Skip to main content
IndicatorPublished Updated

ThreatFox IOCs for 2026-06-02

Source ThreatFox MISP Feed

0

TLP:WHITE, disclosure is not limited

Indicators of compromise

Domains 243

  • kpa.dism188.topVidar botnet C2 domain (confidence level: 100%)
  • kpa.bluewestgroup.comVidar botnet C2 domain (confidence level: 100%)
  • 3sefr3.irClearFake payload delivery domain (confidence level: 100%)
  • zhlwyqr.3sefr3.irClearFake payload delivery domain (confidence level: 100%)
  • adabiyat.orgClearFake payload delivery domain (confidence level: 100%)
  • djineca.adabiyat.orgClearFake payload delivery domain (confidence level: 100%)
  • aftabsport.irClearFake payload delivery domain (confidence level: 100%)
  • utgxkle.aftabsport.irClearFake payload delivery domain (confidence level: 100%)
  • actmimo.aftabsport.irClearFake payload delivery domain (confidence level: 100%)
  • negozimobilireggioemilia.itStrelaStealer payload delivery domain (confidence level: 100%)

URLs 98

  • https://kpa.dism188.top/Vidar botnet C2 (confidence level: 100%)
  • https://kpa.bluewestgroup.com/Vidar botnet C2 (confidence level: 100%)
  • https://hit.dism188.top/Vidar botnet C2 (confidence level: 100%)
  • https://hit.bluewestgroup.com/Vidar botnet C2 (confidence level: 100%)
  • https://hit.duitsm188.top/Vidar botnet C2 (confidence level: 100%)
  • https://hit.canamrental.com/Vidar botnet C2 (confidence level: 100%)
  • https://glnason.lol/file.jsKongTuke payload delivery URL (confidence level: 100%)
  • https://glnason.lol/api/v1/sessionKongTuke payload delivery URL (confidence level: 100%)
  • https://glnason.lol/api/v1/verifyKongTuke payload delivery URL (confidence level: 100%)
  • https://glnason.lol/api/v1/statusKongTuke payload delivery URL (confidence level: 100%)

IP addresses 419

  • 82.156.228.128VShell botnet C2 server (confidence level: 100%)
  • 154.88.99.60VShell botnet C2 server (confidence level: 100%)
  • 154.88.99.37VShell botnet C2 server (confidence level: 100%)
  • 13.60.184.242AsyncRAT botnet C2 server (confidence level: 100%)
  • 154.88.103.51VShell botnet C2 server (confidence level: 100%)
  • 154.88.103.35VShell botnet C2 server (confidence level: 100%)
  • 13.60.184.242AsyncRAT botnet C2 server (confidence level: 100%)
  • 154.88.103.44VShell botnet C2 server (confidence level: 100%)
  • 154.88.101.60VShell botnet C2 server (confidence level: 100%)
  • 154.88.100.52VShell botnet C2 server (confidence level: 100%)

Hashes 1

XMRIG payload (confidence level: 90%)

  • adfa14deed04a850938bf48ef190b1f30b93d1bebe07ad2e7d0b48d8a03bdabc

Description

ThreatFox IOCs for 2026-06-02

Community reviews

Loading reviews…