IndicatorPublished 31 Mar 2026Updated 1 Apr 2026

type osint · ThreatFox IOCs for 2026-03-31

Affects type osintSource ThreatFox MISP Feed

TLP:WHITE, disclosure is not limited

Indicators of compromise

Domains 345

gatewayraven.skyl1tfern.in.netClearFake payload delivery domain (confidence level: 100%)
brokerpasture.mistlatch.in.netClearFake payload delivery domain (confidence level: 100%)
underperformize.comKonni payload delivery domain (confidence level: 75%)
relacks.wikiKonni payload delivery domain (confidence level: 75%)
misgrapeible.wikiKonni payload delivery domain (confidence level: 75%)
sgeek.comUnknown Stealer botnet C2 domain (confidence level: 90%)
api-endpoint.vectorforge.in.netClearFake payload delivery domain (confidence level: 100%)
ios163.comValleyRAT botnet C2 domain (confidence level: 75%)
qn.ios163.comValleyRAT botnet C2 domain (confidence level: 75%)
qn666.usValleyRAT botnet C2 domain (confidence level: 75%)

URLs 80

https://acn.miseguro.com.co/Unknown malware payload delivery URL (confidence level: 90%)
https://voge.pe/Unknown malware payload delivery URL (confidence level: 90%)
http://178.208.87.49/bot/regexLaplasClipper botnet C2 (confidence level: 100%)
http://158.94.210.91/g8hrs4f4vh/index.phpAmadey botnet C2 (confidence level: 100%)
http://5.10.217.60Stealc botnet C2 (confidence level: 100%)
https://l3cdnns.beer/api/css.jsUnknown malware payload delivery URL (confidence level: 100%)
https://exdanteam.beer/api/css.jsUnknown malware payload delivery URL (confidence level: 100%)
https://losfiros.comIClickFix payload delivery URL (confidence level: 100%)
http://151.240.151.158/tta.txtIClickFix payload delivery URL (confidence level: 100%)
http://158.94.210.91/g8hrs4f4vh/login.phpAmadey botnet C2 (confidence level: 100%)

IP addresses 84

193.37.213.18Konni botnet C2 server (confidence level: 75%)
185.205.211.217Konni botnet C2 server (confidence level: 75%)
45.88.186.163Quasar RAT botnet C2 server (confidence level: 100%)
104.131.106.42DarkVNC botnet C2 server (confidence level: 75%)
104.131.106.42DarkVNC botnet C2 server (confidence level: 75%)
45.61.136.190DarkVNC botnet C2 server (confidence level: 75%)
64.95.13.174DarkVNC botnet C2 server (confidence level: 75%)
23.27.49.106DarkVNC botnet C2 server (confidence level: 75%)
64.52.80.3DarkVNC botnet C2 server (confidence level: 75%)
185.237.230.50DarkVNC botnet C2 server (confidence level: 75%)

Hashes 15

cf48286e6a82f62af6637738a0736e4bbc3eaf52620aa4493f49a5f731d251d4Konni payload (confidence level: 100%)
a91e743f20f236e1d052c42cc40ae9383f88151974782ec400915df3063dec4cKonni payload (confidence level: 100%)
0da8d4281946ce2ef6765e68e99b00a37af731e73d8cedbf7486a012d0c7be5cKonni payload (confidence level: 100%)
04a11791a61a8522af2817801860e6f93f487036d936f0287d28fa94b5837c53Unknown Stealer payload (confidence level: 90%)
337873c8d609b7be91635bae8875859c7a6b5729ca875f01946d5d681dd70dc3ValleyRAT payload (confidence level: 75%)
4a7ccc02e95280df9f89dabd6f62eb715163a2318409fbb887fecb16bc4e21c3ValleyRAT payload (confidence level: 75%)
434592e3ef8b2b8f549afa71d903d8b4ddb0b7f5849ea1280cfee6d980432b14ValleyRAT payload (confidence level: 75%)
27d8449808d99f3ef1fd3e0d1a66ae4c85f29543bb6bb13a07dba0cc266624ebValleyRAT payload (confidence level: 75%)
0026574a5ffe7131bdb6e8940bcf50415e3cf2ad01b84f0613c21516162618b5ValleyRAT payload (confidence level: 75%)
a4a8dfb2c339eb26a1b41ce520fa41b9fc4ab96272ee6604dc304720fd892b98ValleyRAT payload (confidence level: 75%)

Description

ThreatFox IOCs for 2026-03-31

Impact

Given the lack of specific affected software or active exploitation, the direct impact on organizations is limited at this time. However, the presence of IOCs related to payload delivery and network activity suggests potential reconnaissance or preparatory stages of malware campaigns. If leveraged by threat actors, these indicators could facilitate initial compromise, lateral movement, or data exfiltration in targeted environments. Organizations worldwide that rely on OSINT for threat detection or those with insufficient network monitoring might miss early signs of intrusion attempts. The medium severity reflects a moderate risk that, if unaddressed, could lead to more severe consequences in the future. The absence of patches or fixes indicates that mitigation relies heavily on detection and response capabilities rather than vulnerability remediation. Overall, the impact is primarily on the ability to detect and respond to emerging threats rather than immediate compromise or system damage.

Defensive guidance

Organizations should integrate the provided IOCs into their security information and event management (SIEM) systems and endpoint detection and response (EDR) tools to enhance detection of suspicious payload delivery and network activities. Regularly updating threat intelligence feeds and correlating them with internal logs can improve early warning capabilities. Network segmentation and strict egress filtering can limit the impact of potential payload delivery attempts. Employ behavioral analytics to identify anomalous network traffic patterns that may indicate reconnaissance or malware activity. Conduct regular threat hunting exercises using the latest OSINT indicators to proactively identify potential compromises. Since no patches are available, focus on strengthening incident response readiness and user awareness training to recognize phishing or social engineering attempts that could deliver malware payloads. Collaborate with threat intelligence sharing communities to stay informed about evolving indicators and tactics. Finally, ensure robust backup and recovery processes are in place to mitigate potential damage from successful payload execution.

Community reviews

Loading reviews…