IndicatorPublished 12 Aug 2025Updated 13 Aug 2025

type osint · ThreatFox IOCs for 2025-08-12

Affects type osintSource ThreatFox MISP Feed

TLP:WHITE, disclosure is not limited

Indicators of compromise

Domains 36

security.flaershueld.comUnknown malware payload delivery domain (confidence level: 100%)
polsenia.comUnknown malware payload delivery domain (confidence level: 100%)
booking-v.comUnknown Loader payload delivery domain (confidence level: 90%)
cs.ivyx.teamCobalt Strike botnet C2 domain (confidence level: 75%)
c3.b1o.itUnknown malware botnet C2 domain (confidence level: 100%)
ferrarlworldabudhabl.comUnknown Loader payload delivery domain (confidence level: 90%)
well-interface.gl.at.ply.ggXWorm botnet C2 domain (confidence level: 100%)
obyconnect.work.gdAsyncRAT botnet C2 domain (confidence level: 100%)
odbconnect.work.gdAsyncRAT botnet C2 domain (confidence level: 100%)
zoo33.myddns.rocksAsyncRAT botnet C2 domain (confidence level: 100%)

URLs 33

http://176.46.152.46/diamo/login.phpUnknown malware botnet C2 (confidence level: 100%)
https://pikipika.cn/bdsg360sm.htmlLatrodectus payload delivery URL (confidence level: 95%)
https://smoking-hot.net/js/timer.jquery.jsUnknown malware payload delivery URL (confidence level: 100%)
https://larinwokin.com/reading/huxleyheavenhell.epubUnknown malware payload delivery URL (confidence level: 100%)
http://119.8.239.80:8888/supershell/login/Unknown malware botnet C2 (confidence level: 100%)
http://cz93437.tw1.ru/ed257e07.phpDCRat botnet C2 (confidence level: 100%)
http://185.196.11.155/t8rku9ms/index.phpAmadey botnet C2 (confidence level: 100%)
http://185.196.11.155/t8rku9ms/login.phpAmadey botnet C2 (confidence level: 100%)
https://ebuinwgs.forum/zkad/apiLumma Stealer botnet C2 (confidence level: 100%)
http://openedhouses.shopStealc botnet C2 (confidence level: 100%)

IP addresses 189

172.111.169.163NjRAT botnet C2 server (confidence level: 75%)
119.8.239.80Unknown malware botnet C2 server (confidence level: 100%)
47.111.10.183Cobalt Strike botnet C2 server (confidence level: 100%)
193.233.165.232Cobalt Strike botnet C2 server (confidence level: 100%)
103.146.124.197Cobalt Strike botnet C2 server (confidence level: 100%)
196.251.88.63Cobalt Strike botnet C2 server (confidence level: 100%)
45.144.137.60Cobalt Strike botnet C2 server (confidence level: 100%)
3.21.206.81Remcos botnet C2 server (confidence level: 100%)
3.141.103.103Remcos botnet C2 server (confidence level: 100%)
74.50.94.54AsyncRAT botnet C2 server (confidence level: 100%)

Hashes 198

d39a1c43b7a0f12fec2a659d25d158512df53730e8d2d0a1754106e2d9b46310Unknown malware payload (confidence level: 100%)
ae8298231d142d5d8af6e47924dc52f319af3af8Agent Tesla payload (confidence level: 95%)
99a2e944a43b8570684560b58c39ad2b64cf59b8d4f03e0ebd963f7911a48884Agent Tesla payload (confidence level: 95%)
d6d7e6fa90339c20dc968d0638f2710dAgent Tesla payload (confidence level: 95%)
142c3956d3521e7999a41a4f4ce315fdac6bd916GCleaner payload (confidence level: 95%)
f03a77666c6c1526e2739c97badff7a460cf66bcd782bb9d2e94d8bc1c7eb250GCleaner payload (confidence level: 95%)
751658dffea56c81bedcab9239aa2f8aGCleaner payload (confidence level: 95%)
66555b8fd58f1e1575e59e7b7bd61052bf01aef9StrelaStealer payload (confidence level: 95%)
f4cf566d25dcc52bfbc988b8e0f5bc78b2bdc941142776f31e60b7e47b86e791StrelaStealer payload (confidence level: 95%)
3cf69ea6735a45953859d139b019fcb6StrelaStealer payload (confidence level: 95%)

Description

ThreatFox IOCs for 2025-08-12

Impact

Given the limited technical details and absence of known exploits in the wild, the immediate impact on European organizations is likely low to medium. However, the presence of payload delivery and network activity indicators suggests potential for malware infection or lateral movement if these IOCs correspond to active threats. European organizations relying heavily on OSINT tools or those with extensive network exposure could face risks of intrusion or data exfiltration if these indicators are part of a broader campaign. The lack of patches or mitigation details implies that organizations must rely on detection and response capabilities. The medium severity rating suggests that while the threat is not currently critical, it warrants monitoring and preparedness to prevent escalation.

Defensive guidance

1. Integrate the provided IOCs into existing security monitoring tools such as SIEMs, IDS/IPS, and endpoint detection platforms to enhance detection capabilities. 2. Conduct network traffic analysis focusing on unusual payload delivery patterns or suspicious network activity aligned with the IOC characteristics. 3. Employ threat hunting exercises using OSINT feeds to proactively identify potential compromises. 4. Maintain up-to-date threat intelligence sharing with industry peers and national cybersecurity centers to receive timely updates on evolving threats. 5. Enforce strict network segmentation and least privilege access to limit potential lateral movement if an infection occurs. 6. Regularly review and update incident response plans to incorporate scenarios involving malware delivery via network vectors. 7. Since no patches are available, emphasize behavioral detection and anomaly identification rather than signature-based methods alone.

Community reviews

Loading reviews…