IndicatorPublished 7 Aug 2025Updated 8 Aug 2025

type osint · ThreatFox IOCs for 2025-08-07

Affects type osintSource ThreatFox MISP Feed

TLP:WHITE, disclosure is not limited

Indicators of compromise

Domains 50

security.flcreagurade.comUnknown malware payload delivery domain (confidence level: 100%)
anatylicsnode.comUnknown malware payload delivery domain (confidence level: 100%)
lasoriodrens.comLatrodectus payload delivery domain (confidence level: 100%)
gifrodasderty.comLatrodectus payload delivery domain (confidence level: 100%)
asioklaydpory.comLatrodectus payload delivery domain (confidence level: 100%)
viropirostandap.comLatrodectus payload delivery domain (confidence level: 100%)
mimamimoflarestore.comLatrodectus payload delivery domain (confidence level: 100%)
fastmionarabastore.comLatrodectus payload delivery domain (confidence level: 100%)
qrwestfiodterty.comLatrodectus payload delivery domain (confidence level: 100%)
firopirocloundare.comLatrodectus payload delivery domain (confidence level: 100%)

URLs 34

http://164.90.171.162/sora.shUnknown malware payload delivery URL (confidence level: 75%)
https://lasoriodrens.com/work/Latrodectus payload delivery URL (confidence level: 100%)
https://gifrodasderty.com/work/Latrodectus payload delivery URL (confidence level: 100%)
https://asioklaydpory.com/work/Latrodectus payload delivery URL (confidence level: 100%)
https://viropirostandap.com/work/Latrodectus payload delivery URL (confidence level: 100%)
https://https://mimamimoflarestore.com/work/Latrodectus payload delivery URL (confidence level: 100%)
https://fastmionarabastore.com/work/Latrodectus payload delivery URL (confidence level: 100%)
https://qrwestfiodterty.com/work/Latrodectus payload delivery URL (confidence level: 100%)
https://firopirocloundare.com/work/Latrodectus payload delivery URL (confidence level: 100%)
https://sumgifaluis.com/work/Latrodectus payload delivery URL (confidence level: 100%)

IP addresses 206

123.129.229.181Cobalt Strike botnet C2 server (confidence level: 100%)
54.89.193.82Cobalt Strike botnet C2 server (confidence level: 100%)
124.71.139.142Cobalt Strike botnet C2 server (confidence level: 100%)
110.42.53.136Cobalt Strike botnet C2 server (confidence level: 100%)
116.204.171.195Ghost RAT botnet C2 server (confidence level: 100%)
107.172.232.82Remcos botnet C2 server (confidence level: 100%)
172.94.9.228Remcos botnet C2 server (confidence level: 100%)
204.12.209.229Quasar RAT botnet C2 server (confidence level: 100%)
187.201.123.181Quasar RAT botnet C2 server (confidence level: 100%)
187.201.123.181Quasar RAT botnet C2 server (confidence level: 100%)

Hashes 229

9ebf0122504459a69a0ab52bd692a34893958ac1Quasar RAT payload (confidence level: 95%)
62dc5b6be5c74b221dc9c63013c503158c1b9fe2ddc09e370e99d6903b8aa3f0Quasar RAT payload (confidence level: 95%)
dace1672bfb905df280c76fdebc403a0Quasar RAT payload (confidence level: 95%)
2aa194334996221c730e027a55d1f94574cffa24FatalRat payload (confidence level: 95%)
1bf77a789062dbe0abfc81b3ac0328fc3cfa48f337fa081d35826285996987f4FatalRat payload (confidence level: 95%)
abf27842cd768eb06f17f432fcd34822FatalRat payload (confidence level: 95%)
37dacc531af62ba1029a7275c4d096fbf91972d6XWorm payload (confidence level: 95%)
bf28751aada8f3a771578ff6e498efbbc7bf1b2e240babc61598cb2da681d8b4XWorm payload (confidence level: 95%)
ac44f516a0a6fc6af3348a7596a04693XWorm payload (confidence level: 95%)
82dacfef360cba32b7515877c70083ebcfd9a7a4FatalRat payload (confidence level: 95%)

Description

ThreatFox IOCs for 2025-08-07

Impact

For European organizations, the impact of this threat is currently limited due to the lack of detailed exploit information, absence of known active exploits, and no patches or vulnerable versions specified. However, the presence of payload delivery and network activity tags indicates potential risks related to malware infections that could lead to data exfiltration, system compromise, or lateral movement within networks if these IOCs are indicators of active malware campaigns. Organizations relying on OSINT and network monitoring tools can leverage these IOCs to enhance detection capabilities. The medium severity suggests vigilance but does not indicate an immediate critical threat. The impact could escalate if these IOCs correspond to emerging malware strains or if threat actors begin exploiting them more broadly.

Defensive guidance

Given the nature of the information as IOCs without specific exploit details, European organizations should focus on enhancing their threat detection and response capabilities. Practical steps include: 1) Integrate the provided IOCs into existing Security Information and Event Management (SIEM) systems and intrusion detection/prevention systems (IDS/IPS) to monitor for related network activity or payload delivery attempts. 2) Conduct regular network traffic analysis to identify anomalous behavior consistent with malware communication patterns. 3) Maintain up-to-date endpoint protection solutions capable of detecting malware payloads and suspicious activities. 4) Implement strict network segmentation to limit lateral movement if a compromise occurs. 5) Train security teams to recognize and respond to OSINT-derived threat intelligence effectively. 6) Participate in information sharing communities to receive timely updates on evolving threats related to these IOCs. These measures go beyond generic advice by focusing on proactive detection and containment based on the nature of the threat intelligence provided.

Community reviews

Loading reviews…