ThreatFox IOC Database

You are browsing the Indicator Of Compromise (IOC) database of ThreatFox. If you would like to contribute IOCs to the corpuse, you can do so through either the web form or the API.

1'519

IOCs shared (past 24 hours)

AMOS

Most seen malware family (past 24 hours)

1'860'897

IOCs in corpus

Using the form below, you can search for malware samples by a hash (MD5, SHA256, SHA1), imphash, tlsh hash, ClamAV signature, tag or malware family.

Browse Database

Search syntax is as follow: keyword:search_term

Following is a list of accepted keywords along with an example search_term

ioc:ms-debug-services.com ( run)
malware:CobaltStrike ( run)
tag:TA505 ( run)
threat_type:cc_skimming ( run)
uuid:87f310f3-540b-11eb-922c-42010aa4000a ( run)

Date (UTC)	IOC	Malware	Reporter
2026-08-07 20:13	b2daee69272ac088ba3af90e630a7b73	NetWorm	Grim
2026-08-07 20:13	a1b471e7cb4cabe80828dfb0b96cc6f5f87bf867969c66bc8511715ecd70459e	NetWorm	Grim
2026-08-07 20:13	6682841224071055bf109254dfc7a65d46ffbb9e	NetWorm	Grim