🤲🏼 NEW | abuse.ch Community Hub! Earn recognition 🏅 for the malware intelligence you share, climb the leaderboards 📈, and connect with like-minded contributors who share your hunting focus 🤝. Ready to unlock your profile? Go to the Community Hub →

ThreatFox IOC Database

You are browsing the Indicator Of Compromise (IOC) database of ThreatFox. If you would like to contribute IOCs to the corpuse, you can do so through either the web form or the API.


1'778

IOCs shared (past 24 hours)

Unknown Loader

Most seen malware family (past 24 hours)

1'862'616

IOCs in corpus


Using the form below, you can search for malware samples by a hash (MD5, SHA256, SHA1), imphash, tlsh hash, ClamAV signature, tag or malware family.

Browse Database


Search syntax is as follow: keyword:search_term

Following is a list of accepted keywords along with an example search_term

  • ioc:ms-debug-services.com ( run)
  • malware:CobaltStrike ( run)
  • tag:TA505 ( run)
  • threat_type:cc_skimming ( run)
  • uuid:87f310f3-540b-11eb-922c-42010aa4000a ( run)

Date (UTC)IOCMalwareTagsReporter
2026-10-20 05:142e443833dd58278d094acda2067a43cae1e88cbdf3902d7515776ab42f41b7e8 GHOSTBLADEanalystic DarkSword GHOSTBLADE ios P7 Darkfibr
2026-10-20 05:145856c2c59ffcbe6b82f49ec94517463dc764cfe43333a7313c49a11c1c7934de GHOSTBLADEanalystic DarkSword GHOSTBLADE ios P7 Darkfibr
2026-10-20 05:14df86db89f7f965fc117d4c14b722d3d02f1d1de5c6ec216bb59fcf2736374caa GHOSTBLADEanalystic DarkSword GHOSTBLADE ios P7 Darkfibr
2026-10-20 05:143196034ef1196c9151395859019674e14e3c06e3fdbf230c7e0d0c5f6211824a GHOSTBLADEanalystic DarkSword GHOSTBLADE ios P7 Darkfibr
2026-10-20 05:1437efaa4237a28a4be411d40de80b2935be5b8c4e6731ee1f858c609142a87445 GHOSTBLADEanalystic DarkSword GHOSTBLADE ios P7 Darkfibr
2026-10-20 05:149c7f86f2b82df171a09f096afcd8fa5b6b24f0b643aae765ad17ecf80dadb196 GHOSTBLADEanalystic DarkSword GHOSTBLADE ios P7 Darkfibr
2026-10-20 05:146db7114ed9e8a89a75d11930d348ebd6c3bd52572238191c3116b100e8963a98 GHOSTBLADEanalystic DarkSword GHOSTBLADE ios P7 Darkfibr
2026-10-20 05:14da3fe94ac1ffe0ae01adfab6d5e6cd58933e93853c4b6e664f76ca468981bb02 GHOSTBLADEanalystic DarkSword GHOSTBLADE ios P7 Darkfibr
2026-10-17 15:32c7ca207e0b068efc1215dee80ae617b7 GHOSTBLADE Grim
2026-10-17 15:32cd005eeb916dddb3d30966c5bbb71caabd403464 GHOSTBLADE Grim
2026-10-17 15:32e1c4d064c1353ba75771662a61b7b529d4a206aa3cce1d5ca6529c53ab8b0946 GHOSTBLADE Grim
2026-10-14 05:42sqwas.shapelie.com GHOSTBLADEDarkSword GHOSTBLADE ios Daydream
2026-10-14 05:42https://odsj13.cc/result GHOSTBLADEDarkSword GHOSTBLADE ios Daydream
2026-10-14 05:42https://odsj13.cc/beacon GHOSTBLADEDarkSword GHOSTBLADE ios Daydream
2026-10-14 05:42https://sqwas.shapelie.com:8881/stats GHOSTBLADEDarkSword GHOSTBLADE ios Daydream
2026-10-14 05:42https://cdn.data-1283.com/app.vue.js GHOSTBLADEDarkSword ios supply-chain web-drive-by Daydream
2026-10-14 05:42https://www.cdnboostcache.com/sdk.html?s=bcdn GHOSTBLADEDarkSword ios supply-chain web-drive-by Daydream
2026-10-14 05:4238.22.89.117:8888 GHOSTBLADEDarkSword panel Daydream
2026-10-14 05:42103.97.128.67:8888 GHOSTBLADEDarkSword panel Daydream
2026-10-14 05:42162.4.136.30:8888 GHOSTBLADEDarkSword panel Daydream
2026-10-14 05:42223.26.63.56:8888 GHOSTBLADEDarkSword panel Daydream
2026-10-14 05:42151.243.126.191:8888 GHOSTBLADEDarkSword panel Daydream
2026-10-14 05:42151.243.126.191:8443 GHOSTBLADEDarkSword panel Daydream
2026-10-14 05:42107.175.49.181:3000 GHOSTBLADEDarkSword panel Daydream
2026-10-14 05:42103.238.129.112:3000 GHOSTBLADEDarkSword panel Daydream
2026-10-14 05:42jkonnet.buzz GHOSTBLADEDarkSword ios web-drive-by Daydream
2026-10-14 05:42myymk.cc GHOSTBLADEDarkSword ios web-drive-by Daydream
2026-10-14 05:42ytl99.vip GHOSTBLADEDarkSword ios web-drive-by Daydream
2026-10-14 05:42tronide.cc GHOSTBLADEDarkSword ios web-drive-by Daydream
2026-10-14 05:42dcgfun.top GHOSTBLADEDarkSword ios web-drive-by Daydream
2026-09-22 14:290d066f4a16eb2463dc340e84c2cba87ea848ab3fdb40ef693e12aed87c75a9ba GHOSTBLADE Grim
2026-09-22 14:29ef57e1c40c1d2394552e43c0c48d63f1 GHOSTBLADE Grim
2026-09-22 14:298490b683504ae8653fd74a97e2dd19cf436dc7ae GHOSTBLADE Grim
2026-09-14 12:31ca3090a6ea422c691b6454fc2ac64cc1 GHOSTBLADE Grim
2026-09-14 12:31f424039f141ac422b9cfd178f317be9e773c2c95d6c72b0af0fcf7e57ca52cb3 GHOSTBLADE Grim
2026-09-14 12:31a2e5458bd1057a66fcd197558f13de7960389862 GHOSTBLADE Grim
2026-09-05 11:34cdn.data-1283.com GHOSTBLADECoruna DarkSword GHOSTBLADE ios Loader KabirAcharya
2026-09-05 11:34www.amazonawsapirds.com GHOSTBLADECoruna DarkSword GHOSTBLADE ios Loader KabirAcharya
2026-09-05 11:34odsj13.cc GHOSTBLADEc2 DarkSword EXFILTRATION GHOSTBLADE ios KabirAcharya
2026-09-05 11:34xncb79.cc GHOSTBLADEDarkSword exploit GHOSTBLADE ios KabirAcharya
2026-09-05 11:3464c52a52d64ea44a8b8e1a9fa367e37a9940f847fcd142182711b1b862efb8a2 GHOSTBLADEDarkSword GHOSTBLADE ios KabirAcharya
2026-09-05 11:3426dd3693e4f86b2af02681680429a120e5389e2bdf6e4227f3ed45babfeb882e GHOSTBLADEDarkSword GHOSTBLADE ios KabirAcharya
2026-09-05 11:3425a5ca273abf934008ae2b5300f74f51670dfc702adf91b45ba6ccca32bf8c24 GHOSTBLADEDarkSword GHOSTBLADE ios KabirAcharya
2026-09-05 11:3471fe83847cdaf8c4d6c1aca90078dc4021cb96010062279d26338f06b4a7ba06 GHOSTBLADEDarkSword GHOSTBLADE ios KabirAcharya
2026-09-05 11:344df20a173ae6da2291fd66cb28a165958a9a6f5998ef9a19e4e143b120f1a844 GHOSTBLADEDarkSword GHOSTBLADE ios KabirAcharya
2026-09-05 11:3477238255f541274ed0c8c1e5e0ffe034532a210a3aaba94d63a05a3499362022 GHOSTBLADEDarkSword GHOSTBLADE ios KabirAcharya
2026-09-05 11:34a5ca944459c08038bfabf7ddbfc6ec2505ef0dc22b987569ed295f7378f30d59 GHOSTBLADEDarkSword GHOSTBLADE ios KabirAcharya
2026-09-05 11:34c1b05dd8e7d060d2a40a859211528e90e62d0dc378f8af831933fe59122490dd GHOSTBLADEDarkSword GHOSTBLADE ios KabirAcharya
2026-09-05 11:34e02855a0c4e27b793644eaf6446da9596ed8d2d3c37b580beb111738010de441 GHOSTBLADEDarkSword GHOSTBLADE ios KabirAcharya
2026-06-22 16:57ea41ab57edc9a9a1cb1ae258325d6519f5d23571 GHOSTBLADE Grim
2026-06-22 16:573b2a2777cead3c4981d4b2106c1ec4b4 GHOSTBLADE Grim
2026-06-22 16:57d7982957ccd47d3603494688dc4a3d1a6d5183f9 GHOSTBLADE Grim
2026-06-22 16:574b1fd32206aa2831edead99efe88549a GHOSTBLADE Grim
2026-06-22 16:57be4bb2ea6fc6959cdeb63238018761be56adb2d1e69e7c3d3340272187198b5d GHOSTBLADE Grim
2026-06-22 16:57ecaedc68c09154f9e97673d84d1860d5755828182a42f6aab64ab3766ce47396 GHOSTBLADE Grim