Skip to main content
IndicatorPublished Updated

ThreatFox IOCs for 2026-07-01

Source ThreatFox MISP Feed

0

TLP:WHITE, disclosure is not limited

Indicators of compromise

Domains 284

  • zaserz.comVidar botnet C2 domain (confidence level: 100%)
  • superwebprotection.comClearFake botnet C2 domain (confidence level: 100%)
  • exclusivecloudprotection.comClearFake botnet C2 domain (confidence level: 100%)
  • extrafireprotection.comClearFake botnet C2 domain (confidence level: 100%)
  • photo-download-drive.infoUnknown RAT payload delivery domain (confidence level: 100%)
  • arigatodomen.sbsVidar payload delivery domain (confidence level: 75%)
  • barmaleieba.lolVidar payload delivery domain (confidence level: 75%)
  • bibliorock.lolVidar payload delivery domain (confidence level: 75%)
  • gasshopper.saleVidar payload delivery domain (confidence level: 75%)
  • mebanebols.tradeVidar payload delivery domain (confidence level: 75%)

URLs 60

  • https://zaserz.com/Unknown malware payload delivery URL (confidence level: 90%)
  • http://103.146.110.206:60051/mozi.mMozi payload delivery URL (confidence level: 75%)
  • http://115.50.231.205:58069/mozi.mMozi payload delivery URL (confidence level: 75%)
  • http://112.27.10.150:34339/mozi.mMozi payload delivery URL (confidence level: 75%)
  • https://schuttc.lol/file.jsKongTuke payload delivery URL (confidence level: 100%)
  • https://schuttc.lol/api/v1/sessionKongTuke payload delivery URL (confidence level: 100%)
  • https://schuttc.lol/api/v1/verifyKongTuke payload delivery URL (confidence level: 100%)
  • http://202.70.139.110:44351/mozi.aMozi payload delivery URL (confidence level: 75%)
  • http://103.248.94.9:51949/mozi.mMozi payload delivery URL (confidence level: 75%)
  • https://195.201.58.116/Vidar botnet C2 (confidence level: 100%)

IP addresses 164

  • 63.250.57.91AsyncRAT botnet C2 server (confidence level: 75%)
  • 91.92.137.12Quasar RAT botnet C2 server (confidence level: 75%)
  • 147.182.140.2Aisuru botnet C2 server (confidence level: 100%)
  • 82.17.235.66Quasar RAT botnet C2 server (confidence level: 50%)
  • 39.96.15.121VShell botnet C2 server (confidence level: 100%)
  • 168.245.203.156Meterpreter botnet C2 server (confidence level: 50%)
  • 47.92.214.13VShell botnet C2 server (confidence level: 100%)
  • 49.232.191.108VShell botnet C2 server (confidence level: 100%)
  • 93.177.77.228VShell botnet C2 server (confidence level: 100%)
  • 101.43.128.56VShell botnet C2 server (confidence level: 100%)

Hashes 59

  • 54415e8a8d8e1ad25fdb246d9dfd50c76dce805a47b92d84539f23d14f6ee31bUnknown malware payload (confidence level: 75%)
  • 11b50a6143f0a10495f509cc7582a141e644b7322a481e02ea8e9a6db7edbbc0Unknown malware payload (confidence level: 100%)
  • bc03887e61e014c17deacc56b7842d47391cecfa3244e7b9cd6d45b4faff1f5fMaskGramStealer payload (confidence level: 95%)
  • cbdc70114cac319dbe3d7455b65dbfe7eebe568dMaskGramStealer payload (confidence level: 95%)
  • 9907606ebe6ce1fdf54180373b03ad77MaskGramStealer payload (confidence level: 95%)
  • 902f94d7819fa6a65e9ba1d491e8fc7cb3d2bcb15ae1e4a89a065223d815f9f8CrossRAT payload (confidence level: 95%)
  • e72df84ddba88ad37b79af285a619b7698914cfaCrossRAT payload (confidence level: 95%)
  • 7226fb1c7386c342d188c0b9467f7bc5CrossRAT payload (confidence level: 95%)
  • 4c9e9d28c5bd78e82cd874856549b18c1cfd5d0fa4b2dd63f779de90cdd27ed8SalatStealer payload (confidence level: 95%)
  • 17c09eea41699746d301191c6a2e984d10c2f8b3SalatStealer payload (confidence level: 95%)

Description

ThreatFox IOCs for 2026-07-01

Community reviews

Loading reviews…