Skip to main content
IndicatorPublished Updated

ThreatFox IOCs for 2026-09-28

Source ThreatFox MISP Feed

0

TLP:WHITE, disclosure is not limited

Indicators of compromise

Domains 34

  • modulefeedsky.comLorem Ipsum botnet C2 domain (confidence level: 90%)
  • ng.v-panel.asiaVidar botnet C2 domain (confidence level: 100%)
  • lute.bowlinggreenwinnelsonco.comClearFake botnet C2 domain (confidence level: 100%)
  • panel.msdos.ruVidar botnet C2 domain (confidence level: 100%)
  • sm.v-panel.asiaVidar botnet C2 domain (confidence level: 100%)
  • account.msdos.ruVidar botnet C2 domain (confidence level: 100%)
  • www.neos-group.chClearFake payload delivery domain (confidence level: 90%)
  • paulonsolucoesjuridicas.comClearFake payload delivery domain (confidence level: 90%)
  • melbettr.coClearFake payload delivery domain (confidence level: 100%)
  • 521mc6ro.melbettr.coClearFake payload delivery domain (confidence level: 100%)

URLs 23

  • https://www.letsdiskuss.com/user/josephyoung69070Lorem Ipsum botnet C2 (confidence level: 90%)
  • https://ng.v-panel.asia/Vidar botnet C2 (confidence level: 100%)
  • https://panel.msdos.ru/loginVidar botnet C2 (confidence level: 100%)
  • http://156.251.16.131:8084/?h=156.251.16.131&p=8084&t=tcp&a=w64&stage=trueVShell payload delivery URL (confidence level: 95%)
  • http://156.251.16.131:8084/?h=156.251.16.131&p=8084&t=ws&a=w64&stage=trueVShell payload delivery URL (confidence level: 95%)
  • http://156.251.16.136:8084/?h=156.251.16.136&p=8084&t=tcp&a=w64&stage=trueVShell payload delivery URL (confidence level: 95%)
  • http://66.179.30.146:443/?h=66.179.30.146&p=443&t=tcp&a=w32&stage=trueUnknown Loader payload delivery URL (confidence level: 85%)
  • http://154.211.86.169:40000/?h=154.211.86.169&p=40000&t=ws&a=w64&stage=trueVShell payload delivery URL (confidence level: 95%)
  • http://66.179.30.146:443/?h=66.179.30.146&p=443&t=ws&a=w64&stage=trueUnknown Loader payload delivery URL (confidence level: 85%)
  • https://sm.v-panel.asia/Vidar botnet C2 (confidence level: 50%)

IP addresses 8

  • 31.77.78.43NonEuclid RAT botnet C2 server (confidence level: 100%)
  • 130.49.190.185Potassium botnet C2 server (confidence level: 100%)
  • 64.176.62.60Cobalt Strike botnet C2 server (confidence level: 100%)
  • 64.176.62.60Cobalt Strike botnet C2 server (confidence level: 100%)
  • 188.166.246.245Aisuru botnet C2 server (confidence level: 100%)
  • 168.245.203.124Meterpreter botnet C2 server (confidence level: 50%)
  • 8.134.132.94VShell botnet C2 server (confidence level: 100%)
  • 165.245.184.215Aisuru botnet C2 server (confidence level: 100%)

Hashes 427

  • b9c948ee46b35d13624acd547d21c34096863d63e6f73735bf494042220780b8AMOS payload (confidence level: 100%)
  • e08d62943df1d69416e4a0511a157b1b994577f86a05fb8de4e8f7cb5ece09b3VShell payload (confidence level: 95%)
  • 0026d4ecdb0b8eeda2f86c5d8e4442abb5f6601a8976ae1621a44ecbdc202e4eMirai payload (confidence level: 95%)
  • 1bdabbd4b6ce490592faeaa2f5a45992bb396c52664c8a188aff0955b78a5d75Mirai payload (confidence level: 95%)
  • 5a377ec931f19b8d8848f35dde27211101c7165212309e2065de22a32598506cMirai payload (confidence level: 95%)
  • a49c0e59f6fabdceedeff38b5cb81de008594c6121be1f6316998d83ec48dd1cMirai payload (confidence level: 100%)
  • f1d2bc282a763dd6a096e2facd1fe5ca08b679517c086913be3f8ec5c26a9872AMOS payload (confidence level: 100%)
  • 4cbf9e936c1a19566f2f42cc7e4a96bce640ac47519696242e7ea1271364ab26VShell payload (confidence level: 95%)
  • 9e00b52b02d6e760b7cee84151b4b229e8b8f0b07f014d30f3db41d0b67feb44Coinminer payload (confidence level: 95%)
  • 5e7a1b9857320e185d0dc8724dac6944bfceb01951a03b0f6c99f929020be862Coinminer payload (confidence level: 95%)

Description

ThreatFox IOCs for 2026-09-28

Community reviews

Loading reviews…