title: Watcher-NetAI — loader C2 indicators
id: 7a9e2c80-3d8f-4f1d-9c7a-1a4e5d8b0c03
status: experimental
description: |
  Detects outbound HTTP traffic to the loader's stage-1 C2 IP. The IP and
  port are public IOCs (URLhaus entry 3793559). The URL-path shape — a
  single 32-character `[A-Za-z0-9_]` segment after the host — matches the
  per-session random path the operator embeds in the delivery URL.
  Plaintext HTTP — payloads on the wire are recoverable to a passive
  network-side observer.
author: OHIIHO Research
date: 2026-05-14
references:
  - Watcher-NetAI / skn public report, OHIIHO Research, 2026-05-14
  - https://urlhaus.abuse.ch/url/3793559/
tags:
  - attack.command_and_control
  - attack.t1071.001
logsource:
  category: network_connection
  product: linux
detection:
  selection_ip_port:
    destination.ip: '64.89.161.144'
    destination.port: 28816
  selection_url_shape:
    url.original|re: '^http://64\.89\.161\.144:28816/[A-Za-z0-9_]{32}.*$'
  condition: selection_ip_port or selection_url_shape
fields:
  - source.ip
  - destination.ip
  - destination.port
  - url.original
falsepositives:
  - Unlikely on enterprise networks. Outbound HTTP on port 28816 to this specific operator IP is itself a high-signal indicator.
level: high
