Skip to main content
IndicatorPublished Updated

ThreatFox IOCs for 2026-09-21

Source ThreatFox MISP Feed

0

TLP:WHITE, disclosure is not limited

Indicators of compromise

Domains 130

  • snalspisa.comClearFake payload delivery domain (confidence level: 90%)
  • keirachenergy.comClearFake payload delivery domain (confidence level: 90%)
  • obranuevaenvigo.comClearFake payload delivery domain (confidence level: 90%)
  • takeactioncanada.caClearFake payload delivery domain (confidence level: 90%)
  • uhcjxoth.infinityjoespizzaclearwater.comClearFake payload delivery domain (confidence level: 100%)
  • zuffereypartner.chClearFake payload delivery domain (confidence level: 90%)
  • site.i-bsi.comClearFake payload delivery domain (confidence level: 90%)
  • ogins74273.workers.devphp.shin_webshell botnet C2 domain (confidence level: 50%)
  • ulgdmdtp.en-en--cardioslim.comClearFake payload delivery domain (confidence level: 100%)
  • skaedbraearaquiet.lifeIClickFix botnet C2 domain (confidence level: 100%)

URLs 60

  • http://178.160.10.203:35090/mozi.mMozi payload delivery URL (confidence level: 75%)
  • http://72.255.19.51:42035/mozi.aMozi payload delivery URL (confidence level: 75%)
  • http://192.25.102.246:8088/?h=192.25.102.246&p=8088&t=tcp&a=l64&stage=trueSNOWLIGHT payload delivery URL (confidence level: 95%)
  • https://pcmastertools.pages.dev/downloads/systech-pc-master-tools-v1.0.0-x64.exeUnknown malware payload delivery URL (confidence level: 80%)
  • https://192.236.217.110/83/goodthings.htaRemcos payload delivery URL (confidence level: 90%)
  • http://45.13.186.37/noncrypt/21-32/bjbh.exeStealc payload delivery URL (confidence level: 95%)
  • http://45.13.186.37/noncrypt/21-32/jhgkuyyg.exeStealc payload delivery URL (confidence level: 95%)
  • https://i.131422.com/Unknown malware payload delivery URL (confidence level: 90%)
  • http://139.95.24.51:8081/?h=139.95.24.51&p=8081&t=ws&a=l32&stage=trueMirai payload delivery URL (confidence level: 95%)
  • https://qingkong-3ax.pages.dev/download/qingkong.zipUnknown malware payload delivery URL (confidence level: 75%)

IP addresses 106

  • 167.71.45.235Aisuru botnet C2 server (confidence level: 100%)
  • 176.65.148.10Unknown malware botnet C2 server (confidence level: 50%)
  • 176.65.148.10Unknown malware botnet C2 server (confidence level: 50%)
  • 46.101.36.181Aisuru botnet C2 server (confidence level: 100%)
  • 46.101.36.181Aisuru botnet C2 server (confidence level: 100%)
  • 209.38.218.95Aisuru botnet C2 server (confidence level: 100%)
  • 165.154.227.8XMRIG botnet C2 server (confidence level: 85%)
  • 165.154.162.74XMRIG botnet C2 server (confidence level: 85%)
  • 95.220.193.183Payload botnet C2 server (confidence level: 80%)
  • 79.36.29.167Payload botnet C2 server (confidence level: 80%)

Hashes 98

  • a2da9aba412172006b2ba30e2168ec030dabcdf8c46e6895ffba1c26834251a6AMOS payload (confidence level: 100%)
  • 382a3e22d91b93c67de463fde451870620e661b8e96f40a4ece80a2d3543a03fAMOS payload (confidence level: 100%)
  • 46407ed93cc6d2564ba5e8a8153b8b8eba117a0cad6bcf483c0c77a26dccb4feNanocore RAT payload (confidence level: 95%)
  • d6beb4f1de9f7cdef083adba4976b110c23e4639Nanocore RAT payload (confidence level: 95%)
  • 21415970e147eadf140c5a1f39ce3ae3Nanocore RAT payload (confidence level: 95%)
  • 13780881bc2e0adda3cb1b686259c963d41537a4797971c80dade56a2eebeb4bVShell payload (confidence level: 95%)
  • ab8aeb201118528cc64080dfd38cf54988303ab5VShell payload (confidence level: 95%)
  • 750982fbe12927c7374b27e0ee0660fcVShell payload (confidence level: 95%)
  • cac0fb12386631685cff542e642b1045c208a59b85f369ffbe53d5c401c5e449Nanocore RAT payload (confidence level: 95%)
  • ba4d1f66ecd35e0b4edb6fd9fc12f85402439a11Nanocore RAT payload (confidence level: 95%)

Description

ThreatFox IOCs for 2026-09-21

Community reviews

Loading reviews…