Skip to main content
IndicatorPublished Updated

ThreatFox IOCs for 2026-04-25

Source ThreatFox MISP Feed

0

TLP:WHITE, disclosure is not limited

Indicators of compromise

Domains 307

  • talvaleet.histori-pneumonia.in.netClearFake payload delivery domain (confidence level: 100%)
  • binaryboost.histori-pneumonia.in.netClearFake payload delivery domain (confidence level: 100%)
  • cl.distritovagas.comClearFake payload delivery domain (confidence level: 100%)
  • cryst0-core.histori-pneumonia.in.netClearFake payload delivery domain (confidence level: 100%)
  • sprdec.histori-pneumonia.in.netClearFake payload delivery domain (confidence level: 100%)
  • absshop-ping.xyzUnknown RAT botnet C2 domain (confidence level: 75%)
  • acre-sagahill.xyzUnknown RAT botnet C2 domain (confidence level: 75%)
  • shirela.pitifrube1la.in.netClearFake payload delivery domain (confidence level: 100%)
  • zfvhht.pitifrube1la.in.netClearFake payload delivery domain (confidence level: 100%)
  • tbfnru68.arapnik-nosog.in.netClearFake payload delivery domain (confidence level: 100%)

URLs 89

  • http://sonra.eutialyson.com/inst24.msiClearFake payload delivery URL (confidence level: 100%)
  • https://pastebin.com/raw/0rmxqy57Unknown malware botnet C2 (confidence level: 49%)
  • https://nuevaprodeciencia.club/br77b/iayjaskyeiagds.phpUnknown malware botnet C2 (confidence level: 49%)
  • http://45.77.60.153/%2bu2qpcwlb0teek0y%2bthl1q%3d%3dGlassWorm payload delivery URL (confidence level: 100%)
  • http://217.69.8.40/63rbxcmtbopzhfyuqusnda%3d%3dGlassWorm payload delivery URL (confidence level: 100%)
  • http://45.77.60.153/get_arhive_npm/zi2wmapzcno8ev9qy%2bqqxq%3d%3dGlassWorm payload delivery URL (confidence level: 100%)
  • http://217.69.8.40/get_arhive_npm/jcbp9cvu%2b%2b%2fczotwvxfjbq%3d%3dGlassWorm payload delivery URL (confidence level: 100%)
  • http://45.77.60.153/darwin-universal/s4%2becczupy7jrkr7qbsmng%3d%3d?wallet=trezorGlassWorm payload delivery URL (confidence level: 100%)
  • http://45.77.60.153/darwin-universal/s4%2becczupy7jrkr7qbsmng%3d%3d?wallet=ledgerGlassWorm payload delivery URL (confidence level: 100%)
  • http://217.69.8.40/darwin-universal/wjcjmfcy4f4sxngll5o0cq%3d%3d?wallet=trezorGlassWorm payload delivery URL (confidence level: 100%)

IP addresses 28

  • 176.65.139.59Mirai botnet C2 server (confidence level: 80%)
  • 144.31.215.205Unknown malware botnet C2 server (confidence level: 85%)
  • 198.251.88.136Unknown malware botnet C2 server (confidence level: 80%)
  • 176.65.139.141Mirai botnet C2 server (confidence level: 80%)
  • 172.67.208.215Nanocore RAT botnet C2 server (confidence level: 100%)
  • 172.67.159.51Nanocore RAT botnet C2 server (confidence level: 100%)
  • 104.21.9.66Nanocore RAT botnet C2 server (confidence level: 100%)
  • 149.12.67.231Xtreme RAT botnet C2 server (confidence level: 100%)
  • 119.167.191.229Xtreme RAT botnet C2 server (confidence level: 100%)
  • 151.241.88.172Cobalt Strike botnet C2 server (confidence level: 100%)

Hashes 2

Unknown malware payload (confidence level: 100%)

  • 0642708ec7c25dec3168f1ab275a29bfd3cf69fe3afc3d5c6eadfa6750102883
  • d942e9cfc0ca32a3d66ec690090ee22dca74953efed6889fb2292de36f5e39fd

Description

ThreatFox IOCs for 2026-04-25

Community reviews

Loading reviews…