IndicatorPublished 18 Mar 2026Updated 19 Mar 2026

type osint · ThreatFox IOCs for 2026-03-18

Affects type osintSource ThreatFox MISP Feed

TLP:WHITE, disclosure is not limited

Indicators of compromise

Domains 480

4gen-switch.tempink.in.netClearFake payload delivery domain (confidence level: 100%)
postprocesser.comUnknown malware payload delivery domain (confidence level: 100%)
truemeasur.saltball.in.netClearFake payload delivery domain (confidence level: 100%)
hydrax.liveUnknown Stealer payload delivery domain (confidence level: 100%)
anysoft.clickUnknown malware payload delivery domain (confidence level: 100%)
saturnspoofer.comUnknown malware payload delivery domain (confidence level: 50%)
banne-shi.catflow.in.netClearFake payload delivery domain (confidence level: 100%)
whrc.ruUnknown malware payload delivery domain (confidence level: 100%)
remotev2.whrc.ruUnknown malware botnet C2 domain (confidence level: 100%)
channelcrawler.getlight.in.netClearFake payload delivery domain (confidence level: 100%)

URLs 610

https://wedbrty.top/token/route-sandbox.jsSmartApeSG payload delivery URL (confidence level: 100%)
http://178.16.52.201/9cca20c6df659f72/install.msiClearFake payload delivery URL (confidence level: 100%)
http://178.16.52.201/9cca20c6df659f72/m_cpt_bld172638.binClearFake payload delivery URL (confidence level: 100%)
https://allhere.biz/bcse/bcse.phpWSO payload delivery URL (confidence level: 75%)
https://hydrax.live/download/hydracheat.7.5.1.zipMaskGramStealer payload delivery URL (confidence level: 100%)
https://gist.githubusercontent.com/hexreaper/eec6869214d2b4e12bd606529128f8c2/raw/gistfile1.txtMaskGramStealer botnet C2 (confidence level: 100%)
http://2.249.142.93:44646/iMozi payload delivery URL (confidence level: 75%)
http://42.179.121.16:43929/iMozi payload delivery URL (confidence level: 75%)
http://103.102.25.50:56749/iMozi payload delivery URL (confidence level: 75%)
http://85.226.212.168:59318/iMozi payload delivery URL (confidence level: 75%)

IP addresses 174

134.209.53.216Aisuru botnet C2 server (confidence level: 100%)
45.141.119.34Unknown malware botnet C2 server (confidence level: 100%)
68.183.1.7Aisuru botnet C2 server (confidence level: 100%)
49.13.63.217Unknown malware botnet C2 server (confidence level: 100%)
64.227.93.6Aisuru botnet C2 server (confidence level: 100%)
68.183.1.7Aisuru botnet C2 server (confidence level: 100%)
35.240.143.135Cobalt Strike botnet C2 server (confidence level: 100%)
154.3.40.204Remcos botnet C2 server (confidence level: 100%)
172.111.139.120Remcos botnet C2 server (confidence level: 100%)
64.89.160.127Remcos botnet C2 server (confidence level: 100%)

Hashes 13

a81867afe0cbbe4636adbf4744705991f6bf3e00b71887b751101f35c3ab4289ClearFake payload (confidence level: 100%)
064fc244c2aaf7e602cf53b725f0355df44bc4e13719fb5bd959efa09887586aClearFake payload (confidence level: 100%)
0e7d340331a78e58772a263dbb58535023d93482030f971f162780c3f6ad2382ClearFake payload (confidence level: 100%)
9190f3209cbb11da41e8d4abedb5736f48965a0c02059077776af399f8320ba6MaskGramStealer payload (confidence level: 100%)
880100e241966ab2e6e5f27a88b46a5e1364e1c2699de08c4fe3aa5934c37579MaskGramStealer payload (confidence level: 100%)
510fc02f59bb4c5ee01f7d3cc3cf1fdaa668a6f2c6cb5417363f2b10b1a84979Babar payload (confidence level: 100%)
ad04d5efb6ff1bbd2641e887b7d1528d57f330d953fa4ff35103e5020e9b9a80Lumma Stealer payload (confidence level: 100%)
e37d156f7247bfdc8d3a5c2ec0fca09da5fe538c446de2ff0908cfcd3a605646Empire Downloader payload (confidence level: 100%)
07d67c83452c82ca25467448deb0bb6a6f68513ecfd23e00aaa1f0d25d888c8bEmpire Downloader payload (confidence level: 100%)
1454b64b74eb655db859d3c1e2c2afc13cbb45b6173dee60923357637da17386SocksProxyGo payload (confidence level: 100%)

Description

ThreatFox IOCs for 2026-03-18

Impact

The potential impact of this threat intelligence feed is indirect but valuable for organizations worldwide. By incorporating these IOCs into security monitoring systems, organizations can improve detection of malware payload delivery attempts and suspicious network activity. However, since no active exploits or vulnerabilities are reported, the immediate risk of compromise is low to moderate. The intelligence can help prevent or mitigate attacks by enabling early detection and response, reducing dwell time of threats within networks. Organizations that rely heavily on OSINT tools or operate in sectors targeted by malware campaigns may benefit most. Without specific exploit details or affected products, the impact is limited to enhancing situational awareness rather than addressing an urgent security flaw.

Defensive guidance

1. Integrate ThreatFox IOCs into existing Security Information and Event Management (SIEM) and Endpoint Detection and Response (EDR) platforms to enhance threat detection capabilities. 2. Regularly update threat intelligence feeds to ensure the latest IOCs are available for correlation and alerting. 3. Conduct network traffic analysis focusing on payload delivery patterns and suspicious network activity as indicated by the intelligence. 4. Train security analysts to interpret OSINT-based threat intelligence and apply it effectively in incident response. 5. Implement strict network segmentation and monitoring to limit the impact of potential malware payload delivery. 6. Maintain robust patch management and endpoint protection, even though no specific patches are noted, to reduce overall attack surface. 7. Collaborate with threat intelligence sharing communities to stay informed about evolving threats and validate the relevance of IOCs.

Community reviews

Loading reviews…