IndicatorPublished 20 Aug 2025Updated 21 Aug 2025

type osint · ThreatFox IOCs for 2025-08-20

Affects type osintSource ThreatFox MISP Feed

TLP:WHITE, disclosure is not limited

Indicators of compromise

Domains 51

miscorof.comUnknown malware payload delivery domain (confidence level: 75%)
thelinedesigns.comUnknown malware payload delivery domain (confidence level: 75%)
lopersab.comUnknown malware payload delivery domain (confidence level: 75%)
picarrs.comUnknown malware payload delivery domain (confidence level: 75%)
ec2-75-101-210-201.compute-1.amazonaws.comHavoc botnet C2 domain (confidence level: 100%)
www.shwepaukkan.orgHavoc botnet C2 domain (confidence level: 100%)
rootyar.messager.myUnknown malware botnet C2 domain (confidence level: 100%)
auth.messager.myUnknown malware botnet C2 domain (confidence level: 100%)
msxzvip.topCobalt Strike botnet C2 domain (confidence level: 100%)
znaiweb.comCobalt Strike botnet C2 domain (confidence level: 100%)

URLs 29

http://tie-cent-orleans-arrival.trycloudflare.comUnknown malware payload delivery URL (confidence level: 100%)
https://myevmanual.com/d.jsUnknown malware payload delivery URL (confidence level: 100%)
https://woop-bicks.com/ajax/pixi.min.jsUnknown malware payload delivery URL (confidence level: 100%)
https://ame-9.com/res/climbfragileUnknown malware payload delivery URL (confidence level: 100%)
http://mohamed88.work.gd:7050/is-readyHoudini botnet C2 (confidence level: 100%)
http://sophos-upd-srv.info:4443/api/v1/update/resultMorpheus Loader botnet C2 (confidence level: 100%)
http://sophos-upd-srv.info:4443/api/v1/commandsMorpheus Loader botnet C2 (confidence level: 100%)
http://sophos-upd-srv.info:4443/api/v1/heartbeatMorpheus Loader botnet C2 (confidence level: 100%)
http://sophos-upd-srv.info:4443/api/v1/infoMorpheus Loader botnet C2 (confidence level: 100%)
http://cj22621.tw1.ru/fcdd7c92.phpDCRat botnet C2 (confidence level: 100%)

IP addresses 200

31.128.158.49NjRAT botnet C2 server (confidence level: 75%)
3.27.235.189Cobalt Strike botnet C2 server (confidence level: 100%)
193.26.115.209Remcos botnet C2 server (confidence level: 100%)
213.190.4.203Remcos botnet C2 server (confidence level: 100%)
124.220.19.20Unknown malware botnet C2 server (confidence level: 100%)
185.196.10.204AsyncRAT botnet C2 server (confidence level: 100%)
95.112.103.2Unknown malware botnet C2 server (confidence level: 100%)
20.42.107.78Unknown malware botnet C2 server (confidence level: 100%)
109.122.197.147Hook botnet C2 server (confidence level: 100%)
187.201.97.119Quasar RAT botnet C2 server (confidence level: 100%)

Hashes 138

a21f48affc8d0c9e4bb028bce03a35cb5987e5d7Luca Stealer payload (confidence level: 95%)
e15886e3c6af9edae546b18f8cce879de2773538cebd598748af924db890da40Luca Stealer payload (confidence level: 95%)
f2642117458898700b711c42223cbf1fLuca Stealer payload (confidence level: 95%)
8c68a27f38496c91143e4a684c9d790c3d645331Stealc payload (confidence level: 95%)
8441f8b903c676d468bb0b0c07d699cb98df153cc50b4ac566e7ab95293cd2dbStealc payload (confidence level: 95%)
2ec65ea39e10130c9ef1b4959cd8c1b6Stealc payload (confidence level: 95%)
68ab64797e2fefd564b145c24fab5b2561eaa352RedLine Stealer payload (confidence level: 95%)
e12ee7f81b36119f286b0aef02de51905a17c14433a37439f089e07baf3044ceRedLine Stealer payload (confidence level: 95%)
5f85b9eca6c9f0ddea551d99fa9dbc8dRedLine Stealer payload (confidence level: 95%)
ae5e74a6edac95b1249a53d7508a9d5bce89175dGCleaner payload (confidence level: 95%)

Description

ThreatFox IOCs for 2025-08-20

Impact

For European organizations, the impact of this threat intelligence update is primarily in the realm of improved detection and preparedness rather than immediate risk. Since no active exploits or vulnerabilities are reported, the direct impact on confidentiality, integrity, or availability is minimal at this stage. However, the presence of payload delivery and network activity indicators suggests that adversaries may be attempting or planning to deliver malware through network channels, which could lead to data breaches, system compromise, or disruption if successful. Organizations that fail to incorporate these IOCs into their security monitoring may be at increased risk of undetected intrusions. The medium severity rating implies that while the threat is not currently critical, it warrants attention to prevent escalation. European entities with significant network infrastructure and exposure to external traffic, such as financial institutions, critical infrastructure providers, and large enterprises, should consider this intelligence relevant to their threat landscape.

Defensive guidance

To effectively mitigate risks associated with this threat intelligence, European organizations should: 1) Integrate the provided IOCs into their Security Information and Event Management (SIEM) systems and intrusion detection/prevention systems (IDS/IPS) to enhance detection capabilities for related network activity and payload delivery attempts. 2) Conduct regular network traffic analysis focusing on anomalies and patterns matching the threat indicators to identify potential malicious activity early. 3) Update firewall and endpoint security rules to block or alert on communications matching the IOCs. 4) Train security operations teams to recognize and respond to signs of payload delivery and network-based attacks, leveraging OSINT sources for contextual awareness. 5) Maintain robust incident response plans that include procedures for handling malware delivery attempts and network intrusions. 6) Collaborate with threat intelligence sharing communities to receive timely updates and validate the relevance of the IOCs to their environment. These steps go beyond generic advice by emphasizing the operational integration of threat intelligence and proactive network monitoring tailored to the nature of the indicators.

Community reviews

Loading reviews…