IndicatorPublished 22 Feb 2025Updated 23 Feb 2025

type osint · ThreatFox IOCs for 2025-02-22

Affects type osintSource ThreatFox MISP Feed

TLP:WHITE, disclosure is not limited

Indicators of compromise

Domains 88

check.eiuuu.onlineClearFake payload delivery domain (confidence level: 100%)
kurrenpowed.runLumma Stealer botnet C2 domain (confidence level: 100%)
www.projectdocs.ioHavoc botnet C2 domain (confidence level: 100%)
check.aoyai.onlineClearFake payload delivery domain (confidence level: 100%)
application-update.australiasoutheast.cloudapp.azure.comCobalt Strike botnet C2 domain (confidence level: 75%)
peacefulsuns.shopUnknown malware botnet C2 domain (confidence level: 100%)
139-162-1-232.ip.linodeusercontent.comHavoc botnet C2 domain (confidence level: 100%)
arthurus36.duckdns.orgQuasar RAT botnet C2 domain (confidence level: 50%)
mrkoko-25195.portmap.ioXWorm botnet C2 domain (confidence level: 50%)
y3yy5434yg3y4y-35188.portmap.hostXWorm botnet C2 domain (confidence level: 50%)

URLs 77

https://check.eiuuu.online/gkcxv.googleClearFake payload delivery URL (confidence level: 100%)
https://check.aoyai.online/gkcxv.googleClearFake payload delivery URL (confidence level: 100%)
http://propere.ru/eternalgeneratorlocal.phpDCRat botnet C2 (confidence level: 100%)
http://59.95.134.248:33569/mozi.mMozi payload delivery URL (confidence level: 50%)
http://657355cm.shnyash.ru/eternallinepythonjssecureprocessormultiflowerasyncdle.phpDCRat botnet C2 (confidence level: 100%)
http://37.139.129.142/htdocs/fphfnxjwcapqtjs.exeMASS Logger payload delivery URL (confidence level: 50%)
http://81.161.229.110/htdocs/ckbxefdwztoqgjr.exeMASS Logger payload delivery URL (confidence level: 50%)
http://66.63.187.123/txt/xcsqpljhnnvxytrw.exeMASS Logger payload delivery URL (confidence level: 50%)
http://154.216.19.160/txt/xugzybfe02qd31l.exeMASS Logger payload delivery URL (confidence level: 50%)
https://45.131.215.139/c262c2557c712ca5/mozglue.dllStealc payload delivery URL (confidence level: 50%)

IP addresses 158

1.118.34.220Cobalt Strike botnet C2 server (confidence level: 100%)
172.94.9.179Remcos botnet C2 server (confidence level: 100%)
118.31.229.51Remcos botnet C2 server (confidence level: 100%)
5.181.157.26Remcos botnet C2 server (confidence level: 100%)
85.239.245.157AsyncRAT botnet C2 server (confidence level: 100%)
163.5.112.109AsyncRAT botnet C2 server (confidence level: 100%)
38.18.228.187AsyncRAT botnet C2 server (confidence level: 100%)
193.163.203.62Unknown malware botnet C2 server (confidence level: 100%)
46.246.84.20DCRat botnet C2 server (confidence level: 100%)
46.246.4.12DCRat botnet C2 server (confidence level: 100%)

Hashes 19

Lynx payload (confidence level: 50%)

b1d81e8bbecccc547645d17395538a2d
a20886a5b378624d16972db66bd4e7e1
f16238836909d07f86154c5ccbade96a
30656c737338818bee8cc3591e3f3dcc
571684f28ce1cf4d8236dbd46ef6f7f0
65c0c7c9fe6bc1d5296447aae6c6c14c
d972bbbb3edb0e5ab5751b911f3dda17
146d350fd6271b4411714c630d8cda87
ff458208c49836cdec92f0a4a7ba6afd
67a44a38cc36becd6e2e9c20c27fd9ad

Description

ThreatFox IOCs for 2025-02-22

Impact

For European organizations, the impact of this threat primarily lies in the potential for malware infections via network-based payload delivery mechanisms. Given the medium severity and lack of known exploits, the immediate risk may be moderate but should not be underestimated, especially for organizations with high exposure to external networks or those relying heavily on OSINT for their operations. Malware infections can lead to data exfiltration, disruption of services, or further compromise of internal systems. The absence of specific affected products means that a broad range of systems could be targeted, increasing the scope of potential impact. European entities involved in critical infrastructure, finance, or government sectors may face increased risk due to the strategic value of their data and operations. Additionally, the use of OSINT techniques by threat actors could facilitate more targeted and sophisticated attacks, increasing the likelihood of successful compromise if defenses are not adequately prepared.

Defensive guidance

Given the nature of this threat, European organizations should implement enhanced network monitoring and threat hunting practices focused on detecting unusual payload delivery and network activity patterns. Deploying and regularly updating intrusion detection and prevention systems (IDS/IPS) with the latest IOCs from trusted sources like ThreatFox can improve early detection capabilities. Organizations should also conduct regular OSINT hygiene reviews to minimize exposure of sensitive information that could be leveraged by attackers. Network segmentation and strict access controls can limit the lateral movement of malware if an infection occurs. Employee awareness training on phishing and social engineering tactics remains critical, as these are common initial infection vectors. Since no patches are available, emphasis should be placed on proactive detection and response rather than remediation via software updates. Collaboration with national and European cybersecurity centers for sharing threat intelligence and coordinated response can further enhance resilience against such threats.

Community reviews

Loading reviews…