Skip to main content
IndicatorPublished Updated

ThreatFox IOCs for 2026-08-06

Source ThreatFox MISP Feed

0

TLP:WHITE, disclosure is not limited

Indicators of compromise

Domains 236

  • metrix-getrix.buzzUnknown malware payload delivery domain (confidence level: 100%)
  • yougriddonaldsfile.comUnknown malware payload delivery domain (confidence level: 75%)
  • crit-pimetri.buzzUnknown malware payload delivery domain (confidence level: 100%)
  • hkhzyje.gtacauto.comClearFake payload delivery domain (confidence level: 100%)
  • cxfpzh.sandblastingaustin.comClearFake payload delivery domain (confidence level: 100%)
  • bnbwupr9.rsfoodproducts.comClearFake payload delivery domain (confidence level: 100%)
  • wftmzym.habbofutbol.comClearFake payload delivery domain (confidence level: 100%)
  • epwjdx.sim-trucking.comClearFake payload delivery domain (confidence level: 100%)
  • yyephml.osbratstvojedinstvo.comClearFake payload delivery domain (confidence level: 100%)
  • istanbulverikurtarmamerkezi.comClearFake payload delivery domain (confidence level: 100%)

URLs 25

  • http://qaqgkowgjgfao.yougriddonaldsfile.com/s/psc4/pr?clUnknown malware payload delivery URL (confidence level: 75%)
  • https://qaqgkowgjgfao.yougriddonaldsfile.com/d/caniUnknown malware payload delivery URL (confidence level: 75%)
  • https://qaqgkowgjgfao.yougriddonaldsfile.com/s/psc4?clUnknown malware payload delivery URL (confidence level: 75%)
  • https://pub-1f5a501a59d74a6a97e77126cf1fc526.r2.dev/ohijfalqvzldlhaqw.exeUnknown malware payload delivery URL (confidence level: 75%)
  • http://192.162.199.186/zpzp/get.phpStealc botnet C2 (confidence level: 100%)
  • http://27.215.126.152:33758/mozi.aMozi payload delivery URL (confidence level: 75%)
  • https://2.26.96.192/uploadUnknown malware botnet C2 (confidence level: 50%)
  • http://2.26.252.48:8080/gate/handshakeUnknown malware botnet C2 (confidence level: 100%)
  • http://2.26.252.48:8080/gate/completeUnknown malware botnet C2 (confidence level: 100%)
  • http://2.26.252.48:8080/gate/chunkUnknown malware botnet C2 (confidence level: 100%)

IP addresses 110

  • 38.207.178.195Aisuru botnet C2 server (confidence level: 100%)
  • 60.247.206.23Cobalt Strike botnet C2 server (confidence level: 100%)
  • 88.216.191.9VShell botnet C2 server (confidence level: 100%)
  • 78.17.93.55Cobalt Strike botnet C2 server (confidence level: 50%)
  • 146.56.195.201Cobalt Strike botnet C2 server (confidence level: 50%)
  • 112.124.44.139VShell botnet C2 server (confidence level: 100%)
  • 47.120.44.195VShell botnet C2 server (confidence level: 100%)
  • 42.51.37.74VShell botnet C2 server (confidence level: 100%)
  • 167.172.188.177Aisuru botnet C2 server (confidence level: 100%)
  • 159.65.136.5Remus botnet C2 server (confidence level: 100%)

Hashes 19

  • 447ead614a3eadc8c5c769ca18947a03865dedfc8e9eb633548ffa3d7e877c7aRevStealer payload (confidence level: 75%)
  • 0f13b40dc73d7a0f46448999cb90db3dae68826c9616bf14c92268d210845b02Unknown malware payload (confidence level: 75%)
  • 3193e4322946e299107786cb6810a3c179879d4b7362250e488c69fd834d4edaUnknown malware payload (confidence level: 75%)
  • 843df3ad51fb7c3d35e6f65545bb710bWarLock payload (confidence level: 100%)
  • dd7f096c647581f6c639e5c3dc7d1e7eWarLock payload (confidence level: 100%)
  • a7fd97ff3685cb971650922c12725e8bWarLock payload (confidence level: 100%)
  • 016802863edd6de4503ffa5d815d90b4WarLock payload (confidence level: 100%)
  • 2bc0e73148e07ade9ea1f2df31ca1c1bWarLock payload (confidence level: 100%)
  • 3c624e9f786189d001dab2649ade0eb9WarLock payload (confidence level: 100%)
  • 66b521a1eccf3b28906299768ee77222WarLock payload (confidence level: 100%)

Description

ThreatFox IOCs for 2026-08-06

Community reviews

Loading reviews…