Skip to main content
IndicatorPublished Updated

ThreatFox IOCs for 2026-08-12

Source ThreatFox MISP Feed

0

TLP:WHITE, disclosure is not limited

Indicators of compromise

Domains 148

  • psc-io.comUnknown malware payload delivery domain (confidence level: 75%)
  • mathiuu.surfKongTuke payload delivery domain (confidence level: 100%)
  • maletosr.worldClearFake botnet C2 domain (confidence level: 100%)
  • hkzhies.eng--slimsounds.comClearFake payload delivery domain (confidence level: 100%)
  • 7i2syccf.en-energyrevolution.comClearFake payload delivery domain (confidence level: 100%)
  • fcfqwd.keraissentials.comClearFake payload delivery domain (confidence level: 100%)
  • luyzkvh.eng-en-slimsounds.comClearFake payload delivery domain (confidence level: 100%)
  • willof.deClearFake payload delivery domain (confidence level: 90%)
  • 9phu1gul.healthfoodzone.comClearFake payload delivery domain (confidence level: 100%)
  • oygeuk.kerassyntials.comClearFake payload delivery domain (confidence level: 100%)

URLs 40

  • https://mathiuu.surf/api/v1/sessionKongTuke payload delivery URL (confidence level: 100%)
  • https://mathiuu.surf/api/v1/verifyKongTuke payload delivery URL (confidence level: 100%)
  • http://39.34.167.77:45582/mozi.7Mozi payload delivery URL (confidence level: 75%)
  • http://103.82.121.89:34590/mozi.mMozi payload delivery URL (confidence level: 75%)
  • http://39.65.92.172:50865/mozi.mMozi payload delivery URL (confidence level: 75%)
  • http://beljaro.shop:2536/reportsRemus botnet C2 (confidence level: 75%)
  • http://tokjoza.shop:5200/reviewsRemus botnet C2 (confidence level: 75%)
  • http://topxgax.click:4930/eventsRemus botnet C2 (confidence level: 75%)
  • http://tokjoza.shop:5200/subscriptionsRemus botnet C2 (confidence level: 75%)
  • http://beljaro.shop:2536/webhooksRemus botnet C2 (confidence level: 75%)

IP addresses 85

  • 89.127.233.194Unknown malware botnet C2 server (confidence level: 100%)
  • 176.149.202.136AsyncRAT botnet C2 server (confidence level: 100%)
  • 159.75.123.199Cobalt Strike botnet C2 server (confidence level: 100%)
  • 159.75.123.199Cobalt Strike botnet C2 server (confidence level: 100%)
  • 159.75.123.199Cobalt Strike botnet C2 server (confidence level: 100%)
  • 8.130.55.42VShell botnet C2 server (confidence level: 100%)
  • 180.76.105.117VShell botnet C2 server (confidence level: 100%)
  • 106.75.178.185VShell botnet C2 server (confidence level: 100%)
  • 142.4.58.48VShell botnet C2 server (confidence level: 100%)
  • 121.89.169.8VShell botnet C2 server (confidence level: 100%)

Hashes 142

  • 554c2e2d6f9cf520e85640600ac90f9a0d3860019f66178ca1f07012f1fc5961ClearFake payload (confidence level: 90%)
  • ed44c0375058d416da981d3cb3cf9ca4fb5e506c36a2082a0b20ade834e1cbc1Vidar payload (confidence level: 95%)
  • 05e65d358f84b7efcb9ffc9487b0b25ef4ef7456Vidar payload (confidence level: 95%)
  • 7a933fff468a55cfe086b1939080127dVidar payload (confidence level: 95%)
  • 4fa823c4439a01bd37c1184ba6e8d694cdef5dd77c074cbbadb2b9da0f8d4aa8Vidar payload (confidence level: 95%)
  • b93550fbce182cce074924decdb90156f9e0b132Vidar payload (confidence level: 95%)
  • 72bc2cd086ffc02895ba73b2cd814588Vidar payload (confidence level: 95%)
  • f02beda33cb97340412881e0805c32580be96de246afd46bac6b75562087ff0dCoinminer payload (confidence level: 95%)
  • 56784228c6253277a808b3e8404e2f43c6647f1dCoinminer payload (confidence level: 95%)
  • dd7cfd448f8fc48232a1a6576ee1fc14Coinminer payload (confidence level: 95%)

Description

ThreatFox IOCs for 2026-08-12

Community reviews

Loading reviews…