Skip to main content
IndicatorPublished Updated

ThreatFox IOCs for 2026-05-27

Source ThreatFox MISP Feed

0

TLP:WHITE, disclosure is not limited

Indicators of compromise

Domains 197

  • issueall.comEtherRAT botnet C2 domain (confidence level: 100%)
  • dakindsoups.comEtherRAT botnet C2 domain (confidence level: 100%)
  • webiqonline.comEtherRAT botnet C2 domain (confidence level: 100%)
  • wilheah.cyouLumma Stealer botnet C2 domain (confidence level: 100%)
  • diplokb.cyouLumma Stealer botnet C2 domain (confidence level: 100%)
  • consuus.cyouLumma Stealer botnet C2 domain (confidence level: 100%)
  • idealvs.cyouLumma Stealer botnet C2 domain (confidence level: 100%)
  • answebi.cyouLumma Stealer botnet C2 domain (confidence level: 100%)
  • clamsal.cyouLumma Stealer botnet C2 domain (confidence level: 100%)
  • pholith.cyouLumma Stealer botnet C2 domain (confidence level: 100%)

URLs 58

  • http://158.94.210.59/25e3868686d747678e3b.phpStealc botnet C2 (confidence level: 100%)
  • https://maxi-vet.ru/Vidar payload delivery URL (confidence level: 75%)
  • http://homeinspectionsdelaware.com/curl/75ddfbae4fcacede52ef513ce634f82ad3d8358984b0bd49756cc8c50a55d501Unknown Stealer payload delivery URL (confidence level: 100%)
  • https://sites.google.com/view/payforwinUnknown Stealer payload delivery URL (confidence level: 100%)
  • https://payforwin.github.io/desktop.htmlUnknown Stealer payload delivery URL (confidence level: 100%)
  • https://driftpress11.com/curl/bbaebdea08c804297a988ec4200424600767ddc94cacc38931f8c430ba93d3d0Unknown Stealer botnet C2 (confidence level: 100%)
  • https://bremadsf.com/Unknown Stealer payload delivery URL (confidence level: 100%)
  • https://sites.google.com/view/xbiernlkUnknown Stealer payload delivery URL (confidence level: 100%)
  • https://lenders.digital/Unknown malware payload delivery URL (confidence level: 90%)
  • https://tangmwp.club/blankLumma Stealer botnet C2 (confidence level: 75%)

IP addresses 58

  • 192.52.242.39Remcos botnet C2 server (confidence level: 50%)
  • 185.229.32.126VShell botnet C2 server (confidence level: 100%)
  • 8.138.180.67Unknown malware botnet C2 server (confidence level: 100%)
  • 39.100.88.189Cobalt Strike botnet C2 server (confidence level: 100%)
  • 39.100.88.189Cobalt Strike botnet C2 server (confidence level: 100%)
  • 39.100.88.189Cobalt Strike botnet C2 server (confidence level: 100%)
  • 152.53.195.50Cobalt Strike botnet C2 server (confidence level: 100%)
  • 152.53.195.50Cobalt Strike botnet C2 server (confidence level: 100%)
  • 152.53.195.50Cobalt Strike botnet C2 server (confidence level: 100%)
  • 152.53.195.50Cobalt Strike botnet C2 server (confidence level: 100%)

Hashes 15

  • f5f496ebc1de17421aa89f2a1160d30901b7b8cbfe475c3f5a7cb1e508d68356Unknown malware payload (confidence level: 85%)
  • 3b330a6ec000ea461732e484a61eb9eda1ece5b0a9b2458c222c5714ba6790ecUnknown malware payload (confidence level: 85%)
  • bab74573404fc44b6e012fda3f7a8b00fe5a80565557ab78c9c1f0a8727afecfUnknown malware payload (confidence level: 85%)
  • 5cd46cb8ffa6092aad21337df0c10881ba012dad4d63f7ffac98eb6c8463d63dUnknown malware payload (confidence level: 85%)
  • cdfae9f1d9702545972c1aee9e349cd3df4e6be8550f5d35ca3c508c6c9a7dc7Unknown malware payload (confidence level: 85%)
  • d25263fc9f895ed6fbc5f07ad009b87b2fe03d691c44e220ce37ce7042ffa9d9Unknown Loader payload (confidence level: 75%)
  • c881253dafcf1322a771139b1a429ec1e78c507ca81a218a20dc1a4b25abbfe7Unknown Loader payload (confidence level: 75%)
  • a8ffab0b134e177655dd255f9b05296bb5ca7c40c5c1a2157db81fc68b350ffdUnknown Loader payload (confidence level: 75%)
  • 4eae39295458ac7a02bb837e0c82eecda3925f50dae684168bc0b203a89c53e2SmartApeSG payload (confidence level: 75%)
  • 5ff519ad6347e7df1bb14e2bc15d72f4b26290da2e642c8a65fb8d4736f23022SmartApeSG payload (confidence level: 75%)

Description

ThreatFox IOCs for 2026-05-27

Community reviews

Loading reviews…