IndicatorPublished 4 Jun 2025Updated 5 Jun 2025

type osint · ThreatFox IOCs for 2025-06-04

Affects type osintSource ThreatFox MISP Feed

TLP:WHITE, disclosure is not limited

Indicators of compromise

Domains 96

masteringjscode.comFAKEUPDATES botnet C2 domain (confidence level: 100%)
security.flagguart.comUnknown malware payload delivery domain (confidence level: 100%)
kolepz.comUnknown malware payload delivery domain (confidence level: 100%)
blacktds.aiUnknown malware botnet C2 domain (confidence level: 100%)
www.0v3py92izrp23yy.xyzFormbook botnet C2 domain (confidence level: 50%)
www.100449.netFormbook botnet C2 domain (confidence level: 50%)
www.59hl.netFormbook botnet C2 domain (confidence level: 50%)
www.77578.shopFormbook botnet C2 domain (confidence level: 50%)
www.87445.pizzaFormbook botnet C2 domain (confidence level: 50%)
www.952734073.xyzFormbook botnet C2 domain (confidence level: 50%)

URLs 121

https://kolepz.com/flare.msiUnknown malware payload delivery URL (confidence level: 100%)
https://travelkrop.com/capcha/Unknown malware payload delivery URL (confidence level: 100%)
https://www.bookingreserv.com/Unknown malware payload delivery URL (confidence level: 100%)
https://claimnotiifcations.com/Unknown malware payload delivery URL (confidence level: 100%)
https://property-paids.com/Unknown malware payload delivery URL (confidence level: 100%)
https://rescv-extranet.com/Unknown malware payload delivery URL (confidence level: 100%)
https://guestcaseportal.com/Unknown malware payload delivery URL (confidence level: 100%)
https://microstteams.com/additional-check.htmlUnknown malware payload delivery URL (confidence level: 100%)
https://elite-vpn.com/captcha/additional-check.htmlUnknown malware payload delivery URL (confidence level: 100%)
https://ecologilives.com/Unknown malware payload delivery URL (confidence level: 100%)

IP addresses 155

194.87.74.199FAKEUPDATES payload delivery server (confidence level: 100%)
128.140.120.188Interlock RAT botnet C2 server (confidence level: 75%)
177.136.225.135Interlock RAT botnet C2 server (confidence level: 75%)
45.61.136.109Interlock RAT botnet C2 server (confidence level: 75%)
49.12.69.80Interlock RAT botnet C2 server (confidence level: 75%)
144.172.100.124BeaverTail botnet C2 server (confidence level: 75%)
144.172.102.21BeaverTail botnet C2 server (confidence level: 75%)
144.172.106.7BeaverTail botnet C2 server (confidence level: 75%)
116.198.52.236Cobalt Strike botnet C2 server (confidence level: 75%)
8.141.83.243Cobalt Strike botnet C2 server (confidence level: 75%)

Hashes 9

e40e82b77019edca06c7760b6133c6cc481d9a22585dd80bce393f0bfbe47a99Interlock RAT payload (confidence level: 75%)
efea43500a35eb76433e596eeeb92f3e6bae37ca07611cd03cc3b56b18721627Interlock RAT payload (confidence level: 75%)
1e6d4f3eacfef45e2fdfe4d5218aa33079a9b5ca2bba1b0eb3c71f9a5d663ea9Interlock RAT payload (confidence level: 75%)
6d55d90d021b0980528f56d040e78fa7b85a96f5c244e23f330f24c8e80c1cb2Crocodilus payload (confidence level: 50%)
fb046b7d0e385ba7ad15b766086cd48b4b099e612d8dd0a460da2385dd31e09eCrocodilus payload (confidence level: 50%)
aa0d64c39680027d56a32ffd4ceb7870b05bdd497a3a7c902f23639cb3b43ba1Unknown malware payload (confidence level: 50%)
071aff6941dc388516d8ca0215b757f9bee7584dea6c27c4c6993da192df1ab9Unknown malware payload (confidence level: 50%)
486f305bdd09a3ef6636e92c6a9e01689b8fa977ed7ffb898453c43d47b5386dUnknown malware payload (confidence level: 50%)
ec234419fc512baded05f7b29fefbf12f898a505f62c43d3481aed90fef33687Unknown malware payload (confidence level: 50%)

Description

ThreatFox IOCs for 2025-06-04

Impact

Given the limited technical details and lack of known active exploits, the immediate impact on European organizations is difficult to quantify precisely. However, the presence of malware-related IOCs associated with network activity and payload delivery suggests a potential risk of infection or compromise if these indicators are present in organizational environments. European organizations, especially those with extensive network exposure or those leveraging OSINT tools and feeds for threat detection, could face risks related to undetected malware infiltration, data exfiltration, or disruption of services. The medium severity rating implies a moderate risk level, potentially affecting confidentiality and availability if exploited. Since no patches or direct mitigations are indicated, the impact largely depends on the organization's ability to detect and respond to these IOCs. The lack of authentication or user interaction details further complicates impact assessment but suggests that exploitation might be opportunistic or reliant on network exposure.

Defensive guidance

To mitigate risks associated with this threat, European organizations should enhance their network monitoring and threat detection capabilities by integrating updated IOCs from reputable OSINT sources such as ThreatFox. Specific actions include: 1) Deploying and regularly updating intrusion detection/prevention systems (IDS/IPS) and endpoint detection and response (EDR) tools to recognize and block known malicious payloads and network behaviors. 2) Conducting regular network traffic analysis to identify anomalous activities that match the provided IOCs or similar patterns. 3) Implementing strict network segmentation to limit lateral movement in case of infection. 4) Ensuring that security teams have access to and actively use threat intelligence feeds to correlate alerts with emerging threats. 5) Conducting employee awareness training focused on recognizing phishing or social engineering attempts that could serve as initial infection vectors. 6) Maintaining robust incident response plans that include procedures for IOC ingestion and rapid containment. Since no patches are available, proactive detection and containment are critical.

Community reviews

Loading reviews…