IndicatorPublished 6 Jun 2025Updated 7 Jun 2025

type osint · ThreatFox IOCs for 2025-06-06

Affects type osintSource ThreatFox MISP Feed

TLP:WHITE, disclosure is not limited

Indicators of compromise

Domains 117

relay.thepcboy.comUnknown RAT botnet C2 domain (confidence level: 100%)
789pettoys.shopNetSupportManager RAT payload delivery domain (confidence level: 100%)
www.cuoreincomune.comNetSupportManager RAT payload delivery domain (confidence level: 100%)
security.flaeregaurde.comUnknown malware payload delivery domain (confidence level: 100%)
depsox.comUnknown malware payload delivery domain (confidence level: 100%)
ns1.admlistdel.comCobalt Strike botnet C2 domain (confidence level: 75%)
b1.parsleyhandbook.lifeUnknown Stealer botnet C2 domain (confidence level: 100%)
h4.wiryexclusion.topUnknown Stealer botnet C2 domain (confidence level: 100%)
windows.driversact.storeRemcos botnet C2 domain (confidence level: 100%)
gou.xiaogoubi.topCobalt Strike botnet C2 domain (confidence level: 50%)

URLs 39

http://181.174.164.12/kycGootLoader botnet C2 (confidence level: 100%)
https://www.cuoreincomune.com/xssrsa.zipNetSupportManager RAT payload delivery URL (confidence level: 100%)
https://cloudflare-check.com/Unknown malware payload delivery URL (confidence level: 100%)
https://receursroomsinf.world/Unknown malware payload delivery URL (confidence level: 100%)
https://verfroomsattend.world/Unknown malware payload delivery URL (confidence level: 100%)
https://extrqnnet-registers.com/Unknown malware payload delivery URL (confidence level: 100%)
https://otherreviewexnt.com/Unknown malware payload delivery URL (confidence level: 100%)
https://789pettoys.shop/lsl/index.jsNetSupportManager RAT payload delivery URL (confidence level: 100%)
https://www.cuoreincomune.com/head.phpNetSupportManager RAT payload delivery URL (confidence level: 100%)
https://depsox.com/flare.msiUnknown malware payload delivery URL (confidence level: 100%)

IP addresses 188

94.158.245.13NetSupportManager RAT botnet C2 server (confidence level: 100%)
181.174.164.12Unknown Stealer botnet C2 server (confidence level: 50%)
139.180.217.210Meterpreter botnet C2 server (confidence level: 75%)
8.155.42.155Cobalt Strike botnet C2 server (confidence level: 75%)
101.42.13.105Cobalt Strike botnet C2 server (confidence level: 75%)
193.104.75.24Cobalt Strike botnet C2 server (confidence level: 100%)
8.130.190.155Cobalt Strike botnet C2 server (confidence level: 100%)
119.45.71.218Cobalt Strike botnet C2 server (confidence level: 100%)
47.92.108.149Cobalt Strike botnet C2 server (confidence level: 100%)
47.92.108.149Cobalt Strike botnet C2 server (confidence level: 100%)

Hashes 8

Unknown malware payload (confidence level: 50%)

71dc9540eb03f2ed4d1b6496b13fe839
00fdc504be1788231aa7b7d2d1335893
d1013bbaa2f151195d563b2b65126fa3
3e581aad42a2a9e080a4a676de42f015
edec051ce461d62fbbd3abf09534b731
5cab4fabffeb5903f684c936a90e0b46
003291d904b89142bada57a9db732ae7
29a2cc59a9ebd334103ce146bca38522

Description

ThreatFox IOCs for 2025-06-06

Impact

For European organizations, the impact of this threat is currently limited due to the absence of known active exploits and the lack of specific affected products or versions. However, the presence of malware-related IOCs in threat intelligence feeds indicates a potential risk of future attacks leveraging these indicators. If exploited, such malware could lead to unauthorized access, data exfiltration, or disruption of network services, impacting confidentiality, integrity, and availability. Organizations in sectors with high network exposure or those that rely heavily on open-source intelligence for threat detection may need to be vigilant. The medium severity suggests a moderate risk level, implying that while immediate impact is low, preparedness is necessary to prevent escalation. The lack of patches or mitigations means organizations must rely on detection and response capabilities to manage this threat.

Defensive guidance

Given the nature of this threat as an intelligence update without active exploitation, European organizations should focus on enhancing their detection and response capabilities. Specific recommendations include: 1) Integrate the latest ThreatFox IOCs into existing Security Information and Event Management (SIEM) systems and Endpoint Detection and Response (EDR) tools to enable early detection of related network activity or payload delivery attempts. 2) Conduct regular network traffic analysis to identify anomalous patterns that may correspond to the delivery or execution of malware payloads. 3) Maintain robust incident response plans that include procedures for handling malware infections and network intrusions. 4) Educate security teams on interpreting OSINT feeds and incorporating them into threat hunting activities. 5) Employ network segmentation and strict access controls to limit the spread of malware if an infection occurs. 6) Since no patches are available, prioritize timely application of security updates for all software and systems to reduce the attack surface for potential future exploits. 7) Collaborate with national and European cybersecurity centers to share intelligence and receive updates on evolving threats.

Community reviews

Loading reviews…