IndicatorPublished 6 May 2025Updated 7 May 2025

type osint · ThreatFox IOCs for 2025-05-06

Affects type osintSource ThreatFox MISP Feed

TLP:WHITE, disclosure is not limited

Indicators of compromise

Domains 270

naqod.pressClearFake payload delivery domain (confidence level: 100%)
memsiug.comFAKEUPDATES payload delivery domain (confidence level: 100%)
security.yourclodd.comFAKEUPDATES payload delivery domain (confidence level: 100%)
pusob.pressClearFake payload delivery domain (confidence level: 100%)
lightsoi.pages.devClearFake payload delivery domain (confidence level: 100%)
e.overallwobbly.ruClearFake payload delivery domain (confidence level: 100%)
vekat.pressClearFake payload delivery domain (confidence level: 100%)
lelah.pressClearFake payload delivery domain (confidence level: 100%)
n51v.pages.devClearFake payload delivery domain (confidence level: 100%)
medikalbitkisel.netLumma Stealer botnet C2 domain (confidence level: 100%)

URLs 252

http://5.181.156.158/files/winhost.exeSliver payload delivery URL (confidence level: 50%)
https://stellar-gumption-ea9fd6.netlify.app/20649.binXWorm payload delivery URL (confidence level: 50%)
https://fanciful-gelato-78b95c.netlify.app/15429b.binXWorm payload delivery URL (confidence level: 50%)
https://statuesque-praline-1be80d.netlify.app/15432bs.binXWorm payload delivery URL (confidence level: 50%)
https://discord.com/api/webhooks/1363629579188568306/wtwqmokcwlyroai6ttyqskdgnqp385afkmt7-nwykmz8vjufynmmiprhjlbgrfh0hqb0BlankGrabber botnet C2 (confidence level: 100%)
https://discord.com/api/webhooks/1368569946631704597/glnlnj8tuuswnyj5rjogug_i3wwpbsue2y4apcdfnmaopjlnkxyara8dhhrwm7tfork_BlankGrabber botnet C2 (confidence level: 100%)
https://serholders.pro/6133d41f0e6446f0.phpUnknown malware botnet C2 (confidence level: 100%)
https://62.60.226.232/1a228f64bf7ebcb0.phpStealc botnet C2 (confidence level: 50%)
http://f0867029.xsph.ru/Unknown malware botnet C2 (confidence level: 50%)
https://pastebin.com/raw/kbtpqkwqXWorm botnet C2 (confidence level: 50%)

IP addresses 770

8.210.236.220Sliver botnet C2 server (confidence level: 50%)
8.222.138.62Sliver botnet C2 server (confidence level: 50%)
156.253.227.62Bashlite botnet C2 server (confidence level: 75%)
5.181.156.158Sliver botnet C2 server (confidence level: 50%)
80.76.49.13Remcos botnet C2 server (confidence level: 100%)
186.169.92.72AsyncRAT botnet C2 server (confidence level: 100%)
79.133.46.33Hook botnet C2 server (confidence level: 100%)
79.133.46.33Hook botnet C2 server (confidence level: 100%)
154.58.204.239Hook botnet C2 server (confidence level: 100%)
45.80.158.118Hook botnet C2 server (confidence level: 100%)

Hashes 9

747bb59ee38af3587d3e9cb0a9a7021fd008df9fc9de335691394112d0b3d5b9PlugX payload (confidence level: 100%)
f8e59c991941085b94e98293eb14f18699c809491cf2d860c470c8f97250882bPlugX payload (confidence level: 100%)
3a514e164db30acdb3063eb79a23aa4fDragonForce payload (confidence level: 50%)
f0410358a0d9dbd0dff3113d9c744ca7DragonForce payload (confidence level: 50%)
99be93aa4c34b39fedcd37663c34511fDragonForce payload (confidence level: 50%)
5b8e02eeb5ee9d091f0f0cfa7d662f081f535fe76a1c2c643e4b001a4693a310Unknown Stealer payload (confidence level: 100%)
9736575cbdfdc728cf78506e76efffd50766f723c360029b3361b6740ac4a4b0Unknown Stealer payload (confidence level: 100%)
21d0e7934bd1393ed8fe9dc3b3364b6355f8380121e65827fed61d8c21b83574Unknown Stealer payload (confidence level: 100%)
6c42f342aafdaaf5c41dcc7018e1363eba0c1407f24edc682ad4c9b813045352Unknown Stealer payload (confidence level: 100%)

Description

ThreatFox IOCs for 2025-05-06

Impact

For European organizations, the impact of this threat intelligence is primarily informational and preparatory rather than immediate or direct. Since no active exploits or vulnerabilities are reported, the risk lies in potential future use of these IOCs by threat actors to conduct targeted attacks involving payload delivery or network intrusion. Organizations relying on threat intelligence feeds can leverage these IOCs to improve their detection and response mechanisms, thereby reducing the risk of compromise. However, without specific malware or exploit details, the immediate operational impact is limited. The medium severity indicates that while the threat is not negligible, it does not currently pose a critical risk to confidentiality, integrity, or availability of systems.

Defensive guidance

European organizations should integrate these IOCs into their existing security monitoring and threat detection platforms, such as SIEM (Security Information and Event Management) and IDS/IPS (Intrusion Detection/Prevention Systems). Regularly updating threat intelligence feeds and correlating these IOCs with internal logs can help identify suspicious network activity or payload delivery attempts early. Additionally, organizations should conduct threat hunting exercises using these indicators to proactively detect potential compromises. Since no patches or specific vulnerabilities are involved, emphasis should be placed on network segmentation, strict access controls, and continuous monitoring of outbound and inbound traffic for anomalies matching the provided IOCs. Training security analysts to recognize patterns associated with payload delivery and network reconnaissance can further enhance defense posture.

Community reviews

Loading reviews…