MalwarePublished 1 Mar 2026

tlp clear · Maltrail IOC for 2026-03-01

Affects tlp clearSource CIRCL OSINT Feed

TLP:CLEAR, disclosure is not limited

Description

Maltrail IOC for 2026-03-01

Impact

The impact is assessed as medium risk based on the source classification, but no specific exploitation or affected systems are identified. Without detailed indicators or known exploits, the direct impact cannot be precisely determined.

Defensive guidance

Security teams should incorporate this IOC into their monitoring and detection systems as appropriate. Since no vendor advisory or patch exists, follow standard threat intelligence integration procedures.

Summary

The report details a malware IOC collected manually and shared under TLP:CLEAR from the CIRCL OSINT Feed on 2026-03-01. It is an external analysis focused on network activity but lacks detailed technical indicators or affected software versions.

Indicators of compromise

Domains 2,671

bambooairways.com.vnfakeapp
discountfoodxyr.comfakeapp
ginal.workandroid_joker
pelage.bondandroid_joker
malik-jaani786.workers.devapt_sidewinder
download-secure-app-from-icloud.malik-jaani786.workers.devapt_sidewinder
hit-view-message-preview.malik-jaani786.workers.devapt_sidewinder
modp-view-full-message.malik-jaani786.workers.devapt_sidewinder
trabajorcm20262090.kozow.comremcos
asydoncu2061.duckdns.orgasyncrat

URLs 63

https://api.github.com/repos/stamparm/maltrail/commits/d65f1deb1c1a6fcc278e2de20a4b38b251552e82fakeapp
https://api.github.com/repos/stamparm/maltrail/commits/f6e389109af35cfd965fe5699f9d5641b9a3ac6bandroid_joker
https://api.github.com/repos/stamparm/maltrail/commits/ad4448801ebd48938310525e58169182fea73762mythic
https://raw.githubusercontent.com/drb-ra/C2IntelFeeds/refs/heads/master/feeds/unverified/IPPortC2s-90day.csvmythic
https://api.github.com/repos/stamparm/maltrail/commits/395fba1eb5b1699b80c4db158deedddf0df8709eapt_sidewinder
https://x.com/volrant136/status/2028050650110554502apt_sidewinder
https://api.github.com/repos/stamparm/maltrail/commits/046720716c0569b478f8d8806a70a9464102276eremcos
https://x.com/skocherhan/status/2027963121151643903remcos
https://www.virustotal.com/gui/file/237c24ac7015834f0de613bf03e8a076aa07abbbf8afd9debf72bce7b37b8295/detectionremcos
https://www.virustotal.com/gui/file/9f68e2fdb521b3cb027592aa34857b80e6e244b41c080b1618a9413dd9568d70/detectionremcos

IP addresses 2,819

102.117.160.251mythic
102.117.161.16mythic
102.117.162.141mythic
102.117.162.153mythic
102.117.162.28mythic
102.117.162.52mythic
102.117.163.126mythic
102.117.163.144mythic
102.117.163.154mythic
102.117.164.165mythic

Community reviews

Loading reviews…