Skip to main content
MalwarePublished 07/25/2026Updated 07/26/2026

ThreatFox IOCs for 2026-07-25

Source ThreatFox MISP Feed

0

Description

ThreatFox IOCs for 2026-07-25

Impact

No direct impact on specific software or systems is detailed. The information serves as intelligence to detect or prevent malware-related activity. There are no known active exploits or affected versions, so the impact is primarily informational for threat detection and response.

Defensive guidance

No patches or fixes are available or applicable. Organizations should use the provided IOCs within their detection and monitoring tools to identify potential malicious activity. Since this is an OSINT feed entry without specific vulnerabilities, no direct remediation actions are prescribed.

Summary

The data represents a collection of threat intelligence indicators (IOCs) related to malware activity reported on 2026-07-25 by ThreatFox MISP Feed. It is classified as malware with a medium severity level and involves payload delivery and network activity. There are no known exploits in the wild and no affected software versions specified. No patches or remediations are available or applicable as this is an intelligence report rather than a vulnerability. The threat level and distribution metrics suggest moderate concern but limited immediate impact.

Indicators of compromise

Domains 109

  • marshalh.icuKongTuke payload delivery domain (confidence level: 100%)
  • hosthex9101.comKongTuke payload delivery domain (confidence level: 100%)
  • clouderfaster.ccUnknown Stealer botnet C2 domain (confidence level: 100%)
  • clouderrtufjcb.ccUnknown Stealer botnet C2 domain (confidence level: 100%)
  • errakgrwenmjibedi.ccUnknown Stealer botnet C2 domain (confidence level: 100%)
  • errjothcxmklspp.ccUnknown Stealer botnet C2 domain (confidence level: 100%)
  • quasarcolonnade.topSmartApeSG payload delivery domain (confidence level: 100%)
  • irahook.lolUnknown RAT botnet C2 domain (confidence level: 100%)
  • astrameduniversity.comIClickFix payload delivery domain (confidence level: 100%)
  • council-icc.orgIClickFix payload delivery domain (confidence level: 100%)

URLs 29

  • https://marshalh.icu/api/v1/sessionKongTuke payload delivery URL (confidence level: 100%)
  • https://marshalh.icu/api/v1/verifyKongTuke payload delivery URL (confidence level: 100%)
  • https://marshalh.icu/api/v1/statusKongTuke payload delivery URL (confidence level: 100%)
  • https://hosthex9101.com/update/packageKongTuke payload delivery URL (confidence level: 100%)
  • http://190.115.80.35:49166/mozi.mMozi payload delivery URL (confidence level: 75%)
  • http://27.213.25.110:48423/mozi.mMozi payload delivery URL (confidence level: 75%)
  • http://153.117.7.16:41154/mozi.aMozi payload delivery URL (confidence level: 75%)
  • https://quasarcolonnade.top/alias/router-fetch.jsSmartApeSG payload delivery URL (confidence level: 100%)
  • https://quasarcolonnade.top/alias/signup-stylesheetSmartApeSG payload delivery URL (confidence level: 100%)
  • https://quasarcolonnade.top/alias/proxy-worker.jsSmartApeSG payload delivery URL (confidence level: 100%)

IP addresses 89

  • 167.172.80.107Aisuru botnet C2 server (confidence level: 100%)
  • 216.250.255.1Cobalt Strike botnet C2 server (confidence level: 100%)
  • 111.170.148.134Unknown malware botnet C2 server (confidence level: 100%)
  • 111.170.148.134Unknown malware botnet C2 server (confidence level: 100%)
  • 111.170.148.134Unknown malware botnet C2 server (confidence level: 100%)
  • 111.170.148.134Unknown malware botnet C2 server (confidence level: 100%)
  • 218.59.87.198Unknown malware payload delivery server (confidence level: 75%)
  • 87.76.146.91NjRAT botnet C2 server (confidence level: 100%)
  • 111.170.148.134Unknown malware botnet C2 server (confidence level: 100%)
  • 122.51.215.90Unknown malware botnet C2 server (confidence level: 100%)

Hashes 184

  • 71b9449efaa11bc7e3e82a3df58a0730faae3b0e4ed1f96b36f71a4d675e872cNjRAT payload (confidence level: 95%)
  • c52a9e0817361e99a6176e679f81e4b85a8e5316NjRAT payload (confidence level: 95%)
  • 306038f5b80551285855f65f1cc13045NjRAT payload (confidence level: 95%)
  • 8429bc3f819bae0b2aa65e741a533ea216b257a08c1741000185ef547f528531WannaCryptor payload (confidence level: 95%)
  • 1c7c0abca29c38db340f3912a342838c6f8d2049WannaCryptor payload (confidence level: 95%)
  • 7ecd3b8fbf1d5242285e253d9910d1a8WannaCryptor payload (confidence level: 95%)
  • 932aa31eb7fa070617035b427aab26a148eaee8e9d4d69da22b5ae89279b3adbCoinminer payload (confidence level: 95%)
  • ad2c75fca548859745799bbf42dfa26f7af196b8Coinminer payload (confidence level: 95%)
  • 46633ffe64281b69b6d6140309d0dfeeCoinminer payload (confidence level: 95%)
  • d0df38cd4febaa3f20daa1b2d4d729c909f23d35c67e479d8230561d2eae330fWannaCryptor payload (confidence level: 95%)

Community reviews

Loading reviews…