Skip to main content
IndicatorPublished Updated

ThreatFox IOCs for 2026-05-05

Source ThreatFox MISP Feed

0

TLP:WHITE, disclosure is not limited

Indicators of compromise

Domains 607

  • msxns.us.comUnknown malware payload delivery domain (confidence level: 75%)
  • dbinst.nelo2qir.latClearFake payload delivery domain (confidence level: 100%)
  • hotfix.sora8lin.latClearFake payload delivery domain (confidence level: 100%)
  • apidoc.nelo2qir.latClearFake payload delivery domain (confidence level: 100%)
  • ipnode.sora8lin.latClearFake payload delivery domain (confidence level: 100%)
  • getcfg.sora8lin.latClearFake payload delivery domain (confidence level: 100%)
  • metalt.nelo2qir.latClearFake payload delivery domain (confidence level: 100%)
  • osbase.nelo2qir.latClearFake payload delivery domain (confidence level: 100%)
  • sslkey.sora8lin.latClearFake payload delivery domain (confidence level: 100%)
  • gro.smtpdenz.my.idVidar botnet C2 domain (confidence level: 100%)

URLs 159

  • https://gro.smtpdenz.my.id/Vidar botnet C2 (confidence level: 100%)
  • https://gro.sleepinggiantmedia.co.uk/Vidar botnet C2 (confidence level: 100%)
  • https://www.notebookrosa.com.br.redeoferta.com.br/Unknown malware payload delivery URL (confidence level: 90%)
  • https://electronicartmetal.comUnknown malware payload delivery URL (confidence level: 100%)
  • https://en-us-herpafend.comUnknown malware payload delivery URL (confidence level: 100%)
  • https://en-us-plantsulin.comUnknown malware payload delivery URL (confidence level: 100%)
  • https://microchlen.lat/cf.jsUnknown malware payload delivery URL (confidence level: 100%)
  • https://microchlen.lat/api/index.phpUnknown malware payload delivery URL (confidence level: 100%)
  • https://microchlen.lat/log.phpUnknown malware payload delivery URL (confidence level: 100%)
  • https://felixcam.comUnknown malware payload delivery URL (confidence level: 100%)

IP addresses 85

  • 195.226.92.129Cobalt Strike botnet C2 server (confidence level: 100%)
  • 151.245.195.142Unknown Loader payload delivery server (confidence level: 100%)
  • 193.202.85.44Unknown malware botnet C2 server (confidence level: 75%)
  • 193.202.84.17Unknown malware botnet C2 server (confidence level: 75%)
  • 193.202.84.71Unknown malware botnet C2 server (confidence level: 75%)
  • 193.182.145.89Unknown malware payload delivery server (confidence level: 75%)
  • 91.132.92.151Unknown malware payload delivery server (confidence level: 75%)
  • 194.14.217.221Unknown malware payload delivery server (confidence level: 75%)
  • 104.168.5.25Remcos botnet C2 server (confidence level: 75%)
  • 172.235.175.148Kimwolf botnet C2 server (confidence level: 100%)

Hashes 10

  • 5bddefae5d5402344cb9e2f5ca88d6933678f1e127cea63ff4866e1ff2d08025Unknown malware payload (confidence level: 75%)
  • 3ca0a7326e9485112e9c88e965f52f96AsyncRAT payload (confidence level: 100%)
  • 6eaba5c0ec1c0e536d8f9701e31d46922a178c7805dcb54270f3740d0fddb81cReverseRAT payload (confidence level: 50%)
  • d06990f1363135f4d4c6f3de65d6638e2874d509be6f32978ab306305a4818b2Unknown malware payload (confidence level: 100%)
  • 96ed62bf3749b5b6559e733166683e2d4ef5ad5b50b0dadb7f235707a966ebaaUnknown malware payload (confidence level: 100%)
  • 0a73595b5c7efcefe1e82174a3492aa903f4760d6c3202cb93e960a9b9cc9fc8KongTuke payload (confidence level: 75%)
  • 28c86021ad35cc4e42684376314fe52aa02a5c2776c3a79abcc83a896295967eKongTuke payload (confidence level: 75%)
  • 16cfe58eab4573ff575c563839e65474da5569247d55fbb59fd56f2684cec610SmartApeSG payload (confidence level: 75%)
  • 8e1ed8998519001d4f4af8e1fe9381950cf9c2501ca1b25c414712d29966aee6SmartApeSG payload (confidence level: 75%)
  • 97f3bdf6db1c274da0e5e653ef59f49514f6d7ed531138f487912d1f9a8fac1cSmartApeSG payload (confidence level: 75%)

Description

ThreatFox IOCs for 2026-05-05

Community reviews

Loading reviews…