Skip to main content
IndicatorPublished Updated

ThreatFox IOCs for 2026-09-11

Source ThreatFox MISP Feed

0

TLP:WHITE, disclosure is not limited

Indicators of compromise

Domains 47

  • ax8ayl1guumv.hellodcuser.comHades botnet C2 domain (confidence level: 100%)
  • 45vpt6bf8rlh.hellodcuser.comHades botnet C2 domain (confidence level: 100%)
  • kw0lwdvgqq1e.hellodcuser.comHades botnet C2 domain (confidence level: 100%)
  • amigo.mexicocentral.cloudapp.azure.comEtherRAT botnet C2 domain (confidence level: 100%)
  • bool.eastasia.cloudapp.azure.comEtherRAT botnet C2 domain (confidence level: 100%)
  • cmhometextil.comClearFake payload delivery domain (confidence level: 90%)
  • sophieslade.comClearFake payload delivery domain (confidence level: 90%)
  • n508kaap.xenburn.usClearFake payload delivery domain (confidence level: 100%)
  • mail.macroad.itClearFake payload delivery domain (confidence level: 90%)
  • solardasaguas.com.brClearFake payload delivery domain (confidence level: 90%)

URLs 5

  • http://223.123.43.245:42794/mozi.7Mozi payload delivery URL (confidence level: 75%)
  • http://102.33.43.241:42381/mozi.7Mozi payload delivery URL (confidence level: 75%)
  • http://175.107.205.230:39941/mozi.7Mozi payload delivery URL (confidence level: 75%)
  • http://153.117.68.124:36913/mozi.mMozi payload delivery URL (confidence level: 75%)
  • https://balancasriograndense.com.br/Unknown malware payload delivery URL (confidence level: 90%)

IP addresses 73

  • 167.172.72.46Aisuru botnet C2 server (confidence level: 100%)
  • 154.91.58.114VShell botnet C2 server (confidence level: 100%)
  • 154.91.59.98VShell botnet C2 server (confidence level: 100%)
  • 154.91.60.107VShell botnet C2 server (confidence level: 100%)
  • 154.91.60.100VShell botnet C2 server (confidence level: 100%)
  • 154.91.60.101VShell botnet C2 server (confidence level: 100%)
  • 118.25.100.71Cobalt Strike botnet C2 server (confidence level: 50%)
  • 23.227.196.108Cobalt Strike botnet C2 server (confidence level: 50%)
  • 154.91.60.118VShell botnet C2 server (confidence level: 100%)
  • 154.91.60.123VShell botnet C2 server (confidence level: 100%)

Hashes 303

  • 8a9006cfaee227415eeef0d645183ca423c80b9a8181e35a57bec71468e72daaUnknown malware payload (confidence level: 90%)
  • d66895d8da6d5eb1d8658647c80f66dce40236c06bb600f1c62a44a657f923b3Unknown malware payload (confidence level: 90%)
  • b8f0c82894032766293b7f6e6feaf287a366edd4886b8e665c41bc5103d512ceUnknown Loader payload (confidence level: 90%)
  • 8de1357454488bd0702f0f22e912b412af41d814dffdc7c76f416d75d7dc1dc6Unknown Loader payload (confidence level: 90%)
  • e60b08b9f64d2d74593a081c5cdc9f82efd76af53fd9b42cab5bef3888e1b5abNjRAT payload (confidence level: 95%)
  • e2b6dbb5b5c44863df8e9e79a6c0d0c4d8fe7bfca346335fbfcd4dc6ca5f9010Vidar payload (confidence level: 100%)
  • d53bfb43671e23ef1f925166938a2f4fb28ad163f88e92a26505aa2d56cf8977AsyncRAT payload (confidence level: 90%)
  • 8e11c717fa2e8c37b5f1ed695d8c8e1898d4e1f40a976e79ece0a8f4260fa9b4Unknown Stealer payload (confidence level: 100%)
  • 61321510045ef68e4e20672cb1b130a2632d7b3cb1c3c8348c4c5e300d0d8a19Remcos payload (confidence level: 100%)
  • c964a9c1f74420abb9006a3b2e3738729517eab0c112f8e7f34864878b18fcbeSalatStealer payload (confidence level: 100%)

Description

ThreatFox IOCs for 2026-09-11

Community reviews

Loading reviews…