IndicatorPublished 13 Aug 2025Updated 14 Aug 2025

type osint · ThreatFox IOCs for 2025-08-13

Affects type osintSource ThreatFox MISP Feed

TLP:WHITE, disclosure is not limited

Indicators of compromise

Domains 33

security.flavregurads.comUnknown malware payload delivery domain (confidence level: 100%)
dekelins.comUnknown malware payload delivery domain (confidence level: 100%)
flyinglotuss.shopStealc botnet C2 domain (confidence level: 50%)
st-yea.gl.at.ply.ggXWorm botnet C2 domain (confidence level: 100%)
evelmarin.duckdns.orgRemcos botnet C2 domain (confidence level: 100%)
rema.earise.proRemcos botnet C2 domain (confidence level: 100%)
shadow32434-42879.portmap.hostQuasar RAT botnet C2 domain (confidence level: 100%)
catpoopa-53750.portmap.hostQuasar RAT botnet C2 domain (confidence level: 100%)
best-displayed.gl.at.ply.ggNjRAT botnet C2 domain (confidence level: 100%)
anime34.ddns.netNanocore RAT botnet C2 domain (confidence level: 100%)

URLs 20

https://hope2cooling.com/js/timer.jquery.jsUnknown malware payload delivery URL (confidence level: 100%)
http://185.102.115.104/cd1072355afc4f72.phpStealc botnet C2 (confidence level: 50%)
http://flyinglotuss.shop/45cc90de006049c9.phpStealc botnet C2 (confidence level: 50%)
http://85.208.84.41/diamo/login.phpUnknown malware botnet C2 (confidence level: 100%)
http://77.90.153.62/diamo/login.phpUnknown malware botnet C2 (confidence level: 100%)
http://gamesarena.gdn/animationsetup2/animation2kc/fre.phpLoki Password Stealer (PWS) botnet C2 (confidence level: 100%)
https://synrxvtd.forum/xiuq/apiLumma Stealer botnet C2 (confidence level: 100%)
https://ligmfbx.top/zqiwLumma Stealer botnet C2 (confidence level: 100%)
https://blq.death-angel.shopVidar botnet C2 (confidence level: 75%)
http://a1156364.xsph.ru/c38ab4c1.phpDCRat botnet C2 (confidence level: 100%)

IP addresses 148

172.111.137.71Remcos botnet C2 server (confidence level: 100%)
101.132.186.25Unknown malware botnet C2 server (confidence level: 100%)
144.172.108.190Hook botnet C2 server (confidence level: 100%)
144.172.93.212Hook botnet C2 server (confidence level: 100%)
187.201.123.181Quasar RAT botnet C2 server (confidence level: 100%)
187.201.123.181Quasar RAT botnet C2 server (confidence level: 100%)
187.201.123.181Quasar RAT botnet C2 server (confidence level: 100%)
187.201.123.181Quasar RAT botnet C2 server (confidence level: 100%)
187.201.123.181Quasar RAT botnet C2 server (confidence level: 100%)
187.201.123.181Quasar RAT botnet C2 server (confidence level: 100%)

Hashes 222

cb18cde0b640f2ac12efc16638651cd6ff7313c5Remcos payload (confidence level: 95%)
369fd02b1704b8bd25a6219eaabe87fe5859857d60c9f2f8d12ba5b078b0a2b8Remcos payload (confidence level: 95%)
339d0b51c42250ce9b0f80409d71a3e7Remcos payload (confidence level: 95%)
3deed109a3f4cddcee767ab2b85297694ab63c55NjRAT payload (confidence level: 95%)
47762694f76f5ab4de9263fadc6e231ea368c5db4cff2e41bfb03fdb14dd3e18NjRAT payload (confidence level: 95%)
084f9be2da54adce92197cf169919c87NjRAT payload (confidence level: 95%)
4c1d10afc225520ca771651abdde0b4f068c1ff9NjRAT payload (confidence level: 95%)
43ce12aa57f6932b022f8cdd3f77bc2c977b7b1e15ee3a4ebd4be824c2a0ae9fNjRAT payload (confidence level: 95%)
1983d75f7347e87530faf1af7daeb263NjRAT payload (confidence level: 95%)
340c7e8dc9a6f696cc311f991f958842c4dac5adStrelaStealer payload (confidence level: 95%)

Description

ThreatFox IOCs for 2025-08-13

Impact

For European organizations, the impact of this threat is currently limited due to the absence of known exploits and detailed technical indicators. However, the presence of IOCs related to payload delivery and network activity implies potential risks if these indicators are integrated into broader attack campaigns. Organizations relying on OSINT for threat detection may benefit from these IOCs to enhance their situational awareness. The medium severity rating suggests a moderate risk level, primarily from reconnaissance and preparatory activities that could precede more damaging attacks. If leveraged by threat actors, these IOCs could facilitate targeted intrusions, data exfiltration, or disruption of network services. The lack of patch availability indicates that mitigation relies on detection and response capabilities rather than software updates.

Defensive guidance

European organizations should incorporate these IOCs into their threat intelligence platforms and security information and event management (SIEM) systems to improve detection of related malicious activities. Network monitoring should focus on anomalous traffic patterns and payload delivery attempts consistent with the provided indicators. Enhancing OSINT capabilities to correlate these IOCs with other threat data can improve early warning and incident response. Since no patches are available, organizations must emphasize proactive network segmentation, strict access controls, and regular threat hunting exercises. Employee awareness training on recognizing phishing or social engineering tactics that might deliver payloads associated with these IOCs is also recommended. Collaboration with national cybersecurity centers and sharing updated IOC data can further strengthen collective defense.

Community reviews

Loading reviews…