IndicatorPublished 6 Jan 2026Updated 7 Jan 2026

ThreatFox IOCs for 2026-01-06

Source ThreatFox MISP Feed

TLP:WHITE, disclosure is not limited

Indicators of compromise

Domains 117

www.essistme.comGootLoader botnet C2 domain (confidence level: 100%)
www.identitetsmanual.seGootLoader botnet C2 domain (confidence level: 100%)
sunrbf.za.comAsyncRAT botnet C2 domain (confidence level: 75%)
dal-business-20.duckdns.orgXWorm botnet C2 domain (confidence level: 100%)
ghostisrealll-39376.portmap.hostXWorm botnet C2 domain (confidence level: 100%)
mnnenmvgfj.a.pinggy.linkQuasar RAT botnet C2 domain (confidence level: 100%)
agn121-64753.portmap.hostNjRAT botnet C2 domain (confidence level: 100%)
qq88.za.comAsyncRAT botnet C2 domain (confidence level: 75%)
springdogs.xyzUnknown Loader botnet C2 domain (confidence level: 100%)
turnclass.xyzUnknown Loader botnet C2 domain (confidence level: 100%)

URLs 41

https://topbilliondirectory.com/author/368betcv-89206/Unknown malware payload delivery URL (confidence level: 90%)
http://62.60.226.159/geter/login.phpTinyLoader botnet C2 (confidence level: 100%)
http://47.101.2.90:8888/supershell/login/Unknown malware botnet C2 (confidence level: 100%)
http://117.72.62.70:8888/supershell/login/Unknown malware botnet C2 (confidence level: 100%)
http://178.16.54.109/lfucky.exeGlobal botnet C2 (confidence level: 50%)
https://3.130.42.49/Unknown malware payload delivery URL (confidence level: 90%)
https://basilicros.su/asdasqLumma Stealer botnet C2 (confidence level: 75%)
https://broguenko.su/asfaseLumma Stealer botnet C2 (confidence level: 75%)
https://familyriwo.su/fssdawLumma Stealer botnet C2 (confidence level: 75%)
https://hammernew.su/asdaseLumma Stealer botnet C2 (confidence level: 75%)

IP addresses 152

185.112.59.176Stealc botnet C2 server (confidence level: 100%)
213.176.72.194Stealc botnet C2 server (confidence level: 100%)
84.234.99.235Mirai botnet C2 server (confidence level: 80%)
66.135.27.20Unknown malware botnet C2 server (confidence level: 100%)
194.163.179.157Unknown malware botnet C2 server (confidence level: 100%)
196.75.236.2Meterpreter botnet C2 server (confidence level: 100%)
104.131.164.45Empire Downloader botnet C2 server (confidence level: 100%)
3.130.42.49Unknown malware botnet C2 server (confidence level: 100%)
216.119.126.23Unknown malware botnet C2 server (confidence level: 100%)
172.233.26.43Cobalt Strike botnet C2 server (confidence level: 100%)

Hashes 164

77cb60d5a0293b34dcc98da4887e4028Global payload (confidence level: 75%)
4abd2ecd7e3b12219b4644bcfe614561Global payload (confidence level: 75%)
ca979fad68362cd3d9ad24424d5ac3fdGlobal payload (confidence level: 75%)
9a004814db05b314fac7b1862a0d8ac117e0464fVidar payload (confidence level: 95%)
d62ef0a828a92ac117fe34edb2aacc21a4c5cf2cca0897d9e86d5898d4c485d1Vidar payload (confidence level: 95%)
9c1e0aad3e5f84784aecdd96f47c9630Vidar payload (confidence level: 95%)
c6677d16c744f174b58a17fc35b740392626c4cbAsyncRAT payload (confidence level: 95%)
6173f089ad3738d51f8df09d9e59bb732b01925f9192ca5c0c68cee2a09a994cAsyncRAT payload (confidence level: 95%)
e9a7943474633ec31267d959e22734eaAsyncRAT payload (confidence level: 95%)
732cd1bb1943daf0b0c2edcd8ad1abb3928c9f06AsyncRAT payload (confidence level: 95%)

Description

ThreatFox IOCs for 2026-01-06

Impact

For European organizations, the impact of this threat intelligence is primarily in enhancing situational awareness and improving detection capabilities. Since no specific vulnerabilities or exploits are identified, the direct risk to confidentiality, integrity, or availability is limited at this stage. However, the mention of payload delivery and network activity indicates potential attempts to deliver malicious code or conduct reconnaissance, which could precede more targeted attacks. Organizations with critical infrastructure or sensitive data may face increased risk if attackers leverage these IOCs to craft tailored attacks. The medium severity suggests that while immediate disruption is unlikely, failure to incorporate this intelligence into security monitoring could allow adversaries to operate undetected. The lack of patches or fixes means defensive measures must focus on detection and response rather than remediation. Overall, the impact is moderate but underscores the importance of proactive threat intelligence integration in security operations.

Defensive guidance

European organizations should integrate the ThreatFox IOCs into their existing security information and event management (SIEM) systems and intrusion detection/prevention systems (IDS/IPS) to improve detection of related network activity and payload delivery attempts. Regularly updating threat intelligence feeds and correlating these with internal logs will help identify suspicious behavior early. Network segmentation and strict egress filtering can limit the potential impact of payload delivery. Employing behavioral analytics and anomaly detection can uncover novel attack patterns that may not yet be covered by signature-based detection. Security teams should conduct threat hunting exercises using these IOCs to proactively identify potential compromises. Additionally, enhancing employee awareness about OSINT-related reconnaissance techniques can reduce the risk of social engineering. Since no patches are available, emphasis should be on layered defenses, continuous monitoring, and rapid incident response capabilities.

Community reviews

Loading reviews…