ThreatFox IOC Database

You are browsing the Indicator Of Compromise (IOC) database of ThreatFox. If you would like to contribute IOCs to the corpuse, you can do so through either the web form or the API.

1'514

IOCs shared (past 24 hours)

AMOS

Most seen malware family (past 24 hours)

1'860'901

IOCs in corpus

Using the form below, you can search for malware samples by a hash (MD5, SHA256, SHA1), imphash, tlsh hash, ClamAV signature, tag or malware family.

Browse Database

Search syntax is as follow: keyword:search_term

Following is a list of accepted keywords along with an example search_term

ioc:ms-debug-services.com ( run)
malware:CobaltStrike ( run)
tag:TA505 ( run)
threat_type:cc_skimming ( run)
uuid:87f310f3-540b-11eb-922c-42010aa4000a ( run)

Date (UTC)	IOC	Malware	Reporter
2026-07-30 11:24	9752755518c4f303c2d419563be71b5d9b7a3552	PITFUEL	Grim
2026-07-30 11:24	d5d17b986fb728e4340968e603256974	PITFUEL	Grim
2026-07-30 11:24	62ba9639ef75606548755a259103e83f0ec1464b0f05c6f02fe5e35990de02c0	PITFUEL	Grim