🤲🏼 NEW | abuse.ch Community Hub! Earn recognition 🏅 for the malware intelligence you share, climb the leaderboards 📈, and connect with like-minded contributors who share your hunting focus 🤝. Ready to unlock your profile? Go to the Community Hub →

ThreatFox IOC Database

You are browsing the Indicator Of Compromise (IOC) database of ThreatFox. If you would like to contribute IOCs to the corpuse, you can do so through either the web form or the API.


676

IOCs shared (past 24 hours)

Unknown malware

Most seen malware family (past 24 hours)

1'775'413

IOCs in corpus


Using the form below, you can search for malware samples by a hash (MD5, SHA256, SHA1), imphash, tlsh hash, ClamAV signature, tag or malware family.

Browse Database


Search syntax is as follow: keyword:search_term

Following is a list of accepted keywords along with an example search_term

  • ioc:ms-debug-services.com ( run)
  • malware:CobaltStrike ( run)
  • tag:TA505 ( run)
  • threat_type:cc_skimming ( run)
  • uuid:87f310f3-540b-11eb-922c-42010aa4000a ( run)

Date (UTC)IOCMalwareTagsReporter
2026-09-13 13:57https://raw.githubusercontent.com/34-19-44r/80-FCF8F2-DD98/refs/heads/main/48-D0-4E-DE-7 ClearFakeClearFake threatcat_ch
2026-09-10 13:02https://raw.githubusercontent.com/cowenrty/issue/refs/heads/main/left ClearFake MrJota
2026-09-07 06:08https://raw.githubusercontent.com/cowenrty/probing/refs/heads/main/related ClearFakeClearFake threatcat_ch
2026-09-03 21:43https://raw.githubusercontent.com/cowenrty/60-13-96-DA-AA-3C/refs/heads/main/2b ClearFakeClearFake threatcat_ch
2026-09-03 18:12https://raw.githubusercontent.com/cowenrty/thinness/refs/heads/main/explicit ClearFakeClearFake threatcat_ch
2026-09-03 18:01https://raw.githubusercontent.com/frantario/step/refs/heads/main/stimulate ClearFakeClearFake threatcat_ch
2026-09-03 14:23https://raw.githubusercontent.com/frantario/shrapnel/refs/heads/main/rosy ClearFakeClearFake threatcat_ch
2026-09-03 11:43https://raw.githubusercontent.com/frantario/gfyruer/refs/heads/main/djhgjh75034 ClearFakeClearFake threatcat_ch
2026-09-02 23:37https://raw.githubusercontent.com/cowenrty/empathic/refs/heads/main/cornea ClearFakeClearFake threatcat_ch
2026-09-02 23:13https://raw.githubusercontent.com/frantario/cloud/refs/heads/main/situated ClearFakeClearFake threatcat_ch
2026-09-02 16:00https://raw.githubusercontent.com/cowenrty/fidgeting/refs/heads/main/obstacle ClearFakeClearFake threatcat_ch
2026-09-02 14:58https://raw.githubusercontent.com/frantario/nativity/refs/heads/main/landing ClearFakeClearFake threatcat_ch
2026-09-02 11:15https://raw.githubusercontent.com/frantario/tranday/refs/heads/main/ruty4839 ClearFakeClearFake threatcat_ch
2026-09-02 10:46https://raw.githubusercontent.com/frantario/tropa47/refs/heads/main/lytkc14 ClearFakeClearFake threatcat_ch
2026-09-02 09:50https://raw.githubusercontent.com/Loolu2846/ruta3742/refs/heads/main/rita80 ClearFakeClearFake threatcat_ch
2026-09-02 07:16https://raw.githubusercontent.com/cowenrty/retushrem/refs/heads/main/neli ClearFakeClearFake threatcat_ch
2026-09-01 22:18https://raw.githubusercontent.com/snowplow-byte/elective/refs/heads/main/unwieldy ClearFakeClearFake threatcat_ch
2026-09-01 10:49https://raw.githubusercontent.com/moonstone-lgtm/radugawolrd/refs/heads/main/wintar ClearFakeClearFake threatcat_ch
2026-09-01 10:39https://raw.githubusercontent.com/moonstone-lgtm/romana/refs/heads/main/lida486 ClearFakeClearFake threatcat_ch
2026-09-01 10:23https://raw.githubusercontent.com/moonstone-lgtm/romana/refs/heads/main/fds5412 ClearFakeClearFake threatcat_ch
2026-09-01 10:00https://raw.githubusercontent.com/snowplow-byte/coronawins/refs/heads/main/ladywin ClearFakeClearFake threatcat_ch
2026-09-01 03:18https://raw.githubusercontent.com/Kath19634/calcium/refs/heads/main/dissuade ClearFakeClearFake threatcat_ch
2026-08-31 12:48https://raw.githubusercontent.com/Christa6547/davidrun/refs/heads/main/pull2395 ClearFakeClearFake threatcat_ch
2026-08-31 12:12https://raw.githubusercontent.com/Christa6547/davidrun ClearFakeClearFake threatcat_ch
2026-08-31 03:13https://raw.githubusercontent.com/Christa6547/fling/refs/heads/main/scoop ClearFakeClearFake threatcat_ch
2026-08-30 12:55https://raw.githubusercontent.com/Kath19634/ural3495/refs/heads/main/fds5412 ClearFakeClearFake threatcat_ch
2026-08-29 17:56https://raw.githubusercontent.com/Christa6547/unopened/refs/heads/main/matchbox ClearFakeClearFake threatcat_ch
2026-08-29 14:53https://raw.githubusercontent.com/Kath19634/landowner/refs/heads/main/target ClearFakeClearFake threatcat_ch
2026-08-29 00:15https://raw.githubusercontent.com/Christa6547/ade9ac52-539c-45d3-b903-1bcdc2d2d8c4/refs/heads/main/4b637250-1e04-4ccf-aced-ddd79d4daa67 ClearFakeClearFake threatcat_ch
2026-08-28 08:55https://raw.githubusercontent.com/snowplow-byte/implicate/refs/heads/main/lilac ClearFakeClearFake threatcat_ch
2026-03-30 16:50https://raw.githubusercontent.com/ninhpn1337/Disable-Windows-Defender/main/source.bat Unknown RATGithub MasonRAT NeptuneRAT Lenny_3BO
2026-03-27 15:00https://raw.githubusercontent.com/babka98/horinis/refs/heads/main/split.msi Unknown malwareClickFix payload HuntYethHounds
2026-03-27 15:00https://raw.githubusercontent.com/babka98/horinis/refs/heads/main/monkey.msi Unknown malwareClickFix payload HuntYethHounds
2026-03-27 14:59https://raw.githubusercontent.com/babka98/horinis/refs/heads/main/gatsby.msi Unknown malwareClickFix payload HuntYethHounds
2026-03-27 14:58https://raw.githubusercontent.com/babka98/horinis/refs/heads/main/Toshi2.msi Unknown malwareClickFix payload HuntYethHounds
2026-03-27 14:57https://raw.githubusercontent.com/babka98/horinis/refs/heads/main/Sinobu.msi Unknown malwareClickFix payload HuntYethHounds
2026-03-27 14:50https://raw.githubusercontent.com/babka98/horinis/refs/heads/main/lykis.msi Unknown malwareClickFix payload HuntYethHounds
2026-03-20 10:43https://raw.githubusercontent.com/tranth655/1df/refs/heads/main/url.txt Unknown StealerGithub stealer telegram Skynet11
2026-03-18 06:34https://gist.githubusercontent.com/HexReaper/eec6869214d2b4e12bd606529128f8c2/raw/gistfile1.txt MaskGramStealerdead-drop GitHub-Gist Kortex WallStealer Lenny_3BO
2026-03-05 12:13https://raw.githubusercontent.com/hello32423423/test.ps1/refs/heads/main/test.ps1 Unknown malwareClickFix HuntYethHounds
2025-12-23 14:29https://raw.githubusercontent.com/machazoo/source/main/main.txt Unknown malwareGithub burger
2025-12-12 06:30https://raw.githubusercontent.com/locsucc/cac/refs/heads/master/c XWormc2 XWorm juroots
2025-11-23 06:21https://raw.githubusercontent.com/whereveryouare666/linuxsys/refs/heads/main/linux.bin XMRIGAnonymous
2025-10-10 05:18https://raw.githubusercontent.com/4yzi/0/0/0/r1w Unknown StealerGithub payload stealer burger
2025-10-10 05:18https://raw.githubusercontent.com/4yzi/0/0/0/r2 Unknown StealerGithub payload stealer burger
2025-10-06 07:38https://raw.githubusercontent.com/Shadow252141/login/refs/heads/main/Image.png SmartLoaderSmartLoader juroots
2025-09-02 05:58https://raw.githubusercontent.com/Igor65afk/text/refs/heads/main/text.txt XWormc2 XWorm juroots
2025-08-25 14:24https://raw.githubusercontent.com/leaoingles/status/main/statuss Unknown Loaderc2 shortloader juroots
2025-08-23 18:00https://raw.githubusercontent.com/srap18/ddoss/main/hosts:4444 XWormc2 triage XWorm DonPasci
2025-08-21 14:59https://raw.githubusercontent.com/NTCHuy/hack/refs/heads/main/Client.exe XenoRATGithub netresec
2025-08-21 10:02https://raw.githubusercontent.com/yunus12343/sada-sada/refs/heads/main/ports AsyncRATasyncrat c2 juroots
2025-05-22 08:52https://raw.githubusercontent.com/z3nn1/vidhay/main/README.md XWormc2 XWorm juroots
2025-05-06 11:10https://gist.githubusercontent.com/vqbondiscord/6e1c57695b6ab6f4fbfafc5ccb2b46a8/raw/daa86a214070c5ad926ce7ac19c925a8475b5285/BackupServerInfo.txt Quasar RAT6May2025 iocbottest Gi7w0rm
2025-03-02 09:41https://raw.githubusercontent.com/76bh/img/main/Imagenep.png Unknown Loadershortloader juroots
2025-02-27 07:07https://raw.githubusercontent.com/43a1723/test/refs/heads/main/Ip XWormc2 XWorm juroots
2024-08-13 05:58https://raw.githubusercontent.com/willbill4/workspaceer/ RAWDOOR johannes
2024-05-29 13:41https://raw.githubusercontent.com/alexiadarocha195267/rp/raw/main/Execute_dll.zip AllaKore johannes
2024-05-29 13:41https://raw.githubusercontent.com/marinabarros320168/new/main/Execute_dll.exe AllaKore johannes
2023-10-09 05:00https://raw.githubusercontent.com/mmmi9w9w0q01/ IRATAc2 irata onecert_ir
2023-10-09 05:00https://raw.githubusercontent.com/mmmi9w9w0q01/s/main/esf.json IRATAc2 irata onecert_ir
2023-09-27 22:00https://raw.githubusercontent.com/SirosIrani/hades-panel IRATAc2 irata onecert_ir
2023-09-27 22:00https://raw.githubusercontent.com/SirosIrani IRATAc2 irata onecert_ir
2023-09-27 22:00https://raw.githubusercontent.com/SirosIrani/hades-panel/main/ IRATAc2 irata onecert_ir
2023-09-25 15:19https://raw.githubusercontent.com/mmmi9w9w0q01 IRATAirata onecert_ir
2023-09-25 15:19https://raw.githubusercontent.com/mmmi9w9w0q01/s/main IRATAirata onecert_ir
2023-09-25 15:19https://raw.githubusercontent.com/mmmi9w9w0q01/s/main/ami.json IRATAirata onecert_ir
2023-09-15 06:15https://raw.githubusercontent.com/SirosMoghadam/ratserver/main IRATAirata onecert_ir
2023-09-15 06:15https://raw.githubusercontent.com/SirosMoghadam/ratserver/main/url.txt IRATAirata onecert_ir
2023-09-15 06:15https://raw.githubusercontent.com/SirosMoghadam/ratserver IRATAirata onecert_ir
2023-09-15 06:15https://raw.githubusercontent.com/SirosMoghadam/ IRATAirata onecert_ir
2023-09-04 05:20https://raw.githubusercontent.com/vangguardadomorrisseyney32/dust-0001/main/d.txt FAKEUPDATESClearFake monitorsg
2023-07-27 15:38https://raw.githubusercontent.com/asaahaki23/gg/main/Hlcrcctzymb DBatLoaderDbatLoader EncryptedPayloadDownload Gi7w0rm
2022-11-11 13:43https://raw.githubusercontent.com/sebekeloytfu/simple-bash-scripts/master/calculator.sh VidarVidar crep1x
2021-12-21 22:28https://raw.githubusercontent.com/MoneroOcean/xmrig_setup/master/setup_moneroocean_miner.bat Unknown malwareCVE-2021-44228 java log4j log4shell Mirai powershell xmrig fish_illuminati