Skip to main content
IndicatorPublished Updated

ThreatFox IOCs for 2026-04-09

Source ThreatFox MISP Feed

0

TLP:WHITE, disclosure is not limited

Indicators of compromise

Domains 388

  • horecabot-dev.horecabid.comUnknown malware botnet C2 domain (confidence level: 75%)
  • r6qckzh8lfkursk13x3g69wgv5vl7urrdn6vjd.comSmartApeSG botnet C2 domain (confidence level: 75%)
  • go6.mySmartApeSG payload delivery domain (confidence level: 75%)
  • go5z.mySmartApeSG payload delivery domain (confidence level: 75%)
  • fucismarjiaff.comNetSupportManager RAT botnet C2 domain (confidence level: 100%)
  • path-gate.systematrixflow.in.netClearFake payload delivery domain (confidence level: 100%)
  • mind-hub.cogniversehub.in.netClearFake payload delivery domain (confidence level: 100%)
  • neural-api.cogniversehub.in.netClearFake payload delivery domain (confidence level: 100%)
  • sense-log.cogniversehub.in.netClearFake payload delivery domain (confidence level: 100%)
  • think-node.cogniversehub.in.netClearFake payload delivery domain (confidence level: 100%)

URLs 50

  • http://217.69.2.135/n0k2pzqqzjes1cvlvcxy4a%3d%3dGlassWorm payload delivery URL (confidence level: 100%)
  • http://217.69.3.51/yfyq24tpv5x3al8cthpmpq%3d%3dGlassWorm payload delivery URL (confidence level: 100%)
  • http://45.32.150.251/1y4wlrpixyti%2fglsmk%2fg5a%3d%3dGlassWorm payload delivery URL (confidence level: 100%)
  • http://45.32.150.251/g/1y4wlrpixyti%2fglsmk%2fg5a%3d%3dGlassWorm payload delivery URL (confidence level: 100%)
  • http://217.69.3.51/g/yfyq24tpv5x3al8cthpmpq%3d%3dGlassWorm payload delivery URL (confidence level: 100%)
  • http://217.69.2.135/get_arhive_npm/iebdxrpfj6hlkpcyiyrlaw%3d%3dGlassWorm payload delivery URL (confidence level: 100%)
  • http://45.32.150.251/get_arhive_npm/ma3yj64bglp%2ffuh1k0a4ca%3d%3dGlassWorm payload delivery URL (confidence level: 100%)
  • http://217.69.3.51/get_arhive_npm/18xaz0gor14htecqzyzxia%3d%3dGlassWorm payload delivery URL (confidence level: 100%)
  • https://185.56.45.248Vidar botnet C2 (confidence level: 75%)
  • https://arresetrewwqo.shop/apiLumma Stealer botnet C2 (confidence level: 100%)

IP addresses 48

  • 103.7.81.202Unknown malware botnet C2 server (confidence level: 100%)
  • 130.12.180.51RedTail botnet C2 server (confidence level: 100%)
  • 213.209.159.158RedTail botnet C2 server (confidence level: 100%)
  • 165.22.97.111Unknown malware botnet C2 server (confidence level: 100%)
  • 159.65.5.193Unknown malware botnet C2 server (confidence level: 50%)
  • 193.123.188.62Nanocore RAT botnet C2 server (confidence level: 100%)
  • 20.226.47.239Cobalt Strike botnet C2 server (confidence level: 75%)
  • 91.197.97.236Cobalt Strike botnet C2 server (confidence level: 75%)
  • 162.14.70.142Cobalt Strike botnet C2 server (confidence level: 75%)
  • 193.227.240.212Cobalt Strike botnet C2 server (confidence level: 75%)

Hashes 6

  • 9210d45827b893c515e961d3008b4fb8Unknown malware payload (confidence level: 100%)
  • 9aa80f91500e7aef0123e9a10c31a4683433aacd99717b3ddd6796c06a2d16f7SmartApeSG payload (confidence level: 75%)
  • 8e7bea86cefb90f029aed719311b976d3f72400fcc8b4ca0eab1f9a9dbc43f52SmartApeSG payload (confidence level: 75%)
  • 731c63cfd9a540a588737de5cf7fb8261e4fef7bc7a9b69fe32afee28932e940GlassWorm payload (confidence level: 100%)
  • 59221aa9623d86c930357dba7e3f54138c7ccbd0daa9c483d766cd8ce1b6ad26GlassWorm payload (confidence level: 100%)
  • 45552a3670e52f13df24b403a8d450b592b556bea9e3343e7d38cd3e0921743dGlassWorm payload (confidence level: 75%)

Description

ThreatFox IOCs for 2026-04-09

Community reviews

Loading reviews…