IndicatorPublished 17 Aug 2025Updated 18 Aug 2025

type osint · ThreatFox IOCs for 2025-08-17

Affects type osintSource ThreatFox MISP Feed

TLP:WHITE, disclosure is not limited

Indicators of compromise

Domains 32

global-weekends.netFAKEUPDATES payload delivery domain (confidence level: 100%)
l86.wpherc.devAres botnet C2 domain (confidence level: 90%)
itredirect.merseine.comAsyncRAT botnet C2 domain (confidence level: 50%)
s3ov838.ddns.netMirai botnet C2 domain (confidence level: 50%)
stubbb.airdns.orgXWorm botnet C2 domain (confidence level: 50%)
technical-harder.gl.at.ply.ggXWorm botnet C2 domain (confidence level: 50%)
public-radios.gl.at.ply.ggXWorm botnet C2 domain (confidence level: 100%)
few-mines.gl.at.ply.ggXWorm botnet C2 domain (confidence level: 100%)
camerwamper-64923.portmap.hostQuasar RAT botnet C2 domain (confidence level: 100%)
static.140.144.161.5.clients.your-server.deHavoc botnet C2 domain (confidence level: 100%)

URLs 20

https://t.me/ghrghrthhetLumma Stealer botnet C2 (confidence level: 75%)
http://156.226.174.33/s.shUnknown malware payload delivery URL (confidence level: 75%)
https://pastebin.com/raw/99vn2mg6XWorm botnet C2 (confidence level: 50%)
https://inefqxf.top/zqouLumma Stealer botnet C2 (confidence level: 100%)
https://rotofay.top/gotrLumma Stealer botnet C2 (confidence level: 100%)
http://americovespucci.shopStealc botnet C2 (confidence level: 100%)
https://achieverbreath.xyz/mxi.phpUnknown Loader botnet C2 (confidence level: 100%)
https://scaleturn.xyz/mxi.phpUnknown Loader botnet C2 (confidence level: 100%)
https://shipfang.xyz/mxi.phpUnknown Loader botnet C2 (confidence level: 100%)
https://toothpastename.xyz/mxi.phpUnknown Loader botnet C2 (confidence level: 100%)

IP addresses 136

156.238.243.109Cobalt Strike botnet C2 server (confidence level: 100%)
134.122.129.44Ghost RAT botnet C2 server (confidence level: 100%)
128.90.113.96AsyncRAT botnet C2 server (confidence level: 100%)
64.227.187.28Hook botnet C2 server (confidence level: 100%)
16.62.129.84NetSupportManager RAT botnet C2 server (confidence level: 100%)
35.180.65.171NetSupportManager RAT botnet C2 server (confidence level: 100%)
196.251.73.24MooBot botnet C2 server (confidence level: 100%)
74.201.72.78Xtreme RAT botnet C2 server (confidence level: 100%)
13.60.76.8XWorm botnet C2 server (confidence level: 100%)
184.75.208.58XWorm botnet C2 server (confidence level: 100%)

Hashes 204

f66f7c2e1b1ddc84c9f5e536aa2e20fe9b3af846XWorm payload (confidence level: 95%)
18b9a33bc5fc6d4bc4a6ede40c33dadc700a16cc3007c54349cc999519df09d0XWorm payload (confidence level: 95%)
4b9a23b97f5575c95fff0ea7e55d60beXWorm payload (confidence level: 95%)
6ede65bb8d310c7da90582878f4468aa258860ccTyphon Stealer payload (confidence level: 95%)
30a0bfa5ea4bfe76867e243af1c3bd7030fcf63dfa0ee351e0fb9a00152b0060Typhon Stealer payload (confidence level: 95%)
e3374a4f4f8b835cd1ac812dd718c548Typhon Stealer payload (confidence level: 95%)
3387e9d7cb30a30b1ba497b51a7e3e17576d4737XWorm payload (confidence level: 95%)
d63994be3db3b03105b1b822d73a89cff59f1cb5d156162c92f556ee38bfc48aXWorm payload (confidence level: 95%)
1e93b1b6c10c181b585b138672bf18a5XWorm payload (confidence level: 95%)
73a2f49a770232e4395d9b5b825385206c664f01StrelaStealer payload (confidence level: 95%)

Description

ThreatFox IOCs for 2025-08-17

Impact

For European organizations, the impact of this threat primarily lies in the potential for undetected malware infections or network intrusions if the provided IOCs are not integrated into security monitoring tools. Since no specific vulnerabilities or exploits are detailed, the direct risk of compromise depends on the organization's ability to leverage these IOCs for early detection and response. Failure to incorporate these indicators could lead to delayed identification of malware payload delivery attempts or network-based attacks, potentially resulting in data exfiltration, operational disruption, or further compromise. The medium severity suggests a moderate risk level, implying that while the threat is not immediately critical, it requires attention to prevent escalation. Organizations relying heavily on network security monitoring and threat intelligence sharing will benefit most from these IOCs. The lack of patches or exploits in the wild indicates that this is more of a proactive intelligence update than an urgent incident response trigger.

Defensive guidance

European organizations should prioritize the integration of these ThreatFox IOCs into their existing security information and event management (SIEM) systems, intrusion detection/prevention systems (IDS/IPS), and endpoint detection and response (EDR) platforms to enhance detection capabilities. Regularly updating threat intelligence feeds and correlating these IOCs with internal logs can help identify early signs of compromise. Network segmentation and strict monitoring of payload delivery channels, such as email gateways and web proxies, should be enforced to limit malware spread. Conducting threat hunting exercises using these indicators can uncover latent infections. Additionally, organizations should maintain robust incident response plans that incorporate OSINT-derived intelligence to improve reaction times. Since no patches are available, emphasis should be placed on detection, containment, and remediation strategies rather than vulnerability management. Training security teams to interpret and act on OSINT feeds effectively will maximize the utility of these indicators.

Community reviews

Loading reviews…