ThreatFox IOCs for 2026-05-23

• sam-sa.netUnknown malware payload delivery domain (confidence level: 85%)
• claudemo.netUnknown malware payload delivery domain (confidence level: 85%)
• finger.claudemo.netUnknown malware payload delivery domain (confidence level: 85%)
• 1morepizza.comVidar payload delivery domain (confidence level: 100%)
• ratting.topUnknown malware botnet C2 domain (confidence level: 100%)
• kalpa-logistics.comVidar payload delivery domain (confidence level: 100%)
• logisteg.com.brVidar payload delivery domain (confidence level: 100%)
• meastt.gov.ttVidar payload delivery domain (confidence level: 100%)
• namathejaljawdah.comVidar payload delivery domain (confidence level: 100%)
• narquitetos.comVidar payload delivery domain (confidence level: 100%)

• https://claudemo.net/infos.php?fronts=1Unknown malware payload delivery URL (confidence level: 85%)
• http://mascard.biz:8768Remus payload delivery URL (confidence level: 50%)
• https://thunderplanethub.top/role/rate-hookSmartApeSG payload delivery URL (confidence level: 100%)
• https://thunderplanethub.top/role/principal-validator.jsSmartApeSG payload delivery URL (confidence level: 100%)
• http://178.156.199.54SmartApeSG payload delivery URL (confidence level: 100%)
• http://5.161.235.47SmartApeSG payload delivery URL (confidence level: 100%)
• https://northernbridgeworks.com/moreSmartApeSG payload delivery URL (confidence level: 100%)
• http://103.144.245.73:8888/supershell/login/Unknown malware botnet C2 (confidence level: 100%)
• https://faisst-vorburger.ch/Vidar payload delivery URL (confidence level: 75%)
• http://45.148.10.210/hostmaneMirai payload delivery URL (confidence level: 85%)

• 120.48.122.238VShell botnet C2 server (confidence level: 100%)
• 134.122.1.247Unknown malware payload delivery server (confidence level: 85%)
• 45.55.35.80Unknown malware botnet C2 server (confidence level: 75%)
• 206.189.148.105Unknown malware botnet C2 server (confidence level: 50%)
• 178.128.18.57Unknown malware botnet C2 server (confidence level: 50%)
• 159.203.95.70Unknown Stealer botnet C2 server (confidence level: 50%)
• 179.43.139.82XMRIG payload delivery server (confidence level: 70%)
• 179.43.139.80XMRIG payload delivery server (confidence level: 60%)
• 179.43.139.81XMRIG payload delivery server (confidence level: 60%)
• 5.109.182.231Cobalt Strike botnet C2 server (confidence level: 100%)

XMRIG payload (confidence level: 90%)

• ef355778546bc6e044330691404b63eddf83d7fc6073047394a25dd0e98c7d7d