IndicatorPublished 30 Jun 2025Updated 1 Jul 2025

type osint · ThreatFox IOCs for 2025-06-30

Affects type osintSource ThreatFox MISP Feed

TLP:WHITE, disclosure is not limited

Indicators of compromise

Domains 112

security.flqergoaurd.comUnknown malware payload delivery domain (confidence level: 100%)
pobikc.comUnknown malware payload delivery domain (confidence level: 100%)
notifications.rubyhall.in.netUnknown malware botnet C2 domain (confidence level: 100%)
www3.accounts.rubyhall.in.netUnknown malware botnet C2 domain (confidence level: 100%)
114.138.61.34.bc.googleusercontent.comUnknown malware botnet C2 domain (confidence level: 100%)
apis.rubyhall.in.netUnknown malware botnet C2 domain (confidence level: 100%)
ec2-3-145-32-11.us-east-2.compute.amazonaws.comHavoc botnet C2 domain (confidence level: 100%)
securityhealthsystray.duckdns.orgAsyncRAT botnet C2 domain (confidence level: 50%)
abc.galaxias.ccMirai botnet C2 domain (confidence level: 50%)
api.chanlevip.siteMirai botnet C2 domain (confidence level: 50%)

URLs 26

http://196.251.116.200/d79737dfb3a8401a.phpStealc botnet C2 (confidence level: 50%)
http://31.43.185.30/ku9f3ton/login.phpAmadey botnet C2 (confidence level: 50%)
http://48.210.223.56:8080/supershell/loginUnknown malware botnet C2 (confidence level: 50%)
http://44.211.217.70/Hook botnet C2 (confidence level: 50%)
http://154.0.170.61:88/pages/login.phpUnknown malware botnet C2 (confidence level: 50%)
https://pastebin.com/raw/4d1ykxxtAsyncRAT botnet C2 (confidence level: 50%)
https://pastebin.com/raw/cwx2e1qsAsyncRAT botnet C2 (confidence level: 50%)
https://onedrive.live.com/download?cid=7c3bbcb226195604&resid=7c3bbcb226195604%21107&authkey=ahbjnu2mopli-joUnknown Loader payload delivery URL (confidence level: 50%)
https://12.35.redc.eu.org/Vidar botnet C2 (confidence level: 100%)
https://ds.exifit.eu.org/Vidar botnet C2 (confidence level: 100%)

IP addresses 183

116.193.170.74Cobalt Strike botnet C2 server (confidence level: 100%)
116.193.170.77Cobalt Strike botnet C2 server (confidence level: 100%)
116.193.170.75Cobalt Strike botnet C2 server (confidence level: 100%)
116.193.170.76Cobalt Strike botnet C2 server (confidence level: 100%)
192.159.99.10Remcos botnet C2 server (confidence level: 100%)
173.225.102.145Remcos botnet C2 server (confidence level: 100%)
196.251.86.71Sliver botnet C2 server (confidence level: 100%)
1.54.160.205Orcus RAT botnet C2 server (confidence level: 100%)
18.170.213.135NetSupportManager RAT botnet C2 server (confidence level: 100%)
8.217.196.192Brute Ratel C4 botnet C2 server (confidence level: 100%)

Hashes 31

b0874e98a3b25ffc94279b765c2442bb4ec1e4d3bfc3b13d90bdba7d0ac78fc5Banload payload (confidence level: 75%)
e2d7d65a347b3638f81939192294eb13Unknown malware payload (confidence level: 50%)
2bf543faf679a374af5fc4848eea5a98Unknown malware payload (confidence level: 50%)
2e07a4de9e6ba84728fbdf27384ea0b9Unknown malware payload (confidence level: 50%)
cc1da5f900c8d38f4d56006549e6734cUnknown malware payload (confidence level: 50%)
82afcebc49f49b758de83b3275c91137Unknown malware payload (confidence level: 50%)
0433393db68ff35f1daa147b987b5795Akira payload (confidence level: 50%)
1eef40b82b5e84b44d33c0a6bb7a8cbea086db321bf455f0e6dab8336c6af50bDragonForce payload (confidence level: 100%)
f5df98b344242c5eaad1fce421c640fadd71f7f21379d2bf7309001dfeb25972DragonForce payload (confidence level: 100%)
a399a293cc3f25f6250ebee65e6e60e818831925769d540354275e9ad87bb5bbDragonForce payload (confidence level: 100%)

Description

ThreatFox IOCs for 2025-06-30

Impact

For European organizations, the impact of this threat could manifest as unauthorized payload delivery leading to potential malware infections, data exfiltration, or network disruptions. Since the threat involves network activity and payload delivery, organizations with exposed network services or insufficient monitoring could be at risk. The medium severity suggests that while the threat is not immediately critical, it could facilitate further compromise if leveraged effectively by attackers. The lack of known exploits in the wild reduces immediate risk but does not eliminate the possibility of future exploitation. European entities involved in critical infrastructure, finance, or government sectors could face operational disruptions or data breaches if targeted. The OSINT nature of the threat implies attackers may be using publicly available information to tailor attacks, increasing the risk of successful social engineering or targeted payload delivery campaigns.

Defensive guidance

To mitigate this threat, European organizations should enhance network monitoring to detect unusual payload delivery or network activity patterns, employing advanced intrusion detection and prevention systems (IDS/IPS) with updated threat intelligence feeds. Implementing strict egress and ingress filtering can reduce exposure to malicious payloads. Organizations should conduct regular OSINT-based threat hunting to identify potential reconnaissance activities against their infrastructure. Network segmentation and application whitelisting can limit the impact of successful payload delivery. Employee training on recognizing social engineering attempts and suspicious communications is essential due to the OSINT-driven nature of the threat. Since no patches are available, focus should be on detection and response capabilities, including timely incident response plans and forensic readiness to analyze and contain any infections promptly.

Community reviews

Loading reviews…