MalwarePublished 18 Mar 2026

tlp clear · Maltrail IOC for 2026-03-18

Affects tlp clearSource CIRCL OSINT Feed

TLP:CLEAR, disclosure is not limited

malware

Description

Maltrail IOC for 2026-03-18

Impact

The impact is assessed as medium risk based on the source classification, but no specific exploitation or compromise details are provided. Without indicators or affected versions, the direct impact on systems cannot be determined from the available data.

Defensive guidance

Since this is an OSINT observation without actionable indicators, no specific mitigation steps can be recommended beyond standard monitoring and threat intelligence integration as appropriate.

Summary

The report describes a malware-related IOC published on 2026-03-18 by the CIRCL OSINT Feed. It is classified as medium risk and relates to network activity observed externally. No affected software versions or exploit details are provided, and there are no known active exploits or patches. The IOC appears to be a general observation without detailed technical indicators or actionable signatures.

Indicators of compromise

Domains 17

programgreedz.infoapt_donot
api.xdweb4k.ccandroid_joker
xdweb4k.ccandroid_joker
coachzenblog.bizapt_lazarus
weatherchecker.livepowershell_injector
api.weatherchecker.livepowershell_injector
speedtoolmetrics.comfakeapp
s.speedtoolmetrics.comfakeapp
selfhonda.comapt_lazarus
potassiumres.stelf_mirai

URLs 29

https://api.github.com/repos/stamparm/maltrail/commits/9e7ac0610fbf146ffcadc6a4ce643e22bf53dde7cyberstrikeai
https://api.github.com/repos/stamparm/maltrail/commits/f13b7fbaf4758bd38ca98237d2790d244b07af2dapt_donot
https://api.github.com/repos/stamparm/maltrail/commits/c971a93d90d5c42cad61db58f0b6229c8a7ba4c1android_joker
https://api.github.com/repos/stamparm/maltrail/commits/9c3161ddafbddcfb3909dfbccffcf2a835796015apt_lazarus
https://api.github.com/repos/stamparm/maltrail/commits/7c2e0c8ee60bb56c72a8734ee4365a1fa1fbc3fdapt_lazarus
https://api.github.com/repos/stamparm/maltrail/commits/25eb0490c2c94fb1119882276eaaec41da13fc13redline
https://x.com/tdatwja/status/2034172367619207516redline
https://www.virustotal.com/gui/file/2a66c5430a0a4e7cfb939d8219a72420213d2768c3eece7f7cac3d9e2d582f63/detectionredline
https://api.github.com/repos/stamparm/maltrail/commits/66977671f6854b8af95d77706a99da2c66b8b9f7powershell_injector
https://x.com/malwrhunterteam/status/2034004347630006501powershell_injector

IP addresses 17

95.131.214.254cyberstrikeai
67.207.166.173apt_lazarus
88.99.241.111apt_lazarus
216.250.252.103apt_lazarus
45.59.160.199apt_lazarus
45.59.160.210apt_lazarus
202.95.18.97redline
100.51.175.254apt_lazarus
146.103.99.12apt_lazarus
167.88.63.91apt_lazarus

Community reviews

Loading reviews…