Skip to main content
IndicatorPublished Updated

ThreatFox IOCs for 2026-09-19

Source ThreatFox MISP Feed

0

TLP:WHITE, disclosure is not limited

Indicators of compromise

Domains 104

  • lyric-8.comAMOS botnet C2 domain (confidence level: 100%)
  • blueprint-71.comAMOS payload delivery domain (confidence level: 100%)
  • qb51hxxp.burn--flow.comClearFake payload delivery domain (confidence level: 100%)
  • membres.encouplesimone.comClearFake payload delivery domain (confidence level: 90%)
  • img2.aixpirts.comFAKEUPDATES botnet C2 domain (confidence level: 100%)
  • ngso2pi7en.workers.devphp.shin_webshell botnet C2 domain (confidence level: 50%)
  • rycupadi.workers.devphp.shin_webshell botnet C2 domain (confidence level: 50%)
  • 00rr59n2.en-pegasus.comClearFake payload delivery domain (confidence level: 100%)
  • en-us-en-smartwaterbox.comClearFake payload delivery domain (confidence level: 100%)
  • 2gp421dm.en-us-en-smartwaterbox.comClearFake payload delivery domain (confidence level: 100%)

URLs 77

  • https://cik07-cos.7moor-fs2.com/im/4d2c3f00-7d4c-11e5-af15-41bf63ae4ea0/129fd90846a1e173/9221.txtUnknown malware payload delivery URL (confidence level: 100%)
  • https://lyric-8.com/api/metrics/run?event=pastedAMOS botnet C2 (confidence level: 100%)
  • https://lyric-8.com/api/metrics/run?event=stagerAMOS botnet C2 (confidence level: 100%)
  • http://165.232.73.74/api/metrics/runAMOS botnet C2 (confidence level: 100%)
  • https://blueprint-71.com/curl/amtkquxbo3/obh3bn3umykzjlth.jsonAMOS payload delivery URL (confidence level: 100%)
  • https://blueprint-71.com/2kqyrm0dcrnyjgos4gvll_fhjrrdtuhgcbjyuywpz6c/cc2/updateAMOS payload delivery URL (confidence level: 100%)
  • http://202.47.44.156:53119/mozi.mMozi payload delivery URL (confidence level: 75%)
  • http://80.74.30.4:3000/sparky/comfyui-utils.gitxmrig payload delivery URL (confidence level: 100%)
  • http://165.245.138.247:81/private/xmrig-win.zipxmrig payload delivery URL (confidence level: 100%)
  • http://165.245.138.247:81/private/rigel-win.zipxmrig payload delivery URL (confidence level: 100%)

IP addresses 136

  • 193.124.131.235Remcos botnet C2 server (confidence level: 100%)
  • 193.124.131.235Remcos botnet C2 server (confidence level: 100%)
  • 193.124.131.235Remcos botnet C2 server (confidence level: 100%)
  • 193.124.131.235Remcos botnet C2 server (confidence level: 100%)
  • 193.124.131.235Remcos botnet C2 server (confidence level: 100%)
  • 165.232.73.74AMOS botnet C2 server (confidence level: 100%)
  • 106.52.255.211Unknown malware botnet C2 server (confidence level: 100%)
  • 113.45.6.129VShell botnet C2 server (confidence level: 100%)
  • 114.215.190.164VShell botnet C2 server (confidence level: 100%)
  • 43.173.38.253Aisuru botnet C2 server (confidence level: 100%)

Hashes 47

  • a3dabccd14492f4c70658ece96a3ed7b4e275ff9d70c434298bd6f863d1e24b9AMOS payload (confidence level: 100%)
  • 6e753133e537264247a08587d87b30b8d9a96caea1d6cc92d41fc8058073b8f7AMOS payload (confidence level: 100%)
  • 55b8fff6b61ed493f477bac718c37714075d4ff52bc302d28a331def371834b6AMOS payload (confidence level: 100%)
  • dfe96b68cb910deb4e29f41c7525e0cd3a2d1c7234e227cbeee4a9e6d535f95fAMOS payload (confidence level: 100%)
  • 872611186a14d610770b362e3bef2cad071cc211d30c39e2b1a186b35f0294baAMOS payload (confidence level: 100%)
  • 214ab25a265b929cb3a4d4efda395773a87ad0ab0e81fda15c361116921b3f69VShell payload (confidence level: 95%)
  • 4eb12aef549c5c5ef491ebdfe976181e1abbbb922d369f2457f099b8cfbe71e6VShell payload (confidence level: 95%)
  • 332d5b8d228dd3bd8fbae99f6408cdfd424f5e48d7c71b054af84d1df414c94dVShell payload (confidence level: 95%)
  • 4683e6a738b43dbb5d8799bb76e60920f3d684489df1863c5c9cecf7e8e8894dUnknown Loader payload (confidence level: 85%)
  • 1f08e8d9dd5374a4df8ae963daf20928faaeee5985eed99cb741f89fafce62faVShell payload (confidence level: 95%)

Description

ThreatFox IOCs for 2026-09-19

Community reviews

Loading reviews…