🤲🏼 NEW | abuse.ch Community Hub! Earn recognition 🏅 for the malware intelligence you share, climb the leaderboards 📈, and connect with like-minded contributors who share your hunting focus 🤝. Ready to unlock your profile? Go to the Community Hub →

ThreatFox IOC Database

You are browsing the Indicator Of Compromise (IOC) database of ThreatFox. If you would like to contribute IOCs to the corpuse, you can do so through either the web form or the API.


1'593

IOCs shared (past 24 hours)

Unknown Loader

Most seen malware family (past 24 hours)

1'861'960

IOCs in corpus


Using the form below, you can search for malware samples by a hash (MD5, SHA256, SHA1), imphash, tlsh hash, ClamAV signature, tag or malware family.

Browse Database


Search syntax is as follow: keyword:search_term

Following is a list of accepted keywords along with an example search_term

  • ioc:ms-debug-services.com ( run)
  • malware:CobaltStrike ( run)
  • tag:TA505 ( run)
  • threat_type:cc_skimming ( run)
  • uuid:87f310f3-540b-11eb-922c-42010aa4000a ( run)

Date (UTC)IOCMalwareTagsReporter
2025-03-10 07:52140aad1f823157222af3da2d23de8789 HellDownhelldown Ransomware TheRavenFile
2025-03-10 07:525e7f5bb24a7cdaabcf3d2e77ed31fa4e HellDownhelldown Ransomware TheRavenFile
2025-03-10 07:52b81df159e7e338a3159f27ef3358094f HellDownhelldown Ransomware TheRavenFile
2025-03-10 07:5264cc86931bab241dcc08db03e659bcc5 HellDownhelldown Ransomware TheRavenFile
2025-03-10 07:52be37cd010227d7b953b07b93d2e5dadc HellDownhelldown Ransomware TheRavenFile
2025-03-10 07:52363af8ec21b8c309e56abdd114f32a39 HellDownhelldown Ransomware TheRavenFile
2024-11-08 07:06helldown.org HellDownhelldown Ransomware TheRavenFile
2024-11-08 07:06onyxcym4mjilrsptk5uo2dhesbwntuban55mvww2olk5ygqafhu3i3yd.onion HellDowndarkweb helldown Ransomware TheRavenFile
2024-11-08 07:06onyxcb44xvqra35m3lp3z26kf2pxrlbn64nbzvyvzjyc3uykzrwcjdid.onion HellDowndarkweb helldown Ransomware TheRavenFile
2024-11-08 07:05onyxcgfg4pjevvp5h34zvhaj45kbft3dg5r33j5vu3nyp7xic3vrzvad.onion HellDowndarkweb helldown Ransomware TheRavenFile