IndicatorPublished 24 Apr 2025Updated 25 Apr 2025

type osint · ThreatFox IOCs for 2025-04-24

Affects type osintSource ThreatFox MISP Feed

TLP:WHITE, disclosure is not limited

Indicators of compromise

Domains 85

vyzap.icuClearFake payload delivery domain (confidence level: 100%)
vickmarine.comFAKEUPDATES payload delivery domain (confidence level: 100%)
tc1.easingaffix.siteClearFake payload delivery domain (confidence level: 100%)
mrdltd.comFAKEUPDATES payload delivery domain (confidence level: 100%)
iguanadx.runLumma Stealer botnet C2 domain (confidence level: 100%)
tycok.icuClearFake payload delivery domain (confidence level: 100%)
dealmakerwealthsociety.comFAKEUPDATES payload delivery domain (confidence level: 90%)
id.webaudiomessages.xyzUnknown Loader payload delivery domain (confidence level: 100%)
mansionsnowy.clickUnknown Loader payload delivery domain (confidence level: 100%)
outlook.webaudiomessages.xyzUnknown Loader payload delivery domain (confidence level: 100%)

URLs 53

https://bpchangeaie.top/gepsUnknown malware botnet C2 (confidence level: 50%)
https://vickmarine.com/3w1s.jsFAKEUPDATES payload delivery URL (confidence level: 100%)
https://mrdltd.com/5q2g.jsFAKEUPDATES payload delivery URL (confidence level: 100%)
https://atrandu.lt/wp-content/plugins/wp-automatic/pwlbdv.php?gdqg=q32eLatrodectus payload delivery URL (confidence level: 95%)
https://crushingthehairbiz.com/wp-content/plugins/wp-automatic/dwyrnb.php?dpf=1kw5qLatrodectus payload delivery URL (confidence level: 95%)
https://emblemat.com/moszna/wp-content/plugins/resads/mfls.php?id=z3m8addgydqo8tnqiyriLatrodectus payload delivery URL (confidence level: 95%)
https://www.wearerescue.com/wp-login.php?redirect_to=https%3a%2f%2fwww.wearerescue.com%2fwp-content%2fplugins%2fresads%2fmfls.php%3fid%3dqwspuwlh23twhnr6fmpi&bp-auth=1&action=bpnoaccessLatrodectus payload delivery URL (confidence level: 95%)
https://setecores.com.br/wp-content/plugins/resads/mfls.php?id=z8gvgx523ii0amyem9qwLatrodectus payload delivery URL (confidence level: 95%)
http://twizt.netUnknown malware botnet C2 (confidence level: 50%)
https://3piratetwrath.run/ytusUnknown malware botnet C2 (confidence level: 50%)

IP addresses 155

193.161.193.99NjRAT botnet C2 server (confidence level: 75%)
194.110.247.90Mirai botnet C2 server (confidence level: 100%)
192.3.118.5Remcos botnet C2 server (confidence level: 100%)
186.169.81.137Remcos botnet C2 server (confidence level: 100%)
154.12.40.188Unknown malware botnet C2 server (confidence level: 100%)
186.169.81.137AsyncRAT botnet C2 server (confidence level: 100%)
157.66.26.148AsyncRAT botnet C2 server (confidence level: 100%)
164.90.172.49Unknown malware botnet C2 server (confidence level: 100%)
154.12.16.122Venom RAT botnet C2 server (confidence level: 100%)
18.224.153.152NetSupportManager RAT botnet C2 server (confidence level: 100%)

Hashes 44

e7444b62dcb531132353d3d769f2963e70d146583a3ec94765fee140a4bc11a9Unknown malware payload (confidence level: 75%)
37402bbc031a233108bd09776b6143bc3476805557560bb0a61bac966d4b4118Unknown malware payload (confidence level: 50%)
24be50c52e97d3a197f9215f390160f3be24cb6325c4f3dd3aed28e93181fc52Unknown malware payload (confidence level: 100%)
d4b09937bd7dbbd61dc84051a9b96f2c3e3bc10a711473fabc04d460a6f1e5b7Unknown malware payload (confidence level: 25%)
7fd4dfb52087b38b35b9728714d903c23e7645737607dd6a4ba44bab99aabb9eUnknown malware payload (confidence level: 75%)
c49757ac008b2f3e58b76da2a1812e26ef601a809c2622efb353c4fc92e39449Unknown malware payload (confidence level: 75%)
c5f79bf3a4d68a78dba47934ca6ba12d646d3aa2f45699e3ccd6525726b5803aUnknown malware payload (confidence level: 75%)
f97280d7fd9ad4077469d8ea85c389af3f57bd79a1c4a6f8cdb4b16bbbc0b270Unknown malware payload (confidence level: 50%)
088cf60b3630da9d0b4fa437bfa7b8c6f589262ccfd025dc229be818709dfadaUnknown malware payload (confidence level: 75%)
2f16aaee07be96aadaad389ef9fd1f7c3b41352ddafc3ddd4396b1a065e6e5c7Unknown malware payload (confidence level: 50%)

Description

ThreatFox IOCs for 2025-04-24

Impact

For European organizations, the impact of these IOCs depends largely on their integration into security monitoring and incident response workflows. Since the IOCs relate to malware payload delivery and network activity, failure to incorporate them into detection systems could result in delayed identification of malicious activity, potentially allowing malware infections or data exfiltration to proceed unnoticed. However, given the lack of known exploits in the wild and no direct vulnerability exploitation, the immediate risk is moderate. Organizations that actively consume and operationalize such OSINT feeds can enhance their threat visibility and reduce dwell time of attackers. Conversely, organizations that do not leverage these IOCs may face increased exposure to emerging threats that use similar tactics. The medium severity rating suggests that while the threat is not critical, it warrants attention to prevent escalation or exploitation in targeted attacks.

Defensive guidance

To effectively mitigate risks associated with these IOCs, European organizations should: 1) Integrate the ThreatFox MISP feed into their Security Information and Event Management (SIEM) and Endpoint Detection and Response (EDR) platforms to enable automated detection of related indicators. 2) Regularly update and validate IOC databases to ensure relevance and reduce false positives. 3) Conduct network traffic analysis focusing on payload delivery patterns and anomalous network activity that align with the IOC characteristics. 4) Train security analysts to interpret and respond to OSINT-derived indicators, emphasizing correlation with internal telemetry. 5) Implement network segmentation and strict egress filtering to limit the impact of potential payload delivery attempts. 6) Maintain robust incident response procedures that incorporate threat intelligence to accelerate containment and remediation. These steps go beyond generic advice by emphasizing operationalizing OSINT feeds and tailoring detection to the specific nature of the indicators.

Community reviews

Loading reviews…