MalwarePublished 20 Mar 2026

tlp clear · Maltrail IOC for 2026-03-20

Affects tlp clearSource CIRCL OSINT Feed

TLP:CLEAR, disclosure is not limited

malware

Description

Maltrail IOC for 2026-03-20

Impact

No direct impact on specific products or versions is indicated. There are no known exploits in the wild associated with this IOC. The threat represents a medium-risk malware observation that may inform network monitoring and threat detection efforts but does not describe an active or confirmed compromise vector.

Defensive guidance

Security teams should consider integrating this IOC into their threat detection systems if relevant but no urgent action is mandated based on the provided information.

Summary

The report details a malware-related IOC published by CIRCL OSINT Feed on 2026-03-20. It is classified as a medium-risk observation of network activity without specific affected software versions or exploit details. The data serves as an external analysis for situational awareness rather than a direct vulnerability or exploit.

Indicators of compromise

Domains 1,192

freegift-pump.funosx_nova
muyo.clickandroid_joker
seblu.proandroid_joker
app.vereoy.comapt_lazarus
vereoy.comapt_lazarus
mypurplemanager.com0ktapus
interactionsystems.cofakeapp
api.interactionsystems.cofakeapp
fix-bkg.compowershell_injector
sing-in-token-op.comek_clearfake

URLs 29

https://api.github.com/repos/stamparm/maltrail/commits/75af25b64e52e999f038c6e3d9b1ae3768ff1a80osx_nova
https://api.github.com/repos/stamparm/maltrail/commits/ce6c9264f1cfa0e1b65339d2e394e5f7d16ccfbeandroid_joker
https://api.github.com/repos/stamparm/maltrail/commits/9f218e5cea0fa3d5ea176fec1f2e68899b9ffc08sectoprat
https://api.github.com/repos/stamparm/maltrail/commits/708cf9a8347146d4d77aceae1470235863f01b96apt_lazarus
https://api.github.com/repos/stamparm/maltrail/commits/7e208279cae34c90963b56ce616680749023e1f1cyberstrikeai
https://api.github.com/repos/stamparm/maltrail/commits/0fe8b5707c9c34aba558fc47bfdf2329f3fc5c9e0ktapus
https://api.github.com/repos/stamparm/maltrail/commits/9253e87c4f4ab7cf486b044c4d82e3d2f95aa1ecfakeapp
https://api.github.com/repos/stamparm/maltrail/commits/f61b6543dbfec1d7c00ae52606ecff7f90741fffpowershell_injector
https://x.com/FatzQatz/status/2034846071369998693powershell_injector
https://www.virustotal.com/gui/file/7e9171fa04a9019727f31dfb23e735cfc63daf01788cfaeb809705e926173ac4/detectionpowershell_injector

IP addresses 19

135.181.138.114sectoprat
141.11.197.133sectoprat
144.31.159.15sectoprat
146.103.126.131sectoprat
178.16.53.124sectoprat
46.149.78.104sectoprat
45.59.160.200apt_lazarus
64.118.144.89cyberstrikeai
108.187.40.45farfli
149.104.0.151farfli

Community reviews

Loading reviews…