Skip to main content
IndicatorPublished Updated

type osint · ThreatFox IOCs for 2026-04-03

Affects type osintSource ThreatFox MISP Feed

0

TLP:WHITE, disclosure is not limited

Indicators of compromise

Domains 90

  • windowscreenrepairnearme.comUnknown RAT botnet C2 domain (confidence level: 50%)
  • test-invalid-domain.invalidVidar botnet C2 domain (confidence level: 100%)
  • dakatawebstick.comStealc botnet C2 domain (confidence level: 100%)
  • ashpaltlonpro.comStealc botnet C2 domain (confidence level: 100%)
  • uehfks.digitalStealc botnet C2 domain (confidence level: 100%)
  • groceryhomerecipes.comSmartApeSG payload delivery domain (confidence level: 50%)
  • eqp.ismagecart credit card skimming domain (confidence level: 100%)
  • blz.ismagecart credit card skimming domain (confidence level: 100%)
  • blitomra.topSmartApeSG payload delivery domain (confidence level: 100%)
  • ratted.localto.netQuasar RAT botnet C2 domain (confidence level: 100%)

URLs 61

  • https://revolaudit.cz/Unknown malware payload delivery URL (confidence level: 90%)
  • http://162.215.170.152/hiddenbin/main_mipsUnknown malware payload delivery URL (confidence level: 75%)
  • https://tirqavem.top/session/version-header.jsSmartApeSG payload delivery URL (confidence level: 100%)
  • https://blitomra.top/scope/realm-html.jsSmartApeSG payload delivery URL (confidence level: 100%)
  • https://blitomra.top/scope/callback-fetch.phpSmartApeSG payload delivery URL (confidence level: 100%)
  • https://blitomra.top/scope/admin-controller.jsSmartApeSG payload delivery URL (confidence level: 100%)
  • https://widdensmoywi.sbs/apiLumma Stealer botnet C2 (confidence level: 100%)
  • https://xar.japan365.co/Vidar botnet C2 (confidence level: 100%)
  • https://xar.scarletmc.ru/Vidar botnet C2 (confidence level: 100%)
  • https://plh.japan365.co/Vidar botnet C2 (confidence level: 100%)

IP addresses 43

  • 94.26.90.100Stealc botnet C2 server (confidence level: 100%)
  • 2.56.165.69XWorm botnet C2 server (confidence level: 100%)
  • 104.193.255.40XWorm botnet C2 server (confidence level: 100%)
  • 147.185.221.26XWorm botnet C2 server (confidence level: 100%)
  • 47.236.241.97ValleyRAT botnet C2 server (confidence level: 100%)
  • 83.168.107.189Mirai botnet C2 server (confidence level: 50%)
  • 141.98.234.20ACR Stealer botnet C2 server (confidence level: 100%)
  • 38.124.86.9Xtreme RAT botnet C2 server (confidence level: 100%)
  • 149.12.67.154Xtreme RAT botnet C2 server (confidence level: 100%)
  • 61.3.31.99Mozi botnet C2 server (confidence level: 100%)

Hashes 5

  • e062e0dcb4c27c0f87a81b4e4c954f753a53bab6b1a29f40e27f22d1f7f88359Stealc payload (confidence level: 100%)
  • 671cdd8942f0adb97637d35fc277f007e8c0d901ac98415b1b6a42a54931af6bStealc payload (confidence level: 100%)
  • 1480dabe89af53f798ac93d4606d37ad8a1e6938dc054460ed4d8548f5e18d70Stealc payload (confidence level: 100%)
  • 3c9be2f3981c57d9ad05be1467be4523bc419f4073f2670b5e7a8ef1f2e47e7aStealc payload (confidence level: 100%)
  • 81ddacc1d4689616b993f34465cb372e6046c035b45a4831343bd55ed37d48eeVidar payload (confidence level: 100%)

Description

ThreatFox IOCs for 2026-04-03

Community reviews

Loading reviews…