Data by Hatching Triage

JokerStat

Profile source: Mallory

C2 tracking

Seven-day C2 activity

Derp observations, rolling seven-day window

1

Sep 6

0

Sep 7

Observed infrastructure

Last seven days

First activity: Sep 6, 2026
Last activity: Sep 7, 2026
Feed role: C2 / Distribution
Host form: 0 IP / 3 hostnames

Leading locations

RU2
US1

Leading providers

Domain names registrar REG.RU, Ltd2
Cloudflare, Inc.1

Infrastructure traits

Hosting 3
Anycast 1

Samples

Recent associated samples

855eb55b83aa49871bb06be6cda7fa6d18b2dbf3641d3955b6be73f702a85eaa

Observed Sep 7, 2026Triage

6fa7884af73117961a809c8499525d5c298e1a517afac5f4e91c87837342beb1

Observed Sep 6, 2026Triage

8371e001e4b67cd6a98891fdb3965abf9b10434ebcfacbd9d2055812536d34f3

Observed Sep 6, 2026Triage

ec5d9d3da47ba3249d5330fdf63d29165c46574119de9ef08054227d956076df

Observed Sep 6, 2026Triage

fcdbaabca884c428a63e62835bebaf134b89ffcd96170ca5b40a282836fb1cbe

Observed Sep 6, 2026Triage

96a3668cbc00872394df7b9cea28b4793907e3c9ef202978b5d99745f4f71a70

Observed Sep 6, 2026Triage

9af388db9399bc668b0227304e36a03b2cd8dd454d50384dc20946f3d508bfc5

Observed Sep 6, 2026Triage

MITRE ATT&CK

JokerStat in ATT&CK

5 distinct techniques

Techniques

5 techniques

T1071 Application Layer Protocol T1113 Screen Capture T1041 Exfiltration Over C2 Channel T1189 Drive-by Compromise T1566 Phishing

We appreciate you

Derp wouldn't exist without the work these projects do for the security community. We rely on their data sources to improve the quality and depth of what we publish. Thank you, we're genuinely grateful.

Hatching Triage IPinfo urlscan.io Mallory eCrime.ch ransomware.live