IndicatorPublished 4 Jan 2026Updated 5 Jan 2026

ThreatFox IOCs for 2026-01-04

Source ThreatFox MISP Feed

TLP:WHITE, disclosure is not limited

Indicators of compromise

Domains 65

ptn.tfba.meVidar botnet C2 domain (confidence level: 100%)
ptn.kievteplo.kiev.uaVidar botnet C2 domain (confidence level: 100%)
korex.sbsUnknown malware payload delivery domain (confidence level: 100%)
goooooogk.cfdUnknown malware payload delivery domain (confidence level: 100%)
lgr7mgmwdnswvdgw.wincryptapi.comUnknown malware botnet C2 domain (confidence level: 100%)
velvetpaw2031.cfdUnknown Stealer botnet C2 domain (confidence level: 100%)
my-api-lol.xyzUnknown Stealer botnet C2 domain (confidence level: 100%)
shabi9988-64207.portmap.hostSpyNote botnet C2 domain (confidence level: 100%)
juridico.tjtjusticia.comUnknown malware payload delivery domain (confidence level: 100%)
lunexmods.ioUnknown malware payload delivery domain (confidence level: 100%)

URLs 75

https://probable-winner.info/Unknown malware payload delivery URL (confidence level: 100%)
https://138.226.237.119/Vidar botnet C2 (confidence level: 100%)
http://77.110.102.154:3000/pages/login.htmlUnknown malware botnet C2 (confidence level: 100%)
http://45.80.158.214/request-downloadUnknown malware botnet C2 (confidence level: 100%)
http://45.80.158.214/request-injectUnknown malware botnet C2 (confidence level: 100%)
http://45.80.158.214/patchUnknown malware botnet C2 (confidence level: 100%)
http://87.248.157.152:5000/upl04dUnknown malware botnet C2 (confidence level: 100%)
https://down.wincryptapi.com/downloadUnknown Stealer payload delivery URL (confidence level: 100%)
http://195.178.136.19/3Phorpiex payload delivery URL (confidence level: 100%)
https://whm.beverlyhillmanor.com/Unknown malware payload delivery URL (confidence level: 90%)

IP addresses 70

138.226.237.105Vidar botnet C2 server (confidence level: 100%)
144.31.216.28Stealc botnet C2 server (confidence level: 100%)
138.226.237.119Vidar botnet C2 server (confidence level: 100%)
77.110.102.154Unknown malware botnet C2 server (confidence level: 100%)
66.135.27.20Unknown malware botnet C2 server (confidence level: 100%)
154.201.84.243Hook botnet C2 server (confidence level: 100%)
109.117.191.163Venom RAT botnet C2 server (confidence level: 100%)
54.89.221.157Meterpreter botnet C2 server (confidence level: 100%)
45.114.106.40Cobalt Strike botnet C2 server (confidence level: 100%)
94.237.122.202MimiKatz botnet C2 server (confidence level: 100%)

Hashes 162

f3af69c7e134a09573f4717553be1f6d6ca229f1Stealc payload (confidence level: 95%)
de1e5a910f9c946c10a912236cd51f12e1d7cc3c280552853059560bc787c309Stealc payload (confidence level: 95%)
473c0f6cc4f759bc27b39d24f4eb3afdStealc payload (confidence level: 95%)
74fa14c2a751ec23c1ee0cce1f66f5225c24a1e0Phorpiex payload (confidence level: 95%)
3a2dcd6c86a8b789c5f07eec531fd9a3d9268288d8cf47e9f324dacd55bb6cfcPhorpiex payload (confidence level: 95%)
e7e955ac85bc6cf49ce677d57d86f3b3Phorpiex payload (confidence level: 95%)
3d67e166a2cb568f8e226bb04672cef2e0e867f9poscardstealer payload (confidence level: 95%)
432cc68671e2f92f171d497c5d3e4b2d6e03bdc572c72daf8375e0412fd44f09poscardstealer payload (confidence level: 95%)
a181d912bc0a1090ba5c60e79766e3fbposcardstealer payload (confidence level: 95%)
f3c131c7b5994bec29b9b32601d8fd9c599cd6f1Typhon Stealer payload (confidence level: 95%)

Description

ThreatFox IOCs for 2026-01-04

Impact

For European organizations, the impact of this threat depends largely on the relevance and applicability of the shared IOCs to their environments. If these IOCs correspond to malware campaigns targeting sectors prevalent in Europe, such as finance, manufacturing, or critical infrastructure, organizations could face risks including network intrusion, data breaches, or service disruption. The lack of specific affected products or versions means that the threat intelligence serves more as an early warning or detection aid rather than signaling an immediate, exploitable vulnerability. European entities that rely heavily on threat intelligence feeds for proactive defense will benefit by updating their detection rules and monitoring for related network activity or payload delivery attempts. Conversely, organizations without mature threat intelligence integration may be slower to detect such threats, increasing their risk exposure. The medium severity rating suggests a moderate risk level, where exploitation could lead to confidentiality or integrity impacts but is not expected to cause widespread or critical availability issues. Overall, the impact is contingent on the operationalization of this intelligence within organizational security frameworks.

Defensive guidance

1. Integrate ThreatFox IOCs into existing SIEM, EDR, and network monitoring tools to enable automated detection and alerting of related malicious activity. 2. Regularly update threat intelligence feeds and correlate with internal logs to identify potential compromise indicators early. 3. Conduct targeted threat hunting exercises focusing on network activity and payload delivery patterns consistent with the shared IOCs. 4. Enhance employee awareness and training on recognizing suspicious network behaviors and phishing attempts that could deliver malware payloads. 5. Implement network segmentation and strict access controls to limit lateral movement if malware is detected. 6. Maintain up-to-date endpoint protection solutions capable of detecting and blocking known malware signatures. 7. Collaborate with national and European cybersecurity information sharing organizations to stay informed about evolving threats. 8. Develop and test incident response plans that incorporate threat intelligence ingestion and rapid containment procedures. 9. Monitor public and private vulnerability disclosures to anticipate any future patches or exploits related to these IOCs. 10. Employ anomaly detection systems to identify deviations from normal network behavior that may indicate payload delivery attempts.

Community reviews

Loading reviews…