Skip to main content

Triada

Malware Family

446 indicators of compromise attributed to Triada across abuse.ch threat intelligence feeds.

Domains

14

IPs

2

URLs

6

Hashes

424

Download indicators

Indicator lists for this family. Free and anonymous downloads are a 10% sample.

Need continuous updates instead of static lists? The same IOCs ship in the STIX/TAXII threat feed, ready for OpenCTI and MISP.

Threat types

Botnet C&CpayloadPayload Delivery

Sample indicators

IndicatorType
file.pushclick.onlinedomain
c.whatsplusdownload.comdomain
c.obwhatsappdownload.comdomain
server.fbsecurity.netdomain
rpif.ad-tracker.networkdomain
app.pushonline.onlinedomain
app.whatsplusdownload.comdomain
app.obwhatsappdownload.comdomain
c.pushonline.onlinedomain
h5.webser.sitedomain
c.whatsplus.onlinedomain
p.thelayzf.fyidomain
q.thelayzf.fyidomain
dubai.thelayzf.fyidomain
43.163.58.184ip
43.163.58.72ip
https://drive.google.com/uc?export=download&id=1HcFfTSeJ59rLIfby_DJTz0sLYvQV_a7Turl
http://apk.gbwhat.pro/GBWhatsApp_2.23.9.490_gw_08_09_1510_sec_sign.apkurl
https://cdn.gbwhatsapp.download/app/android/conf/gb_wakeup.jsonurl
https://www.whatsplus.online/gbwhatsapp.apkurl
https://gbwaaplus.com/download/url
https://gbwaaplus.com/url
56ef89664bb119111f11b4ec6cf98c92078e6ecbb48c8a041b6cf49d70f4947fhash
09139f1a5c427d3b07230dd5956c94d4de2fed98ff6df18e5234621cba998d25hash
18e2006ae25b12849a17cc8d94f009cfc43c5fb3a4d6b0b734732aa0f46066e9hash
1c0ac2ff2acfa9f44990153d6f44ccbe95ddb269fa771edd9e354a5a659ffec9hash
4e42c8756f47235397a23b2dd749ecc6a98d4241588535423b8e04cc18311493hash
8a694fbc4955d86491f30f6aba2dfdb8f6fd1294f516dae7eff9327595a77cf9hash
12de27788ff089d827775fb562f89c1793122de3c7acc7bc0625c8a6496b1238hash
b71a5204be101bf70949cf9139734b2c24f221c90f13a937ff42579e8c16ababhash
784751e30d2f729ac455a9fc4336ee8ef53fa956fc6e16200328bba81f9c4e62hash
bfd4833b3423fe5bef9460f46e2a9638107e4ff148a75506d1da154ecab03c9dhash
fbf1f069f8b9054ff20372363d41140bc12a39115245d73fac66eabc7131ac81hash
a48c82ef727658b2c84265dce8995c8213c2d907956cbc05607d044afc960021hash
63bf8ac99c055c375e500431f6a60cf39b1f60db37d2ab96f68d81eb0921cd7chash
4bf114ce1eb36ad5e430e7e78e49bf21e8386f71e56bdaac0630723f44358d47hash
0cbd383a2d68d0b51c53543fedd96760f57d2f0f6755705e2318c37345381e03hash
6e1fd3355aa57043be674431fc852e4545a3286bf3de2157a2acfa2a22aee5c0hash
b655462193791fabee60c09ed23a4ed7cae92383f1fcfcac1540b80748e82648hash
3e596694e6c74a1991490f4bde5e2404fc1b6d57af8499b7fc67adb44e17394ehash
7215fb11ad3a690d4a2b0f5d7ab1a7ef3ac09f7f4c6b8e921cc7962f15b9858fhash
f925f7ec1f659a5f2bc89101fac9a25c1b24293aa2c45a702e93b88f597302b9hash

Another file to check? Run a file hash reputation check.