StealC C2 domains dropping OverlordRAT, using CloudFlare and Microsoft look-a-like domains 👁️ 🌐 cloud-flare-authenticator .link 🌐 cloud-flare-authenticator .click 🌐 update-microsoft-data .services 📡 89.34.90.45:443 OverlordRAT #botnet C2 server ⤵️ 🌐 download-windows-update .live 📡 151.243.113.94:5173 Both hosted at AS207043 DEDIK-IO in Germany🇩🇪 📄 Malware sample: https://bazaar.abuse.ch/sample/5c61c977440dd7e870c1a63037558dd3fc2c41c8fd9d6ab67acff1c7d35abe01/ 🦊 IOCs on ThreatFox: https://threatfox.abuse.ch/browse/malware/win.stealc/ https://threatfox.abuse.ch/browse/tag/OverlordRAT/