Skip to main content
IndicatorPublished Updated

ThreatFox IOCs for 2026-06-09

Source ThreatFox MISP Feed

0

TLP:WHITE, disclosure is not limited

Indicators of compromise

Domains 218

  • webflare.beerUnknown Stealer botnet C2 domain (confidence level: 100%)
  • berlof.shopUnknown Stealer botnet C2 domain (confidence level: 100%)
  • firazit.comUnknown Stealer botnet C2 domain (confidence level: 100%)
  • macerapindasi.comUnknown Stealer botnet C2 domain (confidence level: 100%)
  • servupdt.comUnknown Stealer botnet C2 domain (confidence level: 100%)
  • alpinecamping.comVidar payload delivery domain (confidence level: 100%)
  • anascopr.netVidar payload delivery domain (confidence level: 100%)
  • associationaudrey.frVidar payload delivery domain (confidence level: 100%)
  • attyx.comVidar payload delivery domain (confidence level: 100%)
  • blossomforth13.comVidar payload delivery domain (confidence level: 100%)

URLs 36

  • https://flzocge.penality.bet/083442ba-5bf1-4cc5-8440-04740f3ca9be/ClearFake payload delivery URL (confidence level: 75%)
  • http://ros-neftbank.ru/index.phpBerbew botnet C2 (confidence level: 100%)
  • http://master-x.com/index.phpBerbew botnet C2 (confidence level: 100%)
  • http://kaspersky.ru/index.phpBerbew botnet C2 (confidence level: 100%)
  • http://color-bank.ru/index.phpBerbew botnet C2 (confidence level: 100%)
  • http://adult-empire.com/index.phpBerbew botnet C2 (confidence level: 100%)
  • http://virus-list.com/index.phpBerbew botnet C2 (confidence level: 100%)
  • http://parex-bank.ru/index.htmBerbew botnet C2 (confidence level: 100%)
  • http://gaz-prom.ru/index.htmBerbew botnet C2 (confidence level: 100%)
  • http://kaspersky.ru/index.htmBerbew botnet C2 (confidence level: 100%)

IP addresses 117

  • 192.3.176.232Remcos botnet C2 server (confidence level: 75%)
  • 8.219.158.30Cobalt Strike botnet C2 server (confidence level: 50%)
  • 196.75.218.37Meterpreter botnet C2 server (confidence level: 50%)
  • 85.209.48.248VShell botnet C2 server (confidence level: 100%)
  • 120.55.246.213Cobalt Strike botnet C2 server (confidence level: 75%)
  • 194.38.138.155Cobalt Strike botnet C2 server (confidence level: 94%)
  • 83.168.110.191Mirai botnet C2 server (confidence level: 75%)
  • 154.29.73.187Mirai botnet C2 server (confidence level: 75%)
  • 217.60.241.39Tofsee botnet C2 server (confidence level: 75%)
  • 217.60.241.17Tofsee botnet C2 server (confidence level: 75%)

Hashes 11

  • 19678a2d474affb5164942a842488275dafc988bab2e5918e38422f152ecc66bClearFake payload (confidence level: 75%)
  • b8e9bbde0e8ce2781c5c829919461ee232b82b81e3be3a6a386cf10ed6f35a21Unknown malware payload (confidence level: 100%)
  • 0b45d1520d0a48bcdac3ce16a3b5000dffd954abbdb1723d9215b35c554f48bbUnknown malware payload (confidence level: 100%)
  • 48f2a3bfb7a70b97875e56d932ada0d975cd5ee154a99caf7d93550275a1548aUnknown malware payload (confidence level: 100%)
  • c7a24e1fc68b7233e1c93c02409e9429a1ea5cf0662eb4cd03364373df7d7044Unknown malware payload (confidence level: 100%)
  • 51e1f3a97629e8db50ca1f9a0b68c019e74c07ce5209d5eefd4a2e3f4fe62869Unknown malware payload (confidence level: 100%)
  • 068505fab1dc1b784ddc845c9eeeba8e04da512383ecd55a7a3d076879656393Unknown malware payload (confidence level: 100%)
  • 90fe8c831a681c8c1dc77a271bb417fd52479fe6fc79d6cb9b7ffaf13f801f93KongTuke payload (confidence level: 100%)
  • 6af715b5105d6d16e02ee6d1de14410a8a0fd2fb3d7b752bb24be25105fac0b2KongTuke payload (confidence level: 100%)
  • 3cea9df086d111a71c24822aa626380105347dd6d458ae7971557684bf12e097XTinyLoader payload (confidence level: 100%)

Description

ThreatFox IOCs for 2026-06-09

Community reviews

Loading reviews…