Skip to main content
IndicatorPublished Updated

ThreatFox IOCs for 2026-06-22

Source ThreatFox MISP Feed

0

TLP:WHITE, disclosure is not limited

Indicators of compromise

Domains 117

  • cdn.privatefile.hostRapidStealer payload delivery domain (confidence level: 100%)
  • bio90.footballClearFake payload delivery domain (confidence level: 100%)
  • betmegapari.netClearFake payload delivery domain (confidence level: 100%)
  • qraju7pt.betmegapari.netClearFake payload delivery domain (confidence level: 100%)
  • betmegapari.orgClearFake payload delivery domain (confidence level: 100%)
  • ranoz.gg5.t Downloader payload delivery domain (confidence level: 100%)
  • lockr.so5.t Downloader payload delivery domain (confidence level: 100%)
  • paster.so5.t Downloader payload delivery domain (confidence level: 100%)
  • filehost.sbs5.t Downloader payload delivery domain (confidence level: 100%)
  • generate920da4.host94p.cfd5.t Downloader payload delivery domain (confidence level: 100%)

URLs 361

  • https://cdn.jsdelivr.net/gh/savina-41/r4240-98d7-bc2c@main/fe3bClearFake payload delivery URL (confidence level: 100%)
  • https://cdn.jsdelivr.net/gh/savina-41/4240-98d7-bc2c@main/fe3bClearFake payload delivery URL (confidence level: 100%)
  • http://85.120.255.35/ssh.shUnknown malware payload delivery URL (confidence level: 75%)
  • https://192.177.26.222Vidar botnet C2 (confidence level: 75%)
  • https://itecau.com.au/Unknown malware payload delivery URL (confidence level: 90%)
  • https://steamcommunity.com/profiles/76561198684471717Vidar botnet C2 (confidence level: 100%)
  • https://telegram.me/t0mdrVidar botnet C2 (confidence level: 100%)
  • https://cht.hitamsm188.top/Vidar botnet C2 (confidence level: 100%)
  • https://cht.utvrent.com/Vidar botnet C2 (confidence level: 100%)
  • https://46.224.16.213/Vidar botnet C2 (confidence level: 100%)

IP addresses 126

  • 77.90.41.3RapidStealer payload delivery server (confidence level: 100%)
  • 61.238.202.155Cobalt Strike botnet C2 server (confidence level: 100%)
  • 3.132.75.97vo1d botnet C2 server (confidence level: 100%)
  • 111.231.173.74Cobalt Strike botnet C2 server (confidence level: 100%)
  • 111.231.173.74Cobalt Strike botnet C2 server (confidence level: 100%)
  • 111.231.173.74Cobalt Strike botnet C2 server (confidence level: 100%)
  • 23.95.103.219Remcos botnet C2 server (confidence level: 75%)
  • 119.45.166.6Cobalt Strike botnet C2 server (confidence level: 75%)
  • 185.157.162.107Quasar RAT botnet C2 server (confidence level: 100%)
  • 194.58.113.92Cobalt Strike botnet C2 server (confidence level: 100%)

Hashes 207

  • 7b55a11d09462a48b0e2c2875edf253827f304ad28eaeb1553c7633b86e87807WannaCryptor payload (confidence level: 95%)
  • 6f5272e60fc23e7d911bc651fbe8e58187a73d30WannaCryptor payload (confidence level: 95%)
  • 6735cd20825820a7065894676a056491WannaCryptor payload (confidence level: 95%)
  • 3832eea5221afb6554def361abd9abed7258c0916fc34ecbd19191131f462fbaCrossRAT payload (confidence level: 95%)
  • 41b27584362b4fff75ab23fb0caa2968609fd570CrossRAT payload (confidence level: 95%)
  • 1277177e9e12414f50182a8bb5463a7aCrossRAT payload (confidence level: 95%)
  • 1859950b3f410ae37bf115ab107917f6af6313a598f76ddbb0225d9cc85518a5ValleyRAT payload (confidence level: 95%)
  • a4358deca3180c3864cd4030d9ac3eea5634a7b3ValleyRAT payload (confidence level: 95%)
  • c3d6b73e54ff4efd29651e46f751fe5bValleyRAT payload (confidence level: 95%)
  • 930070e90a3b037b5132ff7bd2c49899d3da39679e9ff377ef5d7e40ea57d39eCoinminer payload (confidence level: 95%)

Description

ThreatFox IOCs for 2026-06-22

Community reviews

Loading reviews…