Skip to main content
IndicatorPublished Updated

ThreatFox IOCs for 2026-09-25

Source ThreatFox MISP Feed

0

TLP:WHITE, disclosure is not limited

Indicators of compromise

Domains 153

  • denise-rennhardkurz.chUnknown malware payload delivery domain (confidence level: 75%)
  • zavuluka.workers.devphp.shin_webshell botnet C2 domain (confidence level: 50%)
  • hudyqiko.workers.devphp.shin_webshell botnet C2 domain (confidence level: 50%)
  • fullhairbydhtclinic.comClearFake payload delivery domain (confidence level: 90%)
  • gandsonscfo.comClearFake payload delivery domain (confidence level: 90%)
  • baxbet.betClearFake payload delivery domain (confidence level: 100%)
  • bwil48h8.baxus.netClearFake payload delivery domain (confidence level: 100%)
  • www.gabriellaponte.com.brClearFake payload delivery domain (confidence level: 90%)
  • bdducts.clickRemus botnet C2 domain (confidence level: 100%)
  • g0flf7f0.jet90betyek.betClearFake payload delivery domain (confidence level: 100%)

URLs 67

  • http://puytrewdv.comUnknown Loader payload delivery URL (confidence level: 100%)
  • http://91.92.43.245/Unknown Loader payload delivery URL (confidence level: 100%)
  • https://pub-22c5fb19472741eba9206c96fcd10f9c.r2.devUnknown Loader payload delivery URL (confidence level: 100%)
  • http://idcool.codes/7zUnknown malware payload delivery URL (confidence level: 90%)
  • https://combeandjasper.com/mxIClickFix payload delivery URL (confidence level: 100%)
  • https://172.236.209.126Vidar botnet C2 (confidence level: 100%)
  • https://marioopy.site:7443/Unknown malware botnet C2 (confidence level: 100%)
  • http://223.123.73.173:35250/mozi.aMozi payload delivery URL (confidence level: 75%)
  • http://124.29.194.194:43904/mozi.7Mozi payload delivery URL (confidence level: 75%)
  • http://59.103.106.211:60515/mozi.mMozi payload delivery URL (confidence level: 75%)

IP addresses 99

  • 128.90.103.193Remcos botnet C2 server (confidence level: 100%)
  • 217.217.97.60Unknown malware botnet C2 server (confidence level: 100%)
  • 43.156.187.96Remcos botnet C2 server (confidence level: 100%)
  • 176.126.114.42Remcos botnet C2 server (confidence level: 100%)
  • 47.94.56.71Cobalt Strike botnet C2 server (confidence level: 50%)
  • 23.27.143.19Cobalt Strike botnet C2 server (confidence level: 100%)
  • 23.27.143.19Cobalt Strike botnet C2 server (confidence level: 100%)
  • 39.96.15.121VShell botnet C2 server (confidence level: 100%)
  • 168.231.121.175Remus botnet C2 server (confidence level: 100%)
  • 178.128.102.154Nanocore RAT botnet C2 server (confidence level: 100%)

Hashes 82

  • 15f5980c718cda6c5b16ea81cd153ebef15f07a03378594a669395c0d51c64edAMOS payload (confidence level: 100%)
  • 89aad11bff0ba0d654016e4e95b02f6f94b18f01f09475b83b0d983ed0764af2AMOS payload (confidence level: 100%)
  • d3552befdb5519741191cd15d8b6e5109c9f8bba584a4506b3c551253f993474AMOS payload (confidence level: 100%)
  • 6e2c9918a3eee4233cb3058385011fb7c79bf2f801655ff7711174196f1dcb59AMOS payload (confidence level: 100%)
  • bd1b6bed346570b063a14e9f4f7ddf21b19f61dbe1f820e03401fe82c509fd7bAMOS payload (confidence level: 100%)
  • 33cb2391cc0a21681eb67b1b85ce43117641059494c249030be388fa178bbda2AMOS payload (confidence level: 100%)
  • 7243f66e3c28ef7d20a2ab34b30c577fe6f1f4273145a3379be7d3b9fea625a1AMOS payload (confidence level: 100%)
  • f91311823973108b313e941881d0ba501569b59221585b05cb69d2baeba68a74AMOS payload (confidence level: 100%)
  • ef3bec3fc56611025ea5c9e67197f70f8f9d625b3b08eaea7c444f7285264badAMOS payload (confidence level: 100%)
  • 84f4626d2e929200c7bef5f68dc1d1a6dd0d7b9758488c1ff8713b5b4822da47VShell payload (confidence level: 95%)

Description

ThreatFox IOCs for 2026-09-25

Community reviews

Loading reviews…