IndicatorPublished 14 Mar 2026Updated 15 Mar 2026

type osint · ThreatFox IOCs for 2026-03-14

Affects type osintSource ThreatFox MISP Feed

TLP:WHITE, disclosure is not limited

Indicators of compromise

Domains 490

payroll-notify.orgUnknown malware payload delivery domain (confidence level: 100%)
gosidefastandpure.comUnknown malware payload delivery domain (confidence level: 100%)
nexfin.expertUnknown malware payload delivery domain (confidence level: 100%)
fastcruiseandco.comUnknown malware payload delivery domain (confidence level: 100%)
symbiose-business.frUnknown malware payload delivery domain (confidence level: 100%)
payrolladvice.frUnknown malware payload delivery domain (confidence level: 100%)
myverifyblog.sbsUnknown malware payload delivery domain (confidence level: 100%)
mail.authorized-logins.netKongTuke payload delivery domain (confidence level: 100%)
dev-test-node.sturmwelle.in.netClearFake payload delivery domain (confidence level: 100%)
metrics-hub.sturmwelle.in.netClearFake payload delivery domain (confidence level: 100%)

URLs 64

https://payroll-notify.orgUnknown malware payload delivery URL (confidence level: 100%)
https://gosidefastandpure.com/captchaUnknown malware payload delivery URL (confidence level: 100%)
http://gosidefastandpure.com/76773139753479743332356866677863/started/69c85cb9Unknown malware payload delivery URL (confidence level: 100%)
http://gosidefastandpure.com/76773139753479743332356866677863/failed/4a82136Unknown malware payload delivery URL (confidence level: 100%)
http://gosidefastandpure.com/76773139753479743332356866677863/failed/4a821368Unknown malware payload delivery URL (confidence level: 100%)
http://gosidefastandpure.com/76773139753479743332356866677863/completed/a16a5d4Unknown malware payload delivery URL (confidence level: 100%)
https://github.com/4realgg/helper-update1.0/releases/download/update1/mw--58389c35-c76b-46ac-b33e-7efe83b65fda.zipUnknown malware payload delivery URL (confidence level: 100%)
http://nexfin.expertUnknown malware payload delivery URL (confidence level: 100%)
http://fastcruiseandco.comUnknown malware payload delivery URL (confidence level: 100%)
http://symbiose-business.frUnknown malware payload delivery URL (confidence level: 100%)

IP addresses 122

45.142.193.27NetSupportManager RAT botnet C2 server (confidence level: 100%)
91.92.240.149SectopRAT botnet C2 server (confidence level: 100%)
144.172.104.183MooBot botnet C2 server (confidence level: 100%)
159.65.253.170AdaptixC2 botnet C2 server (confidence level: 100%)
96.44.159.209Remcos botnet C2 server (confidence level: 100%)
137.184.38.192AsyncRAT botnet C2 server (confidence level: 100%)
20.8.103.171Unknown malware botnet C2 server (confidence level: 100%)
102.117.170.244Unknown malware botnet C2 server (confidence level: 100%)
194.163.175.135Unknown malware botnet C2 server (confidence level: 100%)
110.42.105.163DCRat botnet C2 server (confidence level: 100%)

Hashes 151

cb04a0c814dd4391ddef5a49f23bd038d9c88c4eLALALA Stealer payload (confidence level: 95%)
591902603acc284754bfbe0dfaf3522edc3f8372f1a8152c5a86465808d90bf9LALALA Stealer payload (confidence level: 95%)
e62bad247c046f8f5a0c75ff52ec4bedLALALA Stealer payload (confidence level: 95%)
9698d1ce388b9439c521f29d9afc145e7af2a35dAttor payload (confidence level: 95%)
102f5610ec49ec1ef47510dd9b0fc6fa3e5f90bcdf3328db8f0398727e869ff4Attor payload (confidence level: 95%)
39653d75a9f6f618558d6169cf0c4713Attor payload (confidence level: 95%)
fb73c5bfbe5d8c4b465a191cefe68fcf1f521178NjRAT payload (confidence level: 95%)
a9a7ebc3406ddb00ffb5a2607cc6aa76bbc39c6865a2f9b5e434b0e065b11353NjRAT payload (confidence level: 95%)
827607d89c33dcd2e0eab71062cbadf5NjRAT payload (confidence level: 95%)
9061a2bf539ab290b9bfdabafba82ea9849361e9Quasar RAT payload (confidence level: 95%)

Description

ThreatFox IOCs for 2026-03-14

Impact

Given the lack of specific affected products, exploit details, or active exploitation reports, the immediate impact on organizations worldwide is limited but not negligible. The threat involves malware payload delivery and network activity, which could facilitate unauthorized access, data exfiltration, or disruption if successfully executed. Without known exploits in the wild or patches, the risk of widespread compromise is currently moderate. However, organizations that do not maintain robust network monitoring and malware detection capabilities could be vulnerable to infection if these IOCs correspond to active campaigns. The medium severity suggests potential confidentiality, integrity, or availability impacts if the malware payloads are deployed effectively. The absence of detailed indicators means that organizations must rely on general best practices and threat intelligence integration to mitigate potential risks. Overall, the threat represents a moderate operational risk, primarily as a component of ongoing malware activity rather than a critical zero-day or widespread exploit.

Defensive guidance

1. Integrate the provided IOCs from the ThreatFox MISP feed into existing Security Information and Event Management (SIEM) and Endpoint Detection and Response (EDR) systems to enhance detection capabilities. 2. Conduct regular network traffic analysis to identify unusual payload delivery attempts or suspicious network activity consistent with the threat categories. 3. Maintain updated malware signatures and heuristic detection rules on antivirus and anti-malware solutions to detect potential payloads. 4. Employ network segmentation and strict access controls to limit malware propagation in case of infection. 5. Implement robust email and web filtering to reduce exposure to common malware delivery vectors. 6. Conduct user awareness training focused on recognizing phishing and social engineering tactics that often accompany payload delivery. 7. Regularly review and update incident response plans to incorporate emerging threat intelligence and ensure rapid containment. 8. Collaborate with threat intelligence sharing communities to receive timely updates and contextual information about evolving threats. These steps go beyond generic advice by emphasizing integration of specific IOCs, network-level monitoring, and proactive intelligence sharing.

Community reviews

Loading reviews…