IndicatorPublished 24 Jan 2026Updated 25 Jan 2026

ThreatFox IOCs for 2026-01-24

Source ThreatFox MISP Feed

TLP:WHITE, disclosure is not limited

Indicators of compromise

Domains 52

radiopoljubac.netNetSupportManager RAT botnet C2 domain (confidence level: 100%)
koszulki.netNetSupportManager RAT botnet C2 domain (confidence level: 100%)
wxqdcakvuv.comUnknown malware payload delivery domain (confidence level: 100%)
official-jaxxwallet.comUnknown malware payload delivery domain (confidence level: 100%)
homencck.comKongTuke payload delivery domain (confidence level: 100%)
ggjvk3v5bzopisqkf7kd5el2j40gdgcu.lambda-url.ap-southeast-1.on.awsCobalt Strike botnet C2 domain (confidence level: 75%)
www.micrcscft.cyouCobalt Strike botnet C2 domain (confidence level: 75%)
hollow-paper.infoSantaStealer botnet C2 domain (confidence level: 100%)
capitamx.cyouLumma Stealer botnet C2 domain (confidence level: 100%)
personrg.cyouLumma Stealer botnet C2 domain (confidence level: 100%)

URLs 18

https://wxqdcakvuv.com/cssfont.jsUnknown malware payload delivery URL (confidence level: 100%)
https://wxqdcakvuv.com/ok1.jsUnknown malware payload delivery URL (confidence level: 100%)
https://185.113.8.55/asd1.jsUnknown malware payload delivery URL (confidence level: 100%)
http://185.113.8.55/uploads/ok.exeUnknown malware payload delivery URL (confidence level: 100%)
http://185.113.8.55/asd1.jsUnknown malware payload delivery URL (confidence level: 100%)
http://185.113.8.55/nepUnknown malware payload delivery URL (confidence level: 100%)
http://srproofing.com/contents/lockUnknown malware payload delivery URL (confidence level: 100%)
http://official-jaxxwallet.com/stealer.txtUnknown malware payload delivery URL (confidence level: 100%)
http://47.95.169.152:8888/supershell/login/Unknown malware botnet C2 (confidence level: 100%)
https://arekinformatika.my.id/Unknown malware botnet C2 (confidence level: 100%)

IP addresses 196

95.85.239.218Stealc botnet C2 server (confidence level: 100%)
195.85.114.118KongTuke payload delivery server (confidence level: 100%)
160.124.104.143Cobalt Strike botnet C2 server (confidence level: 100%)
109.199.119.43Remcos botnet C2 server (confidence level: 100%)
193.164.4.141Venom RAT botnet C2 server (confidence level: 100%)
44.221.193.28Nimplant botnet C2 server (confidence level: 100%)
54.241.182.163Meterpreter botnet C2 server (confidence level: 100%)
81.206.117.70Meterpreter botnet C2 server (confidence level: 100%)
40.177.84.210Meterpreter botnet C2 server (confidence level: 100%)
15.223.120.154Meterpreter botnet C2 server (confidence level: 100%)

Hashes 161

70101dec1e34cb03ac9e8540a05013bf5175fd61GUIDLOADER payload (confidence level: 95%)
ea37950d79a6a7cde271a8d59a222aa4f0f34d3fb08501d9fa9eaee89fe192d0GUIDLOADER payload (confidence level: 95%)
41f630848f119363b0d686b48d376650GUIDLOADER payload (confidence level: 95%)
498918b8acdbb40682595a15bc4e7b25547fd85aposcardstealer payload (confidence level: 95%)
7896a753acbdb05acc1a5f595af2f0ca57ebb9496aac596ec333dfce6a9f848bposcardstealer payload (confidence level: 95%)
47d5c3070b03c74d7916b669f0c0b35fposcardstealer payload (confidence level: 95%)
9eecdcf59d8f9103d2e59335f37fc6ea7e96db0fMasad Stealer payload (confidence level: 95%)
69a8a7ef5a00c00b12fc33f71abc8e30ad4c926166e8c783469d9da33d46d10cMasad Stealer payload (confidence level: 95%)
5d0afd5b48616dbd8ee90cc3a9f8e851Masad Stealer payload (confidence level: 95%)
a10c273fdc50df8351a78a9c97d4dd814ce159e4StrelaStealer payload (confidence level: 95%)

Description

ThreatFox IOCs for 2026-01-24

Impact

For European organizations, the primary impact lies in the potential for network-based malware delivery that could lead to unauthorized access, data exfiltration, or disruption of services. Since no specific software or hardware vulnerabilities are identified, the threat's impact depends on the effectiveness of existing network defenses and the ability to detect and respond to the IOCs. Sectors with high exposure to internet-facing services, such as finance, telecommunications, and critical infrastructure, may face increased risk if attackers leverage these IOCs for targeted payload delivery. The absence of known active exploitation reduces immediate risk but does not eliminate the possibility of future attacks using these indicators. Additionally, the medium severity rating suggests a moderate risk level that requires attention but is not indicative of an imminent large-scale threat. The lack of patches means organizations must rely on detection and response capabilities rather than remediation through updates.

Defensive guidance

1. Integrate the provided IOCs into existing Security Information and Event Management (SIEM) and Endpoint Detection and Response (EDR) systems to enhance detection capabilities. 2. Conduct proactive threat hunting exercises focusing on network traffic anomalies and payload delivery attempts matching the IOC patterns. 3. Strengthen network segmentation and implement strict access controls to limit lateral movement if payload delivery occurs. 4. Employ advanced network monitoring tools capable of detecting unusual outbound and inbound connections related to the IOCs. 5. Regularly update threat intelligence feeds and ensure security teams are trained to interpret and act on OSINT-derived indicators. 6. Collaborate with national and European cybersecurity information sharing organizations to stay informed about evolving threats related to these IOCs. 7. Conduct phishing and social engineering awareness training, as payload delivery often involves user interaction vectors. 8. Maintain robust incident response plans that include procedures for handling malware infections linked to network-delivered payloads.

Community reviews

Loading reviews…