Skip to main content
IndicatorPublished Updated

ThreatFox IOCs for 2026-06-05

Source ThreatFox MISP Feed

0

TLP:WHITE, disclosure is not limited

Indicators of compromise

Domains 191

  • shadowcompass.topSmartApeSG payload delivery domain (confidence level: 100%)
  • goolge.mobiClearFake payload delivery domain (confidence level: 100%)
  • searggend.comClearFake payload delivery domain (confidence level: 100%)
  • youareall.botlesscucks.stMirai botnet C2 domain (confidence level: 100%)
  • musika.botlesscucks.stMirai botnet C2 domain (confidence level: 100%)
  • happytugsmassage.comMirai botnet C2 domain (confidence level: 100%)
  • n058152033245.netvigator.comMirai botnet C2 domain (confidence level: 100%)
  • stoplooking.botlesscucks.stMirai botnet C2 domain (confidence level: 100%)
  • gstatic-node.ioLumma Stealer botnet C2 domain (confidence level: 100%)
  • colomndead.xyzLumma Stealer botnet C2 domain (confidence level: 100%)

URLs 19

  • https://shadowcompass.top/public/acl-partialSmartApeSG payload delivery URL (confidence level: 100%)
  • https://shadowcompass.top/public/token-json.jsSmartApeSG payload delivery URL (confidence level: 100%)
  • http://195.181.245.252:9443/xmrigXMRIG payload delivery URL (confidence level: 80%)
  • http://92.60.77.99:8888/xmrig-x86XMRIG payload delivery URL (confidence level: 80%)
  • https://xmm.evosm188.top/Vidar botnet C2 (confidence level: 75%)
  • http://89.124.78.101/lsge63sd3/index.phpAmadey botnet C2 (confidence level: 100%)
  • http://gxfsxs.cn:8880/getinstall64ValleyRAT botnet C2 (confidence level: 100%)
  • https://steamcommunity.com/profiles/76561198698223785/g75ritVidar botnet C2 (confidence level: 75%)
  • https://zadelom.ru/auth/authBerbew botnet C2 (confidence level: 75%)
  • https://devsolutionsfinder.com/Vidar payload delivery URL (confidence level: 75%)

IP addresses 145

  • 91.92.42.203Mirai payload delivery server (confidence level: 100%)
  • 195.181.245.252XMRIG payload delivery server (confidence level: 80%)
  • 57.128.171.186XMRIG payload delivery server (confidence level: 80%)
  • 104.236.83.40RedTail payload delivery server (confidence level: 80%)
  • 220.162.198.142RedTail payload delivery server (confidence level: 80%)
  • 110.35.80.116Mirai payload delivery server (confidence level: 80%)
  • 8.229.68.116Mirai payload delivery server (confidence level: 80%)
  • 45.156.87.119XMRIG botnet C2 server (confidence level: 80%)
  • 71.6.239.181XMRIG botnet C2 server (confidence level: 80%)
  • 66.240.223.240XMRIG botnet C2 server (confidence level: 80%)

Hashes 5

  • b0e1ae6d73d656b203514f498b59cbcf29f067edf6fbd3803a3de7d21960848dXMRIG payload (confidence level: 80%)
  • f38504f53f6a25c405cfa272572eb0ededbbb4b9399b8aec1706d5e2b990f1c9XMRIG payload (confidence level: 80%)
  • c2b96ba6140ed15d46a7956ab2e590a39c164197AMOS payload (confidence level: 100%)
  • 8a22239f95067a5a5a9520bfafa4c4b71b7cf828AMOS payload (confidence level: 100%)
  • 85abca56aea793d8a45ddb747c4c4e7cf1ab21aaAMOS payload (confidence level: 100%)

Description

ThreatFox IOCs for 2026-06-05

Community reviews

Loading reviews…