IndicatorPublished 9 Feb 2026Updated 10 Feb 2026

ThreatFox IOCs for 2026-02-09

Source ThreatFox MISP Feed

TLP:WHITE, disclosure is not limited

Indicators of compromise

Domains 125

oculusr.cyouLumma Stealer botnet C2 domain (confidence level: 75%)
verbala.cyouLumma Stealer botnet C2 domain (confidence level: 75%)
allwheelwealth.duckdns.orgXWorm botnet C2 domain (confidence level: 100%)
armyshoe.xyzUnknown Loader botnet C2 domain (confidence level: 100%)
celeryerror.xyzUnknown Loader botnet C2 domain (confidence level: 100%)
grandfatherquiver.xyzUnknown Loader botnet C2 domain (confidence level: 100%)
mountainsurprise.cfdUnknown Loader botnet C2 domain (confidence level: 100%)
peacetongue.xyzUnknown Loader botnet C2 domain (confidence level: 100%)
argumentablyfile.spaceUnknown Loader botnet C2 domain (confidence level: 100%)
rabbitsbird.infoUnknown Loader botnet C2 domain (confidence level: 100%)

URLs 130

https://namzcp.org/Unknown malware payload delivery URL (confidence level: 90%)
http://193.143.1.16/g8hrs4f4vh/index.phpAmadey botnet C2 (confidence level: 100%)
http://130.12.180.121/file/allUnknown malware payload delivery URL (confidence level: 75%)
http://130.12.180.20:34029/cat.shUnknown malware payload delivery URL (confidence level: 75%)
http://cg651919.tw1.ru/8830ffbd.phpDCRat botnet C2 (confidence level: 100%)
https://steamcommunity.com/profiles/76561198742173262Vidar botnet C2 (confidence level: 100%)
https://telegram.me/ho00rqVidar botnet C2 (confidence level: 100%)
https://steamcommunity.com/profiles/76561198742377525Vidar botnet C2 (confidence level: 100%)
https://telegram.me/dikkh0kVidar botnet C2 (confidence level: 100%)
https://uyu.deshsaradin.com/Vidar botnet C2 (confidence level: 100%)

IP addresses 164

46.151.182.225Mirai botnet C2 server (confidence level: 100%)
185.241.211.47Remcos botnet C2 server (confidence level: 100%)
95.47.253.116Remcos botnet C2 server (confidence level: 100%)
31.57.219.108XWorm botnet C2 server (confidence level: 100%)
95.85.235.132Stealc botnet C2 server (confidence level: 75%)
138.124.53.228Stealc botnet C2 server (confidence level: 75%)
144.31.139.187Stealc botnet C2 server (confidence level: 75%)
193.58.121.25Stealc botnet C2 server (confidence level: 75%)
8.148.29.29XWorm botnet C2 server (confidence level: 100%)
46.246.34.54Remcos botnet C2 server (confidence level: 100%)

Hashes 184

a9e6652f5001b03df0cfb1e24620ae75Akira payload (confidence level: 100%)
d3cf7a81ddd61e65fc4773257331325dAkira payload (confidence level: 100%)
b356ece2d8150fd0e7e673ae37033554Unknown malware payload (confidence level: 100%)
e8c19bf10d044fe448a60e3fa0f60d58Unknown malware payload (confidence level: 100%)
eb45ff7ea2ccdcceb2e7e14f9cc01397Hive payload (confidence level: 100%)
92a27f2042385e3e9d097cf234c07859Hive payload (confidence level: 100%)
6c1665d8f03efdc96991956f4d7f310dHive payload (confidence level: 100%)
8240d60d83cb7c0248e64389855e29b4Hive payload (confidence level: 100%)
348c4b8618b06c15495988b461b5c355Hive payload (confidence level: 100%)
516f36f2d29a32ee049caadd4721d884Hive payload (confidence level: 100%)

Description

ThreatFox IOCs for 2026-02-09

Impact

The impact of this threat intelligence on European organizations is primarily in enhancing detection and response capabilities rather than indicating an immediate risk of compromise. Since no specific vulnerabilities or exploits are detailed, the direct impact on confidentiality, integrity, or availability is limited. However, the presence of malware-related IOCs related to network activity and payload delivery suggests potential risks if these indicators correspond to active or emerging malware campaigns. European organizations with extensive network infrastructures and exposure to advanced persistent threats may benefit from integrating these IOCs into their security monitoring tools to identify and mitigate potential intrusions early. Failure to incorporate such intelligence could delay detection of malware infections, potentially leading to data breaches or operational disruptions. The lack of patches or known exploits reduces urgency but underscores the importance of maintaining robust network monitoring and incident response processes. Overall, the impact is moderate, emphasizing preparedness and threat hunting rather than immediate remediation.

Defensive guidance

To effectively leverage this threat intelligence, European organizations should: 1) Integrate the provided IOCs into existing Security Information and Event Management (SIEM) systems and intrusion detection/prevention systems (IDS/IPS) to enhance network traffic monitoring for suspicious payload delivery patterns. 2) Conduct regular threat hunting exercises using these IOCs to proactively identify potential malware infections or command and control communications within their networks. 3) Maintain updated endpoint detection and response (EDR) solutions capable of detecting malware payloads associated with the indicators. 4) Share relevant findings with national Computer Security Incident Response Teams (CSIRTs) and participate in information sharing communities to improve collective defense. 5) Ensure network segmentation and strict access controls to limit the lateral movement of malware if detected. 6) Conduct user awareness training focused on recognizing phishing or social engineering tactics that may be used to deliver malware payloads. 7) Continuously update and tune detection rules based on evolving threat intelligence feeds like ThreatFox to maintain relevance. These steps go beyond generic advice by emphasizing integration of specific IOCs into operational security workflows and collaborative defense mechanisms.

Community reviews

Loading reviews…