Skip to main content
IndicatorPublished Updated

ThreatFox IOCs for 2026-09-16

Source ThreatFox MISP Feed

0

TLP:WHITE, disclosure is not limited

Indicators of compromise

Domains 135

  • time.austriaeast.cloudapp.azure.comEtherRAT botnet C2 domain (confidence level: 75%)
  • timesync.westus2.cloudapp.azure.comEtherRAT botnet C2 domain (confidence level: 75%)
  • zigbee.eastus.cloudapp.azure.comEtherRAT botnet C2 domain (confidence level: 75%)
  • zigfree.eastus.cloudapp.azure.comEtherRAT botnet C2 domain (confidence level: 75%)
  • welcome.v-panel.asiaVidar botnet C2 domain (confidence level: 100%)
  • isomnia.plIClickFix payload delivery domain (confidence level: 100%)
  • babullies.liveUnknown RAT botnet C2 domain (confidence level: 75%)
  • nelson47.comUnknown RAT botnet C2 domain (confidence level: 75%)
  • jackiewhitfield.comUnknown RAT botnet C2 domain (confidence level: 75%)
  • mrsls88.comUnknown RAT botnet C2 domain (confidence level: 75%)

URLs 82

  • https://104.253.18.206Vidar botnet C2 (confidence level: 100%)
  • https://time.austriaeast.cloudapp.azure.comEtherRAT botnet C2 (confidence level: 75%)
  • https://timesync.westus2.cloudapp.azure.comEtherRAT botnet C2 (confidence level: 75%)
  • https://zigbee.eastus.cloudapp.azure.comEtherRAT botnet C2 (confidence level: 75%)
  • https://zigfree.eastus.cloudapp.azure.comEtherRAT botnet C2 (confidence level: 75%)
  • https://welcome.v-panel.asia/Vidar botnet C2 (confidence level: 100%)
  • https://217.60.98.234Vidar botnet C2 (confidence level: 100%)
  • https://statpipeplus.com/get_verifyUnknown malware payload delivery URL (confidence level: 80%)
  • https://ingestdot.netUnknown malware payload delivery URL (confidence level: 80%)
  • https://tracewaytech.com/get_verifyUnknown malware payload delivery URL (confidence level: 80%)

IP addresses 100

  • 46.101.169.198Aisuru botnet C2 server (confidence level: 100%)
  • 204.44.69.231Remcos botnet C2 server (confidence level: 100%)
  • 204.44.69.231Remcos botnet C2 server (confidence level: 100%)
  • 204.44.69.231Remcos botnet C2 server (confidence level: 100%)
  • 123.60.142.164Cobalt Strike botnet C2 server (confidence level: 100%)
  • 123.60.142.164Cobalt Strike botnet C2 server (confidence level: 100%)
  • 123.60.142.164Cobalt Strike botnet C2 server (confidence level: 100%)
  • 156.239.224.131Cobalt Strike botnet C2 server (confidence level: 50%)
  • 42.193.227.214Cobalt Strike botnet C2 server (confidence level: 50%)
  • 123.60.142.164Cobalt Strike botnet C2 server (confidence level: 100%)

Hashes 84

  • ec9d65250ddb2195103381f7662ab1d370bbb84aee2b35384ffd4bb69d28177bWannaCryptor payload (confidence level: 95%)
  • d3bcbb06dfb6f58c7a2d895ea75a2fd72226f1acWannaCryptor payload (confidence level: 95%)
  • 0d22029ef7b53677ce81e46aa38be8bdWannaCryptor payload (confidence level: 95%)
  • ea8e565ccaf2d39932858c6156819e2fa23eb23a7aa06f2c1d3ae33c0ad68718WannaCryptor payload (confidence level: 95%)
  • e8ccaf9da9ffb15c251916b8b453bb519c3d8558WannaCryptor payload (confidence level: 95%)
  • e37fc2c689b56a5d66076c335cce334aWannaCryptor payload (confidence level: 95%)
  • 6659054e7fdce5a34a040bd0c730db06ceda0a72b3c6d75dc4a17de3fdc19d2cCoinminer payload (confidence level: 95%)
  • c936f817a52a88caac0dd89c51668ff35ea8f647Coinminer payload (confidence level: 95%)
  • b99701d7d09a46bbd40fc1b778c751feCoinminer payload (confidence level: 95%)
  • e9d7cf3afe8cf7cbf806e39ce528648ea9bb5aa64b0d1b2fc4d2ec3fe92f294bWannaCryptor payload (confidence level: 95%)

Description

ThreatFox IOCs for 2026-09-16

Community reviews

Loading reviews…