Public IOC feed / Malware

Malware

Malware samples, and the hosts that serve malicious payloads, loaders and staged configuration.

1,437 high-confidence indicators from the last 30 days of security reporting. Free, refreshed hourly, no login, CC-BY.

Files

• feed.json everything, with reasons and sources
• domains.txt 167 domains, one per line
• domains.csv with metadata
• ips.txt 66 IPs, one per line
• ips.csv with metadata
• hashes.txt 1,204 hashes, one per line
• hashes.csv with metadata
• RSS new indicators

With an API key: /api/public/v1/iocs/feed?category=malware. API reference

Newest indicators

Showing 100 of 1,437.

• 2ff2945b13a4cd0e9a65c85af29ea1539e162a516466c0de682dbf9f8a4000b1 sha256, 5 Nov

  Hash of a malicious backdoor delivered to targets Source

• 199.19.77.84 ipv4, 4 Nov

  Identified as the operator's IP with confirmed malicious activity Source

• cyberleek.click domain, 4 Nov

  Domain used to distribute malware and demand cryptocurrency payments. Source

• gta6cyberleek.com domain, 4 Nov

  Domain used to distribute a file flagged as a Trojan. Source

• 03FD832B81DD54D2BF5F610A8FF27856 md5, 4 Nov

  Listed as malware hash. Source

• 19E760EE849EB7C1F100F2B7010A763D md5, 4 Nov

  Listed as malware hash. Source

• 1F3031167F94B166CC7B69376A01C124 md5, 4 Nov

  Listed as malware hash. Source

• 2DD8681DCD218C88D1C78DFE939EC92B md5, 4 Nov

  Listed as malware hash. Source

• 3B79D95F7F7B58C401A3BC79F94EBB52 md5, 4 Nov

  Listed as malware hash. Source

• B1D344C9A1525373BE6A3980FA85A603 md5, 4 Nov

  Listed as malware hash. Source

• E0A92209DD62DAE8460D934DC6B7DDD7 md5, 4 Nov

  Listed as malware hash. Source

• 11A6DF1E15663AE89F59A9E598AE8987F42A632B sha1, 4 Nov

  Listed as malware hash. Source

• 173DD4190740B96F6F733C801B6428ED4B52B607 sha1, 4 Nov

  Listed as malware hash. Source

• 2CC0425A90A39AC4EEDADD59CAAAFAD5B50F8420 sha1, 4 Nov

  Listed as malware hash. Source

• 3449A349B6C8045B16DF4F88D58C65C2BDF891BB sha1, 4 Nov

  Listed as malware hash. Source

• 7AB7FFE4C233A4F2440F0FDEB2E117C788792281 sha1, 4 Nov

  Listed as malware hash. Source

• A195810C41F401C4B48CB557CF8CE60C2D807025 sha1, 4 Nov

  Listed as malware hash. Source

• B194A997C9A653134BDB1F2D0C3137DCDACB54D5 sha1, 4 Nov

  Listed as malware hash. Source

• B370B674CE877B9C0A7708C7834AEB7EDA983564 sha1, 4 Nov

  Listed as malware hash. Source

• C41B4E11E6A9E3B53DA1F92B213DE9F65A825C92 sha1, 4 Nov

  Listed as malware hash. Source

• E90D2730F3354FF1ADF334B03C95EAC3207D47B9 sha1, 4 Nov

  Listed as malware hash. Source

• 2B6CDAFDFE427A3DE1A94A8A2CA1F09FC4C8F90E4F59089FD9B35B73185ED01C sha256, 4 Nov

  Listed as malware hash. Source

• 3BD3B300F3278520819A06D0CB1F0EADBF946DBBC11352538246FF075EB427F1 sha256, 4 Nov

  Listed as malware hash. Source

• 5CBB64375636E83B5F17D6083633CECC02E2A5F4168CD7CCA5CDEE36CCCA9B38 sha256, 4 Nov

  Listed as malware hash. Source

• 6634339B813E6105B5138DE6AB67B016B8DFBF49233C29DE9BAB3207E8B50D24 sha256, 4 Nov

  Listed as malware hash. Source

• 6932a20ac61fd3f93d7cfee414f6f46834068ac7c9ca011b054a6a10dc56b3d1 sha256, 4 Nov

  Listed in a table of hashes as a malware sample. Source

• 7462CE2595119C928CF516EC33148DC2A39DD9F71636A5C849C7ED93B7C5CA06 sha256, 4 Nov

  Listed as malware hash. Source

• 795594AD5E6F2868CC4D8ED12DABF4F3999A1477C6B250527C5EDE9A98528FB9 sha256, 4 Nov

  Listed as malware hash. Source

• A53D756F28457B1C4A239C91CDEC8ED7B7DA67A93E332E6DF9621CBEF8417474 sha256, 4 Nov

  Listed as malware hash. Source

• D9DB5CBC193DDAF4C0A265804FDEF70C32451DAAF2974FA9ADF52CE1DEFAC5F7 sha256, 4 Nov

  Listed as malware hash. Source

• DC666E9C148BBCA5E21D8C9A97143575C075F53360F135E0191AED9E8278D396 sha256, 4 Nov

  Listed as malware hash. Source

• gfun.top domain, 4 Nov

  Listed as a DarkVigil bootstrap domain. Source

• sogou-cdn.com domain, 4 Nov

  Used as a staging server for delivering malicious configurations. Source

• dev.soft-png-cdn.com domain, 4 Nov

  Identified as a staging server used for DNS hijacking to deliver malicious configurations. Source

• 51068e96d5cc21002b618c02bd5853520d73cb6451383e4094a70ea055251d5a sha256, 4 Nov

  Listed as a file hash in a malware analysis context. Source

• 45.194.90.57 ipv4, 3 Nov

  Used to download a payload in the attack process Source

• 112.121.185.218 ipv4, 4 Nov

  IP address identified as hosting attacker infrastructure Source

• 89.127.233.127 ipv4, 4 Nov

  Listed as an attacker IP that was shut down Source

• 43.175.144.148 ipv4, 4 Nov

  IP address served modified malicious file Source

• 43.175.145.181 ipv4, 4 Nov

  IP address served modified malicious file Source

• 89.126.250.172 ipv4, 4 Nov

  Listed as an attacker IP used until a specific date Source

• 2f2aac505f486067af6831d6c75ea74df63acb1ed4e4002709c5962c68bd9203 sha256, 4 Nov

  Hash of a modified malicious file Source

• 3aaafbd612f04501a6fdb0bb8b2f8a87796223e5584ac18ea5eb180feeafb193 sha256, 4 Nov

  Hash of a modified malicious file Source

• ad111858f73ef39e955ea4a6cdc83d92b53d5ca0248a94095ff0448c7b147e29 sha256, 3 Nov

  Identified as a secondary credential-harvesting payload hash Source

• 2bedc26d4b29b435c21962beed7db21188a0219a0d28334bba8b4fb1656d7b15 sha256, 3 Nov

  Listed as a dropper in the threat report Source

• 2fe2dd402ee6f9c578fce6dd4b36daaa407e99133e5dd502f2afca80feb60150 sha256, 3 Nov

  Listed as a file indicator in the threat report Source

• 4435fcd6862921092614dbeaa880e4192352984686ebcd98f0ba13ee8e226ef9 sha256, 3 Nov

  Listed as a file indicator in the threat report Source

• 4925bcca085ec504f51191645da278d8e96698d91f3c6df44146336c697b4de8 sha256, 3 Nov

  Listed as a file indicator in the threat report Source

• 652508a9cf40bee883dc0e5e219dfeba71fe7dac591d01c89f74c21f73b4963f sha256, 3 Nov

  Listed as a Rekoobe-based backdoor in the threat report Source

• 7e667ba5f9df912e02275d3cfe3809d16f822fe776f4035c84b118ebd925b1b5 sha256, 3 Nov

  Listed as a file indicator in the threat report Source

• 925c041807d4fb9dfe2ad84f963c2a4c60ea1289f6a0bdccbfb944478ffc2cf2 sha256, 3 Nov

  Listed as a file indicator in the threat report Source

• a37ea9897221d4495b538de72b74f2aa1d2ff09b7b6dcedd395aee58931adbf3 sha256, 3 Nov

  Listed as a file indicator in the threat report Source

• a4379e115d3c4420f5d4b92561022d6e0897990e7297be65c033d47de68e6a6a sha256, 3 Nov

  Listed as a file indicator in the threat report Source

• a65048eb30661e27f8edc2dd8d8c77ec87faec1f1750f6e04e7ecaf069a32858 sha256, 3 Nov

  Listed as a file indicator in the threat report Source

• a6f3b7f932761fb1fd5e74123f2482e36c65dd13e769af2ce08c65da195bfa7a sha256, 3 Nov

  Listed as a BPFDoor sample in the threat report Source

• bf8135f46ecedfe5bd06fcecbb2e721c2367ff765b18f4aa3f868e6597f49e47 sha256, 3 Nov

  Listed as a file indicator in the threat report Source

• analysis.shixunsuda.com domain, 2 Nov

  Listed as a command and control server for XCPE Source

• anyevonline.com domain, 2 Nov

  Used for initial bootstrap, registration, and configuration by malware Source

• collection.shixunsuda.com domain, 2 Nov

  Listed as a command and control server for XCPE Source

• edisajalsjfdfh.shop domain, 2 Nov

  Listed as part of the command and control infrastructure Source

• geo-loadbalanced.com domain, 2 Nov

  Listed as part of the command and control infrastructure Source

• haimnsgsjhansj.shop domain, 2 Nov

  Listed as part of the command and control infrastructure Source

• hiddeninplainsight.top domain, 2 Nov

  Listed as part of the command and control infrastructure Source

• ishuoabh3years.online domain, 2 Nov

  Listed as part of the command and control infrastructure Source

• jaguar-distributor.logreporter.com domain, 2 Nov

  Listed as part of the command and control infrastructure Source

• jaguar-distributor.syslogcollector.com domain, 2 Nov

  Listed as part of the command and control infrastructure Source

• 219.134.163.210 ipv4, 2 Nov

  Used as a host for MQTT broker in the campaign Source

• 219.134.163.211 ipv4, 2 Nov

  Used as a host for MQTT broker in the campaign Source

• 3768f470934a111f1c3e3d098eb1392a3cb6f3e298ef5fd2a6309e6a98ee1e18 sha256, 2 Nov

  Listed as a representative SHA256 hash of malicious software Source

• 42be8f18d6006ca092de191331d38e70a0d8383db701a759466dec59a0986135 sha256, 2 Nov

  Listed as a representative SHA256 hash of malicious software Source

• 4f860efa8d8b9b8f35f343d524500181607a0cdc9fac35394cf16b71ff4ad1d0 sha256, 2 Nov

  Listed as a representative SHA256 hash of malicious software Source

• 701f57169f3968bf412d33ec09fa6f2c11ece632aed9f44efa38eaf4fa2e08c6 sha256, 2 Nov

  ELF binary dropped by com.abc.nexus Source

• 742b7ad8b95d4e0784c914f2b84706124f5a86a404e0fd479a0a97a784c2bb9e sha256, 2 Nov

  ELF binary dropped by com.abc.nexus Source

• 7830ce3c3222dd9b25a77a16116dcf832a24b4b9a0bc998501e12415a828fb42 sha256, 2 Nov

  Listed as a representative SHA256 hash of malicious software Source

• 9e18c113eb8d2ba813199c7f90e26d80af3124d871fc31eea7253319a8406e8e sha256, 2 Nov

  ELF binary dropped by com.abc.nexus, indicating attacker control Source

• b3690b3b013ac60752a6d05c3f53ea1f3e844d4603c5b90d258a30c596d0691b sha256, 2 Nov

  Anti-analysis binary spawned via NexusApplication.onCreate, indicating attacker control Source

• ebcca22b96f7a30ae155efa2f25af29a369c6e9cfc99cb3bb0b72f35bc5528ed sha256, 2 Nov

  Listed in a table of representative SHA256 hashes as an IOC Source

• 0d58616c750fc8530a7e90eee18398ddedd08cc0f4908c863ab650673b9819dd sha256, 3 Nov

  Listed as a file hash from the infection in a malware analysis. Source

• 63810ee8b478575f3b2c6c46160c1fd338b213c6fc11bb0069dac9bbb7db237d sha256, 3 Nov

  Listed as a file hash from the infection in a malware analysis. Source

• 86d0c50cab4f394c58976c44d6d7b67a7dfbbb813fbcf622236e183d94fd944f sha256, 3 Nov

  Listed as a file hash from the infection in a malware analysis. Source

• a4fcfecc5ac8fa57614b23928a0e9b7aa4f4a3b2b3a8c1772487b46277125571 sha256, 3 Nov

  Listed as a file hash from the infection in a malware analysis. Source

• icagllmbt.space domain, 3 Nov

  Registered by attacker for malware delivery Source

• file.anyevonline.com domain, 2 Nov

  Hosts backdoors and other malicious files Source

• felixfuturenext.com domain, 2 Nov

  Domain used in phishing and malware attacks Source

• gomescareerplans.com domain, 2 Nov

  Domain used in attack chain for malware delivery Source

• techtalkhelp.com domain, 2 Nov

  Domain used for staging and command updates Source

• 411c0b9a2f98b927d806a685faf0c1ab1005647b4816157008892347fb88546b sha256, 2 Nov

  SHA256 hash listed as malware sample Source

• 569a21b519aaac8c92f653d708ab6ef34e3f38ea967f47e041d1e2425f6a4b33 sha256, 2 Nov

  SHA256 hash listed as malware sample Source

• a3081df333ca7f18bd90d10a45125ab5011dcf9d2806feae2935f09cab07da4c sha256, 2 Nov

  SHA256 hash listed among malware samples Source

• ccefbdec2718d864d9d33c743aabfcef88a8d7904d1c598bfcf15cf5f3591c88 sha256, 2 Nov

  SHA256 hash listed among malware samples Source

• e3992f8c945b0761242377cba32d91b0a390c7cecd79478439843d93e6d2b76b sha256, 2 Nov

  SHA256 hash listed among malware samples Source

• starkmeet.com domain, 2 Nov

  Used for fake videoconferencing application leading to malware execution. Source

• mfakuwait.online domain, 2 Nov

  Used for credential phishing and malware delivery. Source

• moelcloud.online domain, 2 Nov

  Used for credential phishing and malware delivery. Source

• stark-meet.com domain, 2 Nov

  Domain used for a fake videoconferencing application delivering malware. Source

• stark-meet.online domain, 2 Nov

  Domain used for a fake videoconferencing application delivering malware. Source

• stark-meet.website domain, 2 Nov

  Domain used for a fake videoconferencing application delivering malware. Source

• 0135b69bab304564628488829b825050d1dd6dab98e86ec6776839dac9365af9 sha256, 2 Nov

  Listed as a representative SHA256 hash of malicious software Source

• 01b8c78f5509119b3e27ea4d628048985b94b5e00db0431d843519cf1d3e2cde sha256, 2 Nov

  Listed as a representative SHA256 hash of malicious software Source

• 02490fa9f472ec872723d64d03402967e77932d2df72c588b0d7a7df9e17ae62 sha256, 2 Nov

  Listed as a representative SHA256 hash of malicious software Source

Think one of these is wrong? Email [email protected].