MalwarePublished 25 Feb 2026

tlp clear · Maltrail IOC for 2026-02-25

Affects tlp clearSource CIRCL OSINT Feed

TLP:CLEAR, disclosure is not limited

Description

Maltrail IOC for 2026-02-25

Impact

The impact is assessed as medium risk based on the source classification. However, due to the absence of specific indicators, affected versions, or known exploits, the direct impact on systems cannot be precisely determined from the available data.

Defensive guidance

No patches or official remediation guidance are available for this IOC. Security teams should monitor relevant threat intelligence sources for updates and apply standard network monitoring and threat detection practices relevant to malware indicators.

Summary

The report details a malware IOC identified on 2026-02-25 from the CIRCL OSINT Feed. It is classified as a medium-risk observation involving network activity but lacks detailed technical indicators or affected product versions.

Indicators of compromise

Domains 1,017

genad.clickandroid_joker
infkm.bondandroid_joker
stmuis.helpandroid_joker
suluk.cyouandroid_joker
app.breezyhr.usapt_lazarus
breezyhr.usapt_lazarus
hornetseculty.comapt_unc2465
cdn0x.storepowershell_injector
101centricconsulting.click
101macroconsulting.click

URLs 47

https://api.github.com/repos/stamparm/maltrail/commits/96912006c1e73a8654d881938df2fbc3285525cfandroid_joker
https://api.github.com/repos/stamparm/maltrail/commits/86d172cc9700912c7505a1f8e2212a8f0a36846fapt_lazarus
https://api.github.com/repos/stamparm/maltrail/commits/ca426025791afbb1adbd61cf1bc0542e7e0b703capt_unc2465
https://api.github.com/repos/stamparm/maltrail/commits/ff57848255e0c2f3649dc297b210c0730fc5105bpowershell_injector
https://x.com/malwrhunterteam/status/2026412293878157472powershell_injector
https://www.virustotal.com/gui/file/7cdc63f6cb960db552cdc88e96315b0dc6a7f1418afa452ae325c197351fa8de/detectionpowershell_injector
https://api.github.com/repos/stamparm/maltrail/commits/be7fd0aa11c699b817ba48f4a62e62d3c4ba84dc
https://api.github.com/repos/stamparm/maltrail/commits/e304daaeee300295f23bfd977e7186eca424964f
https://api.github.com/repos/stamparm/maltrail/commits/b24d6b4362def2a9fcc17c36f850b187fc659001ek_clearfake
https://api.github.com/repos/stamparm/maltrail/commits/e9521f0d44ba47b5079ca37b1d66b18f839800bffakeapp

IP addresses 19

147.124.214.235apt_lazarus
157.250.195.237apt_lazarus
144.172.93.88apt_lazarus
66.23.199.44crypto_mining
45.155.102.89crypto_mining
193.178.170.155remcos
213.176.79.188generic
45.84.0.211shadowbyte
141.98.82.198apt_silentlynx
172.86.75.237apt_silentlynx

Community reviews

Loading reviews…