IndicatorPublished 16 Apr 2026Updated 17 Apr 2026

ThreatFox IOCs for 2026-04-16

Source ThreatFox MISP Feed

TLP:WHITE, disclosure is not limited

Indicators of compromise

Domains 325

servena.expect-runes.in.netClearFake payload delivery domain (confidence level: 100%)
rave3-layer.expect-runes.in.netClearFake payload delivery domain (confidence level: 100%)
google-meet-live.comUnknown malware payload delivery domain (confidence level: 50%)
flagbrother.ukUnknown malware botnet C2 domain (confidence level: 100%)
dl.armour-inc-down.netVidar payload delivery domain (confidence level: 75%)
vscoj.invert-manner.in.netClearFake payload delivery domain (confidence level: 100%)
87phs.invert-manner.in.netClearFake payload delivery domain (confidence level: 100%)
gutyx.invert-manner.in.netClearFake payload delivery domain (confidence level: 100%)
authsnapshot.invert-manner.in.netClearFake payload delivery domain (confidence level: 100%)
tri-fluxon.invert-manner.in.netClearFake payload delivery domain (confidence level: 100%)

URLs 177

https://www.zeitdanach.ch/Unknown malware payload delivery URL (confidence level: 90%)
https://www.aircliniq.com/Unknown malware payload delivery URL (confidence level: 90%)
https://www.omnicoresolutions.net/Unknown malware payload delivery URL (confidence level: 90%)
http://213.176.73.132/api/nte3yjdjnwu1njyznju2yta1n2y=SmartLoader botnet C2 (confidence level: 75%)
http://213.176.73.163/task/nte3yjdjnwu1njyznju2yta1n2y=SmartLoader botnet C2 (confidence level: 75%)
http://217.69.0.159/get_encrypt_file_exe/aigcabsoky4l4r4dmn5caw==GlassWorm payload delivery URL (confidence level: 100%)
http://217.69.0.159/get_arhive_npm/cazpvvnsqfldx9o6qbxonw==GlassWorm payload delivery URL (confidence level: 100%)
http://217.69.3.152:80/logGlassWorm botnet C2 (confidence level: 100%)
http://45.32.150.251/get_encrypt_file_exe/uj+za5dgnvuc9s8ezel5nq==GlassWorm payload delivery URL (confidence level: 100%)
http://45.32.150.251/get_arhive_npm/1hss+kibyorp8+9jrxlvgg==GlassWorm payload delivery URL (confidence level: 100%)

IP addresses 52

213.176.73.132SmartLoader botnet C2 server (confidence level: 75%)
213.176.73.163SmartLoader botnet C2 server (confidence level: 75%)
124.71.231.231Cobalt Strike botnet C2 server (confidence level: 75%)
18.170.69.70Cobalt Strike botnet C2 server (confidence level: 75%)
35.179.185.166Cobalt Strike botnet C2 server (confidence level: 75%)
43.128.59.217Cobalt Strike botnet C2 server (confidence level: 75%)
52.220.247.175Cobalt Strike botnet C2 server (confidence level: 75%)
18.170.69.70Cobalt Strike botnet C2 server (confidence level: 75%)
172.245.4.226Remcos botnet C2 server (confidence level: 75%)
92.63.106.237Quasar RAT botnet C2 server (confidence level: 75%)

Hashes 4

Unknown malware payload (confidence level: 100%)

53de68ebec281e7233bffc52199b22ec2dba463eec3b29d4c399838e18daecbf
88e6e4a5478a3ee7bfdfc5e7614ae6f3f121e0d470741a9cc84a111fe9b266db
759eed82699b86b6a792a63ccc76c2fa5ed71720b89132abdead9753f5d7bd11
29577570d18409d93fa2517198354716740b19699eb5392bfaa265f2f6b91896

Description

ThreatFox IOCs for 2026-04-16

Impact

The impact is currently limited to the presence of malware-related IOCs indicating potential payload delivery and network activity. There is no evidence of active exploitation or specific affected software versions. Without known exploits or patches, the immediate risk is moderate and primarily informational for threat detection purposes.

Defensive guidance

No patches or official fixes are available for this threat. Since it is an OSINT report of IOCs without specific vulnerabilities or exploits, mitigation should focus on integrating these IOCs into detection systems and monitoring for related malicious activity. No urgent remediation actions are indicated.

Community reviews

Loading reviews…