MalwarePublished 19 Mar 2026

tlp clear · Maltrail IOC for 2026-03-19

Affects tlp clearSource CIRCL OSINT Feed

TLP:CLEAR, disclosure is not limited

malware

Description

Maltrail IOC for 2026-03-19

Impact

No direct impact details or exploitation evidence are provided. The medium severity rating suggests potential risk if the IOC is relevant to an environment, but no active exploitation or affected versions are noted.

Defensive guidance

Since this is an OSINT observation without specific actionable indicators, defenders should verify relevance to their environment before taking action. Monitor for related activity using existing detection capabilities aligned with the IOC once available.

Summary

The report details a malware-related IOC collected manually and shared as part of an open-source intelligence feed. It is classified under network activity and external analysis but does not provide concrete indicators or vulnerability details. The threat is assessed as medium risk based on the source classification but lacks further technical elaboration or exploit evidence.

Indicators of compromise

Domains 579

tejfudc3.comandroid_promptspy
h5.tejfudc3.comandroid_promptspy
mydisneymanager.com0ktapus
mymckessonconnect.com0ktapus
vereoy.pages.devapt_lazarus
deepwormtoken.lol
megoo.duckdns.orgpowershell_injector
megooo.duckdns.orgpowershell_injector
slashxx.duckdns.orgpowershell_injector
accessnabport.sbsek_clearfake

URLs 76

https://api.github.com/repos/stamparm/maltrail/commits/479c236daad47102be8c0e9c60bd7c84c523aa66android_promptspy
https://api.github.com/repos/stamparm/maltrail/commits/72aa82795ae2938e78c4a77c03a05eb69aa709e3sectoprat
https://api.github.com/repos/stamparm/maltrail/commits/f58b13d1f06030b0b8c4ca56b46906b86f85c82a0ktapus
https://api.github.com/repos/stamparm/maltrail/commits/80fd999a8344e9385d4f48077ca10e72bfdec7f0apt_lazarus
https://api.github.com/repos/stamparm/maltrail/commits/593789587e2a7c4618d5f7041b4008447a643c2f
https://api.github.com/repos/stamparm/maltrail/commits/324fafae47ad73a45c4f5bd5407634dd38149fb0powershell_injector
https://x.com/BlinkzSec/status/2034013249138462876powershell_injector
https://www.virustotal.com/gui/file/e63b6b875326bad1c16a3b079e02a83daf2c73a5c5bccc67a891b6de6c09d84f/detectionpowershell_injector
https://www.virustotal.com/gui/file/5aa0098ca107f74ce5f4708be60ab0edd476b1757abd01150f4908e1d2a7e1f6/detectionpowershell_injector
https://api.github.com/repos/stamparm/maltrail/commits/5171b8c893ebc9534b24b54185fbfec45910fe56ek_clearfake

IP addresses 13

141.11.197.134sectoprat
45.59.114.190sectoprat
45.59.160.211apt_lazarus
156.233.71.230powershell_injector
43.128.42.125gh0strat
212.11.64.72connectwise
77.55.215.96hak5cloud_c2
120.55.74.213cyberstrikeai
8.134.19.3cyberstrikeai
185.139.230.87exa

Community reviews

Loading reviews…