Skip to main content
IndicatorPublished Updated

ThreatFox IOCs for 2026-06-12

Source ThreatFox MISP Feed

0

TLP:WHITE, disclosure is not limited

Indicators of compromise

Domains 382

  • sartora.lolKongTuke payload delivery domain (confidence level: 100%)
  • jiminej.lolKongTuke payload delivery domain (confidence level: 100%)
  • natureorganicbeauty.comStrelaStealer payload delivery domain (confidence level: 100%)
  • 14thstreetmillworks.comStrelaStealer payload delivery domain (confidence level: 100%)
  • 4o6giyl4.ravanshenasinovin.xyzClearFake payload delivery domain (confidence level: 100%)
  • uqknomxs.karbordriyaziyat.xyzClearFake payload delivery domain (confidence level: 100%)
  • kdphdmr.rahnemayenegaresh.siteClearFake payload delivery domain (confidence level: 100%)
  • bjuo48bq.ravanroshd.shopClearFake payload delivery domain (confidence level: 100%)
  • kn46xsmt.readthisintro.xyzClearFake payload delivery domain (confidence level: 100%)
  • lrvizgxp.lincoplus.xyzClearFake payload delivery domain (confidence level: 100%)

URLs 36

  • https://sartora.lol/file.jsKongTuke payload delivery URL (confidence level: 100%)
  • https://sartora.lol/api/v1/sessionKongTuke payload delivery URL (confidence level: 100%)
  • https://sartora.lol/api/v1/verifyKongTuke payload delivery URL (confidence level: 100%)
  • https://jiminej.lol/file.jsKongTuke payload delivery URL (confidence level: 100%)
  • https://jiminej.lol/api/v1/sessionKongTuke payload delivery URL (confidence level: 100%)
  • https://jiminej.lol/api/v1/verifyKongTuke payload delivery URL (confidence level: 100%)
  • https://jiminej.lol/api/v1/statusKongTuke payload delivery URL (confidence level: 100%)
  • http://5.83.134.26/z.shUnknown malware payload delivery URL (confidence level: 75%)
  • https://riverbreezeintl.com/Unknown malware payload delivery URL (confidence level: 90%)
  • https://135.181.224.78/Vidar botnet C2 (confidence level: 100%)

IP addresses 128

  • 185.212.19.144Meterpreter botnet C2 server (confidence level: 100%)
  • 185.212.170.93Cobalt Strike botnet C2 server (confidence level: 100%)
  • 43.99.110.114Cobalt Strike botnet C2 server (confidence level: 100%)
  • 114.132.89.132Cobalt Strike botnet C2 server (confidence level: 100%)
  • 114.132.89.132Cobalt Strike botnet C2 server (confidence level: 100%)
  • 114.132.89.132Cobalt Strike botnet C2 server (confidence level: 100%)
  • 107.189.21.145Cobalt Strike botnet C2 server (confidence level: 91%)
  • 45.205.2.45VShell botnet C2 server (confidence level: 100%)
  • 139.64.172.35DCRat botnet C2 server (confidence level: 100%)
  • 153.0.195.156Unknown malware botnet C2 server (confidence level: 100%)

Hashes 3

Tsunami payload (confidence level: 85%)

  • ef9a91a7f3423d779353baebed34aa1f3b6104e7e4730c77fe8457b42a576ac5
  • e9c924c170332d42cae71bb9113ed9556cf91d5c50257b316eb433be9a211fb7
  • f32b209d33c4194f37dbbf2a677c4faf78cf6b24cf2474bf1c14aed17af40b2e

Description

ThreatFox IOCs for 2026-06-12

Community reviews

Loading reviews…