Threat-Intel Contributions

Every payload our scanners trip is captured, defanged, hashed, and contributed back to the community's most trusted threat-intel platforms: abuse.ch MalwareBazaar and ThreatFox, VirusTotal, and AlienVault OTX. Samples go to MalwareBazaar; the URLs that served them go to ThreatFox as attributed IOCs. This page is live, public proof that whack.sh's multi-egress capture pipeline catches real, current malware, including samples that only appear when the target is probed from a residential or mobile vantage.

1,992 contributed to VirusTotal • 4,847 to MalwareBazaar • 13,953 to OTX • 9,733 IOCs to ThreatFox

unclassified ×2914 Mirai ×674 SalatStealer ×340 VShell ×290 ConnectWise ×74 CoinMiner ×48 Snowlight ×40 RustyStealer ×20 AsyncRAT ×19 Vidar ×13 Formbook ×12 Gafgyt ×11 njrat ×9 RemusStealer ×9 Stealc ×6 EtherSnake ×4 agenttesla ×4 quasar ×4 RemcosRAT ×4 AgentTesla ×4 Sliver ×3 QuasarRAT ×3 FleetDeck ×3 OverlordRAT ×2 MassLogger ×2 Amadey ×2 Heodo ×2 PythonStealer ×2 RemoteManipulator ×2 MaskGramStealer ×2 GCleaner ×2 Blackmoon ×2 SVCStealer ×2 AdaptixC2 ×2 MeshAgent ×2 AveMariaRAT ×1 WARDENStealer ×1 44CaliberStealer ×1 Adware.360SafeBrowse ×1 RevStealer ×1 UmbralStealer ×1 Babadeda ×1 LummaStealer ×1 BlankGrabber ×1 N-able ×1 Redosdru ×1 SantaStealer ×1 SheetRAT ×1 DCRat ×1 VenomRAT ×1 Worm.Ramnit ×1 XWorm ×1 Meterpreter ×1 NetSupport ×1 KoiLoader ×1 SilentNet ×1 MillenuimRAT ×1 Troldesh ×1 Stop ×1 PureLogsStealer ×1

Family	Type	Size	First seen	Detection	Vantage	Sample
unclassified		0 B		-	Cloaked 80%	`e9b106745a31`
unclassified		0 B		-	Cloaked 85%	`1e7fbf29ea90`
unclassified	JS	94.3 KB	2026-10-31	-	Cloaked 100%	`869ff212e880`
unclassified	EXE	10.2 MB	2026-10-31	-	Cloaked 96%	`1693a6194a1b`
unclassified	MSI	9.8 MB	2026-10-31	-	Cloaked 99%	`a10db4873ff6`
unclassified	EXE	13.7 MB	2026-10-31	SecuriteInfo.com.Win64.Trojan.Agent.7U2UDE.18...	Cloaked 85%	`cefd822c269a`
unclassified	EXE	4.5 MB	2026-10-31	-	Cloaked 96%	`5515a2ce2c26`
unclassified	EXE	45.0 KB	2026-10-31	Win.Packed.AsyncRAT-9856570-1	Cloaked 100%	`ab56b618f4f9`
unclassified	PS1	226.7 KB	2026-10-31	-	Cloaked 93%	`1541b17cf4b7`
unclassified	EXE	460.4 KB	2026-10-31	-	Cloaked 96%	`eae0d17dec25`
unclassified	JS	2.3 MB	2026-10-31	-	Cloaked 85%	`480c1b5dacee`
Mirai	ELF	1.3 MB	2026-10-31	SecuriteInfo.com.Linux.Mirai-44.UNOFFICIAL	Cloaked 96%	`920766f7f20d`
Mirai		0 B		-	Cloaked 96%	`77b0dfef9bef`
unclassified	MSI	2.2 MB	2026-10-31	YARA.SIGNATURE_BASE_SUSP_PS1_Frombase64String...	Cloaked 93%	`deffb99e4ffc`
unclassified	EXE	8.5 KB	2026-10-31	-	Cloaked 85%	`c2d3fbc6f611`
Mirai	ELF	80.8 KB	2026-10-31	SecuriteInfo.com.Linux.Mirai.10456.3172.14270...	Cloaked 90%	`633a92715aaa`
unclassified	EXE	1.0 MB	2026-10-31	SecuriteInfo.com.Win64.MalwareX-gen.77199853....	Cloaked 96%	`16f5d4d894a7`
unclassified	EXE	42.5 KB	2026-10-31	-	Cloaked 85%	`2cee7c1be1d9`
Mirai	ELF	353.3 KB	2026-10-31	Sanesecurity.Malware.32144.LX.BOT.UNOFFICIAL	Cloaked 96%	`cc4d2deeeca0`
unclassified	EXE	1.9 MB	2026-10-31	SecuriteInfo.com.Win64.Trojan-Stealer.Rust.B....	Cloaked 96%	`a6bb25f742c9`
unclassified	MACHO	792.0 KB	2026-10-31	SecuriteInfo.com.MacOS.Stealer-OS.85868885.UN...	Cloaked 90%	`e58caff40b30`
Mirai	ELF	357.2 KB	2026-10-31	Sanesecurity.Malware.32144.LX.BOT.UNOFFICIAL	Cloaked 96%	`8c0c81f128a8`
Mirai	ELF	365.5 KB	2026-10-31	Sanesecurity.Malware.32144.LX.BOT.UNOFFICIAL	Cloaked 96%	`c7a02e58c721`
unclassified	EXE	6.9 MB	2026-10-31	SecuriteInfo.com.Trojan.PWS.Salat.389.14050.1...	Cloaked 85%	`21aa6f23743d`
unclassified	EXE	2.2 MB	2026-10-31	ditekSHen.MALWARE.Win.Trojan.QuasarStealer.UN...	Cloaked 96%	`9b151f4ffa47`

Vantage shows how a sample stayed hidden: Residential/Mobile-only means our datacenter leg was served a decoy while a residential or mobile leg was handed the real payload; Cloaked N% is the multi-egress divergence measured on an actively-evasive target. A dash means the sample was captured on the datacenter leg too.
Live from our scanners, refreshed daily. Showing the most recent 25 of 4,847 contributions on MalwareBazaar.

ThreatFox: IOCs

Where MalwareBazaar takes the sample, ThreatFox takes the indicator: the URL that served it, attributed to a malware family wherever an independent source (abuse.ch's own classification of the hash, or VirusTotal's cross-engine consensus) will name one. Where nobody will, we publish it as unknown and let the tags carry the detail, rather than guess. Every URL below is defanged; the live record is on ThreatFox.

1066 IOCs contributed • 1066 carrying a named malware family

Mirai ×552 SalatStealer ×379 Unknown Loader ×52 Bashlite ×17 SmartLoader ×13 Unknown RAT ×9 AsyncRAT ×7 Unknown Stealer ×6 XWorm ×3 Formbook ×3 ValleyRAT ×2 Remcos ×2

IOC	Type	Malware	Confidence	Tags	First seen	Record
`067ec3b602489fd3d7b57cbbe3f9e24d986b476f072ba12777d0b...`	sha256_hash	SmartLoader	85%	Dropper Loader SmartLoader trojan	2026-10-31	view →
`4ea4f6dd439a54cd36d8194c14c1673c6e935b1a493f27bf4df83...`	sha256_hash	Mirai	90%	elf Mirai Torii	2026-10-31	view →
`726cae684af35571a565bbac17e09cd79beaa07afc03672163537...`	sha256_hash	Unknown Loader	85%	elf Loader	2026-10-31	view →
`a60093db824e3163010227d58f0a6687556c3546a7b5a2910a134...`	sha256_hash	Unknown Loader	85%	exe Loader	2026-10-31	view →
`82ea0074e950a589422046178545acaa950b5f0b61760630af275...`	sha256_hash	Mirai	90%	cowrie elf honeypot Mirai	2026-10-31	view →
`33c3e3ebf8122a98abd703abc5b3530ca555c2d6b8dd8fec6bb16...`	sha256_hash	Unknown Loader	85%	Loader macho	2026-10-31	view →
`a3aab95c1115b6c31ffd0e2bd6280ebd04654c1ca067d953e42e5...`	sha256_hash	Unknown Loader	85%	exe Loader	2026-10-31	view →
`3f3ef079a0f71fd6f0c7dab254bdbb4186e3748d2fd2295d1ce0e...`	sha256_hash	Unknown Loader	75%	bat Dropper ps1	2026-10-31	view →
`9cf51d59ec0742588a9400ef1b756a9f07ed65e98f825f689baf5...`	sha256_hash	Unknown Loader	80%	bat Dropper ps1	2026-10-31	view →
`e5249ecf65404d24a294e170f37fbac95e5f49c7b5f1b4df95c9d...`	sha256_hash	Unknown Loader	75%	bat Dropper ps1	2026-10-31	view →
`59e9d072d019317e32082b6183e2e095142a8b3c66f387e8fc4a8...`	sha256_hash	Unknown Loader	75%	bat Dropper ps1	2026-10-31	view →
`05c5d5b026e976b85bef06be507c1d39cfc737a2539d6a085892a...`	sha256_hash	Mirai	90%	elf Mirai	2026-10-31	view →
`9740bdbd19b284078e285ffbce8112ab6b5b9142ad9e59f761cc4...`	sha256_hash	Mirai	90%	elf Mirai	2026-10-31	view →
`991590b79faeed8474a74019d48a0de7981f1bacebcc4c9c45eb9...`	sha256_hash	Unknown Loader	75%	bat Dropper ps1	2026-10-31	view →
`3a1c3dc6fde100194213d9d53ce663f81ed1695b910227a578d4d...`	sha256_hash	Unknown Loader	85%	Loader macho	2026-10-31	view →
`491b3c90fcde895c6b06705bbec66d05fe7e1a90c255f8075c266...`	sha256_hash	Unknown Loader	85%	Dropper exe	2026-10-31	view →
`c76255dcc74030edc6ea7713d743c66e3ca1afbb2b202b13c81de...`	sha256_hash	Mirai	90%	cowrie elf honeypot Mirai	2026-10-31	view →
`32bd1f693d713d24e374e2e33bc8314db740c1e7b2af8e2cd38f7...`	sha256_hash	Mirai	90%	cowrie elf honeypot Mirai	2026-10-31	view →
`4b0d6457b837f31be491735b4ad42ea895f8e117bfcb66e3ec809...`	sha256_hash	Mirai	90%	cowrie elf Gafgyt honeypot	2026-10-31	view →
`3e8de9edafa71f4399820fb5ea8785041807b9300ab0a9739d0bb...`	sha256_hash	Mirai	90%	cowrie elf honeypot Mirai	2026-10-31	view →
`fd9b86c1466e2ac93dc5f5dde51b1c7a6e4d0c04967635a953cca...`	sha256_hash	Mirai	90%	cowrie elf honeypot Mirai	2026-10-31	view →
`b847d0d6692e53a48c6e05929c3b258ba1ef92c3d0308a44bcca2...`	sha256_hash	Mirai	90%	elf Mirai	2026-10-31	view →
`ce5003696151d6721a5e8ede0ef0c107e1f6fbec632333351f954...`	sha256_hash	Mirai	90%	elf Mirai upx	2026-10-31	view →
`d79dbaff000282a19aa0bf53a284df2b11ae3251cdc0b8f0a6c35...`	sha256_hash	Mirai	90%	cowrie elf honeypot Mirai	2026-10-31	view →
`4acfa19a38727b7a2b549ee97365694cd4c3ef1b4aa765e0e4655...`	sha256_hash	Mirai	90%	elf Mirai	2026-10-31	view →

compromised host marks a legitimate site serving malware without its owner's knowledge, reported to ThreatFox as a compromised asset rather than as attacker infrastructure, so the domain's reputation is not damaged by our report.
Showing the most recent 25 of 1066 IOCs.

View all on ThreatFox →

Get these before they hit MalwareBazaar

Real-time push of novel captures via the whack.sh Pro Feed API: sub-second webhook callbacks the moment a payload is captured, hours before it propagates to the public feeds. STIX 2.1 / CSV / JSON.

Start scanning free

View all on MalwareBazaar → Our abuse.ch profile →

How it works Start scanning free