IndicatorPublished 7 Mar 2026Updated 8 Mar 2026

ThreatFox IOCs for 2026-03-07

Source ThreatFox MISP Feed

TLP:WHITE, disclosure is not limited

Indicators of compromise

Domains 361

currencyflow.usdwane.in.netClearFake payload delivery domain (confidence level: 100%)
p8qzr.blinderdevour.in.netClearFake payload delivery domain (confidence level: 100%)
keitarocheats.comVidar payload delivery domain (confidence level: 100%)
ewar4pres.comKongTuke payload delivery domain (confidence level: 100%)
road-to-hell.topKongTuke payload delivery domain (confidence level: 100%)
tricitiesbydesign.comUnknown malware payload delivery domain (confidence level: 100%)
ooe.digitalmatters360.comVidar botnet C2 domain (confidence level: 100%)
blood04.dialectblood.in.netClearFake payload delivery domain (confidence level: 100%)
halroda.cyouLumma Stealer botnet C2 domain (confidence level: 100%)
infhkkh.cyouLumma Stealer botnet C2 domain (confidence level: 100%)

URLs 17

https://103.27.157.144/api/downloadVidar payload delivery URL (confidence level: 100%)
https://ewar4pres.com/5j2s.jsKongTuke payload delivery URL (confidence level: 100%)
https://ewar4pres.com/js.phpKongTuke payload delivery URL (confidence level: 100%)
https://road-to-hell.top/oKongTuke payload delivery URL (confidence level: 100%)
https://cdn3-cloudservices-verify.t3.storage.dev/follow/index.html?x-amz-algorithm=aws4-hmac-sha256&x-amz-credential=tid_nl_uvnrltspfgjoplnpfmgrvpgtyrtbexmsa_zhm_sbzixfvyp%2f20260306%2fauto%2fs3%2faws4_request&x-amz-date=20260306t125126z&x-amz-expires=172800&x-amz-signedheaders=host&x-amz-signature=119933e7d1a96d2c07ac541a641e6de626ce18247ab1555cf5da7838efe9c897Unknown malware payload delivery URL (confidence level: 90%)
http://43.164.1.146:8082/login/indexVShell botnet C2 (confidence level: 100%)
https://lvlenergy.pl/?u=ncilyoqjvutpmi5skblrf4aEmmenhtal payload delivery URL (confidence level: 50%)
https://lxbrands.se/?u=2iklnysz37hzawp4khgr23yEmmenhtal payload delivery URL (confidence level: 50%)
https://lynx-new.mightrecoverymarketing.com/?u=etmbh5zutjelbfywikpqsvqEmmenhtal payload delivery URL (confidence level: 50%)
https://lyssatee.com/?u=n3bdxmkppncau5brlqbigaaEmmenhtal payload delivery URL (confidence level: 50%)

IP addresses 121

167.172.150.241Aisuru botnet C2 server (confidence level: 100%)
178.128.174.202Aisuru botnet C2 server (confidence level: 100%)
192.109.200.147Quasar RAT botnet C2 server (confidence level: 100%)
161.35.37.48Aisuru botnet C2 server (confidence level: 100%)
206.189.72.196Aisuru botnet C2 server (confidence level: 100%)
39.96.181.14Cobalt Strike botnet C2 server (confidence level: 100%)
45.136.15.176Cobalt Strike botnet C2 server (confidence level: 100%)
103.44.88.4Cobalt Strike botnet C2 server (confidence level: 100%)
3.12.57.9Sliver botnet C2 server (confidence level: 100%)
172.111.150.42AsyncRAT botnet C2 server (confidence level: 100%)

Hashes 222

789e761d6af5b948536db12801565c66ae4c87deCoffeeLoader payload (confidence level: 95%)
48a48aa818438aa9ac6086b788126309ae61094539623d62b6298f3372e222bbCoffeeLoader payload (confidence level: 95%)
8ee1d63d154866c0ef31d69037afc83dCoffeeLoader payload (confidence level: 95%)
cd4f293e1b1fa748bf4b57cd0ee9a2cc6e2e452aPeddleCheap payload (confidence level: 95%)
28bfb5ad030de1cb0be842de702da578869ddf6bccdd32b7f6a991e65025587dPeddleCheap payload (confidence level: 95%)
5239d6867d7e09a0d4236f0aab95193fPeddleCheap payload (confidence level: 95%)
1e0766edeff6ae8c71754398e8bd73dbb188fdebDOSTEALER payload (confidence level: 95%)
cd139883e7c08001becf7a9a864c91691bc243c3adb5c87ce94729f9b24a56ceDOSTEALER payload (confidence level: 95%)
3640dc6e844cd3c3940c4c231e656bf0DOSTEALER payload (confidence level: 95%)
ca7ab0373730c9ac645ec60585c4e2f8f4f5edabCobalt Strike payload (confidence level: 95%)

Description

ThreatFox IOCs for 2026-03-07

Impact

Given the lack of detailed technical information, the potential impact of this threat is currently unclear and likely limited. Without known exploits or active payloads, organizations face minimal immediate risk. However, the presence of malware-related IOCs in OSINT feeds indicates ongoing reconnaissance or low-level malware activity that could evolve. If leveraged in targeted attacks, such malware could impact confidentiality, integrity, or availability depending on payload capabilities. The medium severity rating suggests moderate concern but no critical or widespread impact at this time. Organizations relying heavily on OSINT and network monitoring should consider this as part of their broader threat landscape but not as an urgent threat requiring immediate action.

Defensive guidance

Due to the absence of specific technical indicators or affected products, mitigation should focus on general best practices tailored to OSINT and malware detection: 1) Maintain updated threat intelligence feeds and integrate ThreatFox IOCs into SIEM and IDS/IPS systems for early detection. 2) Conduct regular network traffic analysis to identify suspicious payload delivery attempts. 3) Employ endpoint detection and response (EDR) solutions to monitor for anomalous behaviors potentially linked to unknown malware. 4) Ensure robust patch management for all systems, even though no patches are currently available for this threat. 5) Train security teams to recognize emerging OSINT-related malware trends and incorporate threat hunting exercises based on updated intelligence. 6) Collaborate with information sharing communities to receive timely updates and context on evolving threats. These steps go beyond generic advice by emphasizing integration of OSINT feeds and proactive network monitoring.

Community reviews

Loading reviews…