IndicatorPublished 27 Apr 2025Updated 28 Apr 2025

type osint · ThreatFox IOCs for 2025-04-27

Affects type osintSource ThreatFox MISP Feed

TLP:WHITE, disclosure is not limited

Indicators of compromise

Domains 56

tahip.pressClearFake payload delivery domain (confidence level: 100%)
daltum.mxFAKEUPDATES payload delivery domain (confidence level: 100%)
bojut.pressClearFake payload delivery domain (confidence level: 100%)
security-9y5v-scan.comClearFake payload delivery domain (confidence level: 100%)
javascript-67t.pages.devClearFake payload delivery domain (confidence level: 100%)
puqum.pressClearFake payload delivery domain (confidence level: 100%)
www.tomo.inkCobalt Strike botnet C2 domain (confidence level: 100%)
vpn.founderic.xyzHavoc botnet C2 domain (confidence level: 100%)
zipuk.pressClearFake payload delivery domain (confidence level: 100%)
i.30x.ruMirai botnet C2 domain (confidence level: 50%)

URLs 49

http://161.129.65.68:8888/supershell/login/Unknown malware botnet C2 (confidence level: 100%)
https://daltum.mx/xm.txtFAKEUPDATES payload delivery URL (confidence level: 100%)
https://s4cartograhphy.top/ixauLumma Stealer botnet C2 (confidence level: 100%)
https://surmisehotte.click/apiLumma Stealer botnet C2 (confidence level: 75%)
https://kashmir-maryam.com/Unknown malware payload delivery URL (confidence level: 50%)
http://203.115.83.231:88/login.phpBlackNET RAT botnet C2 (confidence level: 50%)
https://paste.ee/r/bo0ebfvp/0XWorm botnet C2 (confidence level: 50%)
http://117.232.5.183:59191/mozi.mMozi payload delivery URL (confidence level: 50%)
http://factlow.xyz/biks.phpUnknown Loader botnet C2 (confidence level: 100%)
https://buildingsuggestion.sbs/art.phpUnknown Loader botnet C2 (confidence level: 100%)

IP addresses 148

176.65.142.122Mirai botnet C2 server (confidence level: 75%)
176.98.185.41Stealc botnet C2 server (confidence level: 100%)
212.64.73.200Cobalt Strike botnet C2 server (confidence level: 100%)
118.107.221.14Cobalt Strike botnet C2 server (confidence level: 100%)
94.26.90.81NjRAT botnet C2 server (confidence level: 75%)
124.70.204.188Cobalt Strike botnet C2 server (confidence level: 100%)
103.117.120.98Cobalt Strike botnet C2 server (confidence level: 100%)
118.178.224.193Unknown malware botnet C2 server (confidence level: 100%)
78.164.223.72AsyncRAT botnet C2 server (confidence level: 100%)
24.199.79.214Unknown malware botnet C2 server (confidence level: 100%)

Hashes 900

466a8e120c75770ecbc0c73f0439d304Cactus payload (confidence level: 50%)
718d56fd19bbaf5e78c03e096dae64caCactus payload (confidence level: 50%)
008199541407fdd2112210208b8a6f9e2abeabe2f21b76a3699117e5de5a16d6Gofing payload (confidence level: 50%)
00908e46d239a6dd09cc5fd7fca66eceaa26965092e7a9ac303318c47da9ed6cGofing payload (confidence level: 50%)
00a0285b3f6e5a481f5e1ae19ef047949e3e3ad07755195738db7fbbd815d7adGofing payload (confidence level: 50%)
00ac94c243af3c67ceeca842d5e7aa552650eddea7ac71d005303e597b9ebca4Gofing payload (confidence level: 50%)
00b77133aa2ca43d9698a310d68b4a9bf0a3a5df3c9fb3dacd22023353d3bf20Gofing payload (confidence level: 50%)
00c0931e2a3aff93101f12ebcc23aef4ed871d674b5f358fc3d5af85e60a92e4Gofing payload (confidence level: 50%)
00c4490bce7f327a78edabe788bbb96baf0acc93cda11538a9227887d3172799Gofing payload (confidence level: 50%)
01440b588c9d429f8a6230523d14a3d73eea25d78ad4b43ddf69ff5f9679a5b7Gofing payload (confidence level: 50%)

Description

ThreatFox IOCs for 2025-04-27

Impact

Given the lack of detailed technical information and absence of known exploits or affected versions, the immediate impact on European organizations is difficult to quantify precisely. However, malware involving network activity and payload delivery generally poses risks including unauthorized access, data exfiltration, disruption of services, or further malware propagation. European organizations, especially those with extensive networked infrastructure and reliance on open source intelligence tools or feeds, could be at risk if this malware is part of a broader campaign. The medium severity rating suggests a moderate threat level, potentially impacting confidentiality and availability if exploited. Without specific IOCs or affected systems, the threat may currently represent a low to medium risk, primarily serving as an early warning for security teams to monitor network traffic and OSINT feeds for emerging indicators.

Defensive guidance

In the absence of specific patches or IOCs, European organizations should focus on strengthening general network security and monitoring capabilities. Recommendations include: 1) Enhancing network traffic analysis to detect unusual payload delivery patterns or suspicious OSINT-related activity; 2) Implementing strict segmentation and access controls to limit malware propagation; 3) Maintaining up-to-date endpoint protection solutions capable of heuristic and behavior-based detection; 4) Regularly updating threat intelligence feeds and integrating them into security information and event management (SIEM) systems for timely alerts; 5) Conducting employee awareness training on phishing and social engineering tactics that often accompany malware delivery; 6) Preparing incident response plans tailored to malware infections involving network payload delivery; and 7) Collaborating with national and European cybersecurity centers to share intelligence and receive updated IOCs as they become available.

Community reviews

Loading reviews…