IndicatorPublished 25 Mar 2025Updated 26 Mar 2025

type osint · ThreatFox IOCs for 2025-03-25

Affects type osintSource ThreatFox MISP Feed

TLP:WHITE, disclosure is not limited

Indicators of compromise

Domains 58

progressiveptgreenvalley.comFAKEUPDATES payload delivery domain (confidence level: 100%)
www.amanmail.infoHavoc botnet C2 domain (confidence level: 100%)
www.mkdirjava.comHavoc botnet C2 domain (confidence level: 100%)
electrumdoge.comUnknown malware botnet C2 domain (confidence level: 75%)
electrum-avax.comUnknown malware botnet C2 domain (confidence level: 75%)
electrum-ravencoin.comUnknown malware botnet C2 domain (confidence level: 75%)
electrum-xmr.netUnknown malware botnet C2 domain (confidence level: 75%)
cpcontacts.aaa.104-168-101-27.cprapid.comBashlite botnet C2 domain (confidence level: 100%)
cpanel.a.multi-canale.comBashlite botnet C2 domain (confidence level: 100%)
mail.b.ora-0-web.comBashlite botnet C2 domain (confidence level: 100%)

URLs 23

http://91.211.248.206/Hook botnet C2 (confidence level: 50%)
http://176.65.141.187/Hook botnet C2 (confidence level: 50%)
https://pastebin.com/raw/jd8cp7b0AsyncRAT botnet C2 (confidence level: 50%)
https://pastebin.com/raw/lbtbvbyiAsyncRAT botnet C2 (confidence level: 50%)
https://pastebin.com/raw/j5bthnrrXWorm botnet C2 (confidence level: 50%)
https://h.p.formaxprime.co.uk/Vidar botnet C2 (confidence level: 100%)
https://4ad74aab.xyz/index.phpDarkWatchman botnet C2 (confidence level: 100%)
https://compralibri.com/1q2w.jsFAKEUPDATES payload delivery URL (confidence level: 100%)
https://compralibri.com/js.phpFAKEUPDATES payload delivery URL (confidence level: 100%)
https://steamcommunity.com/profiles/76561199839170361Vidar botnet C2 (confidence level: 100%)

IP addresses 140

43.160.193.143Cobalt Strike botnet C2 server (confidence level: 100%)
128.90.113.194AsyncRAT botnet C2 server (confidence level: 100%)
209.38.142.255Hook botnet C2 server (confidence level: 100%)
113.45.132.242Unknown malware botnet C2 server (confidence level: 100%)
213.199.57.185Unknown malware botnet C2 server (confidence level: 100%)
152.203.30.145Unknown malware botnet C2 server (confidence level: 100%)
47.94.7.163Unknown malware botnet C2 server (confidence level: 100%)
144.208.127.241Remcos botnet C2 server (confidence level: 100%)
31.58.169.119AsyncRAT botnet C2 server (confidence level: 100%)
51.38.215.206Unknown malware botnet C2 server (confidence level: 100%)

Hashes 5

Unknown Stealer payload (confidence level: 100%)

2246f3653b24eb50f8e43be528270178d8b9576b72fce298d97dda6b5865aced
2065c11664a7a30b693a8334a37fa049f7221ec39bdad401ebae9c453d453edb
1b48785b6098f696992c1f65e814ad9f4e2fe3f61ce57bdf0477c05c19661217
a4ef61a4c32010e87894ad322b87d9f24b9b64c20da5b8b53a1545bbcd16e810
6deae0104a84d93f5d2e4fd4c8fb3ae218b77129771bd6c5c79bd7a31e621fd2

Description

ThreatFox IOCs for 2025-03-25

Impact

Given the nature of the data as OSINT-based threat intelligence without specific exploit details or affected products, the direct impact on European organizations is limited. However, the dissemination of such IOCs can aid defenders in detecting and mitigating malware campaigns that may target network infrastructure or endpoints. European organizations relying on threat intelligence feeds like ThreatFox can use this information to enhance their detection capabilities. The medium severity suggests a moderate risk level, possibly indicating ongoing or emerging malware campaigns that could affect confidentiality, integrity, or availability if exploited. Without concrete exploit details or affected software, the impact remains speculative but underscores the importance of maintaining updated threat intelligence and monitoring network activity for suspicious payload delivery attempts.

Defensive guidance

To effectively leverage this threat intelligence, European organizations should integrate ThreatFox IOCs into their security information and event management (SIEM) systems and intrusion detection/prevention systems (IDS/IPS) to enhance detection of related malware activity. Regularly updating and tuning detection rules based on the latest OSINT feeds will improve early warning capabilities. Network segmentation and strict egress filtering can limit the impact of payload delivery attempts. Organizations should also conduct regular threat hunting exercises using these IOCs to identify potential compromises early. Since no patches or specific vulnerabilities are associated, focus should be on proactive monitoring, incident response preparedness, and employee awareness to recognize phishing or social engineering attempts that often accompany malware delivery. Collaboration with national and European cybersecurity centers can help contextualize these IOCs within broader threat landscapes.

Community reviews

Loading reviews…