IndicatorPublished 14 Aug 2025Updated 15 Aug 2025

type osint · ThreatFox IOCs for 2025-08-14

Affects type osintSource ThreatFox MISP Feed

TLP:WHITE, disclosure is not limited

Indicators of compromise

Domains 38

coverdealsforfood.icuUnknown RAT botnet C2 domain (confidence level: 100%)
analyticanoden.comUnknown malware payload delivery domain (confidence level: 100%)
security.flacergurad.comUnknown malware payload delivery domain (confidence level: 100%)
vendomen.comUnknown malware payload delivery domain (confidence level: 100%)
captchaverift.comKongTuke payload delivery domain (confidence level: 100%)
items-ana.gl.at.ply.ggXWorm botnet C2 domain (confidence level: 100%)
wasabidesktop.ioUnknown Stealer payload delivery domain (confidence level: 100%)
amaprox.clickUnknown Stealer botnet C2 domain (confidence level: 100%)
ec2-3-8-147-54.eu-west-2.compute.amazonaws.comUnknown malware botnet C2 domain (confidence level: 100%)
mar-cant.gl.at.ply.ggXWorm botnet C2 domain (confidence level: 100%)

URLs 23

https://193.5.65.150/gateway/sutnucq9.bftwcRhadamanthys botnet C2 (confidence level: 100%)
https://linckonly.com/res/strategyrememberUnknown malware payload delivery URL (confidence level: 100%)
https://captchaverift.com/4r3.jsKongTuke payload delivery URL (confidence level: 100%)
https://lolkasdokriosell.com/work/Latrodectus botnet C2 (confidence level: 75%)
https://yuikasdojhf.com/work/Latrodectus botnet C2 (confidence level: 75%)
https://burahrmp.forum/xiwi/apiLumma Stealer botnet C2 (confidence level: 75%)
https://combvff.top/zalwLumma Stealer botnet C2 (confidence level: 75%)
https://redroademail.com/scatter.bakKoadic payload delivery URL (confidence level: 100%)
https://redroademail.com/skill.phpKoadic botnet C2 (confidence level: 100%)
https://redroademail.com/cappp/Koadic payload delivery URL (confidence level: 100%)

IP addresses 133

87.248.150.68Mirai botnet C2 server (confidence level: 100%)
196.251.81.3Remcos botnet C2 server (confidence level: 100%)
45.141.84.189pupy botnet C2 server (confidence level: 100%)
124.198.132.19AsyncRAT botnet C2 server (confidence level: 100%)
5.223.67.5Unknown malware botnet C2 server (confidence level: 100%)
104.194.153.26Hook botnet C2 server (confidence level: 100%)
187.201.123.181Quasar RAT botnet C2 server (confidence level: 100%)
187.201.123.181Quasar RAT botnet C2 server (confidence level: 100%)
187.201.123.181Quasar RAT botnet C2 server (confidence level: 100%)
203.161.41.158Havoc botnet C2 server (confidence level: 100%)

Hashes 166

cb158ba65e9cb8300a9968378a259855d465ebd6417b8d7ec5bc91294c4de9c3Unknown malware payload (confidence level: 100%)
53afe35feae5ec8b5868a5f2588087506f1b50e5GCleaner payload (confidence level: 95%)
1f5ede5de37e1dd4b8242bea76ca13391cc0c3118d949282a91eb95b7ae932a5GCleaner payload (confidence level: 95%)
d3526bf5b74831753366c51edea11e59GCleaner payload (confidence level: 95%)
1eff32f04e1f73e1368f7066c60eebb6efa8950bQuasar RAT payload (confidence level: 95%)
dce88a89d7c51facbf90f88d023ef295513991303b57b5a15b63461c4746be82Quasar RAT payload (confidence level: 95%)
b32e0d2ea31e969d76dc3e07262c687fQuasar RAT payload (confidence level: 95%)
277f31fb1f16590e42aa01ad5b38d0ba2fcd1edcCoinminer payload (confidence level: 95%)
fffe15a3fe30b9c2c4f6ee26350d5b1b546a187811780425203bd16dd38cc73dCoinminer payload (confidence level: 95%)
46d32b7e96d5d442afd21bbdc68a96e7Coinminer payload (confidence level: 95%)

Description

ThreatFox IOCs for 2025-08-14

Impact

For European organizations, the impact of this threat intelligence update is primarily in enhancing situational awareness and improving detection capabilities rather than responding to an immediate active threat. Since no specific vulnerabilities or exploits are identified, the direct risk to confidentiality, integrity, or availability is limited at this stage. However, failure to incorporate these IOCs into security monitoring tools could result in missed detection opportunities for malware infections or network intrusions that use the identified indicators. Organizations in sectors with high exposure to targeted attacks, such as finance, critical infrastructure, and government, may benefit most from integrating this intelligence to preempt potential payload delivery attempts. The medium severity rating suggests a moderate risk level, emphasizing the importance of proactive defense but not indicating an urgent or critical threat.

Defensive guidance

European organizations should focus on integrating the provided IOCs into their existing security infrastructure, including intrusion detection/prevention systems (IDS/IPS), Security Information and Event Management (SIEM) platforms, and endpoint detection and response (EDR) solutions. Regularly updating threat intelligence feeds and correlating alerts with these IOCs can improve early detection of suspicious network activity or payload delivery attempts. Additionally, organizations should conduct threat hunting exercises using these indicators to identify any latent compromises. Network segmentation and strict egress filtering can limit the impact of potential payload delivery. Since no patches are available, emphasis should be placed on robust monitoring, user awareness training to recognize phishing or social engineering attempts that may deliver payloads, and maintaining up-to-date backups to mitigate ransomware or destructive malware risks. Collaboration with national and European cybersecurity centers can enhance response coordination.

Community reviews

Loading reviews…