IndicatorPublished 9 Jul 2025Updated 10 Jul 2025

type osint · ThreatFox IOCs for 2025-07-09

Affects type osintSource ThreatFox MISP Feed

TLP:WHITE, disclosure is not limited

Indicators of compromise

Domains 113

baidu-cdn29.shopCobalt Strike botnet C2 domain (confidence level: 75%)
regone.dnsframe.comXWorm botnet C2 domain (confidence level: 100%)
anonsim.pwXWorm botnet C2 domain (confidence level: 100%)
casino.ddnss.deRemcos botnet C2 domain (confidence level: 100%)
hajouts8koumis10.duckdns.orgRemcos botnet C2 domain (confidence level: 100%)
hajouts8koumis11.duckdns.orgRemcos botnet C2 domain (confidence level: 100%)
hajouts8koumis12.duckdns.orgRemcos botnet C2 domain (confidence level: 100%)
ms-office.duckdns.orgRemcos botnet C2 domain (confidence level: 100%)
ms-office1.duckdns.orgRemcos botnet C2 domain (confidence level: 100%)
dczip7.duckdns.orgAsyncRAT botnet C2 domain (confidence level: 100%)

URLs 126

http://1.94.239.203:1111/kaboCobalt Strike botnet C2 (confidence level: 75%)
http://45.94.47.147/contactAMOS botnet C2 (confidence level: 50%)
http://45.94.47.145/contactAMOS botnet C2 (confidence level: 50%)
http://45.94.47.146/contactAMOS botnet C2 (confidence level: 50%)
http://45.94.47.147/api/tasksAMOS botnet C2 (confidence level: 50%)
http://45.94.47.147/admin/AMOS botnet C2 (confidence level: 50%)
http://45.94.47.147/api/tasks/rj6leuffrscck0helmxo1w==AMOS botnet C2 (confidence level: 50%)
http://45.94.47.147/api/tasks/fwtp43gdj4l+4rbc1gvxxa==AMOS botnet C2 (confidence level: 50%)
http://45.94.47.147/api/tasks/td/kwwdt1lsy9dueve5pigAMOS botnet C2 (confidence level: 50%)
http://45.94.47.147/api/tasks/vxknm+cklplzp+quebackw=AMOS botnet C2 (confidence level: 50%)

IP addresses 332

101.43.62.241Cobalt Strike botnet C2 server (confidence level: 100%)
42.193.0.19Cobalt Strike botnet C2 server (confidence level: 100%)
156.246.3.167Unknown malware botnet C2 server (confidence level: 100%)
156.246.2.187Unknown malware botnet C2 server (confidence level: 100%)
5.161.72.36Unknown malware botnet C2 server (confidence level: 100%)
102.219.210.199Quasar RAT botnet C2 server (confidence level: 100%)
35.180.210.246NetSupportManager RAT botnet C2 server (confidence level: 100%)
35.180.210.246NetSupportManager RAT botnet C2 server (confidence level: 100%)
15.237.251.27NetSupportManager RAT botnet C2 server (confidence level: 100%)
40.176.177.0NetSupportManager RAT botnet C2 server (confidence level: 100%)

Hashes 12

8d8b40e87d3011de5b33103df2ed4ec81458b2a2f8807fbb7ffdbc351c7c7b5eAMOS payload (confidence level: 50%)
3402883ff6efadf0cc8b7434a0530fb769de5549b0e9510dfdd23bc0689670d6AMOS payload (confidence level: 50%)
11e55fa23f0303ae949f1f1d7766b79faf0eb77bccb6f976f519a29fe51ce838AMOS payload (confidence level: 50%)
2102c2178000f8c63d01fd9199400885d1449501337c4f9f51b7e444aa6fbf50Unknown malware payload (confidence level: 50%)
e07b33b5560bbef2e4ae055a062fdf5b6a7e5b097283a77a0ec87edb7a354725Unknown malware payload (confidence level: 50%)
3f3e367d673cac778f3f562d0792e4829a919766460ae948ab2594d922a0edaeUnknown malware payload (confidence level: 50%)
f8403e30dd495561dc0674a3b1aedaea5d6839808428069d98e30e19bd6dc045Unknown malware payload (confidence level: 50%)
fbffe681c61f9bba4c7abcb6e8fe09ef4d28166a10bfeb73281f874d84f69b3dUnknown malware payload (confidence level: 50%)
39c68962a6b0963b56085a0f1a2af25c7974a167b650cf99eb1acd433ecb772bUnknown malware payload (confidence level: 50%)
9d1f587b1bd2cce1a14a1423a77eb746d126e1982a0a794f6b870a2d7178bd2cUnknown malware payload (confidence level: 50%)

Description

ThreatFox IOCs for 2025-07-09

Impact

For European organizations, the impact of this threat is currently limited due to the absence of known exploits and specific affected products or versions. Since this is an OSINT-based IOC update without active exploitation, the immediate risk to confidentiality, integrity, or availability is low. However, the presence of new or updated IOCs can aid attackers in refining their payload delivery and network activity tactics, potentially increasing the risk of future targeted attacks. Organizations relying on threat intelligence feeds like ThreatFox can leverage this information to enhance detection capabilities. The medium severity suggests vigilance is warranted, especially for sectors with high exposure to malware campaigns, such as finance, critical infrastructure, and government entities. The lack of patches or mitigation details means organizations must rely on proactive monitoring and network defense strategies to mitigate potential risks.

Defensive guidance

Given the nature of this threat as an IOC update without specific exploit details, mitigation should focus on enhancing detection and response capabilities. European organizations should: 1) Integrate the latest ThreatFox IOCs into their Security Information and Event Management (SIEM) and Endpoint Detection and Response (EDR) systems to improve identification of suspicious network activity and payload delivery attempts. 2) Conduct regular threat hunting exercises using these IOCs to identify potential compromises early. 3) Maintain robust network segmentation and apply strict egress and ingress filtering to limit malware propagation and command-and-control communications. 4) Ensure all systems are up to date with security patches unrelated to this specific threat to reduce overall attack surface. 5) Educate security teams on interpreting and operationalizing OSINT-based IOCs effectively. 6) Collaborate with national and European cybersecurity centers to share intelligence and receive timely updates on emerging threats. These steps go beyond generic advice by emphasizing proactive intelligence integration and operational readiness rather than reactive patching or generic controls.

Community reviews

Loading reviews…