IndicatorPublished 5 Jun 2025Updated 6 Jun 2025

type osint · ThreatFox IOCs for 2025-06-05

Affects type osintSource ThreatFox MISP Feed

TLP:WHITE, disclosure is not limited

Indicators of compromise

Domains 37

security.guaedfleres.comUnknown malware payload delivery domain (confidence level: 100%)
nemaodi.comUnknown malware payload delivery domain (confidence level: 100%)
robertocalimera.icuFAKEUPDATES payload delivery domain (confidence level: 100%)
jetjetbrzil.shopCrocodilus botnet C2 domain (confidence level: 100%)
mastercardkeys.worldCrocodilus botnet C2 domain (confidence level: 100%)
basicvitals.comBrute Ratel C4 botnet C2 domain (confidence level: 100%)
callbak.link.comCobalt Strike botnet C2 domain (confidence level: 75%)
chat.mrflame.cfdCobalt Strike botnet C2 domain (confidence level: 100%)
bravo-rewards.comUnknown malware botnet C2 domain (confidence level: 100%)
microsofte.zapto.orgAsyncRAT botnet C2 domain (confidence level: 100%)

URLs 29

https://nemaodi.com/flare.msiUnknown malware payload delivery URL (confidence level: 100%)
http://cs16566.tw1.ru/628beae0.phpDCRat botnet C2 (confidence level: 100%)
http://387780cm.nyashvibe.ru/providertrackwppublic.phpDCRat botnet C2 (confidence level: 100%)
http://nitelume.shop/requestcpubigloadwpcentral.phpDCRat botnet C2 (confidence level: 100%)
https://wepwwd.live/iauh/apiLumma Stealer botnet C2 (confidence level: 75%)
https://lepidobdkn.digital/tajLumma Stealer botnet C2 (confidence level: 75%)
https://heartokait.digital/gaiLumma Stealer botnet C2 (confidence level: 75%)
https://https://t.me/stfmms/apiLumma Stealer botnet C2 (confidence level: 75%)
http://mastercardkeys.world/pragmaticalCrocodilus botnet C2 (confidence level: 50%)
http://jetjetbrzil.shop/pragmaticalCrocodilus botnet C2 (confidence level: 50%)

IP addresses 127

79.141.160.153FAKEUPDATES payload delivery server (confidence level: 100%)
47.105.120.230Cobalt Strike botnet C2 server (confidence level: 75%)
120.26.98.120Cobalt Strike botnet C2 server (confidence level: 75%)
47.95.31.143Cobalt Strike botnet C2 server (confidence level: 75%)
44.203.208.169Cobalt Strike botnet C2 server (confidence level: 75%)
47.111.154.80Cobalt Strike botnet C2 server (confidence level: 100%)
43.100.9.138Cobalt Strike botnet C2 server (confidence level: 100%)
179.43.176.3Remcos botnet C2 server (confidence level: 100%)
154.247.135.60Sliver botnet C2 server (confidence level: 100%)
38.46.221.61Sliver botnet C2 server (confidence level: 100%)

Hashes 6

69575d53f0cb5f56293ac9f000889d2b6cb8e78411aa4b954119abe62260cdacCrocodilus payload (confidence level: 100%)
c55df59ba08f65d53695c37a712a280d944fd1b251319b7049396a77d3bc93e2Crocodilus payload (confidence level: 100%)
65955cfb6f9fe3c3398c67ba936637e19faca3058cf0a2748b2a72e533740109Crocodilus payload (confidence level: 100%)
7b6f0650b61266f4cceeb300b57980b997e8d81e522e4d00c6b5e35641250df9Crocodilus payload (confidence level: 100%)
d86163423afa32bb0b793ad909d6b357Unknown malware payload (confidence level: 50%)
34d8f42e67a6ae938554cb98f939b759Unknown malware payload (confidence level: 50%)

Description

ThreatFox IOCs for 2025-06-05

Impact

For European organizations, the impact of this threat depends largely on the nature and accuracy of the IOCs provided. Since the threat involves payload delivery and network activity, there is a potential risk of malware infection leading to data exfiltration, system compromise, or disruption of services. However, the medium severity and lack of known exploits in the wild imply that immediate widespread impact is unlikely. Organizations that rely heavily on OSINT feeds for threat detection can benefit from integrating these IOCs into their security monitoring tools to enhance detection capabilities. The absence of specific affected products or versions means that the threat could be generic or targeting multiple platforms, which requires vigilance across diverse IT environments. European entities with critical infrastructure or sensitive data may face increased risk if these IOCs correspond to emerging malware campaigns targeting their sectors. Overall, the threat underscores the importance of proactive threat intelligence consumption and network monitoring to detect and respond to potential payload delivery attempts.

Defensive guidance

1. Integrate the provided IOCs into existing Security Information and Event Management (SIEM) systems and Endpoint Detection and Response (EDR) tools to enhance detection of related malicious activities. 2. Conduct network traffic analysis focusing on anomalies that match the network activity patterns indicated by the IOCs. 3. Maintain updated threat intelligence feeds and cross-reference these IOCs with other sources to identify any emerging patterns or related threats. 4. Implement strict network segmentation and least privilege access controls to limit the potential spread of malware if payload delivery is successful. 5. Educate security teams on the importance of OSINT-based threat intelligence and encourage regular review of public threat feeds like ThreatFox. 6. Since no patches are available, emphasize robust incident response planning and rapid containment strategies in case of detection. 7. Employ multi-factor authentication and continuous monitoring to reduce the risk of initial compromise and lateral movement.

Community reviews

Loading reviews…