IndicatorPublished 2 Jan 2026Updated 3 Jan 2026

ThreatFox IOCs for 2026-01-02

Source ThreatFox MISP Feed

TLP:WHITE, disclosure is not limited

Indicators of compromise

Domains 37

zarintandis.irGootLoader botnet C2 domain (confidence level: 100%)
pushokbandit-598.cfdUnknown Stealer botnet C2 domain (confidence level: 100%)
pushokriotru-907.icuUnknown Stealer botnet C2 domain (confidence level: 100%)
ksc.ae.orgAsyncRAT botnet C2 domain (confidence level: 100%)
phillipsconsulting.us.comAsyncRAT botnet C2 domain (confidence level: 100%)
vbr.uk.comAsyncRAT botnet C2 domain (confidence level: 100%)
www.doctorsacademy.orgGootLoader botnet C2 domain (confidence level: 100%)
bong88.co.comDCRat botnet C2 domain (confidence level: 100%)
login.bong88.co.comDCRat botnet C2 domain (confidence level: 100%)
google.bong88.co.comDCRat botnet C2 domain (confidence level: 100%)

URLs 4

http://77.110.119.94/ce369e7324834845.phpStealc botnet C2 (confidence level: 100%)
https://t.me/awesome_mineUnknown malware botnet C2 (confidence level: 100%)
http://155.117.98.14:8888/supershell/login/Unknown malware botnet C2 (confidence level: 100%)
http://144.31.216.28Stealc botnet C2 (confidence level: 100%)

IP addresses 74

130.12.180.134Mirai botnet C2 server (confidence level: 100%)
139.162.12.197Mirai botnet C2 server (confidence level: 50%)
80.64.19.173Remcos botnet C2 server (confidence level: 100%)
74.124.24.240AsyncRAT payload delivery server (confidence level: 100%)
45.93.20.198Stealc botnet C2 server (confidence level: 100%)
96.44.159.154Remcos botnet C2 server (confidence level: 100%)
80.171.145.76Unknown malware botnet C2 server (confidence level: 100%)
151.242.20.7AdaptixC2 botnet C2 server (confidence level: 100%)
3.131.196.201Unknown malware botnet C2 server (confidence level: 100%)
157.245.54.75pupy botnet C2 server (confidence level: 100%)

Hashes 195

ba5035bcf39ff948da9dca68bc972497c5977a4fStealc payload (confidence level: 95%)
d5cbae815c0ce005b7941c1a3279c06bcbf229ebbfe00d3face5ab8499fbede0Stealc payload (confidence level: 95%)
271e2683f47956b21a631dace079adf7Stealc payload (confidence level: 95%)
342376bf7b63e62ba57c69df68b1cf0e5ececa27poscardstealer payload (confidence level: 95%)
fe33c0f159c8d2f37c694215f63a95f55b498da024863b87f7f5601e0c6c42b9poscardstealer payload (confidence level: 95%)
91763fd6a0da2fb89df38b3ed2ee1f69poscardstealer payload (confidence level: 95%)
fbd7b9e63f2ce14c6ce749386115f5a2e176eb6aQuasar RAT payload (confidence level: 95%)
d40088a972032de51cfc946a3585fbad54fdf06b3ba1dd5423a48ba7723654abQuasar RAT payload (confidence level: 95%)
8f452784b2c3910c7652bd35b66d9cd6Quasar RAT payload (confidence level: 95%)
2c494ba8118e95005dad757eef0d2dc84c432453Vidar payload (confidence level: 95%)

Description

ThreatFox IOCs for 2026-01-02

Impact

Since this entry represents OSINT threat intelligence data rather than an active exploit or vulnerability, the direct impact on European organizations is minimal. The primary value lies in enhancing detection and response capabilities by integrating these IOCs into security monitoring systems such as SIEMs or endpoint detection platforms. If these IOCs correspond to malware or threat actor activity targeting European entities, they could help identify early signs of compromise. However, no immediate compromise or system disruption is indicated. The lack of affected versions or patches means no direct remediation is required. The impact is therefore indirect, improving threat awareness rather than indicating an imminent risk to confidentiality, integrity, or availability.

Defensive guidance

European organizations should incorporate the provided IOCs into their existing threat intelligence platforms and security monitoring tools to enhance detection of potential malicious activity. Regularly updating IOC feeds like ThreatFox ensures timely identification of emerging threats. Security teams should correlate these IOCs with internal logs and network traffic to detect any signs of compromise. Additionally, organizations should maintain robust network segmentation, endpoint protection, and incident response procedures to mitigate any malware infections indicated by such intelligence. Since no patches or specific vulnerabilities are associated, focus should remain on proactive monitoring and threat hunting using these indicators. Collaboration with national CERTs and sharing intelligence within trusted communities can further improve preparedness.

Community reviews

Loading reviews…