files.catbox.moe
Classification: Malicious
files.catbox.moe is a malicious hostname. Linked to Xloader, Dcrat malware. 611 sightings from 8 threat sources (Malware Download), last seen 2026-10-17.
Current activity
- Offline — no longer resolving. Last online 2026-10-18 05:02:29.
- Malware distribution — This indicator is distributing malware.
- Stores phishing content — Phishing resources are hosted here.
MITRE ATT&CK associations
Malware families: XLOADER (S1207) DCRAT (S9017) AGENT TESLA (S0331) ASYNCRAT (S1087) COBALT STRIKE (S0154) DEATHRANSOM (S0616) DISCO (S1088) PANDORA (S0664) REMCOS (S0332) LOKIBOT (S0447)
Blacklist sightings
| Description | Source | First seen | Last seen | Labels | MITRE ATT&CK |
|---|---|---|---|---|---|
| Generic Malware | Cyber Threat Alliance | 2026-10-09 15:33:37 | 2026-10-17 15:28:15 | compromised malicious-activity | |
| AOL phishing | Maltiverse | 2026-10-10 10:02:06 | 2026-10-10 10:02:06 | malicious-activity phishing | T1566 Phishing |
| Wetransfer phishing | Maltiverse | 2026-10-06 10:04:02 | 2026-10-08 10:01:52 | malicious-activity phishing | T1566 Phishing |
| Malware Download | URLhaus Abuse.ch | 2022-07-06 13:15:34 | 2026-09-18 05:04:17 | malicious-activity malware | |
| Suspicious URL | Triage | 2026-07-29 06:08:12 | 2026-07-29 06:08:12 | anomalous-activity | |
| Phantom_stealer | Triage | 2026-05-12 09:10:46 | 2026-05-12 09:10:46 | malicious-activity | |
| Lokibot | Triage | 2026-05-04 00:58:20 | 2026-05-04 00:58:20 | malicious-activity | S0447 Lokibot |
| Malicious URL | Triage | 2026-01-31 20:20:38 | 2026-04-12 05:55:27 | malicious-activity | |
| Quasar | Triage | 2026-03-31 00:32:27 | 2026-04-04 11:23:57 | malicious-activity | |
| Donutloader | Triage | 2026-04-03 23:13:52 | 2026-04-03 23:13:52 | malicious-activity | |
| Top Popularity Site | Cisco Umbrella | 2022-07-18 23:02:40 | 2026-02-03 23:25:38 | benign | |
| Disco | Maltiverse Threat Observatory | 2025-06-29 21:21:39 | 2025-11-28 13:21:38 | S1088 Disco | |
| Pandora | Maltiverse Threat Observatory | 2025-11-18 01:21:38 | 2025-11-28 13:21:38 | S0664 Pandora | |
| Trojan.generic | Maltiverse Threat Observatory | 2025-08-09 21:21:40 | 2025-11-28 13:21:38 | ||
| Hacktool.generic | Maltiverse Threat Observatory | 2025-06-17 19:44:25 | 2025-11-28 09:21:39 | ||
| Trojan.genkryptik | Maltiverse Threat Observatory | 2025-06-21 21:21:39 | 2025-11-28 09:21:39 | ||
| Trojan.dropper.win32 | Maltiverse Threat Observatory | 2025-06-26 07:21:39 | 2025-11-28 06:21:36 | ||
| Trojan.downloader | Maltiverse Threat Observatory | 2025-06-19 02:21:38 | 2025-11-27 10:21:39 | ||
| Backdoor.generic | Maltiverse Threat Observatory | 2025-09-02 02:21:33 | 2025-11-26 22:21:40 | ||
| Cobalt strike | Maltiverse Threat Observatory | 2025-06-21 17:21:39 | 2025-11-26 07:21:39 | S0154 Cobalt Strike | |
| Kuaibu | Maltiverse Threat Observatory | 2025-06-17 19:44:25 | 2025-11-25 09:21:34 | ||
| Coinminer | Maltiverse Threat Observatory | 2025-11-23 22:21:36 | 2025-11-24 12:21:35 | ||
| Pup | Maltiverse Threat Observatory | 2025-06-17 19:44:25 | 2025-11-23 20:21:35 | ||
| Android.banker | Maltiverse Threat Observatory | 2025-06-18 09:21:39 | 2025-11-23 19:21:37 | ||
| Redcap | Maltiverse Threat Observatory | 2025-06-18 18:21:39 | 2025-11-23 19:21:37 | ||
| Android.trojan.downloader | Maltiverse Threat Observatory | 2025-08-23 20:21:34 | 2025-11-23 18:21:36 | ||
| Android.trojan.generic | Maltiverse Threat Observatory | 2025-06-19 07:21:37 | 2025-11-22 07:21:36 | ||
| Xloader | Maltiverse Threat Observatory | 2025-09-30 08:21:36 | 2025-11-20 11:21:35 | S1207 XLoader | |
| Trojan.stealer | Maltiverse Threat Observatory | 2025-07-28 12:21:35 | 2025-11-20 07:21:35 | ||
| Asyncrat | Maltiverse Threat Observatory | 2025-06-24 15:21:38 | 2025-11-19 20:21:35 | S1087 AsyncRAT | |
| Banload | Maltiverse Threat Observatory | 2025-06-23 07:21:39 | 2025-11-18 20:21:36 | ||
| Purelogs | Maltiverse Threat Observatory | 2025-11-17 18:01:07 | 2025-11-17 18:01:07 | ||
| Spynote | Maltiverse Threat Observatory | 2025-07-26 20:21:35 | 2025-11-17 17:21:37 | ||
| Backdoor.win32.generic | Maltiverse Threat Observatory | 2025-06-30 11:21:38 | 2025-11-15 19:21:35 | ||
| Xworm | Maltiverse Threat Observatory | 2025-06-30 02:21:39 | 2025-11-14 11:21:34 | ||
| Trojan.bat.generic | Maltiverse Threat Observatory | 2025-10-09 13:21:37 | 2025-11-10 10:21:35 | ||
| Remcos | Maltiverse Threat Observatory | 2025-08-27 10:21:34 | 2025-10-30 11:21:35 | S0332 Remcos | |
| Trojan.msil | Maltiverse Threat Observatory | 2025-08-22 17:21:35 | 2025-10-20 22:21:36 | ||
| Clipbanker | Maltiverse Threat Observatory | 2025-09-18 16:21:36 | 2025-10-16 16:21:36 | ||
| Trojan.crypt | Maltiverse Threat Observatory | 2025-08-22 02:21:32 | 2025-10-09 10:21:39 | ||
| Houdini | Maltiverse Threat Observatory | 2025-07-27 07:21:35 | 2025-09-24 16:21:37 | ||
| Cloudeye | Maltiverse Threat Observatory | 2025-09-12 18:01:05 | 2025-09-12 18:01:05 | ||
| Donut_injector | Maltiverse Threat Observatory | 2025-08-27 13:21:34 | 2025-08-28 12:21:35 | ||
| XWorm | ThreatFox Abuse.ch | 2025-08-26 11:17:03 | 2025-08-26 11:17:03 | malicious-activity | |
| Downloader.win32.generic | Maltiverse Threat Observatory | 2025-08-20 01:21:36 | 2025-08-23 10:21:33 | ||
| Agent tesla | Maltiverse Threat Observatory | 2025-08-13 18:01:04 | 2025-08-13 18:01:04 | S0331 Agent Tesla | |
| Ransomware unknown | Maltiverse Threat Observatory | 2025-08-11 19:21:37 | 2025-08-12 12:21:38 | ||
| Xenorat | Maltiverse Threat Observatory | 2025-08-11 19:21:37 | 2025-08-12 12:21:38 | ||
| Trojan.msilzilla | Maltiverse Threat Observatory | 2025-08-11 07:21:43 | 2025-08-11 21:21:37 | ||
| Bashlite | Maltiverse Threat Observatory | 2025-08-06 21:21:39 | 2025-08-07 22:21:39 | ||
| Exploit.agent | Maltiverse Threat Observatory | 2025-08-06 21:21:39 | 2025-08-07 22:21:39 | ||
| Mirai | Maltiverse Threat Observatory | 2025-08-06 21:21:39 | 2025-08-07 22:21:39 | ||
| Snojan | Maltiverse Threat Observatory | 2025-08-04 02:21:38 | 2025-08-05 12:21:38 | ||
| Exploit.generic | Maltiverse Threat Observatory | 2025-07-29 11:21:36 | 2025-08-01 11:21:37 | ||
| Rugmi | Maltiverse Threat Observatory | 2025-08-01 07:21:39 | 2025-08-01 09:21:37 | ||
| Mariposa | Maltiverse Threat Observatory | 2025-07-11 17:21:37 | 2025-07-13 12:21:36 | ||
| Deathransom | Maltiverse Threat Observatory | 2025-07-03 16:21:39 | 2025-07-03 16:21:39 | S0616 DEATHRANSOM | |
| DCRat | ThreatFox Abuse.ch | 2025-05-24 08:00:16 | 2025-05-26 07:21:14 | malicious-activity | S9017 DCRAT |
| Unknown malware | ThreatFox Abuse.ch | 2025-05-23 09:17:05 | 2025-05-23 09:17:05 | malicious-activity | |
| DarkCloud Stealer | ThreatFox Abuse.ch | 2025-05-15 06:17:13 | 2025-05-15 06:17:13 | malicious-activity | |
| Malicious URL | Hybrid-Analysis | 2023-05-13 03:15:03 | 2023-05-13 03:15:03 | ||
| Formbook | ThreatFox Abuse.ch | 2022-09-21 15:18:32 | 2022-09-21 15:18:32 | compromised malicious-activity | S1207 XLoader |
| Malware.Generic | Hybrid-Analysis | 2021-10-28 03:15:10 | 2021-10-28 03:15:10 | ||
| Malicious site | Hybrid-Analysis | 2019-09-19 10:00:08 | 2021-08-12 22:30:17 | ||
| Malware Download | Abuse.ch | 2019-02-11 05:58:46 | 2020-12-04 19:15:35 | malicious-activity | |
| Generic.Malware | Hybrid-Analysis | 2019-01-24 12:17:04 | 2020-10-10 21:30:04 | ||
| Alexa Top 1 Million | Maltiverse Research Team | 2020-07-09 19:38:57 | 2020-07-09 19:38:57 | ||
| Malware site | Hybrid-Analysis | 2018-08-15 19:45:21 | 2019-02-12 09:30:15 | ||
| evasive | Maltiverse | 2017-12-16 23:48:31 | 2017-12-16 23:48:31 | ||
| exploit,maldoc | Maltiverse | 2017-11-22 05:26:07 | 2017-11-22 05:26:07 | ||
| maldoc | Maltiverse | 2017-11-22 04:15:59 | 2017-11-22 04:15:59 | ||
| exploit | Maltiverse | 2017-11-09 12:34:57 | 2017-11-09 12:34:57 |
Tags
agenttesla none xworm 108-62-118-133--9734 ascii pw-1786 encrypted malware_download win.xloader exploit compressed malicious loader nanocore dropped-by-smokeloader redline bat related_to_mallox_ransomware zip exe trojan.boxter trojan.tisifi quasarrat rar mirai venomrat asyncrat pif dll ps1 hacktool encoded powercat oak-token-grabber-used redlinestealer hta formbook base64 ua-wget blankgrabber donutloader masslogger base64_exe lunalogger rat dofoil ransomware powershell elf darkcloud dcrat fakecaptcha darkcrystal rat apk .exe base64-loader txt geofenced stego vuln-driver guloader bin remcosrat discovery persistence spyware stealer collection credential_access defense_evasion execution upx privilege_escalation installer adware trojan quasar skidquasar office04 lokibot phantom_stealer phantomstealer pyinstaller hypeagent redis shell-script phishingIP addresses resolved by this hostname
- 108.181.20.37 (2024-08-29 10:19:30)
- 66.150.188.176 (2017-11-09 12:34:57)
- 108.181.20.39 (2025-02-15 17:21:06)
- 2604:6600:5:1::3 (2025-05-25 04:18:57)
- 108.181.20.43 (2026-06-28 19:14:44)
- 108.181.20.35 (2026-10-17 04:31:43)
Whois information
- AS name
- AS32374 Nuclearfallout Enterprises, Inc.
- Domain
- catbox.moe
- TLD
- moe
- DNSSEC
- ['unsigned']
- Nameservers
- ns4gvx.name.com, ns3fqs.name.com, ns1bqx.name.com, ns2fjz.name.com, curitiba.ns.porkbun.com, salvador.ns.porkbun.com, fortaleza.ns.porkbun.com, maceio.ns.porkbun.com
- Registrant
- Name.com, Inc.
- Address
- REDACTED FOR PRIVACY
- City
- REDACTED FOR PRIVACY
- State
- CO
- Country
- US — United States 🇺🇸
- Contact email
- [email protected], [email protected], [email protected]
- Domain created
- 2015-04-06 04:37:44
- Domain expires
- 2027-04-05 23:59:59
- First indexed
- 2017-11-09 12:34:57
- Last updated
- 2026-10-10 10:02:53