IndicatorPublished 26 Jul 2025Updated 27 Jul 2025

type osint · ThreatFox IOCs for 2025-07-26

Affects type osintSource ThreatFox MISP Feed

TLP:WHITE, disclosure is not limited

Indicators of compromise

Domains 41

security.flekergauuard.comUnknown malware payload delivery domain (confidence level: 100%)
perxilox.comUnknown malware payload delivery domain (confidence level: 100%)
5ndg65b68274v.cfc-execute.bj.baidubce.comCobalt Strike botnet C2 domain (confidence level: 75%)
web.vnpti.ukCobalt Strike botnet C2 domain (confidence level: 75%)
dhcp-150-193-129-5.metro86.ruCobalt Strike botnet C2 domain (confidence level: 100%)
fpvxzvrzz-58282.portmap.hostXWorm botnet C2 domain (confidence level: 100%)
graphics-discussions.gl.at.ply.ggXWorm botnet C2 domain (confidence level: 100%)
carolina-collections.gl.at.ply.ggXWorm botnet C2 domain (confidence level: 100%)
there-prozac.gl.at.ply.ggXWorm botnet C2 domain (confidence level: 100%)
sixx.hopto.orgXWorm botnet C2 domain (confidence level: 100%)

URLs 37

http://144.172.106.101/bins/star.x86Unknown malware payload delivery URL (confidence level: 75%)
http://87.121.84.105/1.shUnknown malware payload delivery URL (confidence level: 75%)
http://ck06120.tw1.ru/5f940d99.phpDCRat botnet C2 (confidence level: 100%)
http://cy69121.tw1.ru/70b71c3d.phpDCRat botnet C2 (confidence level: 100%)
http://94.154.35.25/di9ku38f/index.phpAmadey botnet C2 (confidence level: 100%)
http://45.145.228.142:8888/supershell/login/Unknown malware botnet C2 (confidence level: 100%)
http://94.154.35.25/di9ku38f/login.phpAmadey botnet C2 (confidence level: 100%)
https://mnvgp.click/tiriLumma Stealer botnet C2 (confidence level: 100%)
http://196.251.73.115/hbts/top1miku.x86_64Unknown malware payload delivery URL (confidence level: 75%)
http://196.251.73.115/hbts/top1miku.i586Unknown malware payload delivery URL (confidence level: 75%)

IP addresses 179

188.37.160.41PureLogs Stealer botnet C2 server (confidence level: 66%)
62.60.235.100PureLogs Stealer botnet C2 server (confidence level: 66%)
192.30.240.242PureLogs Stealer botnet C2 server (confidence level: 66%)
91.92.120.102PureLogs Stealer botnet C2 server (confidence level: 66%)
8.134.205.250Cobalt Strike botnet C2 server (confidence level: 100%)
47.236.130.154Cobalt Strike botnet C2 server (confidence level: 100%)
86.106.85.185Cobalt Strike botnet C2 server (confidence level: 100%)
45.79.249.239Sliver botnet C2 server (confidence level: 100%)
192.159.99.164AsyncRAT botnet C2 server (confidence level: 100%)
185.93.89.54SectopRAT botnet C2 server (confidence level: 100%)

Hashes 1

Scavenger payload (confidence level: 100%)

c68e42f416f482d43653f36cd14384270b54b68d6496a8e34ce887687de5b441

Description

ThreatFox IOCs for 2025-07-26

Impact

For European organizations, the impact of this threat depends on the nature and prevalence of the malware associated with these IOCs. Since no specific affected products or versions are mentioned, the threat appears generic and potentially applicable across multiple environments. The medium severity rating suggests a moderate risk of compromise if these IOCs correspond to active malware campaigns. Potential impacts include unauthorized access, data exfiltration, or disruption of network services if the malware payload is successfully delivered and executed. European organizations with extensive network exposure or those operating in sectors with high threat actor interest (e.g., finance, critical infrastructure, government) may face increased risk. However, the lack of known exploits in the wild and absence of patches indicate that this is primarily an intelligence update rather than an immediate operational threat. Organizations relying on threat intelligence feeds can leverage these IOCs to enhance detection and response capabilities, thereby reducing potential impact.

Defensive guidance

Given the nature of this threat as an OSINT IOC update without specific exploit details, mitigation should focus on proactive detection and network defense strategies. Organizations should: 1) Integrate these IOCs into existing intrusion detection and prevention systems (IDS/IPS), security information and event management (SIEM) platforms, and endpoint detection and response (EDR) tools to identify potential malicious activity early. 2) Conduct regular network traffic analysis to detect anomalous payload delivery or command and control communications matching the IOC patterns. 3) Maintain robust network segmentation and least privilege access controls to limit malware propagation if infection occurs. 4) Ensure timely application of security patches for all software and firmware, even though no patches are currently linked to this threat, to reduce attack surface. 5) Promote user awareness training focusing on phishing and social engineering, common vectors for payload delivery. 6) Collaborate with threat intelligence sharing communities to receive updated IOC feeds and contextual information. These targeted actions go beyond generic advice by emphasizing integration of specific IOCs into detection tools and continuous monitoring of network activity.

Community reviews

Loading reviews…