IndicatorPublished 27 Feb 2025Updated 28 Feb 2025

type osint · ThreatFox IOCs for 2025-02-27

Affects type osintSource ThreatFox MISP Feed

TLP:WHITE, disclosure is not limited

Indicators of compromise

Domains 366

ert67-o9.pages.devClearFake payload delivery domain (confidence level: 100%)
tumbl.design-x.xyzClearFake payload delivery domain (confidence level: 100%)
check.digoc.icuClearFake payload delivery domain (confidence level: 100%)
thingymediay.cyouLumma Stealer botnet C2 domain (confidence level: 100%)
emplofirelpd.onlineLumma Stealer botnet C2 domain (confidence level: 100%)
praisepunishek.onlineLumma Stealer botnet C2 domain (confidence level: 100%)
thichinsideo.onlineLumma Stealer botnet C2 domain (confidence level: 100%)
beerepiero.onlineLumma Stealer botnet C2 domain (confidence level: 100%)
churhemarke.onlineLumma Stealer botnet C2 domain (confidence level: 100%)
palmnighet.onlineLumma Stealer botnet C2 domain (confidence level: 100%)

URLs 195

https://tumbl.design-x.xyz/glass.mp3ClearFake payload delivery URL (confidence level: 100%)
https://ert67-o9.pages.dev/dataClearFake payload delivery URL (confidence level: 100%)
https://cananyalcin.com/webpanel/panel/login.phpGomorrah stealer botnet C2 (confidence level: 100%)
http://128.199.113.162/panel/login.phpAmadey botnet C2 (confidence level: 100%)
https://thingymediay.cyou/apiLumma Stealer botnet C2 (confidence level: 100%)
https://emplofirelpd.online/apiLumma Stealer botnet C2 (confidence level: 100%)
https://praisepunishek.online/apiLumma Stealer botnet C2 (confidence level: 100%)
https://thichinsideo.online/apiLumma Stealer botnet C2 (confidence level: 100%)
https://beerepiero.online/apiLumma Stealer botnet C2 (confidence level: 100%)
https://churhemarke.online/apiLumma Stealer botnet C2 (confidence level: 100%)

IP addresses 216

45.155.103.183RedLine Stealer botnet C2 server (confidence level: 100%)
47.109.45.147Cobalt Strike botnet C2 server (confidence level: 100%)
104.245.240.123Remcos botnet C2 server (confidence level: 100%)
135.125.27.227Remcos botnet C2 server (confidence level: 100%)
173.255.206.56Sliver botnet C2 server (confidence level: 100%)
152.67.63.88AsyncRAT botnet C2 server (confidence level: 100%)
145.239.200.144AsyncRAT botnet C2 server (confidence level: 100%)
166.88.90.22AsyncRAT botnet C2 server (confidence level: 100%)
128.90.122.181AsyncRAT botnet C2 server (confidence level: 100%)
38.68.49.150AsyncRAT botnet C2 server (confidence level: 100%)

Hashes 1

Akira payload (confidence level: 50%)

b5873a60af597ce01867fede65c2846f

Description

ThreatFox IOCs for 2025-02-27

Impact

Given the sparse information and lack of specific indicators or exploit details, the direct impact on European organizations is difficult to ascertain. However, as the threat relates to malware and payload delivery, there is an inherent risk of compromise if these IOCs correspond to active malware campaigns. Potential impacts could include unauthorized access, data exfiltration, disruption of network services, or further malware propagation. European organizations relying on threat intelligence feeds like ThreatFox for early detection could benefit from monitoring these IOCs to enhance their detection capabilities. Without concrete exploit details or affected products, the impact remains theoretical but warrants vigilance, especially for sectors with high exposure to network-based threats such as finance, critical infrastructure, and government entities.

Defensive guidance

1. Integrate ThreatFox and similar OSINT feeds into existing Security Information and Event Management (SIEM) and Endpoint Detection and Response (EDR) systems to enable real-time detection of emerging IOCs. 2. Conduct regular threat hunting exercises using the latest IOCs from ThreatFox to identify any signs of compromise within the network. 3. Maintain up-to-date network segmentation and strict access controls to limit the spread of potential malware payloads. 4. Enhance employee awareness training focusing on recognizing phishing and social engineering tactics that often serve as initial infection vectors for malware. 5. Implement robust network monitoring to detect unusual network activity patterns indicative of payload delivery or command and control communications. 6. Since no patches are available, emphasize proactive detection and containment rather than reactive patching. 7. Collaborate with national and European cybersecurity centers (e.g., ENISA) to share intelligence and receive updates on evolving threats related to these IOCs.

Community reviews

Loading reviews…