IndicatorPublished 19 Mar 2026Updated 20 Mar 2026

type osint · ThreatFox IOCs for 2026-03-19

Affects type osintSource ThreatFox MISP Feed

TLP:WHITE, disclosure is not limited

Indicators of compromise

Domains 300

vcterypore.topSmartApeSG payload delivery domain (confidence level: 100%)
imarketads.comUnknown RAT botnet C2 domain (confidence level: 75%)
ghost-z2-node.nux-systems.in.netClearFake payload delivery domain (confidence level: 100%)
aabstone.comEtherRAT botnet C2 domain (confidence level: 75%)
justtalken.comEtherRAT botnet C2 domain (confidence level: 75%)
echaefer.comUnknown malware botnet C2 domain (confidence level: 50%)
dev3host.metracore.in.netClearFake payload delivery domain (confidence level: 100%)
entry4link.metracore.in.netClearFake payload delivery domain (confidence level: 100%)
mon1point.densapoint.in.netClearFake payload delivery domain (confidence level: 100%)
sys2power.densapoint.in.netClearFake payload delivery domain (confidence level: 100%)

URLs 42

http://213.176.73.145/api/nte3yjdjnwu1njyznju2yta1n2y=SmartLoader botnet C2 (confidence level: 75%)
https://vcterypore.top/beta/api-sandbox.phpSmartApeSG payload delivery URL (confidence level: 100%)
https://vcterypore.top/beta/rate-css.jsSmartApeSG payload delivery URL (confidence level: 100%)
https://afshapiro.com/parterKongTuke payload delivery URL (confidence level: 100%)
http://150.241.94.112/verification.googleUnknown malware payload delivery URL (confidence level: 50%)
http://192.168.223.139:8443/fo8pCobalt Strike botnet C2 (confidence level: 75%)
https://157.180.81.4Vidar botnet C2 (confidence level: 75%)
https://74.0.32.211Vidar botnet C2 (confidence level: 75%)
https://95.214.25.106:1677/35f878290a290e1ed8506/wbx49ghn.522w1Rhadamanthys botnet C2 (confidence level: 100%)
http://46.30.188.99:8443/api/checkinUnknown malware botnet C2 (confidence level: 100%)

IP addresses 148

213.176.73.145SmartLoader botnet C2 server (confidence level: 75%)
198.211.100.209Aisuru botnet C2 server (confidence level: 100%)
206.189.117.106Aisuru botnet C2 server (confidence level: 100%)
68.183.1.7Aisuru botnet C2 server (confidence level: 100%)
165.227.54.160Aisuru botnet C2 server (confidence level: 100%)
64.89.161.130Mirai botnet C2 server (confidence level: 100%)
45.151.106.127Stealc botnet C2 server (confidence level: 75%)
45.131.214.189Stealc botnet C2 server (confidence level: 75%)
86.54.25.43Stealc botnet C2 server (confidence level: 75%)
91.92.243.14Stealc botnet C2 server (confidence level: 75%)

Hashes 14

7504898b17a9ce05eb9209128bcd0fb67d675a70c8c64f6f624d08b47b2fe3afUnknown malware payload (confidence level: 50%)
eaf98b4b08982bc19385a501e3afc3ad52e711ca48f3fc5f5b63719937cf1a64EtherRAT payload (confidence level: 100%)
61e103db36ebb57770443d9249b5024ee0ae4c54d17fe10c1d44e87e2fc5ee99Unknown malware payload (confidence level: 50%)
23e2a0c25c95eebe1a593b27ac1b81a73b23ddad7617b3b11c69a89c3d49812eUnknown malware payload (confidence level: 50%)
00019221fb0b61b769d4168664f11c1258e4d61659bd3ffecb126eaf92dbfe2fUnknown malware payload (confidence level: 50%)
6e360fca0b1e3021908f8de271d80620d634600955fefc9fd0af40557cd517d7Unknown malware payload (confidence level: 50%)
64a2609d6707a2ebfe5b40f5227d0f9b85911b752cd04f830d1bbc8aa6bec2c8Unknown malware payload (confidence level: 50%)
6718cb66521a678274e5672285bf208eac375827d622edcf1fe7eba7e7aa65e0win.beast payload (confidence level: 50%)
479d0947816467d562bf6d24b295bf50512176a2d3d955b8f4d932aea2378227win.beast payload (confidence level: 50%)
cc0680de960f3e1b727b61a42e59f9c282bd8e41fe20146ed191c7f4bf9283a7win.beast payload (confidence level: 50%)

Description

ThreatFox IOCs for 2026-03-19

Impact

Due to the lack of specific technical details, affected systems, or exploit information, the immediate impact of this threat is minimal. Organizations worldwide are unlikely to face direct compromise or disruption from this entry alone. However, as an OSINT feed entry, it may provide early warning or context for emerging threats if further details become available. The medium severity rating suggests some potential risk, but without concrete indicators or exploits, the threat remains theoretical. The absence of patches or mitigation guidance further indicates that no active vulnerability is currently being exploited. Therefore, the impact is primarily informational, supporting threat intelligence and situational awareness rather than indicating an imminent attack or breach.

Defensive guidance

Given the informational nature of this threat report, specific mitigation steps are limited. Organizations should continue to monitor ThreatFox and other OSINT feeds for updates that might provide actionable indicators or exploit details. Maintaining robust network monitoring and intrusion detection systems can help identify suspicious payload delivery or network activity consistent with emerging threats. Regularly updating and patching systems remains best practice, even though no patches are currently associated with this entry. Sharing threat intelligence within trusted communities can enhance collective awareness. Finally, organizations should validate and contextualize OSINT data before allocating resources to response efforts, focusing on confirmed threats with concrete indicators.

Community reviews

Loading reviews…