MalwarePublished 11 Apr 2026Updated 12 Apr 2026

tlp clear · Maltrail IOC for 2026-04-12

Affects tlp clearSource CIRCL OSINT Feed

TLP:CLEAR, disclosure is not limited

malware

Description

Maltrail IOC for 2026-04-12

Impact

The impact is assessed as medium risk due to the presence of malware-related network activity indicators. However, no direct exploitation or vulnerability details are provided, and no known active exploits have been reported. The lack of affected versions or patch information suggests this is an observational IOC rather than a vulnerability with a direct remediation path.

Defensive guidance

Security teams should consider integrating this IOC into their detection and monitoring systems to identify potential malicious network activity. Since this is an OSINT observation without direct exploit or vulnerability, no urgent remediation actions are indicated.

Summary

The report details a Maltrail IOC identified on April 12, 2026, indicating suspicious or malicious network activity associated with malware. It is based on external OSINT analysis without specific technical indicators or affected software versions. No known exploits or patches are associated with this IOC, and it is classified as medium severity based on the source assessment.

Indicators of compromise

Domains 2,001

nemzetivalasztas.comapt_unclassified
nemzetivalasztasiroda.comapt_unclassified
visapics.infopowershell_injector
192-166-82-72.cprapid.comfakeapp
306099.xyzfakeapp
abantyesilev.supportfakeapp
acmewebpages.orgfakeapp
baclinksolves.topfakeapp
camidvvest.comfakeapp
cammidvvest.comfakeapp

URLs 66

https://api.github.com/repos/stamparm/maltrail/commits/0898fb987966ac19b679b63541ef0d229f0cbe40apt_unclassified
https://x.com/smica83/status/2043078916508708895apt_unclassified
https://www.virustotal.com/gui/file/b54371228b9a9657abe03b118247942d5b61370b36bbdd6027abc178b8a09e35/detectionapt_unclassified
https://api.github.com/repos/stamparm/maltrail/commits/573b382dd22b5323eae12b92e0c3537680c74851powershell_injector
https://x.com/smica83/status/2043042341439648160powershell_injector
https://tria.ge/260411-x76q3saz4y/behavioral1powershell_injector
https://api.github.com/repos/stamparm/maltrail/commits/10ea8be72b3caf50c891d6acdbde987fe86514d3crip
https://x.com/smica83/status/2043038864223154241crip
https://tria.ge/260411-xesnrahz5z/behavioral1crip
https://www.virustotal.com/gui/file/4be0aa46d7fc6deab04f210881e4f9ce9914fd3ca407f7f2f6782b6ee0e628fe/detectioncrip

IP addresses 18

45.90.98.215crip
175.24.15.10cyberstrikeai
185.91.127.173masonrat
38.127.8.151zshell_c2
38.207.181.130zshell_c2
38.207.181.131zshell_c2
38.207.181.132zshell_c2
38.207.181.133zshell_c2
38.207.181.134zshell_c2
185.19.85.138

Community reviews

Loading reviews…