ThreatFox IOC Database

You are browsing the Indicator Of Compromise (IOC) database of ThreatFox. If you would like to contribute IOCs to the corpuse, you can do so through either the web form or the API.

1'558

IOCs shared (past 24 hours)

AsyncRAT

Most seen malware family (past 24 hours)

1'777'261

IOCs in corpus

Using the form below, you can search for malware samples by a hash (MD5, SHA256, SHA1), imphash, tlsh hash, ClamAV signature, tag or malware family.

Browse Database

Search syntax is as follow: keyword:search_term

Following is a list of accepted keywords along with an example search_term

ioc:ms-debug-services.com ( run)
malware:CobaltStrike ( run)
tag:TA505 ( run)
threat_type:cc_skimming ( run)
uuid:87f310f3-540b-11eb-922c-42010aa4000a ( run)

Date (UTC)	IOC	Malware	Reporter
2026-09-12 15:32	bbafb0d313cb0f7a55395f950a0a1337934af072b3d4ebafc704bab60f03fdfc	PY#RATION	Grim
2026-09-12 15:32	8ec6051fd1c23060aef7d7a37c9130ee3ebc2aac	PY#RATION	Grim
2026-09-12 15:32	788464d6404cc1dc463f511c3b1c22eb	PY#RATION	Grim
2026-09-12 15:32	e9f2856e7040aeebd9a4f0107296fd2a13873e482bfafe285652687af25ab949	PY#RATION	Grim
2026-09-12 15:32	faaae3aa1b19eb446142dc618e674a5947b5f4c1	PY#RATION	Grim
2026-09-12 15:32	d28cc2606a5acdbb0da3b957e4ee44af	PY#RATION	Grim