MalwarePublished 24 Feb 2026

tlp clear · Maltrail IOC for 2026-02-24

Affects tlp clearSource CIRCL OSINT Feed

TLP:CLEAR, disclosure is not limited

Description

This entry reports a Maltrail Indicator of Compromise (IOC) dated 2026-02-24, classified as malware with medium severity. It is an OSINT observation from the CIRCL OSINT Feed, indicating suspicious network activity. No specific affected versions, exploits in the wild, or patch information are provided. The threat is categorized as medium risk based on available data.

Impact

The impact is currently limited to detection and monitoring of suspicious network activity associated with malware. There is no evidence of active exploitation or direct compromise linked to this IOC. The medium severity rating suggests a moderate level of concern but no confirmed widespread threat or damage.

Defensive guidance

Security teams should incorporate this IOC into their detection and monitoring tools to identify potential malicious activity. Follow standard incident response procedures if the IOC is detected in the environment.

Summary

The report details a malware-related IOC identified by Maltrail on 2026-02-24, sourced from CIRCL OSINT Feed. It represents an external analysis of network activity flagged as suspicious. The information is based on manual OSINT collection and is intended for awareness and detection purposes.

Indicators of compromise

Domains 115

tered.pwandroid_joker
rvtoolc.infoapt_unc2465
rvtooli.infoapt_unc2465
account.booklngg.comek_clearfake
booklngg.comek_clearfake
nightlywallet.appek_clearfake
59xgjeq2.hexalink.digitalek_clearfake
best.deals.my.idek_clearfake
brandnew.deals.my.idek_clearfake
buycheap.deals.my.idek_clearfake

URLs 73

https://api.github.com/repos/stamparm/maltrail/commits/e53c50beda89b027b090eed0a98c9445a08327ceairbot
https://api.github.com/repos/stamparm/maltrail/commits/d4716f94d5df29aefb74947468dbd0c4bd0996fcandroid_joker
https://api.github.com/repos/stamparm/maltrail/commits/1060b34b043498957ee8024d00fb38fa8d4a119fapt_unc2465
https://api.github.com/repos/stamparm/maltrail/commits/8f99fa593c921ab847d4a87ed524e4cb4546d486apt_unc2465
https://api.github.com/repos/stamparm/maltrail/commits/5678302f8a5a9f8db722fd68c4378ea5b5fe497fek_clearfake
https://api.github.com/repos/stamparm/maltrail/commits/daf13720da4344b799ac1bce73959a260ce00a8a
https://api.github.com/repos/stamparm/maltrail/commits/ade51ff5ba6b3ab47046f82970e5cef3a0b4bda4dcrat
https://www.virustotal.com/gui/file/5b2977786f032de4a260fe264d36e4a959927e07d558eff259679afc71e87350/detectiondcrat
https://api.github.com/repos/stamparm/maltrail/commits/c035cfbce3585cd0fdbbca5aa53e8f1a752de647fakeapp
https://api.github.com/repos/stamparm/maltrail/commits/b282cf463fb1fb9eca272d304565e5df86876a120ktapus

IP addresses 28

151.241.154.119airbot
65.21.104.235powershell_injector
143.92.60.24supershell_c2
192.159.99.176quasarrat
141.195.117.128netsupport
198.23.175.46remcos
38.240.32.108remcos
212.11.64.250cyberstrikeai
103.164.81.110cyberstrikeai
106.52.47.65cyberstrikeai

Community reviews

Loading reviews…