ThreatFox IOC Database

You are browsing the Indicator Of Compromise (IOC) database of ThreatFox. If you would like to contribute IOCs to the corpuse, you can do so through either the web form or the API.

1'431

IOCs shared (past 24 hours)

Unknown Loader

Most seen malware family (past 24 hours)

1'868'460

IOCs in corpus

Using the form below, you can search for malware samples by a hash (MD5, SHA256, SHA1), imphash, tlsh hash, ClamAV signature, tag or malware family.

Browse Database

Search syntax is as follow: keyword:search_term

Following is a list of accepted keywords along with an example search_term

ioc:ms-debug-services.com ( run)
malware:CobaltStrike ( run)
tag:TA505 ( run)
threat_type:cc_skimming ( run)
uuid:87f310f3-540b-11eb-922c-42010aa4000a ( run)

Date (UTC)	IOC	Malware	Reporter
2026-11-10 15:00	3b21610a45e12d02a0f8e40354071d58	Ares	Grim
2026-11-10 15:00	5d620521cf8d83a81d0f814adabe0ce9ed3af7777f9d122e39fcc2d60ed22d99	Ares	Grim
2026-11-10 15:00	b5b3dc2faeb6eced79e48067f7c54e2573d601b8	Ares	Grim