🤲🏼 NEW | abuse.ch Community Hub! Earn recognition 🏅 for the malware intelligence you share, climb the leaderboards 📈, and connect with like-minded contributors who share your hunting focus 🤝. Ready to unlock your profile? Go to the Community Hub →

ThreatFox IOC Database

You are viewing the ThreatFox database entry for url http://mops.to:408/task/Stealer.

Database Entry

Add tag Delete this IOC  Report False Positive Export IOC (JSON)    Export IOC (CSV)
IOC ID:1977308
IOC: http://mops.to:408/task/Stealer
IOC Type :url
Threat Type :payload_delivery
Malware: Unknown Stealer
Confidence Level : Confidence level is high (90%)
Is compromised? : False
ASN:AS211381 PODAON
Country:- LV
First seen:2026-10-21 07:12:38 UTC
Last seen:never
UUID:5c6705db-cd1e-11f1-8717-42010aa4000a
Reporter Anonymous
Reward 5 credits from ThreatFox
Tags:fake-git MopsStealer static-analysis
Reference: https://bazaar.abuse.ch/sample/1c850a5b877770dd831c68e2b6c9681419e63533c2f04cf9bdfa8f7fa6756585/

Avatar
Anonymous
Current task-DLL delivery URL, retrieved as inert data 2026-10-21 06:38:35 UTC; 1461248 bytes, SHA256 1c850a5b877770dd831c68e2b6c9681419e63533c2f04cf9bdfa8f7fa6756585. Two standalone GETs returned 403. A bounded synthetic registration on mops[.]to WebSocket port 406 followed by the same HTTP GET with User-Agent 0badc0de returned 200. No victim identity supplied, no received command executed, getinfo ignored, no task assignment observed. DLL self-identifies as Mops Stealer V3; family attribution remains unverified. Extends fake-git delivery context in ThreatFox IOC 1973467. No specimen execution.