Skip to main content
IndicatorPublished Updated

ThreatFox IOCs for 2026-04-22

Source ThreatFox MISP Feed

0

TLP:WHITE, disclosure is not limited

Indicators of compromise

Domains 356

  • notiflame.matri2rchyor.in.netClearFake payload delivery domain (confidence level: 100%)
  • 655f.pepper-reprint.in.netClearFake payload delivery domain (confidence level: 100%)
  • 0n6rt.ant5pender.in.netClearFake payload delivery domain (confidence level: 100%)
  • trindastal.comUnknown malware botnet C2 domain (confidence level: 100%)
  • dailyhomireciple.comUnknown malware botnet C2 domain (confidence level: 100%)
  • xeeeto.ant5pender.in.netClearFake payload delivery domain (confidence level: 100%)
  • dailyhomireciple.comUnknown malware payload delivery domain (confidence level: 85%)
  • trindastal.comUnknown malware payload delivery domain (confidence level: 85%)
  • dawn-route.ant5pender.in.netClearFake payload delivery domain (confidence level: 100%)
  • delihyp.ant5pender.in.netClearFake payload delivery domain (confidence level: 100%)

URLs 132

  • https://49xb5hoiqsr.com/dl/agent.bat?tk=5c6782c32ce7b4b8442c60f9afc95a39KongTuke payload delivery URL (confidence level: 100%)
  • https://trindastal.com/4ba0af68-0037-5f6e-afd1-64f89fc0f554/v8Unknown malware payload delivery URL (confidence level: 100%)
  • https://trindastal.com/4ba0af68-0037-5f6e-afd1-64f89fc0f554/loc8Unknown malware payload delivery URL (confidence level: 100%)
  • https://tdypy7dvtdq.com/dl/agent.batKongTuke payload delivery URL (confidence level: 100%)
  • https://tdypy7dvtdq.com/dl/update.zipKongTuke payload delivery URL (confidence level: 100%)
  • https://amanullahstorellc.com/Unknown malware payload delivery URL (confidence level: 90%)
  • https://vasijl-cloud.b-cdn.net/peton.zipClearFake payload delivery URL (confidence level: 100%)
  • https://xs.bhaaratkeeshakti.vip/fwefwe324234234rgeffwehtrwyrhtrhtqwfqwd31443wefefwwfer3232fewwefwefwefqgrqwtherergqefwefqweqfwqf32fefwsda/uploads/efewefwewfew342234423234feweefwwefewefweffewwefewf.php?file=333.exeVidar payload delivery URL (confidence level: 75%)
  • https://mastojh.cyouLumma Stealer botnet C2 (confidence level: 75%)
  • https://brorgma.cyouLumma Stealer botnet C2 (confidence level: 75%)

IP addresses 33

  • 213.139.77.228Unknown malware botnet C2 server (confidence level: 100%)
  • 46.183.25.42Unknown malware botnet C2 server (confidence level: 90%)
  • 35.212.234.225Unknown malware botnet C2 server (confidence level: 100%)
  • 3.226.119.211Unknown malware botnet C2 server (confidence level: 100%)
  • 46.101.191.5Unknown malware botnet C2 server (confidence level: 100%)
  • 194.87.161.238Unknown malware botnet C2 server (confidence level: 100%)
  • 31.57.201.126Unknown Stealer botnet C2 server (confidence level: 100%)
  • 185.56.45.69Vidar botnet C2 server (confidence level: 100%)
  • 74.0.48.181Vidar botnet C2 server (confidence level: 100%)
  • 100.52.249.75Cobalt Strike botnet C2 server (confidence level: 100%)

Hashes 9

  • 93791ebe5df8c415f10518f839ada39c88d6e93b1217f37b04ac96b9b112ed40Unknown malware payload (confidence level: 100%)
  • 353bd65eca3e04761f823cffdda51fd0e098e23651a953fa353b3fd15bbba28dUnknown malware payload (confidence level: 100%)
  • 60e7f9ef3d00c861fb8dbfc14b2d9a221e54fac9adb365b4c38475965be75542Unknown malware payload (confidence level: 100%)
  • 8a7697678c13bd359029829564a3068802b56eb5288464c9d2d5df56a440c738Unknown malware payload (confidence level: 85%)
  • 46b1ec2b6a1c9284fa04653188f9a559Unknown Stealer payload (confidence level: 100%)
  • f0c677887d252862fb1d962c73f68912Unknown Stealer payload (confidence level: 100%)
  • af55aa78858a6cee47e5ccab50b79319Unknown Stealer payload (confidence level: 100%)
  • fe884e30188e2a05a0b5a6958bab7104Unknown Stealer payload (confidence level: 100%)
  • 29d757d6559b32839efccd8157b293baUnknown Stealer payload (confidence level: 100%)

Description

ThreatFox IOCs for 2026-04-22

Community reviews

Loading reviews…