Skip to main content
IndicatorPublished Updated

ThreatFox IOCs for 2026-06-25

Source ThreatFox MISP Feed

0

TLP:WHITE, disclosure is not limited

Indicators of compromise

Domains 75

  • packsmc.com5.t Downloader payload delivery domain (confidence level: 100%)
  • yellowrace.comUnknown RAT botnet C2 domain (confidence level: 100%)
  • impresa.pubBackdoorit payload delivery domain (confidence level: 100%)
  • ledesla.cfdKongTuke payload delivery domain (confidence level: 100%)
  • ext4-v.topKongTuke payload delivery domain (confidence level: 100%)
  • clicky.comUnknown malware payload delivery domain (confidence level: 100%)
  • unsinkable.boatsMirai botnet C2 domain (confidence level: 100%)
  • squibblypuff.asiaMirai botnet C2 domain (confidence level: 100%)
  • druzya-iz-kartonnoy-korobki.christmasMirai botnet C2 domain (confidence level: 100%)
  • rigel1poker.comClearFake payload delivery domain (confidence level: 100%)

URLs 76

  • https://namaste-bungalows.com/Unknown malware payload delivery URL (confidence level: 90%)
  • https://synthexisgroupllc.com/Unknown malware payload delivery URL (confidence level: 90%)
  • https://www.zhouruntech.com/Unknown malware payload delivery URL (confidence level: 90%)
  • https://ledesla.cfd/file.jsKongTuke payload delivery URL (confidence level: 100%)
  • https://ledesla.cfd/api/v1/sessionKongTuke payload delivery URL (confidence level: 100%)
  • https://ledesla.cfd/api/v1/verifyKongTuke payload delivery URL (confidence level: 100%)
  • https://ledesla.cfd/api/v1/statusKongTuke payload delivery URL (confidence level: 100%)
  • https://ext4-v.top/oKongTuke payload delivery URL (confidence level: 100%)
  • http://111.164.238.73:57439/mozi.mMozi payload delivery URL (confidence level: 75%)
  • http://119.160.215.52:35806/mozi.aMozi payload delivery URL (confidence level: 75%)

IP addresses 332

  • 159.223.162.164Unknown malware botnet C2 server (confidence level: 75%)
  • 144.31.151.138Tsunami botnet C2 server (confidence level: 80%)
  • 62.238.37.207Tsunami payload delivery server (confidence level: 80%)
  • 158.51.96.38XOR DDoS payload delivery server (confidence level: 80%)
  • 45.81.243.62XMRIG payload delivery server (confidence level: 80%)
  • 46.101.213.236XMRIG payload delivery server (confidence level: 80%)
  • 144.31.158.144RedTail payload delivery server (confidence level: 80%)
  • 27.153.157.138RedTail payload delivery server (confidence level: 80%)
  • 83.229.8.197RedTail payload delivery server (confidence level: 80%)
  • 101.47.8.187RedTail payload delivery server (confidence level: 80%)

Hashes 264

  • 363ee51fc02f20cb206039434758c3afa1c71bc7d316c6db4a39b0d310ab92f9Remcos payload (confidence level: 100%)
  • 372f19a45d0eb4c8c52117c6ae2bb8040a91bc72be8670623f957a18c2166985Remcos payload (confidence level: 100%)
  • 1eb89fbbdeaca143288cd71e73304fedf5abbeb093bfe64bce48ccb4e5158be9Unknown malware payload (confidence level: 75%)
  • 7791be7f06e67cfb2e32c1f709b8bf8afc5f354653d1a2074a47e80d8c04ff49DarkTortilla payload (confidence level: 95%)
  • 88c44f87b0decd5d91759514ffa7e4abd7c42471DarkTortilla payload (confidence level: 95%)
  • 6434db989785abb5ce2088e34915935fDarkTortilla payload (confidence level: 95%)
  • 5187e5216ddf0f63d74a69f483c9568d0b04f7ae67dd17ed1d7644b97ce3a8d1Coinminer payload (confidence level: 95%)
  • c64ca32757200e42117a290de4c6c56842e5c9a1Coinminer payload (confidence level: 95%)
  • 341a025fa2b8c640b9b09b8cafb2d329Coinminer payload (confidence level: 95%)
  • 93696af402e19dfc858f5867e56e9dd5ddfa4f88df05bbb68cb482ca2c21a79bNanocore RAT payload (confidence level: 95%)

Description

ThreatFox IOCs for 2026-06-25

Community reviews

Loading reviews…