IndicatorPublished 10 May 2026Updated 11 May 2026

ThreatFox IOCs for 2026-05-10

Source ThreatFox MISP Feed

TLP:WHITE, disclosure is not limited

Indicators of compromise

Domains 450

cruch.onlineUnknown malware botnet C2 domain (confidence level: 75%)
helper.zulipchat.comUnknown malware botnet C2 domain (confidence level: 49%)
donutsmpcheat.comUnknown malware payload delivery domain (confidence level: 100%)
bahaisda.cyouLumma Stealer botnet C2 domain (confidence level: 100%)
privahtc.cyouLumma Stealer botnet C2 domain (confidence level: 100%)
brakyfaw.cyouLumma Stealer botnet C2 domain (confidence level: 100%)
fourdigs.cyouLumma Stealer botnet C2 domain (confidence level: 100%)
straigxo.cyouLumma Stealer botnet C2 domain (confidence level: 100%)
honceybl.cyouLumma Stealer botnet C2 domain (confidence level: 50%)
mexzicaj.cyouLumma Stealer botnet C2 domain (confidence level: 50%)

URLs 31

http://144.48.124.92:8888/supershell/login/Unknown malware botnet C2 (confidence level: 100%)
http://144.48.124.94:8888/supershell/login/Unknown malware botnet C2 (confidence level: 100%)
https://www.paperrig.store/Unknown malware payload delivery URL (confidence level: 100%)
http://108.59.252.214/9290546939c94eebbdb2.phpStealc botnet C2 (confidence level: 100%)
https://donutsmpcheat.com/Unknown malware payload delivery URL (confidence level: 100%)
https://donutsmpcheat.com/downloads/kryptonite-cracked.jarUnknown malware payload delivery URL (confidence level: 100%)
https://donutsmpcheat.com/downloads/float-client.jarUnknown malware payload delivery URL (confidence level: 100%)
https://donutsmpcheat.com/downloads/solar-client.jarUnknown malware payload delivery URL (confidence level: 100%)
https://donutsmpcheat.com/downloads/xenon-cracked.jarUnknown malware payload delivery URL (confidence level: 100%)
https://donutsmpcheat.com/downloads/meteor-client.jarUnknown malware payload delivery URL (confidence level: 100%)

IP addresses 93

144.48.124.92Unknown malware botnet C2 server (confidence level: 100%)
144.48.124.94Unknown malware botnet C2 server (confidence level: 100%)
178.208.87.109Unknown malware botnet C2 server (confidence level: 75%)
172.235.175.62Kimwolf botnet C2 server (confidence level: 100%)
172.235.175.53Kimwolf botnet C2 server (confidence level: 100%)
172.235.175.67Kimwolf botnet C2 server (confidence level: 100%)
172.235.175.103Kimwolf botnet C2 server (confidence level: 100%)
172.233.46.84Kimwolf botnet C2 server (confidence level: 100%)
172.235.175.121Kimwolf botnet C2 server (confidence level: 100%)
172.235.175.137Kimwolf botnet C2 server (confidence level: 100%)

Hashes 3

9be2cd1308cfbb403db283c6fa1ac0aa37cdbe301e3768804170420c4a3ae38bNanocore RAT payload (confidence level: 100%)
462da039980a8f166fbd27d15437fa093ab9c369ba13055d7fad90bf3b9d1627Nanocore RAT payload (confidence level: 50%)
7d7948005af45b2fbc59a20c266ffd70f584d0fba1a28e048bd9994ad9353bdbVShell payload (confidence level: 90%)

Description

ThreatFox IOCs for 2026-05-10

Impact

The threat involves malware payload delivery and associated network activity, which could potentially lead to compromise if exploited. However, no known exploits in the wild or specific vulnerable versions are identified, limiting immediate impact. The medium severity suggests a moderate risk level based on observed activity rather than confirmed widespread exploitation.

Defensive guidance

No patches or official fixes are available for this threat. Organizations should leverage the provided IOCs for detection and monitoring within their environments. Since this is OSINT-based threat intelligence, applying relevant network and endpoint detection rules aligned with these IOCs is recommended. No urgent remediation actions are indicated by the vendor data.

Community reviews

Loading reviews…