Skip to main content
IndicatorPublished Updated

ThreatFox IOCs for 2026-09-15

Source ThreatFox MISP Feed

0

TLP:WHITE, disclosure is not limited

Indicators of compromise

Domains 33

  • enhanced.jeetbot.ccUnknown malware botnet C2 domain (confidence level: 50%)
  • enhanced-1.jeetbot.ccUnknown malware botnet C2 domain (confidence level: 50%)
  • ext-03.jeetbot.ccUnknown malware botnet C2 domain (confidence level: 50%)
  • proxy.morphilina.meUnknown malware botnet C2 domain (confidence level: 50%)
  • ext-styles.jeetbot.ccUnknown malware botnet C2 domain (confidence level: 50%)
  • api.jeetbot.ccUnknown malware botnet C2 domain (confidence level: 50%)
  • img.drisnya.onlineUnknown malware botnet C2 domain (confidence level: 50%)
  • gst.v-panel.asiaVidar botnet C2 domain (confidence level: 100%)
  • sngdtg.cfdUnknown malware payload delivery domain (confidence level: 75%)
  • htawxjwamiw.sngdtg.cfdUnknown malware payload delivery domain (confidence level: 75%)

URLs 16

  • https://sw.qq1x.orgVidar botnet C2 (confidence level: 100%)
  • https://gst.v-panel.asia/Vidar botnet C2 (confidence level: 100%)
  • https://htawxjwamiw.sngdtg.cfd/?pj7ignqk2bi=dxh2zmfyUnknown malware payload delivery URL (confidence level: 75%)
  • http://144.48.132.207:38157/mozi.mMozi payload delivery URL (confidence level: 75%)
  • http://223.29.233.212:53063/mozi.mMozi payload delivery URL (confidence level: 75%)
  • http://42.178.61.190:46830/mozi.mMozi payload delivery URL (confidence level: 75%)
  • https://bo.qq1x.orgVidar botnet C2 (confidence level: 100%)
  • https://bo.177betwin.org/Vidar botnet C2 (confidence level: 100%)
  • http://cruahop.shop:8213/reviewsRemus botnet C2 (confidence level: 75%)
  • http://booohop.shop:5627/workspacesRemus botnet C2 (confidence level: 75%)

IP addresses 48

  • 128.90.122.99Remcos botnet C2 server (confidence level: 100%)
  • 134.209.223.192Aisuru botnet C2 server (confidence level: 100%)
  • 159.203.178.139Aisuru botnet C2 server (confidence level: 100%)
  • 134.209.106.204Aisuru botnet C2 server (confidence level: 100%)
  • 161.35.197.52Aisuru botnet C2 server (confidence level: 100%)
  • 46.101.169.198Aisuru botnet C2 server (confidence level: 100%)
  • 161.35.197.52Aisuru botnet C2 server (confidence level: 100%)
  • 23.254.229.105Hook botnet C2 server (confidence level: 75%)
  • 23.254.229.105Hook botnet C2 server (confidence level: 75%)
  • 134.209.106.204Aisuru botnet C2 server (confidence level: 100%)

Hashes 355

  • 37cbee9242444dffe560c8f2dfefa6ec0ff4bda186824bb5ace22ed8cd486436SalatStealer payload (confidence level: 95%)
  • 74a28581cdc96b69d58c1b2f640c2f3c6932d11eb4b53fb5bf9cf2e89ac30dd4Unknown Loader payload (confidence level: 95%)
  • 052f0caff530a67f9a17df5795806d9b01a551f309e434cd4eb92fba8e024051GCleaner payload (confidence level: 100%)
  • 44ca813f78d95e2ff729a0e0efb4705a2c13a1338d12a4cb7d1a91612c6462dcUnknown malware payload (confidence level: 100%)
  • b9956521c3fb26cfb49791e6c3b29faae02ab8ac12314c2207f4f1301534df90Unknown Loader payload (confidence level: 85%)
  • 2e54785c850529f281f91edd3f90ed866c883dd034bc7053c4068500e5bb0b92Mirai payload (confidence level: 100%)
  • 07bfd97e419f739258c04c8bc976ae6add8bd2936c97471642a759b0b6cc115bMirai payload (confidence level: 100%)
  • ea5784a4389f86bb28ec9ca5fc099b5d4e8791983ce7b66df5c1cf8cb01e5952AsyncRAT payload (confidence level: 75%)
  • ea5a59097ac39f79bb5d6d473f0e9d3f6bd25d25aed087f05fa5549effbd6c6aAsyncRAT payload (confidence level: 75%)
  • ea5ff285c1d683ff3addced76464bb791f31b545a9836bc0b380e02bd70a4179AsyncRAT payload (confidence level: 75%)

Description

ThreatFox IOCs for 2026-09-15

Community reviews

Loading reviews…