Skip to main content
IndicatorPublished Updated

ThreatFox IOCs for 2026-05-15

Source ThreatFox MISP Feed

0

TLP:WHITE, disclosure is not limited

Indicators of compromise

Domains 145

  • 0x295bae89192c32.comUnknown malware botnet C2 domain (confidence level: 50%)
  • latiendadelafelicidad.comRemus botnet C2 domain (confidence level: 100%)
  • vanta.stUnknown malware payload delivery domain (confidence level: 100%)
  • whbackend.ruUnknown malware payload delivery domain (confidence level: 100%)
  • remotev2.whbackend.ruUnknown malware botnet C2 domain (confidence level: 100%)
  • best-seller.lavanille.buzzCobalt Strike botnet C2 domain (confidence level: 50%)
  • shinesafar.sardk.icuPicassoLoader botnet C2 domain (confidence level: 50%)
  • hinesafar.sardk.icuPicassoLoader botnet C2 domain (confidence level: 50%)
  • mickeymousegamesdealer.alexavegas.icuPicassoLoader botnet C2 domain (confidence level: 50%)
  • easiestnewsfromourpointofview.algsat.icuPicassoLoader botnet C2 domain (confidence level: 50%)

URLs 22

  • http://latiendadelafelicidad.com:5200/Remus botnet C2 (confidence level: 100%)
  • https://remotev2.whbackend.ru/ws/clientUnknown malware botnet C2 (confidence level: 100%)
  • https://whbackend.ru/files/jar/module2Unknown malware payload delivery URL (confidence level: 100%)
  • https://whbackend.ru/files/jar/componentUnknown malware payload delivery URL (confidence level: 100%)
  • https://whbackend.ru/files/jar/runtimebroker.exeUnknown malware payload delivery URL (confidence level: 100%)
  • https://whbackend.ru/files/jar/pjibf.exeUnknown malware payload delivery URL (confidence level: 100%)
  • https://whbackend.ru/files/jar/securityUnknown malware payload delivery URL (confidence level: 100%)
  • https://whbackend.ru/files/jar/moduleUnknown malware payload delivery URL (confidence level: 100%)
  • https://whbackend.ru/files/jar/elevatorUnknown malware payload delivery URL (confidence level: 100%)
  • https://evamotion.com/Unknown malware payload delivery URL (confidence level: 90%)

IP addresses 159

  • 38.190.198.12VShell botnet C2 server (confidence level: 100%)
  • 38.60.253.35VShell botnet C2 server (confidence level: 100%)
  • 172.233.38.244Kimwolf botnet C2 server (confidence level: 100%)
  • 172.235.191.18Kimwolf botnet C2 server (confidence level: 100%)
  • 172.235.191.229Kimwolf botnet C2 server (confidence level: 100%)
  • 38.244.38.42Unknown malware botnet C2 server (confidence level: 100%)
  • 66.154.104.204VShell botnet C2 server (confidence level: 100%)
  • 118.31.62.238Cobalt Strike botnet C2 server (confidence level: 100%)
  • 172.233.40.153Kimwolf botnet C2 server (confidence level: 100%)
  • 172.235.173.105Kimwolf botnet C2 server (confidence level: 100%)

Hashes 122

  • de0e25a3e6c1e1e5998b306b7141b3dc4c0088da9d7bb47c1c00c91e6e4f85d6Shai-Hulud payload (confidence level: 100%)
  • 81d2a004a1bca6ef87a1caf7d0e0b355ad1764238e40ff6d1b1cb77ad4f595c3Shai-Hulud payload (confidence level: 100%)
  • 83a650ce44b2a9854802a7fb4c202877815274c129af49e6c2d1d5d5d55c501eShai-Hulud payload (confidence level: 100%)
  • 4b2399646573bb737c4969563303d8ee2e9ddbd1b271f1ca9e35ea78062538dbShai-Hulud payload (confidence level: 100%)
  • dc67467a39b70d1cd4c1f7f7a459b35058163592f4a9e8fb4dffcbba98ef210cShai-Hulud payload (confidence level: 100%)
  • b74caeaa75e077c99f7d44f46daaf9796a3be43ecf24f2a1fd381844669da777Shai-Hulud payload (confidence level: 100%)
  • 86532ed94c5804e1ca32fa67257e1bb9de628e3e48a1f56e67042dc055effb5bShai-Hulud payload (confidence level: 100%)
  • aba1fcbd15c6ba6d9b96e34cec287660fff4a31632bf76f2a766c499f55ca1eeShai-Hulud payload (confidence level: 100%)
  • ab4fcadaec49c03278063dd269ea5eef82d24f2124a8e15d7b90f2fa8601266cShai-Hulud payload (confidence level: 100%)
  • 2ec78d556d696e208927cc503d48e4b5eb56b31abc2870c2ed2e98d6be27fc96Shai-Hulud payload (confidence level: 100%)

Description

ThreatFox IOCs for 2026-05-15

Community reviews

Loading reviews…