\r\naa1cbbf73b761585ee0353bf8f40461b\r\ne8084007d595879f52f05f9083175d3f\r\nf398d68d59cfc3a1a3415649f8324e6b\r\n1696e4b5342fa4f1721767ec5e7f5cdc\r\n1a1fcd0e1b661b4ecc160a7772b4f46a\r\n2361397d688312d862efad87d1c0a525\r\n50de216e6a3f99abc33b025a2d8acb41\r\n65964e1d3841ea26e9552a57f0a8d37d\r\n65d808967ca7b7ba87d2d1ae9b268f77\r\nhttps://viriback.com/recent-litehttp-activities-and-iocs/\r\nPage 3 of 6\n\n67d85a9af46ac0e4052f647561e45012\r\n70eedafb7494b27ff94781c2245d7624\r\n834e5453349b71d21783e475509f46e3\r\n881618eeffece7fea5bba2fc3e589cca\r\nb5803930438bd2578b0983cca7dcb08b\r\nbd7098ecac3678c98e9907086576292d\r\nc30afb3577826654aea95810a0e87dec\r\ndccecbd3baf3fc2e451b54bb392b01eb\r\ndd94c70d4a53ee04a7a1c25c48ac2f70\r\ne1f2104ea54aed9a7eedc954d24c2b6d\r\ne256c4d3b44c55b040e7576121b15ee3\r\nfac365dc7c1588ff054094481e33633d\r\n48f9633d03cbe781f65c76087844e2e9\r\n19b5c9f833ed1dd0b68df970a765d0f5\r\n2d4f85618adb4b1576a6414cb37db449\r\n45e5864c3a69fbb9ee3a11b6b3c26f7c\r\n977cbdd6b7e8623465e35176085dc17d\r\n9aa3bd406b254181d1a16d6d280d7490\r\na2d955231b610626fc68510722cb27fc\r\nde80e2b7f87438e4f39414a94083c954\r\ne47313dbfac4934a866069d2c2c1a305\r\n21c7805d4227866332fc25425981b360\r\n6ebff77cfc1ab21e02d604a12ab416b4\r\n063b7db270c03c58316d6d1f17be55e6\r\n0be1d348eeceecff5817fe5c513e9172\r\n1989abbcef413c2473d71c5d868b649f\r\n3f54cc5d47fff7cf7735b0f30afa5707\r\n423fd2489703f155640ce488cc776e8f\r\n43db1aa9e2574c84f09d087efec21bc2\r\n4fcf013cda3586e3dda973cab9b5eff4\r\n629ae5236ebaec9452ff4ad47daa2d10\r\n634a92c9b1c2beb584965d15222f01aa\r\n666819caa468e2fa24f0107a3d076700\r\n6da563bef78ba94647915ae795278b42\r\n6fa88e08a3055282fd4e78a483821a0b\r\n7ebf7da0d048ce95514359644bbf1db8\r\n9b92e55cba936c390a62ff8b00b57326\r\n9c84f43ff72aff262a0fd34e26e5c811\r\n9d523a63c28d34afdbe80b7f0e080d08\r\na3508b09f61b15d86e6a1659f3e4f05c\r\na5eb787d733fc39a0375bf176f11a9a4\r\na723f616e0ae03c4a9e198d04b4d8bd6\r\nhttps://viriback.com/recent-litehttp-activities-and-iocs/\r\nPage 4 of 6\n\nb0358707ddfde044c4944396d2c7c29b\r\nc5bae65408bf00f89428fc2d200d9c48\r\ncfd77b5405814fa9022affc48c76a420\r\nda8976c966de36eb1b177a41093406c5\r\ne110d1db461441607c21c18cd42ba82c\r\ne1c375876659407ed7452504839ad6c0\r\nf27f3222353280e52793a7130e41f5c5\r\nfe1759f0600e3221d6323ee2ac5c9ace\r\n38b789e9fba006ead95c9d8a9def44bb\r\nb3a6ec4f4a4889ecd245a75458268646\r\nec03d66b68304502b36aa765497cbd18\r\n26d95659c646f88d2b14dc71e2bc07b2\r\n5f8b7d6cae04ff17bcf7186bbf8b30d7\r\ndc3fa09bc67a9ca0f2aae55e0af4184a\r\ned1b204cd1e6850c43b814bb96e94097\r\nhttp://103.194.170.51/Panel/login/\r\nadeaada185fa73cd8b779869e10cbe91\r\nhttp://172.81.133.27//lite/login/\r\nd91ad16e2e3c57dba48dfffe315e715c\r\ncff1ab09d5d582086588882e5fdf1696\r\nhttp://176.223.131.228/Panel/login/\r\n18ada7caf0478dda9ca3b62dcef66c6b\r\n775cdac7ee3daa4fa462431b7f51998b\r\nb49e2dcb3aef79d61a9832d1903d101e\r\ncf992f2fc1c2ad4b8f5ad5a9410cc50f\r\nhttp://62.77.155.65/Panel/login/\r\n5691ab6b01e9092578d4f3e0199a1583\r\nhttp://babycute.thats.im/sociu/login/\r\n0c163243ba933d4b14a7673a9c561795\r\nhttp://bananaloop.ru/Panel/login/\r\n987d46def142dc455f32e3c8ea052edb\r\nf3e02148b8f4dccf131fd24667e2f8dd\r\nhttp://k9stock.com/Panel/login/\r\n671d6ad1db0e32d2626f1de297f08471\r\nhttp://partnerwithuss.ru//Panel/login/\r\n39c5fb2236aac6d5a672155ba174a028\r\nhttps://viriback.com/recent-litehttp-activities-and-iocs/\r\nPage 5 of 6\n\nhttp://posalive.su/login/\r\n2615eabfac63bc5ff0418ca7edf10092\r\nhttp://razilov06.hldns.ru/panel/login/\r\n543f8a019a3f886afdf3b3b4efc7a312\r\nhttp://sketchie.ru/HTTP/ZzZz/login/\r\na3e211615cddff693f73bfab8317fcdc\r\nhttp://tik-media.info//login/\r\nbc9f581a808576eabe09c19a09737ff1\r\nhttp://x420.me/latte/login/\r\n7f170a002757bd3c1f6fcdd61e750944\r\n7c0176ede8e8920b559eb7c7a7cd72d5\r\nd3ab4462ace2bd0ad62a9adec5b47516\r\n789388866ccb7b45d79d5e1b827211ac\r\nhttp://xanull.phy.sx/Panel/login/\r\nf5549ac23c7e934efe149cd63c3ed7b5\r\n6e3050622a038866506890c1c94224eb\r\n5d1ebb7a2a459467cfcbf87acfd3c4ca\r\nhttp://yylisah0.beget.tech/images/thumbs/about/informio/login/\r\n0494ef09f44c8646a3ebf79baad93417\r\nAbout the Author: Viriback\r\n#Malware C2 hunter #infosec passionate.\r\nSource: https://viriback.com/recent-litehttp-activities-and-iocs/\r\nhttps://viriback.com/recent-litehttp-activities-and-iocs/\r\nPage 6 of 6", "extraction_quality": 1, "language": "EN", "sources": [ "Malpedia" ], "references": [ "https://viriback.com/recent-litehttp-activities-and-iocs/" ], "report_names": [ "recent-litehttp-activities-and-iocs" ], "threat_actors": [], "ts_created_at": 1775791263, "ts_updated_at": 1775791339, "ts_creation_date": 0, "ts_modification_date": 0, "files": { "pdf": "https://archive.orkl.eu/9b2f51a0a041090af77ae6a7bd9942e8cf4382e9.pdf", "text": "https://archive.orkl.eu/9b2f51a0a041090af77ae6a7bd9942e8cf4382e9.txt", "img": "https://archive.orkl.eu/9b2f51a0a041090af77ae6a7bd9942e8cf4382e9.jpg" } }