Skip to main content
IndicatorPublished Updated

ThreatFox IOCs for 2026-06-23

Source ThreatFox MISP Feed

0

TLP:WHITE, disclosure is not limited

Indicators of compromise

Domains 83

  • pdf-srv.pdfbamaa.comUnknown malware payload delivery domain (confidence level: 75%)
  • claudverification-id.beerUnknown Loader payload delivery domain (confidence level: 100%)
  • stellar-minds.cfdUnknown Loader payload delivery domain (confidence level: 100%)
  • popularsoftupdates.comdonut_injector payload delivery domain (confidence level: 100%)
  • editdocumentfree.comdonut_injector payload delivery domain (confidence level: 100%)
  • opendocumentonline.comdonut_injector payload delivery domain (confidence level: 100%)
  • getimageinformation.comdonut_injector payload delivery domain (confidence level: 100%)
  • senterprise2026.comdonut_injector payload delivery domain (confidence level: 100%)
  • cdnusa-01.xyzUnknown malware payload delivery domain (confidence level: 100%)
  • avivtech.orgUnknown malware payload delivery domain (confidence level: 100%)

URLs 47

  • http://103.98.37.183:37776/mozi.mMozi payload delivery URL (confidence level: 75%)
  • http://223.123.42.237:49820/mozi.mMozi payload delivery URL (confidence level: 75%)
  • https://one-verification.lol/mUnknown malware botnet C2 (confidence level: 75%)
  • https://mascotfreights.com/Unknown malware payload delivery URL (confidence level: 90%)
  • https://216.173.65.250/dispatch_service/v2/testKV botnet C2 (confidence level: 75%)
  • http://45.90.119.34/dotnetzip.dllUnknown Stealer botnet C2 (confidence level: 50%)
  • https://bartach.xyz/file.jsKongTuke payload delivery URL (confidence level: 100%)
  • https://bartach.xyz/api/v1/sessionKongTuke payload delivery URL (confidence level: 100%)
  • https://bartach.xyz/api/v1/verifyKongTuke payload delivery URL (confidence level: 100%)
  • https://destinationsomewheretravel.com/Unknown malware payload delivery URL (confidence level: 90%)

IP addresses 99

  • 216.173.65.250KV botnet C2 server (confidence level: 75%)
  • 194.14.217.88KV botnet C2 server (confidence level: 75%)
  • 149.248.3.38KV botnet C2 server (confidence level: 75%)
  • 45.138.135.27Cobalt Strike botnet C2 server (confidence level: 100%)
  • 2.55.81.169Sliver botnet C2 server (confidence level: 100%)
  • 185.156.66.165Cobalt Strike botnet C2 server (confidence level: 86%)
  • 89.184.185.198Cobalt Strike botnet C2 server (confidence level: 92%)
  • 194.38.157.233Cobalt Strike botnet C2 server (confidence level: 93%)
  • 185.89.60.74Cobalt Strike botnet C2 server (confidence level: 94%)
  • 185.89.141.70Cobalt Strike botnet C2 server (confidence level: 94%)

Hashes 265

  • 665e50b3ccf388f8fd9360e4d41bca52edf7defb5d6d8804865e517f5db2cb46Unknown malware payload (confidence level: 100%)
  • 40ad28b87b5ed395fe8ff303555cc28974682ed6cc5a71ede76c4b17648cb8edKV payload (confidence level: 100%)
  • 28a23ab78739de674f94d9acadfe0709862c2b2d947e9051b200a24d3f9f45c4KV payload (confidence level: 100%)
  • d1414803a83b1ba260e3e1be742379eccbb806f987ec1e7c0bc5399e4971a58fKV payload (confidence level: 100%)
  • 03c4667f016f1e8441177639d87f77a59f32d2c7e0041616376967338667bd3bKV payload (confidence level: 100%)
  • 1e0da906811b570c4134ade310c3a94631d4b308d27b616497266b49aae2ad0aKV payload (confidence level: 100%)
  • d62055910cd579ff1fb57bd1926c5b2e80e1677f0316737b2f733f86b01615dcKV payload (confidence level: 100%)
  • 96ecc107aa645e36b5f939ebfcf9e61fc9ebc27616680fbd0fdeb41c7950d79aKV payload (confidence level: 100%)
  • 000122bb86e71548cc16dd4c4f5bb6c8fdf548a098d1bd591ee10f1bc17f9883Unknown malware payload (confidence level: 75%)
  • 0c5f1770ba4495fb3be0e3abd522a7b0685cb375e33acf5c42fde6cba0513c41Unknown malware payload (confidence level: 75%)

Description

ThreatFox IOCs for 2026-06-23

Community reviews

Loading reviews…