IndicatorPublished 13 Jul 2025Updated 14 Jul 2025

type osint · ThreatFox IOCs for 2025-07-13

Affects type osintSource ThreatFox MISP Feed

TLP:WHITE, disclosure is not limited

Indicators of compromise

Domains 27

analyticasnodez.comUnknown malware payload delivery domain (confidence level: 100%)
security.faraleshiaeld.comUnknown malware payload delivery domain (confidence level: 100%)
solpendi.comUnknown malware payload delivery domain (confidence level: 100%)
xn--2vrub.ccCobalt Strike botnet C2 domain (confidence level: 100%)
157-230-34-254.cprapid.comHavoc botnet C2 domain (confidence level: 100%)
biaderibra.infoHavoc botnet C2 domain (confidence level: 100%)
craftsgamer.4cloud.clickQuasar RAT botnet C2 domain (confidence level: 100%)
xntryz.thddns.netNjRAT botnet C2 domain (confidence level: 100%)
bibl129.ddns.netDarkComet botnet C2 domain (confidence level: 50%)
names-jelsoft.gl.at.ply.ggDCRat botnet C2 domain (confidence level: 50%)

URLs 27

http://cj13224.tw1.ru/85d4698c.phpDCRat botnet C2 (confidence level: 100%)
https://saawzig.pics/gutdLumma Stealer botnet C2 (confidence level: 75%)
http://prolprolprol.shopStealc botnet C2 (confidence level: 100%)
http://94.156.177.41/mrc/five/fre.phpLoki Password Stealer (PWS) botnet C2 (confidence level: 100%)
https://62.60.226.188/e9591576f6114884.phpStealc botnet C2 (confidence level: 50%)
https://pastebin.com/edit/fwjes08rXWorm botnet C2 (confidence level: 50%)
https://pastebin.com/raw/mazt3hdbXWorm botnet C2 (confidence level: 50%)
https://nelospaet.cfd/apiLumma Stealer botnet C2 (confidence level: 100%)
https://sthfna.pics/zjajLumma Stealer botnet C2 (confidence level: 75%)
https://chehmk.top/taowLumma Stealer botnet C2 (confidence level: 75%)

IP addresses 162

185.244.0.116Cobalt Strike botnet C2 server (confidence level: 100%)
121.61.109.25Cobalt Strike botnet C2 server (confidence level: 100%)
107.149.154.103Cobalt Strike botnet C2 server (confidence level: 100%)
156.236.74.163Ghost RAT botnet C2 server (confidence level: 100%)
216.250.250.246Remcos botnet C2 server (confidence level: 100%)
196.251.113.10AsyncRAT botnet C2 server (confidence level: 100%)
196.251.81.62Hook botnet C2 server (confidence level: 100%)
216.245.184.59Havoc botnet C2 server (confidence level: 100%)
176.96.137.222Venom RAT botnet C2 server (confidence level: 100%)
148.66.21.234DCRat botnet C2 server (confidence level: 100%)

Hashes 3

Lumma Stealer payload (confidence level: 100%)

0600abfaae8c11c14dd88dabcc8a230b35d2294921085dc299fd2d3e4bf1b03c
38e9a217d00e3b5b9873bad810ed1ed4d1d19b7a421365092e529ed5fd47a11d
7fa03d9f6fed85029600e9e4dff8f8275c258b155f33e000f76e3d8e1205ac20

Description

ThreatFox IOCs for 2025-07-13

Impact

For European organizations, the impact of these IOCs is primarily in enhancing threat detection capabilities rather than mitigating an active or imminent threat. Since no specific malware or exploit is detailed, the direct risk to confidentiality, integrity, or availability is unclear. However, the presence of new or updated IOCs can improve the ability of security teams to identify and respond to malicious network activity, potentially reducing the window of exposure to payload delivery attempts or network intrusions. Organizations relying on OSINT feeds and threat intelligence platforms can integrate these indicators to strengthen their monitoring and incident response processes. The medium severity rating suggests that while the threat is not critical, ignoring these IOCs could allow adversaries to operate undetected. European entities with mature security operations centers (SOCs) and threat hunting capabilities stand to benefit most from incorporating this intelligence. Conversely, organizations with limited threat intelligence integration may see less immediate impact but should still consider updating detection rules accordingly.

Defensive guidance

Given the nature of this content as threat intelligence IOCs rather than a direct exploit, mitigation focuses on operational security measures: 1) Integrate the provided IOCs into existing security information and event management (SIEM) systems, intrusion detection/prevention systems (IDS/IPS), and endpoint detection and response (EDR) tools to enhance detection of related network activity or payload delivery attempts. 2) Conduct regular threat hunting exercises using these IOCs to proactively identify potential compromises. 3) Ensure that network segmentation and strict access controls are in place to limit the spread of any detected payloads. 4) Maintain up-to-date threat intelligence feeds and automate IOC ingestion to reduce response times. 5) Train security analysts to recognize patterns associated with these indicators and to escalate suspicious activity promptly. 6) Since no patches are available, emphasize layered defenses and monitoring rather than relying on software updates. 7) Collaborate with information sharing communities to contextualize these IOCs within broader threat landscapes.

Community reviews

Loading reviews…