MalwarePublished 23 Feb 2026Updated 16 Apr 2026

tlp clear · Maltrail IOC for 2026-02-23

Affects tlp clearSource CIRCL OSINT Feed

TLP:CLEAR, disclosure is not limited

malware

Description

Maltrail IOC for 2026-02-23

Impact

The impact is currently limited to awareness of a medium-risk malware IOC without evidence of active exploitation or affected software versions. There is no known exploit in the wild and no direct patch or fix applicable. The threat intelligence may support detection and monitoring efforts but does not indicate an immediate operational compromise.

Defensive guidance

Security teams should consider integrating this IOC into their detection systems if relevant but no urgent action is mandated based on the provided data.

Summary

The report details a malware-related IOC identified on 2026-02-23 from the CIRCL OSINT Feed. It is classified as medium severity and relates to network activity observed externally. The data lacks specific affected versions, exploit details, or technical indicators, limiting actionable insights.

Indicators of compromise

Domains 1,161

document-share.appgeneric
123pan.chookyin.cngeneric
44.248.52.124.nip.iogeneric
7747743.xyzgeneric
apostler.duckdns.orggeneric
arena-diplomb365.onlinegeneric
arena-diplomh.onlinegeneric
arena-diploml.rugeneric
arenadiplomc24.onlinegeneric
arrived-answers-restoration-screenshots.trycloudflare.comgeneric

URLs 80

https://api.github.com/repos/stamparm/maltrail/commits/96c7897ebe98fed99b473729698340ddaeca23c9generic
https://api.github.com/repos/stamparm/maltrail/commits/80ff587a5e2e081f6ae32eeaf2b2d06b9880adc0generic
https://app.validin.com/detail?find=WsgiDAV%20-%20Index%20of%20%2F%20&type=raw&ref_id=9be6e05f86e#tab=host_pairsgeneric
https://api.github.com/repos/stamparm/maltrail/commits/6aa6766b548d8e45a028ef5442086409a761aae7
https://api.github.com/repos/stamparm/maltrail/commits/b33cfce4f96461877076365e69f9492d9489911a
https://api.github.com/repos/stamparm/maltrail/commits/c197b94ec267778ca5770cda6be9a76a324b8c63vidar
https://x.com/smica83/status/2025693291560173713vidar
https://www.virustotal.com/gui/file/0323da67b133228d6b955513892821613152df7bf7bd156e9fd112d07da3d189/detectionvidar
https://api.github.com/repos/stamparm/maltrail/commits/6ffb79dfc16c2882eb67f3755422a5cbaa951049xworm
https://x.com/ShadowOpCode/status/2025889978446725498xworm

IP addresses 31

44.248.52.124generic
74.0.48.30vidar
143.92.60.13supershell_c2
143.92.60.26supershell_c2
151.247.25.231sectoprat
34.153.28.2sectoprat
77.238.232.188sectoprat
79.110.49.251airbot
37.77.150.50powershell_injector
62.60.226.224powershell_injector

Community reviews

Loading reviews…