ThreatFox IOC Database

You are browsing the Indicator Of Compromise (IOC) database of ThreatFox. If you would like to contribute IOCs to the corpuse, you can do so through either the web form or the API.

1'000

IOCs shared (past 24 hours)

Mirai

Most seen malware family (past 24 hours)

1'867'148

IOCs in corpus

Using the form below, you can search for malware samples by a hash (MD5, SHA256, SHA1), imphash, tlsh hash, ClamAV signature, tag or malware family.

Browse Database

Search syntax is as follow: keyword:search_term

Following is a list of accepted keywords along with an example search_term

ioc:ms-debug-services.com ( run)
malware:CobaltStrike ( run)
tag:TA505 ( run)
threat_type:cc_skimming ( run)
uuid:87f310f3-540b-11eb-922c-42010aa4000a ( run)

Date (UTC)	IOC	Malware	Tags	Reporter
2026-03-16 10:41	62c6ba7f5356663c46b8918b6a0994fc	Unknown malware	Ransomware ScreenConnect tengu	TheRavenFile
2026-03-16 10:41	b400c58e7e227361cc689078ce9163c4	Unknown malware	Ransomware ScreenConnect tengu	TheRavenFile
2026-03-16 10:41	3b18e9da970fa7d336b08c5df04668b7	Unknown malware	Ransomware ScreenConnect tengu	TheRavenFile
2026-03-16 10:41	511a4780cbd9ed2280b432afc6cbfd1a	Unknown malware	Ransomware ScreenConnect tengu	TheRavenFile
2026-03-16 10:41	b8c81e1e17adcaf9e84d76401697b7e5	Unknown malware	Ransomware ScreenConnect tengu	TheRavenFile