Skip to main content
IndicatorPublished Updated

ThreatFox IOCs for 2026-05-19

Source ThreatFox MISP Feed

0

TLP:WHITE, disclosure is not limited

Indicators of compromise

Domains 125

  • abernaehy.lolKongTuke payload delivery domain (confidence level: 100%)
  • 435123332155.comUnknown RAT botnet C2 domain (confidence level: 75%)
  • ttsadnfgsdf.cnWinos payload delivery domain (confidence level: 80%)
  • rubysen.comEtherRAT botnet C2 domain (confidence level: 100%)
  • ager-stp.orgEtherRAT botnet C2 domain (confidence level: 100%)
  • brand-physics-aerial-companion.trycloudflare.comEtherRAT botnet C2 domain (confidence level: 100%)
  • distributedbloomnetwork.gardenClearFake payload delivery domain (confidence level: 100%)
  • botanicalresourcecontroller.gardenClearFake payload delivery domain (confidence level: 100%)
  • irrigationanalyticssystem.gardenClearFake payload delivery domain (confidence level: 100%)
  • rjcuszqj.siciliandefensetheory.digitalClearFake payload delivery domain (confidence level: 100%)

URLs 30

  • https://435123332155.com/api.phpUnknown Stealer botnet C2 (confidence level: 100%)
  • https://abernaehy.lol/file.jsKongTuke payload delivery URL (confidence level: 100%)
  • https://abernaehy.lol/api/v1/sessionKongTuke payload delivery URL (confidence level: 100%)
  • https://abernaehy.lol/api/v1/verifyKongTuke payload delivery URL (confidence level: 100%)
  • https://abernaehy.lol/api/v1/statusKongTuke payload delivery URL (confidence level: 100%)
  • http://79.110.50.15:8089/borlndmm.dllUnknown malware payload delivery URL (confidence level: 80%)
  • http://85.239.155.68:3001/uploadUnknown malware botnet C2 (confidence level: 100%)
  • http://85.239.155.68:3001/internal/logUnknown malware botnet C2 (confidence level: 100%)
  • http://85.239.155.68:3001/wsUnknown malware botnet C2 (confidence level: 100%)
  • http://91.92.241.242/successGCleaner botnet C2 (confidence level: 100%)

IP addresses 130

  • 178.16.54.156Quasar RAT botnet C2 server (confidence level: 99%)
  • 27.124.19.53Cobalt Strike botnet C2 server (confidence level: 100%)
  • 43.144.19.220Cobalt Strike botnet C2 server (confidence level: 100%)
  • 43.144.19.220Cobalt Strike botnet C2 server (confidence level: 100%)
  • 43.144.19.220Cobalt Strike botnet C2 server (confidence level: 100%)
  • 43.142.51.69Cobalt Strike botnet C2 server (confidence level: 100%)
  • 43.142.51.69Cobalt Strike botnet C2 server (confidence level: 100%)
  • 172.86.76.154Cobalt Strike botnet C2 server (confidence level: 100%)
  • 172.86.76.154Cobalt Strike botnet C2 server (confidence level: 100%)
  • 8.219.228.206VShell botnet C2 server (confidence level: 100%)

Hashes 9

  • e18e9309db33273762be1d78f5bdd78fa6ea41dadf5f6eef8ece4c841ea76110ClearFake payload (confidence level: 80%)
  • 78be219b8793d648213172a6bc2c1738f4e14f7b65a01d2d875e40c858e1b484Unknown malware payload (confidence level: 75%)
  • 6c974418247ab414c674fb699ee001d1703f8a6c54810b1773cdc1647cc69e52Unknown malware payload (confidence level: 75%)
  • d0c2fe58efadb86c93f9930cb8668cd40b60399f3a8db54b1c9974ee4eab4b39Unknown malware payload (confidence level: 75%)
  • b2af4e6e723b7a8074ed41a90da69c6cd1b1db4fc4cc8a2e2930daa58704443cUnknown malware payload (confidence level: 75%)
  • 52461a7264164f0e8d1723ef0b76e99f394936b5290df25a5f26c8552a01369aUnknown malware payload (confidence level: 75%)
  • 9a6b750766ff30309502a31bf3bacae5c60211f2257c446c114f28148d2f4fd8Unknown malware payload (confidence level: 85%)
  • 766b70cb0477fbfcd6b012573f1dbc3831c6da44f372e34500e8314fd1084943Unknown malware payload (confidence level: 75%)
  • 4591e91432b52478c20b04fe138b6da5003710b7c74701600bbb4a39148f4783Unknown malware payload (confidence level: 75%)

Description

ThreatFox IOCs for 2026-05-19

Community reviews

Loading reviews…