IndicatorPublished 15 May 2025Updated 16 May 2025

type osint · ThreatFox IOCs for 2025-05-15

Affects type osintSource ThreatFox MISP Feed

TLP:WHITE, disclosure is not limited

Indicators of compromise

Domains 50

saxecocnak.liveLumma Stealer botnet C2 domain (confidence level: 100%)
emphatakpn.betLumma Stealer botnet C2 domain (confidence level: 100%)
laminaflbx.shopLumma Stealer botnet C2 domain (confidence level: 100%)
brandenfrancseet.sbsUnknown Loader payload delivery domain (confidence level: 100%)
fmovies123.topNetSupportManager RAT payload delivery domain (confidence level: 100%)
ndgpt.ruClearFake payload delivery domain (confidence level: 100%)
zdqdc.ruClearFake payload delivery domain (confidence level: 100%)
ec2-54-183-101-23.us-west-1.compute.amazonaws.comCobalt Strike botnet C2 domain (confidence level: 75%)
flowergrandeseen.sbsUnknown Loader payload delivery domain (confidence level: 100%)
console24.onlineUnknown Loader payload delivery domain (confidence level: 100%)

URLs 51

https://fmovies123.top/fix/select.jsNetSupportManager RAT payload delivery URL (confidence level: 100%)
https://fmovies123.top/fix/his.phpNetSupportManager RAT payload delivery URL (confidence level: 100%)
https://probuildgroupusa.com/xsxs.zipNetSupportManager RAT payload delivery URL (confidence level: 100%)
http://ck92448.tw1.ru/5d8ad51b.phpDCRat botnet C2 (confidence level: 100%)
https://7lancery.digital/gojLumma Stealer botnet C2 (confidence level: 75%)
https://files.catbox.moe/olyfi3.001DarkCloud Stealer payload delivery URL (confidence level: 50%)
http://206.206.126.216/Hook botnet C2 (confidence level: 50%)
https://onedrive.live.com/download?cid=74f1199a49c3215b&resid=74f1199a49c3215b%21122&authkey=aagy326uc3bhn_ksUnknown Loader payload delivery URL (confidence level: 50%)
http://crackarithmetic.icu/glo.phpUnknown Loader botnet C2 (confidence level: 100%)
https://mflowerexju.bet/lanzLumma Stealer botnet C2 (confidence level: 75%)

IP addresses 144

47.96.114.159Cobalt Strike botnet C2 server (confidence level: 100%)
159.65.9.106Cobalt Strike botnet C2 server (confidence level: 100%)
47.115.202.126Cobalt Strike botnet C2 server (confidence level: 100%)
205.198.88.140Cobalt Strike botnet C2 server (confidence level: 100%)
39.100.76.142Cobalt Strike botnet C2 server (confidence level: 100%)
134.175.229.167Cobalt Strike botnet C2 server (confidence level: 100%)
196.251.85.128Remcos botnet C2 server (confidence level: 100%)
172.111.244.102Remcos botnet C2 server (confidence level: 100%)
3.17.164.16Sliver botnet C2 server (confidence level: 100%)
8.218.254.239Unknown malware botnet C2 server (confidence level: 100%)

Hashes 5

bf3b43f5e4398ac810f005200519e096349b2237587d920d3c9b83525bb6bafcDarkCloud Stealer payload (confidence level: 50%)
9940de30f3930cf0d0e9e9c8769148594240d11242fcd6c9dd9e9f572f68ac01DarkCloud Stealer payload (confidence level: 50%)
30738450f69c3de74971368192a4a647e4ed9c658f076459e42683b110baf371DarkCloud Stealer payload (confidence level: 50%)
1269c968258999930b573682699fe72de72d96401e3beb314ae91baf0e0e49e8DarkCloud Stealer payload (confidence level: 50%)
4ebd79e8935076a7916e19650f98cc8c20aef4fb5c9da57807b472ee012d6d8cLumma Stealer payload (confidence level: 100%)

Description

ThreatFox IOCs for 2025-05-15

Impact

For European organizations, the impact of these IOCs depends on their integration into security monitoring and incident response processes. Since these are OSINT-based indicators related to network activity and payload delivery, they can help identify malicious communications or payloads in network traffic. The medium severity suggests a moderate risk, likely indicating that these IOCs could be associated with malware campaigns or threat actors that might target organizations indiscriminately or sector-specifically. Without specific affected products or vulnerabilities, the direct impact on confidentiality, integrity, or availability is uncertain but could involve detection of malware infections or network intrusions. Organizations lacking robust threat intelligence ingestion or network monitoring capabilities may miss early signs of compromise. Conversely, those with mature security operations can leverage these IOCs to enhance detection and reduce dwell time of threats. The lack of known exploits in the wild reduces immediate risk but does not eliminate potential future exploitation or targeted attacks using these indicators.

Defensive guidance

1. Integrate the provided IOCs into existing Security Information and Event Management (SIEM) systems and threat intelligence platforms to enable automated detection and alerting on matching network activity or payload signatures. 2. Conduct regular network traffic analysis and endpoint monitoring to identify suspicious communications or payload deliveries matching these indicators. 3. Enhance collaboration with threat intelligence sharing communities to receive timely updates and context around these IOCs. 4. Implement network segmentation and strict egress filtering to limit the impact of potential payload delivery and lateral movement. 5. Train security analysts to interpret OSINT-based indicators and correlate them with internal telemetry for effective incident response. 6. Maintain up-to-date endpoint protection and network security controls to reduce the risk of successful payload execution, even if specific patches are unavailable. 7. Continuously review and update detection rules based on evolving threat intelligence to adapt to changes in attacker tactics.

Community reviews

Loading reviews…