ThreatFox IOC Database

You are browsing the Indicator Of Compromise (IOC) database of ThreatFox. If you would like to contribute IOCs to the corpuse, you can do so through either the web form or the API.


259

IOCs shared (past 24 hours)

ClearFake

Most seen malware family (past 24 hours)

1'692'585

IOCs in corpus


Using the form below, you can search for malware samples by a hash (MD5, SHA256, SHA1), imphash, tlsh hash, ClamAV signature, tag or malware family.

Browse Database

Search syntax is as follow: keyword:search_term

Following is a list of accepted keywords along with an example search_term

  • ioc:ms-debug-services.com ( run)
  • malware:CobaltStrike ( run)
  • tag:TA505 ( run)
  • threat_type:cc_skimming ( run)
  • uuid:87f310f3-540b-11eb-922c-42010aa4000a ( run)

Date (UTC)IOCMalwareTagsReporter
2021-09-29 08:165EDF9810355DE986EAD251B297856F38 FinFisher RAT Virus_Deck
2021-09-29 08:1631F1D208EE740E1FDF9667B2E525F3D7 FinFisher RAT Virus_Deck
2021-09-29 08:164994952020DA28BB0AA023D236A6BF3B FinFisher RAT Virus_Deck
2021-09-29 08:16262C9241B5F50293CB972C0E93D5D5FC FinFisher RAT Virus_Deck
2021-09-29 08:16405BB24ADE435693B11AF1D81E2BB279 FinFisher RAT Virus_Deck
2021-09-29 08:16EF74C95B1DBDBF9BD231DA1EE99F0A7E FinFisher RAT Virus_Deck
2021-09-29 08:16B8A15A0CE29692FBA36A87FCDED971DE FinFisher RAT Virus_Deck
2021-07-19 09:3039cf2ee07b7b333e7c179d0bf4d798a5b72af6a4e584f51e642703bbfa4fc828 FinFisher RATfinspy Virus_Deck
2021-07-19 09:3002e4d0e23391bbbb75c47f5db44d119176803da74b1c170250e848de51632ae9 FinFisher RATfinspy Virus_Deck
2021-07-19 09:30b882d79b6965c5864db91704b8feb7ce4865ac7466f025f5685441f1d698a724 FinFisher RATfinspy Virus_Deck
2021-07-19 09:3065c89525ea4da91500c021e5ac3cb67cf2c29086cca3ef7c75a44ac38cc1cce5 FinFisher RATfinspy Virus_Deck