IndicatorPublished 13 Apr 2025Updated 14 Apr 2025

type osint · ThreatFox IOCs for 2025-04-13

Affects type osintSource ThreatFox MISP Feed

TLP:WHITE, disclosure is not limited

Indicators of compromise

Domains 1,409

check.qowot.icuClearFake payload delivery domain (confidence level: 100%)
roomsvisitor999837.worldUnknown Stealer payload delivery domain (confidence level: 100%)
roomnum-998388.worldUnknown Stealer payload delivery domain (confidence level: 100%)
alphaprmlanding.pages.devUnknown Stealer payload delivery domain (confidence level: 100%)
digi-captcha.hfl388066.workers.devUnknown Stealer payload delivery domain (confidence level: 100%)
educational008.pages.devUnknown Stealer payload delivery domain (confidence level: 100%)
education009.pages.devUnknown Stealer payload delivery domain (confidence level: 100%)
dunaluxablak.huUnknown Stealer payload delivery domain (confidence level: 100%)
centerforregionalconnectivityanddevelopment.comUnknown Stealer payload delivery domain (confidence level: 100%)
townofwayneok.orgUnknown Stealer payload delivery domain (confidence level: 100%)

URLs 41

https://check.revuq.icu/gkcxv.googleClearFake payload delivery URL (confidence level: 100%)
https://check.wysaf.icu/gkcxv.googleClearFake payload delivery URL (confidence level: 100%)
https://judgecountry.icu/art.phpUnknown Loader botnet C2 (confidence level: 100%)
https://check.xulap.icu/gkcxv.googleClearFake payload delivery URL (confidence level: 100%)
https://changecorn.icu/art.phpUnknown Loader botnet C2 (confidence level: 100%)
http://wishson.icu/ido.phpUnknown Loader botnet C2 (confidence level: 100%)
http://controlexample.xyz/apr.phpUnknown Loader botnet C2 (confidence level: 100%)
http://controlexample.xyz/apri.phpUnknown Loader botnet C2 (confidence level: 100%)
https://dsoursopsf.run/gsoiaoLumma Stealer botnet C2 (confidence level: 75%)
https://revitmodh.run/pzawLumma Stealer botnet C2 (confidence level: 75%)

IP addresses 130

146.19.213.187Unknown RAT botnet C2 server (confidence level: 100%)
159.253.120.195Unknown RAT botnet C2 server (confidence level: 100%)
176.97.113.235Unknown RAT botnet C2 server (confidence level: 100%)
37.221.64.54Unknown RAT botnet C2 server (confidence level: 100%)
93.157.106.17Unknown RAT botnet C2 server (confidence level: 100%)
196.251.72.144Cobalt Strike botnet C2 server (confidence level: 100%)
154.8.160.34Cobalt Strike botnet C2 server (confidence level: 100%)
185.183.243.251Unknown malware botnet C2 server (confidence level: 100%)
209.141.52.16Unknown malware botnet C2 server (confidence level: 100%)
107.189.17.103Hook botnet C2 server (confidence level: 100%)

Hashes 959

0ba336f1f203476bbbe192e4bc9d6cb5fe2c0fc7f8bc044f2e6507588e9e5f21DCRat payload (confidence level: 75%)
00283f31ab994fb21115ac05c76f31a4554de053cac7a3a070bc69341b91c054DarkGate payload (confidence level: 50%)
00341c230e89b346ad6cf05d8bef480fc20278cc5784fcfe06e9a445491a64f9DarkGate payload (confidence level: 50%)
004dc00f66098d37167a52a7fc0814f497d30814dc00a8da7083a4765510d79aDarkGate payload (confidence level: 50%)
007e6640a49030d68af8679df6ef5b9ad7bb917396f6a2ab1b5eb72037ebf120DarkGate payload (confidence level: 50%)
00985db874d9177de4a18999f7a420260b3a4665ba2b5b32aa39433ef79819dfDarkGate payload (confidence level: 50%)
00f25f4e27938650e42747fc5b85d87e040d8c79db82c72ccf05ca03c8d32771DarkGate payload (confidence level: 50%)
01037b2cc999d1d16c1ebcc90d35c3b6f61c543f78d03e495dd924d50db818b0DarkGate payload (confidence level: 50%)
0130e9d398cc202f042ac8c8712712950b5e29842993260517a79b983e8f090aDarkGate payload (confidence level: 50%)
0145592b79cc6d211b39edcf3a8847b23941214c613ab57b66b03af20d833ce8DarkGate payload (confidence level: 50%)

Description

ThreatFox IOCs for 2025-04-13

Impact

For European organizations, the impact of these IOCs depends largely on their ability to integrate and act upon this threat intelligence within their security monitoring and incident response processes. Since the threat is categorized as medium severity and involves payload delivery and network activity, organizations could face risks such as malware infections, unauthorized network communications, or data exfiltration attempts if these indicators correspond to active campaigns. However, without known exploits or specific malware details, the immediate risk is more about detection and early warning rather than active compromise. Organizations that do not incorporate updated threat intelligence feeds may be slower to detect emerging threats, potentially increasing exposure. The impact is therefore primarily on the security operations and threat hunting capabilities rather than direct system compromise at this stage.

Defensive guidance

European organizations should ensure their security infrastructure—such as SIEM (Security Information and Event Management), IDS/IPS (Intrusion Detection/Prevention Systems), endpoint detection and response (EDR), and firewall solutions—are configured to ingest and correlate these ThreatFox IOCs. Regularly updating threat intelligence feeds and tuning detection rules to identify payload delivery and suspicious network activity patterns is critical. Additionally, organizations should conduct threat hunting exercises using these IOCs to proactively identify potential compromises. Since no patches are available, mitigation focuses on detection and response rather than vulnerability remediation. Enhancing network segmentation, enforcing strict egress filtering, and monitoring for anomalous outbound connections can reduce the risk of payload delivery and lateral movement. Finally, staff training on recognizing phishing or social engineering attempts that could lead to payload delivery remains important.

Community reviews

Loading reviews…