{ "count": 206, "indicators": [ { "ioc_value": "https:\/\/github.com\/ff245185\/payload\/raw\/refs\/heads\/main\/Fast%20Download.exe", "ioc_type": "url", "category": "Domains\/URLs", "threat_score": "0.50", "confidence_score": "0.50", "sighting_count": 4, "first_seen": "2026-08-06 13:07:42", "last_seen": "2026-08-24 11:11:39" }, { "ioc_value": "https:\/\/raw.githubusercontent.com\/lehila05\/pdc\/refs\/heads\/main\/payload.bin", "ioc_type": "url", "category": "Domains\/URLs", "threat_score": "0.50", "confidence_score": "0.50", "sighting_count": 4, "first_seen": "2026-08-06 13:07:42", "last_seen": "2026-08-24 11:11:39" }, { "ioc_value": "https:\/\/raw.githubusercontent.com\/ff245185\/payload\/refs\/heads\/main\/Fast%20Download.exe", "ioc_type": "url", "category": "Domains\/URLs", "threat_score": "0.50", "confidence_score": "0.50", "sighting_count": 4, "first_seen": "2026-08-06 13:07:42", "last_seen": "2026-08-24 11:11:39" }, { "ioc_value": "http:\/\/github.com\/ff245185\/payload\/raw\/refs\/heads\/main\/Fast%20Download.exe", "ioc_type": "url", "category": "Domains\/URLs", "threat_score": "0.50", "confidence_score": "0.50", "sighting_count": 4, "first_seen": "2026-08-06 13:07:42", "last_seen": "2026-08-24 11:11:39" }, { "ioc_value": "https:\/\/raw.githubusercontent.com\/fuzzbunch\/fuzzbunch\/master\/payloads\/Doublepulsar-1.3.1.exe", "ioc_type": "url", "category": "Domains\/URLs", "threat_score": "0.50", "confidence_score": "0.50", "sighting_count": 4, "first_seen": "2026-08-06 13:07:42", "last_seen": "2026-08-24 11:11:39" }, { "ioc_value": "https:\/\/raw.githubusercontent.com\/aissardp\/payload\/main\/payload.exe", "ioc_type": "url", "category": "Domains\/URLs", "threat_score": "0.50", "confidence_score": "0.50", "sighting_count": 4, "first_seen": "2026-08-06 13:07:42", "last_seen": "2026-08-24 11:11:39" }, { "ioc_value": "https:\/\/raw.githubusercontent.com\/pistacchietto\/win-python-backdoor\/master\/standalone_payload.exe", "ioc_type": "url", "category": "Domains\/URLs", "threat_score": "0.50", "confidence_score": "0.50", "sighting_count": 4, "first_seen": "2026-08-06 13:07:42", "last_seen": "2026-08-24 11:11:39" }, { "ioc_value": "https:\/\/raw.githubusercontent.com\/ff245185\/payload\/main\/Fast%20Download.exe", "ioc_type": "url", "category": "Domains\/URLs", "threat_score": "0.50", "confidence_score": "0.50", "sighting_count": 4, "first_seen": "2026-08-06 13:07:42", "last_seen": "2026-08-24 11:11:39" }, { "ioc_value": "https:\/\/raw.githubusercontent.com\/lehila05\/pdc\/main\/payload.bin", "ioc_type": "url", "category": "Domains\/URLs", "threat_score": "0.50", "confidence_score": "0.50", "sighting_count": 4, "first_seen": "2026-08-06 13:07:42", "last_seen": "2026-08-24 11:11:38" }, { "ioc_value": "https:\/\/raw.githubusercontent.com\/lehila05\/pdc\/main\/payload_encrypted.bin", "ioc_type": "url", "category": "Domains\/URLs", "threat_score": "0.50", "confidence_score": "0.50", "sighting_count": 4, "first_seen": "2026-08-06 13:07:42", "last_seen": "2026-08-24 11:11:38" }, { "ioc_value": "https:\/\/semencepourlavie.org\/stego_payload1.png", "ioc_type": "url", "category": "Domains\/URLs", "threat_score": "0.50", "confidence_score": "0.50", "sighting_count": 5, "first_seen": "2026-08-06 13:07:41", "last_seen": "2026-08-24 11:11:36" }, { "ioc_value": "https:\/\/raw.githubusercontent.com\/cloudie-w\/payload-kit\/main\/sql-injection\/payload_kit_v2.0.zip", "ioc_type": "url", "category": "Domains\/URLs", "threat_score": "0.50", "confidence_score": "0.50", "sighting_count": 5, "first_seen": "2026-08-06 13:07:40", "last_seen": "2026-08-24 11:11:36" }, { "ioc_value": "https:\/\/raw.githubusercontent.com\/mathews2007morais-boop\/payload-obfuscator\/main\/public\/payload_obfuscator_v2.3.zip", "ioc_type": "url", "category": "Domains\/URLs", "threat_score": "0.50", "confidence_score": "0.50", "sighting_count": 5, "first_seen": "2026-08-06 13:07:40", "last_seen": "2026-08-24 11:11:35" }, { "ioc_value": "http:\/\/23.94.145.229\/api\/v1\/ps1\/bf57fba60c91af3c5b2a12a00824e554\/payload?gk=8548a53bccb76780011e980c89530d41dc9762640a4cc2664b532a045e8dee8b", "ioc_type": "url", "category": "Domains\/URLs", "threat_score": "0.50", "confidence_score": "0.50", "sighting_count": 7, "first_seen": "2026-08-23 06:20:53", "last_seen": "2026-08-24 11:11:35" }, { "ioc_value": "http:\/\/91.199.133.133:8080\/payload.sql", "ioc_type": "url", "category": "Domains\/URLs", "threat_score": "0.50", "confidence_score": "0.50", "sighting_count": 9, "first_seen": "2026-08-06 13:07:37", "last_seen": "2026-08-24 11:11:34" }, { "ioc_value": "http:\/\/dsgagfsahkfsahfjs.shop\/payload.sh", "ioc_type": "url", "category": "Domains\/URLs", "threat_score": "0.50", "confidence_score": "0.50", "sighting_count": 9, "first_seen": "2026-08-06 13:07:37", "last_seen": "2026-08-24 11:11:34" }, { "ioc_value": "http:\/\/2.58.56.170:8080\/payload.tgz", "ioc_type": "url", "category": "Domains\/URLs", "threat_score": "0.50", "confidence_score": "0.50", "sighting_count": 9, "first_seen": "2026-08-06 13:07:37", "last_seen": "2026-08-24 11:11:34" }, { "ioc_value": "http:\/\/187.77.145.183:8081\/payload.sh", "ioc_type": "url", "category": "Domains\/URLs", "threat_score": "0.50", "confidence_score": "0.50", "sighting_count": 9, "first_seen": "2026-08-06 13:07:37", "last_seen": "2026-08-24 11:11:34" }, { "ioc_value": "https:\/\/breakneckridgefarm.com\/payload.dat", "ioc_type": "url", "category": "Domains\/URLs", "threat_score": "0.50", "confidence_score": "0.50", "sighting_count": 9, "first_seen": "2026-08-06 13:07:37", "last_seen": "2026-08-24 11:11:34" }, { "ioc_value": "http:\/\/94.154.43.123:8080\/payload\/tadizabyazbi\/97ba.sh", "ioc_type": "url", "category": "Domains\/URLs", "threat_score": "0.50", "confidence_score": "0.50", "sighting_count": 9, "first_seen": "2026-08-06 13:07:37", "last_seen": "2026-08-24 11:11:34" }, { "ioc_value": "http:\/\/104.129.11.86\/payloads\/Ciabins.sh", "ioc_type": "url", "category": "Domains\/URLs", "threat_score": "0.50", "confidence_score": "0.50", "sighting_count": 9, "first_seen": "2026-08-06 13:07:37", "last_seen": "2026-08-24 11:11:34" }, { "ioc_value": "http:\/\/184.174.97.162:1337\/payload\/386\/pikachu", "ioc_type": "url", "category": "Domains\/URLs", "threat_score": "0.50", "confidence_score": "0.50", "sighting_count": 10, "first_seen": "2026-08-06 13:07:36", "last_seen": "2026-08-24 11:11:33" }, { "ioc_value": "http:\/\/193.25.217.70\/payloads.sh", "ioc_type": "url", "category": "Domains\/URLs", "threat_score": "0.50", "confidence_score": "0.50", "sighting_count": 11, "first_seen": "2026-08-06 13:07:37", "last_seen": "2026-08-24 11:11:33" }, { "ioc_value": "http:\/\/149.50.154.101:8000\/payload.sh", "ioc_type": "url", "category": "Domains\/URLs", "threat_score": "0.50", "confidence_score": "0.50", "sighting_count": 4, "first_seen": "2026-08-23 06:20:54", "last_seen": "2026-08-24 11:11:31" }, { "ioc_value": "http:\/\/160.191.242.92\/payload.xml", "ioc_type": "url", "category": "Domains\/URLs", "threat_score": "0.50", "confidence_score": "0.50", "sighting_count": 4, "first_seen": "2026-08-23 06:20:54", "last_seen": "2026-08-24 11:11:31" }, { "ioc_value": "http:\/\/newstan.online:8443\/payloads\/18cb4cb2cb097b20.bin", "ioc_type": "url", "category": "Domains\/URLs", "threat_score": "0.50", "confidence_score": "0.50", "sighting_count": 4, "first_seen": "2026-08-23 06:20:53", "last_seen": "2026-08-24 11:11:30" }, { "ioc_value": "http:\/\/newstan.online:8443\/payloads\/18cb72c503457787.bin", "ioc_type": "url", "category": "Domains\/URLs", "threat_score": "0.50", "confidence_score": "0.50", "sighting_count": 4, "first_seen": "2026-08-23 06:20:53", "last_seen": "2026-08-24 11:11:30" }, { "ioc_value": "http:\/\/newstan.online:8443\/payloads\/18cb7333cef1df5b.bin", "ioc_type": "url", "category": "Domains\/URLs", "threat_score": "0.50", "confidence_score": "0.50", "sighting_count": 4, "first_seen": "2026-08-23 06:20:53", "last_seen": "2026-08-24 11:11:30" }, { "ioc_value": "http:\/\/newstan.online:8443\/payloads\/18cb4d3ad86bac08.bin", "ioc_type": "url", "category": "Domains\/URLs", "threat_score": "0.50", "confidence_score": "0.50", "sighting_count": 4, "first_seen": "2026-08-23 06:20:53", "last_seen": "2026-08-24 11:11:30" }, { "ioc_value": "http:\/\/newstan.online:8443\/payloads\/18cb7441f57b1a78.bin", "ioc_type": "url", "category": "Domains\/URLs", "threat_score": "0.50", "confidence_score": "0.50", "sighting_count": 4, "first_seen": "2026-08-23 06:20:53", "last_seen": "2026-08-24 11:11:30" }, { "ioc_value": "http:\/\/newstan.online:8443\/payloads\/18cb4d062cca7589.bin", "ioc_type": "url", "category": "Domains\/URLs", "threat_score": "0.50", "confidence_score": "0.50", "sighting_count": 4, "first_seen": "2026-08-23 06:20:53", "last_seen": "2026-08-24 11:11:30" }, { "ioc_value": "http:\/\/newstan.online:8443\/payload\/18cb9cea2d96337e.bin", "ioc_type": "url", "category": "Domains\/URLs", "threat_score": "0.50", "confidence_score": "0.50", "sighting_count": 4, "first_seen": "2026-08-23 06:20:53", "last_seen": "2026-08-24 11:11:30" }, { "ioc_value": "http:\/\/newstan.online:8443\/payloads\/18cb7182b6e8e7b6.bin", "ioc_type": "url", "category": "Domains\/URLs", "threat_score": "0.50", "confidence_score": "0.50", "sighting_count": 4, "first_seen": "2026-08-23 06:20:53", "last_seen": "2026-08-24 11:11:30" }, { "ioc_value": "http:\/\/newstan.online:8443\/payloads\/18cb9c2f86cabdb2.bin", "ioc_type": "url", "category": "Domains\/URLs", "threat_score": "0.50", "confidence_score": "0.50", "sighting_count": 4, "first_seen": "2026-08-23 06:20:53", "last_seen": "2026-08-24 11:11:30" }, { "ioc_value": "http:\/\/newstan.online:8443\/payloads\/18cb4ccfb9e27fc2.bin", "ioc_type": "url", "category": "Domains\/URLs", "threat_score": "0.50", "confidence_score": "0.50", "sighting_count": 4, "first_seen": "2026-08-23 06:20:53", "last_seen": "2026-08-24 11:11:30" }, { "ioc_value": "http:\/\/newstan.online:8443\/payloads\/18cb4cef6566cc70.bin", "ioc_type": "url", "category": "Domains\/URLs", "threat_score": "0.50", "confidence_score": "0.50", "sighting_count": 4, "first_seen": "2026-08-23 06:20:53", "last_seen": "2026-08-24 11:11:30" }, { "ioc_value": "http:\/\/newstan.online:8443\/payloads\/18cb7296bb21486f.bin", "ioc_type": "url", "category": "Domains\/URLs", "threat_score": "0.50", "confidence_score": "0.50", "sighting_count": 4, "first_seen": "2026-08-23 06:20:53", "last_seen": "2026-08-24 11:11:30" }, { "ioc_value": "http:\/\/newstan.online:8443\/payloads\/18cb73a84c0c2684.bin", "ioc_type": "url", "category": "Domains\/URLs", "threat_score": "0.50", "confidence_score": "0.50", "sighting_count": 4, "first_seen": "2026-08-23 06:20:53", "last_seen": "2026-08-24 11:11:30" }, { "ioc_value": "http:\/\/newstan.online:8443\/payloads\/18cb4b870df50ce6.bin", "ioc_type": "url", "category": "Domains\/URLs", "threat_score": "0.50", "confidence_score": "0.50", "sighting_count": 4, "first_seen": "2026-08-23 06:20:53", "last_seen": "2026-08-24 11:11:30" }, { "ioc_value": "http:\/\/newstan.online:8443\/payloads\/18cb4bd89774939d.bin", "ioc_type": "url", "category": "Domains\/URLs", "threat_score": "0.50", "confidence_score": "0.50", "sighting_count": 4, "first_seen": "2026-08-23 06:20:53", "last_seen": "2026-08-24 11:11:30" }, { "ioc_value": "http:\/\/newstan.online:8443\/payloads\/18cb4ba64c9fd789.bin", "ioc_type": "url", "category": "Domains\/URLs", "threat_score": "0.50", "confidence_score": "0.50", "sighting_count": 4, "first_seen": "2026-08-23 06:20:53", "last_seen": "2026-08-24 11:11:30" }, { "ioc_value": "http:\/\/newstan.online:8443\/payload.exe", "ioc_type": "url", "category": "Domains\/URLs", "threat_score": "0.50", "confidence_score": "0.50", "sighting_count": 4, "first_seen": "2026-08-23 06:20:53", "last_seen": "2026-08-24 11:11:30" }, { "ioc_value": "http:\/\/newstan.online:8443\/payload\/18cb7ca62cfb04e6.bin", "ioc_type": "url", "category": "Domains\/URLs", "threat_score": "0.50", "confidence_score": "0.50", "sighting_count": 4, "first_seen": "2026-08-23 06:20:53", "last_seen": "2026-08-24 11:11:30" }, { "ioc_value": "http:\/\/newstan.online:8443\/payload\/18cb7a9ae6f1d608.bin", "ioc_type": "url", "category": "Domains\/URLs", "threat_score": "0.50", "confidence_score": "0.50", "sighting_count": 4, "first_seen": "2026-08-23 06:20:53", "last_seen": "2026-08-24 11:11:30" }, { "ioc_value": "http:\/\/178.132.198.200\/payload_v10.sh", "ioc_type": "url", "category": "Domains\/URLs", "threat_score": "0.50", "confidence_score": "0.50", "sighting_count": 4, "first_seen": "2026-08-23 06:20:53", "last_seen": "2026-08-24 11:11:29" }, { "ioc_value": "http:\/\/2.27.248.13\/payload.sh", "ioc_type": "url", "category": "Malware URLs", "threat_score": "0.50", "confidence_score": "0.50", "sighting_count": 3, "first_seen": "2026-08-23 11:08:12", "last_seen": "2026-08-24 11:11:29" }, { "ioc_value": "https:\/\/rukeyou.com\/sys\/X2\/X2-payload_dfyihao.zip", "ioc_type": "url", "category": "Domains\/URLs", "threat_score": "0.50", "confidence_score": "0.50", "sighting_count": 4, "first_seen": "2026-08-23 06:20:53", "last_seen": "2026-08-24 11:11:29" }, { "ioc_value": "https:\/\/rukeyou.com\/sys\/X2\/X2-payload_baolljp.jpg", "ioc_type": "url", "category": "Domains\/URLs", "threat_score": "0.50", "confidence_score": "0.50", "sighting_count": 4, "first_seen": "2026-08-23 06:20:53", "last_seen": "2026-08-24 11:11:29" }, { "ioc_value": "https:\/\/www.artleadsdigital.com\/payloadencrypted.bin", "ioc_type": "url", "category": "Domains\/URLs", "threat_score": "0.50", "confidence_score": "0.50", "sighting_count": 4, "first_seen": "2026-08-23 06:20:53", "last_seen": "2026-08-24 11:11:29" }, { "ioc_value": "payloadt.top", "ioc_type": "other", "category": "Cryptocurrency", "threat_score": "0.50", "confidence_score": "0.50", "sighting_count": 3, "first_seen": "2026-08-06 14:41:31", "last_seen": "2026-08-24 01:06:10" }, { "ioc_value": "https:\/\/www.pwndefend.com\/2022\/06\/04\/cve-2022-26134-honeypot-payload-analysis-example\/", "ioc_type": "url", "category": "Threat Actors", "threat_score": "0.50", "confidence_score": "0.50", "sighting_count": 3, "first_seen": "2026-08-06 13:13:00", "last_seen": "2026-08-23 13:09:22" }, { "ioc_value": "https:\/\/blog.malwarebytes.com\/threat-intelligence\/2021\/12\/sidecopy-apt-connecting-lures-to-victims-payloads-to-infrastructure\/", "ioc_type": "url", "category": "Threat Actors", "threat_score": "0.50", "confidence_score": "0.50", "sighting_count": 3, "first_seen": "2026-08-06 13:13:00", "last_seen": "2026-08-23 13:09:22" }, { "ioc_value": "https:\/\/blog.confiant.com\/exploring-scamclub-payloads-via-deobfuscation-using-abstract-syntax-trees-65ef7f412537", "ioc_type": "url", "category": "Threat Actors", "threat_score": "0.50", "confidence_score": "0.50", "sighting_count": 3, "first_seen": "2026-08-06 13:13:00", "last_seen": "2026-08-23 13:09:22" }, { "ioc_value": "https:\/\/www.microsoft.com\/en-us\/security\/blog\/2022\/11\/17\/dev-0569-finds-new-ways-to-deliver-royal-ransomware-various-payloads\/", "ioc_type": "url", "category": "ATT&CK", "threat_score": "0.50", "confidence_score": "0.50", "sighting_count": 9, "first_seen": "2026-08-06 13:09:17", "last_seen": "2026-08-23 13:09:22" }, { "ioc_value": "https:\/\/unit42.paloaltonetworks.com\/new-python-based-payload-mechaflounder-used-by-chafer\/", "ioc_type": "url", "category": "ATT&CK", "threat_score": "0.50", "confidence_score": "0.50", "sighting_count": 9, "first_seen": "2026-08-06 13:09:17", "last_seen": "2026-08-23 13:09:22" }, { "ioc_value": "https:\/\/unit42.paloaltonetworks.com\/ups-observations-on-cve-2015-3113-prior-zero-days-and-the-pirpi-payload\/", "ioc_type": "url", "category": "ATT&CK", "threat_score": "0.50", "confidence_score": "0.50", "sighting_count": 6, "first_seen": "2026-08-06 13:09:18", "last_seen": "2026-08-23 13:09:21" }, { "ioc_value": "https:\/\/www.virusbulletin.com\/conference\/vb2023\/abstracts\/unveiling-activities-tropic-trooper-2023-deep-analysis-xiangoop-loader-and-entryshell-payload\/", "ioc_type": "url", "category": "ATT&CK", "threat_score": "0.50", "confidence_score": "0.50", "sighting_count": 6, "first_seen": "2026-08-06 13:09:18", "last_seen": "2026-08-23 13:09:21" }, { "ioc_value": "https:\/\/unit42.paloaltonetworks.com\/polyglot-file-icedid-payload", "ioc_type": "url", "category": "ATT&CK", "threat_score": "0.50", "confidence_score": "0.50", "sighting_count": 6, "first_seen": "2026-08-06 13:09:18", "last_seen": "2026-08-23 13:09:21" }, { "ioc_value": "https:\/\/news.sophos.com\/en-us\/2021\/03\/01\/gootloader-expands-its-payload-delivery-options\/", "ioc_type": "url", "category": "ATT&CK", "threat_score": "0.50", "confidence_score": "0.50", "sighting_count": 6, "first_seen": "2026-08-06 13:09:17", "last_seen": "2026-08-23 13:09:20" }, { "ioc_value": "https:\/\/www.aikido.dev\/blog\/teampcp-stage-payload-canisterworm-iran", "ioc_type": "url", "category": "ATT&CK", "threat_score": "0.50", "confidence_score": "0.50", "sighting_count": 7, "first_seen": "2026-08-06 13:09:17", "last_seen": "2026-08-23 13:09:20" }, { "ioc_value": "https:\/\/www.crowdstrike.com\/blog\/self-extracting-archives-decoy-files-and-their-hidden-payloads\/", "ioc_type": "url", "category": "ATT&CK", "threat_score": "0.50", "confidence_score": "0.50", "sighting_count": 6, "first_seen": "2026-08-06 13:09:18", "last_seen": "2026-08-23 13:09:20" }, { "ioc_value": "https:\/\/www.microsoft.com\/security\/blog\/2016\/07\/14\/reverse-engineering-dubnium-stage-2-payload-analysis\/", "ioc_type": "url", "category": "ATT&CK", "threat_score": "0.50", "confidence_score": "0.50", "sighting_count": 6, "first_seen": "2026-08-06 13:09:17", "last_seen": "2026-08-23 13:09:20" }, { "ioc_value": "https:\/\/blog.trendmicro.com\/trendlabs-security-intelligence\/skidmap-linux-malware-uses-rootkit-capabilities-to-hide-cryptocurrency-mining-payload\/", "ioc_type": "url", "category": "ATT&CK", "threat_score": "0.50", "confidence_score": "0.50", "sighting_count": 6, "first_seen": "2026-08-06 13:09:17", "last_seen": "2026-08-23 13:09:20" }, { "ioc_value": "https:\/\/www.malwarebytes.com\/blog\/news\/2021\/12\/sidecopy-apt-connecting-lures-to-victims-payloads-to-infrastructure", "ioc_type": "url", "category": "ATT&CK", "threat_score": "0.50", "confidence_score": "0.50", "sighting_count": 6, "first_seen": "2026-08-06 13:09:17", "last_seen": "2026-08-23 13:09:19" }, { "ioc_value": "https:\/\/www.sonatype.com\/blog\/six-npm-packages-use-ethereum-transactions-to-retrieve-malicious-payloads\\n\\nSix", "ioc_type": "url", "category": "Threat Reports", "threat_score": "0.50", "confidence_score": "0.50", "sighting_count": 1, "first_seen": "2026-08-23 12:47:34", "last_seen": "2026-08-23 12:47:34" }, { "ioc_value": "https:\/\/www.sonatype.com\/blog\/six-npm-packages-use-ethereum-transactions-to-retrieve-malicious-payloads\\n\\nResearchers", "ioc_type": "url", "category": "Threat Reports", "threat_score": "0.50", "confidence_score": "0.50", "sighting_count": 1, "first_seen": "2026-08-23 12:47:34", "last_seen": "2026-08-23 12:47:34" }, { "ioc_value": "https:\/\/www.sonatype.com\/blog\/six-npm-packages-use-ethereum-transactions-to-retrieve-malicious-payloads\\n\\nThe", "ioc_type": "url", "category": "Threat Reports", "threat_score": "0.50", "confidence_score": "0.50", "sighting_count": 1, "first_seen": "2026-08-23 12:47:34", "last_seen": "2026-08-23 12:47:34" }, { "ioc_value": "https:\/\/www.sonatype.com\/blog\/six-npm-packages-use-ethereum-transactions-to-retrieve-malicious-payloads\\n\\nSource:", "ioc_type": "url", "category": "Threat Reports", "threat_score": "0.50", "confidence_score": "0.50", "sighting_count": 1, "first_seen": "2026-08-23 12:47:34", "last_seen": "2026-08-23 12:47:34" }, { "ioc_value": "https:\/\/www.sonatype.com\/blog\/six-npm-packages-use-ethereum-transactions-to-retrieve-malicious-payloads\\n\\nPage", "ioc_type": "url", "category": "Threat Reports", "threat_score": "0.50", "confidence_score": "0.50", "sighting_count": 1, "first_seen": "2026-08-23 12:47:34", "last_seen": "2026-08-23 12:47:34" }, { "ioc_value": "https:\/\/www.sonatype.com\/blog\/six-npm-packages-use-ethereum-transactions-to-retrieve-malicious-payloads", "ioc_type": "url", "category": "Threat Reports", "threat_score": "0.50", "confidence_score": "0.50", "sighting_count": 1, "first_seen": "2026-08-23 12:47:34", "last_seen": "2026-08-23 12:47:34" }, { "ioc_value": "http:\/\/45.207.196.86\/payload.sh", "ioc_type": "url", "category": "Domains\/URLs", "threat_score": "0.50", "confidence_score": "0.50", "sighting_count": 7, "first_seen": "2026-08-06 13:07:37", "last_seen": "2026-08-23 11:08:20" }, { "ioc_value": "payload.enc", "ioc_type": "other", "category": "Domains\/URLs", "threat_score": "0.50", "confidence_score": "0.50", "sighting_count": 3, "first_seen": "2026-08-06 13:11:11", "last_seen": "2026-08-23 09:01:40" }, { "ioc_value": "payload.res", "ioc_type": "other", "category": "Domains\/URLs", "threat_score": "0.50", "confidence_score": "0.50", "sighting_count": 3, "first_seen": "2026-08-06 13:11:11", "last_seen": "2026-08-23 09:01:40" }, { "ioc_value": "payload.txt", "ioc_type": "other", "category": "Domains\/URLs", "threat_score": "0.50", "confidence_score": "0.50", "sighting_count": 4, "first_seen": "2026-08-06 13:11:11", "last_seen": "2026-08-23 09:01:40" }, { "ioc_value": "https:\/\/app.validin.com\/detail?type=dom&find=payload.exe", "ioc_type": "url", "category": "Domains\/URLs", "threat_score": "0.50", "confidence_score": "0.50", "sighting_count": 3, "first_seen": "2026-08-06 13:11:09", "last_seen": "2026-08-23 09:01:37" }, { "ioc_value": "https:\/\/www.netskope.com\/jp\/blog\/latrodectus-rapid-evolution-continues-with-latest-new-payload-features", "ioc_type": "url", "category": "Malware Attribution", "threat_score": "0.50", "confidence_score": "0.50", "sighting_count": 4, "first_seen": "2026-08-06 13:07:43", "last_seen": "2026-08-12 00:08:24" }, { "ioc_value": "s.generateTracePayload", "ioc_type": "other", "category": "Disinformation", "threat_score": "0.50", "confidence_score": "0.50", "sighting_count": 1, "first_seen": "2026-08-06 19:47:43", "last_seen": "2026-08-06 19:47:43" }, { "ioc_value": "https:\/\/bernasibutuwqu2.com\/debug\/payload.applescript", "ioc_type": "url", "category": "Malware", "threat_score": "0.50", "confidence_score": "0.50", "sighting_count": 1, "first_seen": "2026-08-06 19:46:49", "last_seen": "2026-08-06 19:46:49" }, { "ioc_value": "http:\/\/168.220.248.106:9087\/payload\/a6i3khk75wgf\/7m0g9inf47", "ioc_type": "url", "category": "Malware", "threat_score": "0.50", "confidence_score": "0.50", "sighting_count": 1, "first_seen": "2026-08-06 19:46:48", "last_seen": "2026-08-06 19:46:48" }, { "ioc_value": "http:\/\/168.220.248.106:9087\/payload\/a6i3khk75wgf\/8260f4p5nk", "ioc_type": "url", "category": "Malware", "threat_score": "0.50", "confidence_score": "0.50", "sighting_count": 1, "first_seen": "2026-08-06 19:46:48", "last_seen": "2026-08-06 19:46:48" }, { "ioc_value": "http:\/\/168.220.248.106:9087\/payload\/a6i3khk75wgf\/9rkb4qtpm3", "ioc_type": "url", "category": "Malware", "threat_score": "0.50", "confidence_score": "0.50", "sighting_count": 1, "first_seen": "2026-08-06 19:46:48", "last_seen": "2026-08-06 19:46:48" }, { "ioc_value": "http:\/\/168.220.248.106:9087\/payload\/a6i3khk75wgf\/b7hovpz6ti", "ioc_type": "url", "category": "Malware", "threat_score": "0.50", "confidence_score": "0.50", "sighting_count": 1, "first_seen": "2026-08-06 19:46:48", "last_seen": "2026-08-06 19:46:48" }, { "ioc_value": "http:\/\/168.220.248.106:9087\/payload\/a6i3khk75wgf\/qfighdyhbm", "ioc_type": "url", "category": "Malware", "threat_score": "0.50", "confidence_score": "0.50", "sighting_count": 1, "first_seen": "2026-08-06 19:46:48", "last_seen": "2026-08-06 19:46:48" }, { "ioc_value": "http:\/\/168.220.248.106:9087\/payload\/a6i3khk75wgf\/f1yu71wyjd", "ioc_type": "url", "category": "Malware", "threat_score": "0.50", "confidence_score": "0.50", "sighting_count": 1, "first_seen": "2026-08-06 19:46:48", "last_seen": "2026-08-06 19:46:48" }, { "ioc_value": "http:\/\/168.220.248.106:9087\/payload\/a6i3khk75wgf\/lhyrtqlndq", "ioc_type": "url", "category": "Malware", "threat_score": "0.50", "confidence_score": "0.50", "sighting_count": 1, "first_seen": "2026-08-06 19:46:48", "last_seen": "2026-08-06 19:46:48" }, { "ioc_value": "http:\/\/168.220.248.106:9087\/payload\/a6i3khk75wgf\/ezidr3y5ct", "ioc_type": "url", "category": "Malware", "threat_score": "0.50", "confidence_score": "0.50", "sighting_count": 1, "first_seen": "2026-08-06 19:46:48", "last_seen": "2026-08-06 19:46:48" }, { "ioc_value": "http:\/\/168.220.248.106:9087\/payload\/a6i3khk75wgf\/zkrbtwag7o", "ioc_type": "url", "category": "Malware", "threat_score": "0.50", "confidence_score": "0.50", "sighting_count": 1, "first_seen": "2026-08-06 19:46:48", "last_seen": "2026-08-06 19:46:48" }, { "ioc_value": "http:\/\/168.220.248.106:9087\/payload\/a6i3khk75wgf\/wpd1a29m25", "ioc_type": "url", "category": "Malware", "threat_score": "0.50", "confidence_score": "0.50", "sighting_count": 1, "first_seen": "2026-08-06 19:46:48", "last_seen": "2026-08-06 19:46:48" }, { "ioc_value": "http:\/\/168.220.248.106:9087\/payload\/a6i3khk75wgf\/xcjygk37yu", "ioc_type": "url", "category": "Malware", "threat_score": "0.50", "confidence_score": "0.50", "sighting_count": 1, "first_seen": "2026-08-06 19:46:48", "last_seen": "2026-08-06 19:46:48" }, { "ioc_value": "http:\/\/168.220.248.106:9087\/payload\/a6i3khk75wgf\/4jiz0v4h1r", "ioc_type": "url", "category": "Malware", "threat_score": "0.50", "confidence_score": "0.50", "sighting_count": 1, "first_seen": "2026-08-06 19:46:48", "last_seen": "2026-08-06 19:46:48" }, { "ioc_value": "http:\/\/168.220.248.106:9087\/payload\/a6i3khk75wgf\/84aghucl1g", "ioc_type": "url", "category": "Malware", "threat_score": "0.50", "confidence_score": "0.50", "sighting_count": 1, "first_seen": "2026-08-06 19:46:48", "last_seen": "2026-08-06 19:46:48" }, { "ioc_value": "http:\/\/168.220.248.106:9087\/payload\/a6i3khk75wgf\/mn42gxnolr", "ioc_type": "url", "category": "Malware", "threat_score": "0.50", "confidence_score": "0.50", "sighting_count": 1, "first_seen": "2026-08-06 19:46:48", "last_seen": "2026-08-06 19:46:48" }, { "ioc_value": "http:\/\/168.220.248.106:9087\/payload\/a6i3khk75wgf\/3aoq8phdv9", "ioc_type": "url", "category": "Malware", "threat_score": "0.50", "confidence_score": "0.50", "sighting_count": 1, "first_seen": "2026-08-06 19:46:48", "last_seen": "2026-08-06 19:46:48" }, { "ioc_value": "http:\/\/168.220.248.106:9087\/payload\/a6i3khk75wgf\/jc6g6x1vph", "ioc_type": "url", "category": "Malware", "threat_score": "0.50", "confidence_score": "0.50", "sighting_count": 1, "first_seen": "2026-08-06 19:46:48", "last_seen": "2026-08-06 19:46:48" }, { "ioc_value": "http:\/\/168.220.248.106:9087\/payload\/a6i3khk75wgf\/4vxlsuz00c", "ioc_type": "url", "category": "Malware", "threat_score": "0.50", "confidence_score": "0.50", "sighting_count": 1, "first_seen": "2026-08-06 19:46:48", "last_seen": "2026-08-06 19:46:48" }, { "ioc_value": "http:\/\/168.220.248.106:9087\/payload\/a6i3khk75wgf\/ksoilti7oi", "ioc_type": "url", "category": "Malware", "threat_score": "0.50", "confidence_score": "0.50", "sighting_count": 1, "first_seen": "2026-08-06 19:46:48", "last_seen": "2026-08-06 19:46:48" }, { "ioc_value": "http:\/\/193.233.113.85\/payload.sh", "ioc_type": "url", "category": "Malware", "threat_score": "0.50", "confidence_score": "0.50", "sighting_count": 1, "first_seen": "2026-08-06 19:46:48", "last_seen": "2026-08-06 19:46:48" }, { "ioc_value": "http:\/\/83.217.209.80\/payload.sh", "ioc_type": "url", "category": "Malware", "threat_score": "0.50", "confidence_score": "0.50", "sighting_count": 1, "first_seen": "2026-08-06 19:46:48", "last_seen": "2026-08-06 19:46:48" }, { "ioc_value": "http:\/\/178.16.53.143:8080\/payload.cs", "ioc_type": "url", "category": "Malware", "threat_score": "0.50", "confidence_score": "0.50", "sighting_count": 1, "first_seen": "2026-08-06 19:46:48", "last_seen": "2026-08-06 19:46:48" }, { "ioc_value": "https:\/\/jankop.shop\/stego_payload23456.png", "ioc_type": "url", "category": "Malware", "threat_score": "0.50", "confidence_score": "0.50", "sighting_count": 1, "first_seen": "2026-08-06 19:46:48", "last_seen": "2026-08-06 19:46:48" }, { "ioc_value": "http:\/\/45.153.34.93\/payload", "ioc_type": "url", "category": "Malware", "threat_score": "0.50", "confidence_score": "0.50", "sighting_count": 1, "first_seen": "2026-08-06 19:46:48", "last_seen": "2026-08-06 19:46:48" }, { "ioc_value": "http:\/\/hexvm.cloud:2095\/payload.sh", "ioc_type": "url", "category": "Malware", "threat_score": "0.50", "confidence_score": "0.50", "sighting_count": 1, "first_seen": "2026-08-06 19:46:48", "last_seen": "2026-08-06 19:46:48" }, { "ioc_value": "https:\/\/i.postimg.cc\/YC5yGSkG\/ste-payload.png", "ioc_type": "url", "category": "Malware", "threat_score": "0.50", "confidence_score": "0.50", "sighting_count": 1, "first_seen": "2026-08-06 19:46:47", "last_seen": "2026-08-06 19:46:47" }, { "ioc_value": "https:\/\/i.postimg.cc\/8PSWBzht\/stego-payload.png", "ioc_type": "url", "category": "Malware", "threat_score": "0.50", "confidence_score": "0.50", "sighting_count": 1, "first_seen": "2026-08-06 19:46:47", "last_seen": "2026-08-06 19:46:47" }, { "ioc_value": "https:\/\/github.com\/tiiisiet65-sudo\/adawcacaw\/raw\/refs\/heads\/main\/payload.zip", "ioc_type": "url", "category": "Malware", "threat_score": "0.50", "confidence_score": "0.50", "sighting_count": 1, "first_seen": "2026-08-06 19:46:46", "last_seen": "2026-08-06 19:46:46" }, { "ioc_value": "https:\/\/github.com\/tiiisiet65-sudo\/adawcacaw\/raw\/refs\/heads\/main\/payload.b64", "ioc_type": "url", "category": "Malware", "threat_score": "0.50", "confidence_score": "0.50", "sighting_count": 1, "first_seen": "2026-08-06 19:46:46", "last_seen": "2026-08-06 19:46:46" }, { "ioc_value": "https:\/\/ritubohara.com\/stego_payload.png", "ioc_type": "url", "category": "Malware", "threat_score": "0.50", "confidence_score": "0.50", "sighting_count": 1, "first_seen": "2026-08-06 19:46:46", "last_seen": "2026-08-06 19:46:46" }, { "ioc_value": "https:\/\/inervadores.life\/bin\/stego_payload.png", "ioc_type": "url", "category": "Malware", "threat_score": "0.50", "confidence_score": "0.50", "sighting_count": 1, "first_seen": "2026-08-06 19:46:46", "last_seen": "2026-08-06 19:46:46" }, { "ioc_value": "https:\/\/corwineagles.com\/payloads.png", "ioc_type": "url", "category": "Malware", "threat_score": "0.50", "confidence_score": "0.50", "sighting_count": 1, "first_seen": "2026-08-06 19:46:46", "last_seen": "2026-08-06 19:46:46" }, { "ioc_value": "https:\/\/inervadores.life\/enter\/stego_payload.png", "ioc_type": "url", "category": "Malware", "threat_score": "0.50", "confidence_score": "0.50", "sighting_count": 1, "first_seen": "2026-08-06 19:46:46", "last_seen": "2026-08-06 19:46:46" }, { "ioc_value": "http:\/\/172.86.110.181:8080\/payload.exe", "ioc_type": "url", "category": "Malware", "threat_score": "0.50", "confidence_score": "0.50", "sighting_count": 1, "first_seen": "2026-08-06 19:46:46", "last_seen": "2026-08-06 19:46:46" }, { "ioc_value": "https:\/\/corwineagles.com\/stego_payload.png", "ioc_type": "url", "category": "Malware", "threat_score": "0.50", "confidence_score": "0.50", "sighting_count": 1, "first_seen": "2026-08-06 19:46:46", "last_seen": "2026-08-06 19:46:46" }, { "ioc_value": "https:\/\/s.littleshabby.net\/payloads\/zzh", "ioc_type": "url", "category": "Malware", "threat_score": "0.50", "confidence_score": "0.50", "sighting_count": 1, "first_seen": "2026-08-06 19:46:46", "last_seen": "2026-08-06 19:46:46" }, { "ioc_value": "http:\/\/s.littleshabby.net\/payloads\/indexi.png", "ioc_type": "url", "category": "Malware", "threat_score": "0.50", "confidence_score": "0.50", "sighting_count": 1, "first_seen": "2026-08-06 19:46:46", "last_seen": "2026-08-06 19:46:46" }, { "ioc_value": "http:\/\/s.littleshabby.net\/payloads\/indexis.png", "ioc_type": "url", "category": "Malware", "threat_score": "0.50", "confidence_score": "0.50", "sighting_count": 1, "first_seen": "2026-08-06 19:46:46", "last_seen": "2026-08-06 19:46:46" }, { "ioc_value": "https:\/\/s.littleshabby.net\/payloads\/indexi.png", "ioc_type": "url", "category": "Malware", "threat_score": "0.50", "confidence_score": "0.50", "sighting_count": 1, "first_seen": "2026-08-06 19:46:46", "last_seen": "2026-08-06 19:46:46" }, { "ioc_value": "http:\/\/s.littleshabby.net\/payloads\/zzh", "ioc_type": "url", "category": "Malware", "threat_score": "0.50", "confidence_score": "0.50", "sighting_count": 1, "first_seen": "2026-08-06 19:46:46", "last_seen": "2026-08-06 19:46:46" }, { "ioc_value": "http:\/\/s.littleshabby.net\/payloads\/indexrs.png", "ioc_type": "url", "category": "Malware", "threat_score": "0.50", "confidence_score": "0.50", "sighting_count": 1, "first_seen": "2026-08-06 19:46:46", "last_seen": "2026-08-06 19:46:46" }, { "ioc_value": "https:\/\/s.littleshabby.net\/payloads\/indexrs.png", "ioc_type": "url", "category": "Malware", "threat_score": "0.50", "confidence_score": "0.50", "sighting_count": 1, "first_seen": "2026-08-06 19:46:46", "last_seen": "2026-08-06 19:46:46" }, { "ioc_value": "https:\/\/s.littleshabby.net\/payloads\/indexni.png", "ioc_type": "url", "category": "Malware", "threat_score": "0.50", "confidence_score": "0.50", "sighting_count": 1, "first_seen": "2026-08-06 19:46:46", "last_seen": "2026-08-06 19:46:46" }, { "ioc_value": "https:\/\/s.littleshabby.net\/payloads\/indexis.png", "ioc_type": "url", "category": "Malware", "threat_score": "0.50", "confidence_score": "0.50", "sighting_count": 1, "first_seen": "2026-08-06 19:46:46", "last_seen": "2026-08-06 19:46:46" }, { "ioc_value": "http:\/\/s.littleshabby.net\/payloads\/indexni.png", "ioc_type": "url", "category": "Malware", "threat_score": "0.50", "confidence_score": "0.50", "sighting_count": 1, "first_seen": "2026-08-06 19:46:46", "last_seen": "2026-08-06 19:46:46" }, { "ioc_value": "https:\/\/s.littleshabby.net\/payloads\/rs.sh", "ioc_type": "url", "category": "Malware", "threat_score": "0.50", "confidence_score": "0.50", "sighting_count": 1, "first_seen": "2026-08-06 19:46:46", "last_seen": "2026-08-06 19:46:46" }, { "ioc_value": "http:\/\/103.45.68.4\/payload.bin", "ioc_type": "url", "category": "Malware", "threat_score": "0.50", "confidence_score": "0.50", "sighting_count": 1, "first_seen": "2026-08-06 19:46:46", "last_seen": "2026-08-06 19:46:46" }, { "ioc_value": "http:\/\/s.littleshabby.net\/payloads\/rs.sh", "ioc_type": "url", "category": "Malware", "threat_score": "0.50", "confidence_score": "0.50", "sighting_count": 1, "first_seen": "2026-08-06 19:46:46", "last_seen": "2026-08-06 19:46:46" }, { "ioc_value": "https:\/\/s.littleshabby.net\/payloads\/is.sh", "ioc_type": "url", "category": "Malware", "threat_score": "0.50", "confidence_score": "0.50", "sighting_count": 1, "first_seen": "2026-08-06 19:46:46", "last_seen": "2026-08-06 19:46:46" }, { "ioc_value": "http:\/\/s.littleshabby.net\/payloads\/init.sh", "ioc_type": "url", "category": "Malware", "threat_score": "0.50", "confidence_score": "0.50", "sighting_count": 1, "first_seen": "2026-08-06 19:46:46", "last_seen": "2026-08-06 19:46:46" }, { "ioc_value": "https:\/\/s.littleshabby.net\/payloads\/newinit.sh", "ioc_type": "url", "category": "Malware", "threat_score": "0.50", "confidence_score": "0.50", "sighting_count": 1, "first_seen": "2026-08-06 19:46:46", "last_seen": "2026-08-06 19:46:46" }, { "ioc_value": "http:\/\/s.littleshabby.net\/payloads\/newinit.sh", "ioc_type": "url", "category": "Malware", "threat_score": "0.50", "confidence_score": "0.50", "sighting_count": 1, "first_seen": "2026-08-06 19:46:46", "last_seen": "2026-08-06 19:46:46" }, { "ioc_value": "http:\/\/s.littleshabby.net\/payloads\/is.sh", "ioc_type": "url", "category": "Malware", "threat_score": "0.50", "confidence_score": "0.50", "sighting_count": 1, "first_seen": "2026-08-06 19:46:46", "last_seen": "2026-08-06 19:46:46" }, { "ioc_value": "https:\/\/s.littleshabby.net\/payloads\/init.sh", "ioc_type": "url", "category": "Malware", "threat_score": "0.50", "confidence_score": "0.50", "sighting_count": 1, "first_seen": "2026-08-06 19:46:46", "last_seen": "2026-08-06 19:46:46" }, { "ioc_value": "https:\/\/qw4c12qqqqoepwq.com\/debug\/payload.applescript?build=94dabb3c6bb6d13338b7dadcc1432c4a", "ioc_type": "url", "category": "Malware", "threat_score": "0.50", "confidence_score": "0.50", "sighting_count": 1, "first_seen": "2026-08-06 19:46:46", "last_seen": "2026-08-06 19:46:46" }, { "ioc_value": "http:\/\/45.85.218.109\/payload.sh", "ioc_type": "url", "category": "Malware", "threat_score": "0.50", "confidence_score": "0.50", "sighting_count": 1, "first_seen": "2026-08-06 19:46:46", "last_seen": "2026-08-06 19:46:46" }, { "ioc_value": "http:\/\/45.202.246.143\/bins\/payload.xml", "ioc_type": "url", "category": "Malware", "threat_score": "0.50", "confidence_score": "0.50", "sighting_count": 1, "first_seen": "2026-08-06 19:46:45", "last_seen": "2026-08-06 19:46:45" }, { "ioc_value": "https:\/\/salsabil.com\/steg\/stego_payloadxxx.png", "ioc_type": "url", "category": "Malware", "threat_score": "0.50", "confidence_score": "0.50", "sighting_count": 1, "first_seen": "2026-08-06 19:46:45", "last_seen": "2026-08-06 19:46:45" }, { "ioc_value": "https:\/\/www.controliumbt.com\/cpeg\/stego_payload.png", "ioc_type": "url", "category": "Malware", "threat_score": "0.50", "confidence_score": "0.50", "sighting_count": 1, "first_seen": "2026-08-06 19:46:45", "last_seen": "2026-08-06 19:46:45" }, { "ioc_value": "http:\/\/94.26.106.236\/payload.sh", "ioc_type": "url", "category": "Malware", "threat_score": "0.50", "confidence_score": "0.50", "sighting_count": 1, "first_seen": "2026-08-06 19:46:45", "last_seen": "2026-08-06 19:46:45" }, { "ioc_value": "https:\/\/mamigummy.com\/md\/dog_payload.png", "ioc_type": "url", "category": "Malware", "threat_score": "0.50", "confidence_score": "0.50", "sighting_count": 1, "first_seen": "2026-08-06 19:46:44", "last_seen": "2026-08-06 19:46:44" }, { "ioc_value": "https:\/\/badeer.fit\/a\/stego_payload.png", "ioc_type": "url", "category": "Malware", "threat_score": "0.50", "confidence_score": "0.50", "sighting_count": 1, "first_seen": "2026-08-06 19:46:44", "last_seen": "2026-08-06 19:46:44" }, { "ioc_value": "https:\/\/rcqwr12c541wa421q.com\/debug\/payload.applescript?build=4255a2023db4a285d45efb4aeedd4897", "ioc_type": "url", "category": "Malware", "threat_score": "0.50", "confidence_score": "0.50", "sighting_count": 1, "first_seen": "2026-08-06 19:46:44", "last_seen": "2026-08-06 19:46:44" }, { "ioc_value": "http:\/\/176.65.134.33\/payload.sh", "ioc_type": "url", "category": "Malware", "threat_score": "0.50", "confidence_score": "0.50", "sighting_count": 1, "first_seen": "2026-08-06 19:46:44", "last_seen": "2026-08-06 19:46:44" }, { "ioc_value": "https:\/\/voltejeasteis.click\/lack\/stego_payload.png", "ioc_type": "url", "category": "Malware", "threat_score": "0.50", "confidence_score": "0.50", "sighting_count": 1, "first_seen": "2026-08-06 19:46:44", "last_seen": "2026-08-06 19:46:44" }, { "ioc_value": "http:\/\/sixmexicos.com\/jp\/stego_payload.png", "ioc_type": "url", "category": "Malware", "threat_score": "0.50", "confidence_score": "0.50", "sighting_count": 1, "first_seen": "2026-08-06 19:46:44", "last_seen": "2026-08-06 19:46:44" }, { "ioc_value": "http:\/\/inini.kesug.com\/uploads\/payload.txt", "ioc_type": "url", "category": "Malware", "threat_score": "0.50", "confidence_score": "0.50", "sighting_count": 1, "first_seen": "2026-08-06 19:46:44", "last_seen": "2026-08-06 19:46:44" }, { "ioc_value": "http:\/\/217.60.195.146\/bins\/payload.sh", "ioc_type": "url", "category": "Malware", "threat_score": "0.50", "confidence_score": "0.50", "sighting_count": 1, "first_seen": "2026-08-06 19:46:44", "last_seen": "2026-08-06 19:46:44" }, { "ioc_value": "http:\/\/217.60.195.146\/payload.sh", "ioc_type": "url", "category": "Malware", "threat_score": "0.50", "confidence_score": "0.50", "sighting_count": 1, "first_seen": "2026-08-06 19:46:44", "last_seen": "2026-08-06 19:46:44" }, { "ioc_value": "http:\/\/31.56.209.222\/payload.sh", "ioc_type": "url", "category": "Malware", "threat_score": "0.50", "confidence_score": "0.50", "sighting_count": 1, "first_seen": "2026-08-06 19:46:44", "last_seen": "2026-08-06 19:46:44" }, { "ioc_value": "http:\/\/209.99.190.157\/payload.exe", "ioc_type": "url", "category": "Malware", "threat_score": "0.50", "confidence_score": "0.50", "sighting_count": 1, "first_seen": "2026-08-06 19:46:42", "last_seen": "2026-08-06 19:46:42" }, { "ioc_value": "https:\/\/5v12-3my5908y1.com\/debug\/payload.applescript", "ioc_type": "url", "category": "Malware", "threat_score": "0.50", "confidence_score": "0.50", "sighting_count": 1, "first_seen": "2026-08-06 19:46:42", "last_seen": "2026-08-06 19:46:42" }, { "ioc_value": "http:\/\/31.56.209.84\/payload.sh", "ioc_type": "url", "category": "Malware", "threat_score": "0.50", "confidence_score": "0.50", "sighting_count": 1, "first_seen": "2026-08-06 19:46:42", "last_seen": "2026-08-06 19:46:42" }, { "ioc_value": "http:\/\/5.175.189.102:8080\/payload.sh", "ioc_type": "url", "category": "Malware", "threat_score": "0.50", "confidence_score": "0.50", "sighting_count": 1, "first_seen": "2026-08-06 19:46:42", "last_seen": "2026-08-06 19:46:42" }, { "ioc_value": "https:\/\/mamigummy.com\/.well-known\/stego_payload.png", "ioc_type": "url", "category": "Malware", "threat_score": "0.50", "confidence_score": "0.50", "sighting_count": 1, "first_seen": "2026-08-06 19:46:42", "last_seen": "2026-08-06 19:46:42" }, { "ioc_value": "https:\/\/mamigummy.com\/.well-known\/stego_payload%20(3).png", "ioc_type": "url", "category": "Malware", "threat_score": "0.50", "confidence_score": "0.50", "sighting_count": 1, "first_seen": "2026-08-06 19:46:42", "last_seen": "2026-08-06 19:46:42" }, { "ioc_value": "https:\/\/mamigummy.com\/.well-known\/stego_payload%20(31).png", "ioc_type": "url", "category": "Malware", "threat_score": "0.50", "confidence_score": "0.50", "sighting_count": 1, "first_seen": "2026-08-06 19:46:42", "last_seen": "2026-08-06 19:46:42" }, { "ioc_value": "https:\/\/mamigummy.com\/.well-known\/stego_payload%20(6).png", "ioc_type": "url", "category": "Malware", "threat_score": "0.50", "confidence_score": "0.50", "sighting_count": 1, "first_seen": "2026-08-06 19:46:42", "last_seen": "2026-08-06 19:46:42" }, { "ioc_value": "https:\/\/mamigummy.com\/.well-known\/stego_payload%20(9).png", "ioc_type": "url", "category": "Malware", "threat_score": "0.50", "confidence_score": "0.50", "sighting_count": 1, "first_seen": "2026-08-06 19:46:42", "last_seen": "2026-08-06 19:46:42" }, { "ioc_value": "http:\/\/155.138.195.0:8080\/payload.exe", "ioc_type": "url", "category": "Malware", "threat_score": "0.50", "confidence_score": "0.50", "sighting_count": 1, "first_seen": "2026-08-06 19:46:42", "last_seen": "2026-08-06 19:46:42" }, { "ioc_value": "https:\/\/ach-sa.com\/wp-content\/plugins\/resmushit-image-optimizer\/stego_payload.png", "ioc_type": "url", "category": "Malware", "threat_score": "0.50", "confidence_score": "0.50", "sighting_count": 1, "first_seen": "2026-08-06 19:46:42", "last_seen": "2026-08-06 19:46:42" }, { "ioc_value": "https:\/\/lb.nigsv.com\/maiv\/stego_payloads.png", "ioc_type": "url", "category": "Malware", "threat_score": "0.50", "confidence_score": "0.50", "sighting_count": 1, "first_seen": "2026-08-06 19:46:42", "last_seen": "2026-08-06 19:46:42" }, { "ioc_value": "https:\/\/latinaria.xyz\/enter\/stego_payload1.png", "ioc_type": "url", "category": "Malware", "threat_score": "0.50", "confidence_score": "0.50", "sighting_count": 1, "first_seen": "2026-08-06 19:46:42", "last_seen": "2026-08-06 19:46:42" }, { "ioc_value": "http:\/\/85.204.125.67:8080\/payload.sh", "ioc_type": "url", "category": "Malware", "threat_score": "0.50", "confidence_score": "0.50", "sighting_count": 1, "first_seen": "2026-08-06 19:46:41", "last_seen": "2026-08-06 19:46:41" }, { "ioc_value": "http:\/\/2.26.75.58\/payload.sh", "ioc_type": "url", "category": "Malware", "threat_score": "0.50", "confidence_score": "0.50", "sighting_count": 1, "first_seen": "2026-08-06 19:46:41", "last_seen": "2026-08-06 19:46:41" }, { "ioc_value": "http:\/\/sarinaglobal.sbs\/schx\/stego_payload.png", "ioc_type": "url", "category": "Domains\/URLs", "threat_score": "0.50", "confidence_score": "0.50", "sighting_count": 5, "first_seen": "2026-08-06 13:07:38", "last_seen": "2026-08-06 19:46:40" }, { "ioc_value": "https:\/\/redhiban.cfd\/css\/css\/enter\/stego_payload.png", "ioc_type": "url", "category": "Domains\/URLs", "threat_score": "0.50", "confidence_score": "0.50", "sighting_count": 5, "first_seen": "2026-08-06 13:07:38", "last_seen": "2026-08-06 19:46:40" }, { "ioc_value": "http:\/\/185.143.223.115\/payload.exe", "ioc_type": "url", "category": "Domains\/URLs", "threat_score": "0.50", "confidence_score": "0.50", "sighting_count": 5, "first_seen": "2026-08-06 13:07:38", "last_seen": "2026-08-06 19:46:40" }, { "ioc_value": "http:\/\/94.154.43.51\/payload.sh", "ioc_type": "url", "category": "Domains\/URLs", "threat_score": "0.50", "confidence_score": "0.50", "sighting_count": 5, "first_seen": "2026-08-06 13:07:38", "last_seen": "2026-08-06 19:46:40" }, { "ioc_value": "http:\/\/208.85.17.8\/api\/payload?arch=$(uname", "ioc_type": "url", "category": "Domains\/URLs", "threat_score": "0.50", "confidence_score": "0.50", "sighting_count": 5, "first_seen": "2026-08-06 13:07:39", "last_seen": "2026-08-06 19:46:40" }, { "ioc_value": "https:\/\/exptersed.com\/debug\/payload.applescript", "ioc_type": "url", "category": "Domains\/URLs", "threat_score": "0.50", "confidence_score": "0.50", "sighting_count": 5, "first_seen": "2026-08-06 13:07:38", "last_seen": "2026-08-06 19:46:40" }, { "ioc_value": "https:\/\/exptersed.com\/debug\/payload.applescript?build=2200432e9275376bedaf93db2cd7feb4", "ioc_type": "url", "category": "Domains\/URLs", "threat_score": "0.50", "confidence_score": "0.50", "sighting_count": 5, "first_seen": "2026-08-06 13:07:38", "last_seen": "2026-08-06 19:46:40" }, { "ioc_value": "http:\/\/151.247.22.48:8080\/bins\/payload.sh", "ioc_type": "url", "category": "Domains\/URLs", "threat_score": "0.50", "confidence_score": "0.50", "sighting_count": 5, "first_seen": "2026-08-06 13:07:38", "last_seen": "2026-08-06 19:46:40" }, { "ioc_value": "http:\/\/208.85.17.8\/api\/payload.sh", "ioc_type": "url", "category": "Domains\/URLs", "threat_score": "0.50", "confidence_score": "0.50", "sighting_count": 5, "first_seen": "2026-08-06 13:07:39", "last_seen": "2026-08-06 19:46:40" }, { "ioc_value": "https:\/\/redhiban.cfd\/cn\/enter\/stego_payload.png", "ioc_type": "url", "category": "Domains\/URLs", "threat_score": "0.50", "confidence_score": "0.50", "sighting_count": 5, "first_seen": "2026-08-06 13:07:38", "last_seen": "2026-08-06 19:46:40" }, { "ioc_value": "http:\/\/69.12.83.188\/payload.ps1", "ioc_type": "url", "category": "Domains\/URLs", "threat_score": "0.50", "confidence_score": "0.50", "sighting_count": 5, "first_seen": "2026-08-06 13:07:38", "last_seen": "2026-08-06 19:46:40" }, { "ioc_value": "http:\/\/94.154.43.123:8080\/payload\/ce8wkx7wrurx\/ymvyvf.sh", "ioc_type": "url", "category": "Domains\/URLs", "threat_score": "0.50", "confidence_score": "0.50", "sighting_count": 5, "first_seen": "2026-08-06 13:07:38", "last_seen": "2026-08-06 19:46:39" }, { "ioc_value": "http:\/\/217.60.195.143\/payload.sh", "ioc_type": "url", "category": "Domains\/URLs", "threat_score": "0.50", "confidence_score": "0.50", "sighting_count": 7, "first_seen": "2026-08-06 13:07:38", "last_seen": "2026-08-06 19:46:39" }, { "ioc_value": "payloads.Lure", "ioc_type": "other", "category": "Malware Families", "threat_score": "0.50", "confidence_score": "0.50", "sighting_count": 2, "first_seen": "2026-08-06 13:13:03", "last_seen": "2026-08-06 14:45:34" }, { "ioc_value": "payloadynyvabjacbun4uwhmxc7yvdzorycslzmnleguxjn7glahsvqd.onion", "ioc_type": "onion", "category": "Ransomware Actors", "threat_score": "0.50", "confidence_score": "0.50", "sighting_count": 2, "first_seen": "2026-08-06 13:12:26", "last_seen": "2026-08-06 14:45:05" }, { "ioc_value": "http:\/\/payloadynyvabjacbun4uwhmxc7yvdzorycslzmnleguxjn7glahsvqd.onion", "ioc_type": "url", "category": "Ransomware Actors", "threat_score": "0.50", "confidence_score": "0.50", "sighting_count": 3, "first_seen": "2026-08-06 13:12:26", "last_seen": "2026-08-06 14:45:05" }, { "ioc_value": "payloadrz5yw227brtbvdqpnlhq3rdcdekdnn3rgucbcdeawq2v6vuyd.onion", "ioc_type": "onion", "category": "Ransomware Actors", "threat_score": "0.50", "confidence_score": "0.50", "sighting_count": 2, "first_seen": "2026-08-06 13:12:26", "last_seen": "2026-08-06 14:45:05" }, { "ioc_value": "http:\/\/payloadrz5yw227brtbvdqpnlhq3rdcdekdnn3rgucbcdeawq2v6vuyd.onion", "ioc_type": "url", "category": "Ransomware Actors", "threat_score": "0.50", "confidence_score": "0.50", "sighting_count": 3, "first_seen": "2026-08-06 13:12:26", "last_seen": "2026-08-06 14:45:05" }, { "ioc_value": "http:\/\/payloadrz5yw227brtbvdqpnlhq3rdcdekdnn3rgucbcdeawq2v6vuyd.onion\/", "ioc_type": "url", "category": "Ransomware Actors", "threat_score": "0.50", "confidence_score": "0.50", "sighting_count": 2, "first_seen": "2026-08-06 13:12:26", "last_seen": "2026-08-06 14:45:05" }, { "ioc_value": "https:\/\/www.ransomware.live\/group\/payload", "ioc_type": "url", "category": "Ransomware Actors", "threat_score": "0.50", "confidence_score": "0.50", "sighting_count": 2, "first_seen": "2026-08-06 13:12:26", "last_seen": "2026-08-06 14:45:05" }, { "ioc_value": "https:\/\/www.ransomware.live\/group\/payloadbin", "ioc_type": "url", "category": "Ransomware Actors", "threat_score": "0.50", "confidence_score": "0.50", "sighting_count": 2, "first_seen": "2026-08-06 13:12:26", "last_seen": "2026-08-06 14:45:05" }, { "ioc_value": "http:\/\/payload6eualw6kni6v2lqn7ovjcl76ojx25z5unsyvqo3lbqy3bo5qd.onion\/", "ioc_type": "url", "category": "Ransomware Actors", "threat_score": "0.50", "confidence_score": "0.50", "sighting_count": 1, "first_seen": "2026-08-06 13:13:02", "last_seen": "2026-08-06 13:13:02" }, { "ioc_value": "https:\/\/www.ransomlook.io\/group\/payload", "ioc_type": "url", "category": "Ransomware Actors", "threat_score": "0.50", "confidence_score": "0.50", "sighting_count": 1, "first_seen": "2026-08-06 13:13:02", "last_seen": "2026-08-06 13:13:02" }, { "ioc_value": "https:\/\/www.zscaler.com\/blogs\/security-research\/kaseya-supply-chain-ransomware-attack-technical-analysis-revil-payload", "ioc_type": "url", "category": "Ransomware Actors", "threat_score": "0.50", "confidence_score": "0.50", "sighting_count": 1, "first_seen": "2026-08-06 13:13:01", "last_seen": "2026-08-06 13:13:01" }, { "ioc_value": "https:\/\/www.bleepingcomputer.com\/news\/security\/new-evil-corp-ransomware-mimics-payloadbin-gang-to-evade-us-sanctions\/", "ioc_type": "url", "category": "Ransomware Actors", "threat_score": "0.50", "confidence_score": "0.50", "sighting_count": 1, "first_seen": "2026-08-06 13:13:01", "last_seen": "2026-08-06 13:13:01" }, { "ioc_value": "https:\/\/www.bleepingcomputer.com\/news\/security\/hive-ransomware-uses-new-ipfuscation-trick-to-hide-payload\/", "ioc_type": "url", "category": "Ransomware Actors", "threat_score": "0.50", "confidence_score": "0.50", "sighting_count": 1, "first_seen": "2026-08-06 13:13:01", "last_seen": "2026-08-06 13:13:01" }, { "ioc_value": "https:\/\/www.trendmicro.com\/content\/dam\/trendmicro\/global\/en\/research\/22\/d\/thwarting-loaders-from-socgholish-to-blisters-lockbit-payload\/iocs-thwarting-loaders-socgholish-blister.txt", "ioc_type": "url", "category": "Ransomware Actors", "threat_score": "0.50", "confidence_score": "0.50", "sighting_count": 1, "first_seen": "2026-08-06 13:13:01", "last_seen": "2026-08-06 13:13:01" }, { "ioc_value": "https:\/\/www.trendmicro.com\/en_no\/research\/22\/d\/Thwarting-Loaders-From-SocGholish-to-BLISTERs-LockBit-Payload.html", "ioc_type": "url", "category": "Ransomware Actors", "threat_score": "0.50", "confidence_score": "0.50", "sighting_count": 1, "first_seen": "2026-08-06 13:13:01", "last_seen": "2026-08-06 13:13:01" }, { "ioc_value": "https:\/\/www.trendmicro.com\/en_us\/research\/22\/d\/Thwarting-Loaders-From-SocGholish-to-BLISTERs-LockBit-Payload.html", "ioc_type": "url", "category": "Ransomware Actors", "threat_score": "0.50", "confidence_score": "0.50", "sighting_count": 1, "first_seen": "2026-08-06 13:13:01", "last_seen": "2026-08-06 13:13:01" }, { "ioc_value": "https:\/\/cyberintelmag.com\/malware-viruses\/payloadbin-ransomware-attributed-to-evil-corp", "ioc_type": "url", "category": "Ransomware Actors", "threat_score": "0.50", "confidence_score": "0.50", "sighting_count": 1, "first_seen": "2026-08-06 13:13:01", "last_seen": "2026-08-06 13:13:01" }, { "ioc_value": "https:\/\/www.ransomlook.io\/group\/payloadbin", "ioc_type": "url", "category": "Ransomware Actors", "threat_score": "0.50", "confidence_score": "0.50", "sighting_count": 1, "first_seen": "2026-08-06 13:13:01", "last_seen": "2026-08-06 13:13:01" }, { "ioc_value": "https:\/\/cryptax.medium.com\/android-bianlian-payload-61febabed00a", "ioc_type": "url", "category": "Ransomware Actors", "threat_score": "0.50", "confidence_score": "0.50", "sighting_count": 1, "first_seen": "2026-08-06 13:13:01", "last_seen": "2026-08-06 13:13:01" }, { "ioc_value": "https:\/\/yoroi.company\/research\/dissecting-bluesky-ransomware-payload\/", "ioc_type": "url", "category": "Ransomware Actors", "threat_score": "0.50", "confidence_score": "0.50", "sighting_count": 1, "first_seen": "2026-08-06 13:13:01", "last_seen": "2026-08-06 13:13:01" }, { "ioc_value": "https:\/\/www.databreaches.net\/babuk-re-organizes-as-payload-bin-offers-its-first-leak\/", "ioc_type": "url", "category": "Ransomware Actors", "threat_score": "0.50", "confidence_score": "0.50", "sighting_count": 1, "first_seen": "2026-08-06 13:13:01", "last_seen": "2026-08-06 13:13:01" }, { "ioc_value": "https:\/\/www.aikido.dev\/blog\/teampcp-stage-payload-canisterworm-iran\\n\\ncmd", "ioc_type": "url", "category": "Threat Reports", "threat_score": "0.50", "confidence_score": "0.50", "sighting_count": 1, "first_seen": "2026-08-06 13:12:36", "last_seen": "2026-08-06 13:12:36" }, { "ioc_value": "https:\/\/www.aikido.dev\/blog\/teampcp-stage-payload-canisterworm-iran\\n\\nHost\\n\\n\/var\/lib\/svc_internal\/runner.py\\n\\n\/etc\/systemd\/system\/internal-monitor.service\\n\\n\/tmp\/pglog\\n\\n\/tmp\/.pg_state\\n\\n\/var\/lib\/pgmon\/pgmon.py\\n\\n\/etc\/systemd\/system\/pgmonitor.service\\n\\nSystemd", "ioc_type": "url", "category": "Threat Reports", "threat_score": "0.50", "confidence_score": "0.50", "sighting_count": 1, "first_seen": "2026-08-06 13:12:36", "last_seen": "2026-08-06 13:12:36" }, { "ioc_value": "https:\/\/www.aikido.dev\/blog\/teampcp-stage-payload-canisterworm-iran\\n\\nPage", "ioc_type": "url", "category": "Threat Reports", "threat_score": "0.50", "confidence_score": "0.50", "sighting_count": 1, "first_seen": "2026-08-06 13:12:36", "last_seen": "2026-08-06 13:12:36" }, { "ioc_value": "https:\/\/www.aikido.dev\/blog\/teampcp-stage-payload-canisterworm-iran\\n\\nCanisterWorm", "ioc_type": "url", "category": "Threat Reports", "threat_score": "0.50", "confidence_score": "0.50", "sighting_count": 1, "first_seen": "2026-08-06 13:12:36", "last_seen": "2026-08-06 13:12:36" }, { "ioc_value": "https:\/\/www.aikido.dev\/blog\/teampcp-stage-payload-canisterworm-iran\\n\\nif", "ioc_type": "url", "category": "Threat Reports", "threat_score": "0.50", "confidence_score": "0.50", "sighting_count": 1, "first_seen": "2026-08-06 13:12:36", "last_seen": "2026-08-06 13:12:36" }, { "ioc_value": "https:\/\/www.aikido.dev\/blog\/teampcp-stage-payload-canisterworm-iran\\n\\nrm", "ioc_type": "url", "category": "Threat Reports", "threat_score": "0.50", "confidence_score": "0.50", "sighting_count": 1, "first_seen": "2026-08-06 13:12:36", "last_seen": "2026-08-06 13:12:36" }, { "ioc_value": "https:\/\/www.aikido.dev\/blog\/teampcp-stage-payload-canisterworm-iran\\n\\nmetadata:\\n\\nlabels:\\n\\nname:", "ioc_type": "url", "category": "Threat Reports", "threat_score": "0.50", "confidence_score": "0.50", "sighting_count": 1, "first_seen": "2026-08-06 13:12:36", "last_seen": "2026-08-06 13:12:36" }, { "ioc_value": "https:\/\/www.aikido.dev\/blog\/teampcp-stage-payload-canisterworm-iran\\n\\nname:", "ioc_type": "url", "category": "Threat Reports", "threat_score": "0.50", "confidence_score": "0.50", "sighting_count": 1, "first_seen": "2026-08-06 13:12:36", "last_seen": "2026-08-06 13:12:36" }, { "ioc_value": "https:\/\/www.aikido.dev\/blog\/teampcp-stage-payload-canisterworm-iran\\n\\npath:", "ioc_type": "url", "category": "Threat Reports", "threat_score": "0.50", "confidence_score": "0.50", "sighting_count": 1, "first_seen": "2026-08-06 13:12:36", "last_seen": "2026-08-06 13:12:36" }, { "ioc_value": "https:\/\/www.aikido.dev\/blog\/teampcp-stage-payload-canisterworm-iran\\n\\nOutbound", "ioc_type": "url", "category": "Threat Reports", "threat_score": "0.50", "confidence_score": "0.50", "sighting_count": 1, "first_seen": "2026-08-06 13:12:36", "last_seen": "2026-08-06 13:12:36" } ] }