IndicatorPublished 9 Mar 2026Updated 10 Mar 2026

type osint · ThreatFox IOCs for 2026-03-09

Affects type osintSource ThreatFox MISP Feed

TLP:WHITE, disclosure is not limited

Indicators of compromise

Domains 303

good-gate.goodtime.in.netClearFake payload delivery domain (confidence level: 100%)
kirk-service.liveMaskGramStealer botnet C2 domain (confidence level: 100%)
crispy-rusty.comSantaStealer botnet C2 domain (confidence level: 100%)
ford-sync.ironford.in.netClearFake payload delivery domain (confidence level: 100%)
gate-v05.lakegate.in.netClearFake payload delivery domain (confidence level: 100%)
gennods.cyouLumma Stealer botnet C2 domain (confidence level: 100%)
brocaez.clubLumma Stealer botnet C2 domain (confidence level: 100%)
familbg.clubLumma Stealer botnet C2 domain (confidence level: 100%)
mobbyyt.clubLumma Stealer botnet C2 domain (confidence level: 100%)
nbdeco.frStrelaStealer payload delivery domain (confidence level: 100%)

URLs 69

https://www.ulfhedinnvikings.com/Unknown malware payload delivery URL (confidence level: 90%)
http://kirk-service.live/6e07a7147a15224446034debd2d1288b/mzcxijwx2zg9e7wMaskGramStealer botnet C2 (confidence level: 100%)
http://kirk-service.live/6e07a7147a15224446034debd2d1288b/ejk52zwt2js16roMaskGramStealer botnet C2 (confidence level: 100%)
http://kirk-service.live/6e07a7147a15224446034debd2d1288b/6v0tazc5mboxujsMaskGramStealer botnet C2 (confidence level: 100%)
http://kirk-service.live/6e07a7147a15224446034debd2d1288b/q7cherolivolejkMaskGramStealer botnet C2 (confidence level: 100%)
http://kirk-service.live/6e07a7147a15224446034debd2d1288b/iro9a3cp6zsd230MaskGramStealer botnet C2 (confidence level: 100%)
http://kirk-service.live/6e07a7147a15224446034debd2d1288b/ujgti3g12f45y74MaskGramStealer botnet C2 (confidence level: 100%)
http://kirk-service.live/6e07a7147a15224446034debd2d1288b/m3o1azkhufs1enkMaskGramStealer botnet C2 (confidence level: 100%)
http://kirk-service.live/6e07a7147a15224446034debd2d1288b/y74habwtyvsxarwMaskGramStealer botnet C2 (confidence level: 100%)
http://kirk-service.live/6e07a7147a15224446034debd2d1288b/a7k56jotufo5ab4MaskGramStealer botnet C2 (confidence level: 100%)

IP addresses 117

31.57.216.128Remcos botnet C2 server (confidence level: 100%)
5.206.227.239Remcos botnet C2 server (confidence level: 100%)
146.103.106.71Sliver botnet C2 server (confidence level: 100%)
38.242.144.218AsyncRAT botnet C2 server (confidence level: 100%)
102.117.160.235Unknown malware botnet C2 server (confidence level: 100%)
79.135.160.20Unknown malware botnet C2 server (confidence level: 100%)
8.138.0.148Unknown malware botnet C2 server (confidence level: 100%)
144.31.164.198Bashlite botnet C2 server (confidence level: 100%)
45.158.196.14AdaptixC2 botnet C2 server (confidence level: 100%)
196.75.62.145Meterpreter botnet C2 server (confidence level: 100%)

Hashes 9

Unknown malware payload (confidence level: 100%)

9f431d5549a03aee92cfd2bdbbe90f1c91e965c99e90a0c9ad5a001f4e80c350
98a7b0900a9072bb40af579ec372da7b27af12b15868394df51fefe290ab176b
66cceb2c2f1d9988b501832fd3b559775982e2fce4ab38fc4ffe71b74eafc726
679ee05d92a858b6fe70aeb6072eb804548f1732e18b6c181af122b833386afb
4762e944a0ce1f9aef243e11538f84f16b6f36560ed6e32dfd9a5f99e17e8e50
98442387d466f27357d727b3706037a4df12a78602b93df973b063462a677761
cc2bc3750cc5125a50466f66ae4f2bedf1cac0e43477a78ed2fd88f3e987a292
cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce
0ecc867ce916d01640d76ec03de24d1d23585eb582e9c48a0364c62a590548ac

Description

ThreatFox IOCs for 2026-03-09

Impact

Due to the absence of detailed information on the malware's capabilities, affected systems, or exploitation methods, the potential impact remains unclear. The medium severity rating suggests some risk, but without specifics, it is difficult to assess the threat's effect on confidentiality, integrity, or availability. Organizations worldwide could theoretically be impacted if the malware targets widely used systems or networks, but no evidence supports active exploitation or widespread distribution. The lack of known exploits and patches indicates this may be an emerging or low-activity threat, or simply an intelligence collection without immediate operational impact.

Defensive guidance

Given the limited information, organizations should focus on general best practices for malware defense and OSINT monitoring: 1) Maintain updated endpoint protection and network monitoring tools capable of detecting unusual payload delivery and network activity. 2) Integrate ThreatFox and other threat intelligence feeds into security information and event management (SIEM) systems to enhance detection capabilities. 3) Conduct regular threat hunting exercises focusing on network anomalies and suspicious payloads. 4) Educate security teams on interpreting and leveraging OSINT-based threat intelligence. 5) Maintain robust incident response plans to quickly address any emerging threats identified through updated intelligence. Since no patches or specific exploits are known, no targeted remediation is currently possible.

Community reviews

Loading reviews…