ThreatFox IOC Database

You are browsing the Indicator Of Compromise (IOC) database of ThreatFox. If you would like to contribute IOCs to the corpuse, you can do so through either the web form or the API.

669

IOCs shared (past 24 hours)

Unknown malware

Most seen malware family (past 24 hours)

1'775'216

IOCs in corpus

Using the form below, you can search for malware samples by a hash (MD5, SHA256, SHA1), imphash, tlsh hash, ClamAV signature, tag or malware family.

Browse Database

Search syntax is as follow: keyword:search_term

Following is a list of accepted keywords along with an example search_term

ioc:ms-debug-services.com ( run)
malware:CobaltStrike ( run)
tag:TA505 ( run)
threat_type:cc_skimming ( run)
uuid:87f310f3-540b-11eb-922c-42010aa4000a ( run)

Date (UTC)	IOC	Malware	Tags	Reporter
2026-05-20 05:25	9fd30bda0edf3b10b326703303fa15995a688d200582822ef49422ebac87b7f7	nccTrojan	lab malware sha256	raohamdrizwan
2026-05-20 05:25	c8ac1b977d771c89ed7152f0daedb6a3e8b69b24	nccTrojan	lab malware sha1	raohamdrizwan
2026-03-10 14:23	188.137.224.103:80	nccTrojan	opendir	ThreatOpsX
2022-01-31 15:47	367ce073e19a8cc30ff8201155afa4be7a6f238c543cf7607fcb3387ce4a1b2d	nccTrojan		Virus_Deck