IndicatorPublished 6 Aug 2025Updated 7 Aug 2025

type osint · ThreatFox IOCs for 2025-08-06

Affects type osintSource ThreatFox MISP Feed

TLP:WHITE, disclosure is not limited

Indicators of compromise

Domains 160

materdvc.beerLumma Stealer botnet C2 domain (confidence level: 100%)
pudejmoy.xinLumma Stealer botnet C2 domain (confidence level: 100%)
enterprise-confirm.gl.at.ply.ggXWorm botnet C2 domain (confidence level: 100%)
security.flnaresgurard.comUnknown malware payload delivery domain (confidence level: 100%)
when-assumed.gl.at.ply.ggXWorm botnet C2 domain (confidence level: 100%)
c95f137f-7f36-4b18-964c-56d0d113b143-00-dc5usg4e8pkl.kirk.replit.devCobalt Strike botnet C2 domain (confidence level: 75%)
apm.vpce.gdw55e.micsoloft.infoCobalt Strike botnet C2 domain (confidence level: 100%)
login-us.micsoloft.infoCobalt Strike botnet C2 domain (confidence level: 100%)
cdn.assets.as2.micsoloft.infoCobalt Strike botnet C2 domain (confidence level: 100%)
sci.micsoloft.infoCobalt Strike botnet C2 domain (confidence level: 100%)

URLs 140

http://516063cm.nyash.es/imagegeobaselinuxgeneratortestuniversalwp.phpDCRat botnet C2 (confidence level: 75%)
https://columuyr.xin/iite/apiLumma Stealer botnet C2 (confidence level: 100%)
https://pudejmoy.xin/kxjr/apiLumma Stealer botnet C2 (confidence level: 75%)
http://87.120.222.208/xx45kingsman.txtUnknown malware payload delivery URL (confidence level: 100%)
http://87.120.222.208/xx45.exeUnknown malware payload delivery URL (confidence level: 100%)
http://87.120.222.208/kingcode.txtUnknown malware payload delivery URL (confidence level: 100%)
http://87.120.222.208/mainapp.exeUnknown malware payload delivery URL (confidence level: 100%)
http://892408cm.nyash.es/serverdatalifetemporary.phpDCRat botnet C2 (confidence level: 100%)
http://45.221.64.110/Hook botnet C2 (confidence level: 50%)
https://62.60.227.98/g8jejfc38/login.phpAmadey botnet C2 (confidence level: 50%)

IP addresses 366

192.238.232.45Cobalt Strike botnet C2 server (confidence level: 100%)
43.226.17.11Ghost RAT botnet C2 server (confidence level: 100%)
208.64.33.109Remcos botnet C2 server (confidence level: 100%)
91.236.116.151Matanbuchus botnet C2 server (confidence level: 100%)
164.68.120.30AsyncRAT botnet C2 server (confidence level: 100%)
201.14.19.106AsyncRAT botnet C2 server (confidence level: 100%)
201.14.19.106AsyncRAT botnet C2 server (confidence level: 100%)
201.14.19.106AsyncRAT botnet C2 server (confidence level: 100%)
201.14.19.106AsyncRAT botnet C2 server (confidence level: 100%)
201.14.19.106AsyncRAT botnet C2 server (confidence level: 100%)

Hashes 27

a4e60b10b970f747bee009277c4bd467PrivateLoader payload (confidence level: 50%)
fc14d194dcedece32fb024bcb4ddc335PrivateLoader payload (confidence level: 50%)
bc29c587d6b2eef3e822929375643f66PrivateLoader payload (confidence level: 50%)
0fe32bb43a106b5e5216ca8c3a698d49PrivateLoader payload (confidence level: 50%)
cd233ec4c17ad2ad61e2a44a2ea978caPrivateLoader payload (confidence level: 50%)
58747853fabe22c713b3168411a96f92PrivateLoader payload (confidence level: 50%)
81b094c4717b2dd56f38ab7db4fb938cPrivateLoader payload (confidence level: 50%)
51ac5f4bcffd208899ebe778c1725579Ares payload (confidence level: 100%)
7dd7a25a6ae7caeb4f7ad9a89d96f7ecAres payload (confidence level: 100%)
e1b4572ea0780c963043819016f4c7a8Unknown malware payload (confidence level: 100%)

Description

ThreatFox IOCs for 2025-08-06

Impact

For European organizations, the impact of this threat depends largely on the nature of the malware payloads delivered and the sectors targeted. Given the medium severity and the focus on network activity and payload delivery, potential impacts include unauthorized access, data exfiltration, disruption of services, or compromise of endpoint systems. Organizations with extensive network exposure, such as financial institutions, critical infrastructure providers, and large enterprises, could face operational disruptions or data breaches if targeted. The lack of known exploits in the wild and absence of patches suggest that this threat may currently be in an intelligence-gathering or early distribution phase, but it could evolve. European entities that rely heavily on OSINT for threat detection or have open network architectures may be more susceptible to initial infection vectors. Additionally, the TLP:white classification indicates that the information is intended for wide distribution, which may lead to broader awareness but also potential adversary adaptation.

Defensive guidance

Given the limited technical details, mitigation should focus on enhancing network monitoring and threat detection capabilities. European organizations should: 1) Integrate and regularly update threat intelligence feeds, including ThreatFox IOCs, into their Security Information and Event Management (SIEM) systems to detect related indicators promptly. 2) Employ advanced network traffic analysis tools to identify anomalous payload delivery attempts, especially those flagged by OSINT sources. 3) Harden network perimeters by implementing strict ingress and egress filtering, and segment networks to limit lateral movement. 4) Conduct regular employee training on phishing and social engineering, as payload delivery often involves user interaction. 5) Maintain up-to-date endpoint protection solutions capable of detecting and blocking malware payloads. 6) Establish incident response plans that incorporate OSINT-derived threat intelligence to enable rapid containment and remediation. 7) Collaborate with national and European cybersecurity centers to share intelligence and receive timely alerts about emerging threats.

Community reviews

Loading reviews…