Skip to main content
IndicatorPublished Updated

ThreatFox IOCs for 2026-09-10

Source ThreatFox MISP Feed

0

TLP:WHITE, disclosure is not limited

Indicators of compromise

Domains 146

  • api.vexxuhq.siteUnknown Stealer botnet C2 domain (confidence level: 100%)
  • logm-justia.comUnknown malware payload delivery domain (confidence level: 80%)
  • ssospace.netUnknown malware payload delivery domain (confidence level: 80%)
  • netstreamplus.comUnknown malware payload delivery domain (confidence level: 80%)
  • csswaytech.netUnknown malware payload delivery domain (confidence level: 80%)
  • okuneva.sbsKongTuke payload delivery domain (confidence level: 100%)
  • regions.globalcargonetwork.comFAKEUPDATES botnet C2 domain (confidence level: 100%)
  • bociljp.uk.comClearFake payload delivery domain (confidence level: 100%)
  • digitaltechparis.comClearFake payload delivery domain (confidence level: 100%)
  • yzegs5gy.digitaltechparis.comClearFake payload delivery domain (confidence level: 100%)

URLs 63

  • https://vexxuhq.site/pathsUnknown Stealer botnet C2 (confidence level: 100%)
  • https://api.vexxuhq.site/send-embedUnknown Stealer botnet C2 (confidence level: 100%)
  • https://api.vexxuhq.site/send-embed-viewerUnknown Stealer botnet C2 (confidence level: 100%)
  • https://api.vexxuhq.site/download/Unknown Stealer payload delivery URL (confidence level: 100%)
  • https://gunbuyerclub.comUnknown malware payload delivery URL (confidence level: 80%)
  • https://notion-brown.com/4qx0lb/tm/oppeUnknown malware payload delivery URL (confidence level: 80%)
  • http://178.198.246.24/photo.scrUnknown malware payload delivery URL (confidence level: 85%)
  • http://177.70.102.232:8070/tmpftp/01/recep%c3%a7%c3%a3o/2022-09-05/info.zipUnknown malware payload delivery URL (confidence level: 75%)
  • https://178.16.52.221/bin/screenconnect.clientsetup.exeUnknown malware payload delivery URL (confidence level: 85%)
  • http://95.62.202.150:10071/sshdUnknown malware payload delivery URL (confidence level: 85%)

IP addresses 120

  • 167.172.71.91Aisuru botnet C2 server (confidence level: 100%)
  • 45.138.16.54Unknown Stealer botnet C2 server (confidence level: 100%)
  • 45.138.16.54Unknown Stealer botnet C2 server (confidence level: 100%)
  • 45.138.16.54Unknown Stealer botnet C2 server (confidence level: 100%)
  • 161.35.166.196Aisuru botnet C2 server (confidence level: 100%)
  • 103.148.58.43Aisuru botnet C2 server (confidence level: 100%)
  • 161.35.166.196Aisuru botnet C2 server (confidence level: 100%)
  • 154.91.60.113VShell botnet C2 server (confidence level: 100%)
  • 154.91.60.112VShell botnet C2 server (confidence level: 100%)
  • 154.91.61.99VShell botnet C2 server (confidence level: 100%)

Hashes 51

  • cbabe6cb9fd822bb69b271c14952397b4d2a571d9e11e08c26312fad1b158163Venus Stealer payload (confidence level: 95%)
  • 638bb882ff0dba784ecc078c1792706983af0f91Venus Stealer payload (confidence level: 95%)
  • ee12bf94330dbbb5025aae8e1ec908a7Venus Stealer payload (confidence level: 95%)
  • eac635e113733a48d63427369c5456b94ffe8075f447eb6e465157f08ab4c87bPhantom Stealer payload (confidence level: 95%)
  • dddcb764f3af1265392641bbade3632b2f319ab0Phantom Stealer payload (confidence level: 95%)
  • 41c524a1390a872f207f17a08b443a72Phantom Stealer payload (confidence level: 95%)
  • fc8f02c2dbb35322152f330c0b872bb71ea30d4a74472734531e60de9f2454efPhantom Stealer payload (confidence level: 95%)
  • ce147e4941248647e59168df4e92e0331416aa0dPhantom Stealer payload (confidence level: 95%)
  • 7ea1ac9405b7ffcb6c087e3b65d1462aPhantom Stealer payload (confidence level: 95%)
  • cc3417c2cdd3d0a9897528f1229f8649fa7313b348f887aba05173e6542b3e14KrakenKeylogger payload (confidence level: 95%)

Description

ThreatFox IOCs for 2026-09-10

Community reviews

Loading reviews…