IndicatorPublished 22 Aug 2025Updated 23 Aug 2025

type osint · ThreatFox IOCs for 2025-08-22

Affects type osintSource ThreatFox MISP Feed

TLP:WHITE, disclosure is not limited

Indicators of compromise

Domains 70

boos.caramelmojo.comAmadey botnet C2 domain (confidence level: 75%)
onedomainpro.comAmadey botnet C2 domain (confidence level: 75%)
suspendedclash.shopStealc botnet C2 domain (confidence level: 100%)
trannlu.topLumma Stealer botnet C2 domain (confidence level: 75%)
escencearuba.comUnknown malware payload delivery domain (confidence level: 100%)
iietrich.cfdRhadamanthys botnet C2 domain (confidence level: 100%)
showypresume.ruClearFake payload delivery domain (confidence level: 100%)
nexus-cloud-360.comRhadamanthys botnet C2 domain (confidence level: 100%)
myth.instantlypay.orgUnknown Stealer botnet C2 domain (confidence level: 100%)
image-advantage.gl.at.ply.ggXWorm botnet C2 domain (confidence level: 100%)

URLs 38

http://suspendedclash.shop/19b574f278f94a33.phpStealc botnet C2 (confidence level: 100%)
https://91.154.35.99:1888/gateway/fc43v2og.zla4tRhadamanthys botnet C2 (confidence level: 100%)
http://89.213.44.123/1.shUnknown malware payload delivery URL (confidence level: 75%)
http://185.208.159.143/kqkuwulun.htmlUnknown malware payload delivery URL (confidence level: 100%)
https://193.233.126.43/gateway/amwv5fbr.pxue8Rhadamanthys botnet C2 (confidence level: 100%)
https://193.23.216.48/gateway/amwv5fbr.pxue8Rhadamanthys botnet C2 (confidence level: 100%)
http://196.251.84.253/misc.telnet.shUnknown malware payload delivery URL (confidence level: 75%)
https://94.154.35.99:1888/gateway/9xrretqm.e33dsRhadamanthys botnet C2 (confidence level: 100%)
https://nexus-cloud-360.com:1888/gateway/9xrretqm.e33dsRhadamanthys botnet C2 (confidence level: 100%)
https://nexus-cloud-360.com:1888/gateway/7yu2mndw.5ypfmRhadamanthys botnet C2 (confidence level: 100%)

IP addresses 161

95.217.244.192Vidar botnet C2 server (confidence level: 100%)
116.203.13.148Vidar botnet C2 server (confidence level: 100%)
5.252.153.134Amadey botnet C2 server (confidence level: 100%)
185.208.159.143XWorm botnet C2 server (confidence level: 100%)
178.16.54.47Latrodectus botnet C2 server (confidence level: 100%)
178.16.54.40Latrodectus botnet C2 server (confidence level: 100%)
216.126.236.181SectopRAT botnet C2 server (confidence level: 100%)
45.144.53.118SectopRAT botnet C2 server (confidence level: 100%)
187.201.200.172Quasar RAT botnet C2 server (confidence level: 100%)
187.201.200.172Quasar RAT botnet C2 server (confidence level: 100%)

Hashes 154

a65feb6fdb51f253d6f8af64ea78c5913552bdd018ac3e64fd6a80c479ed71d0Rhadamanthys payload (confidence level: 100%)
7cfecf27adf1abf38ad5260b7e51a9aa26280bb2ValleyRAT payload (confidence level: 95%)
7a58ff410c2e2f9ddcfedefb22ff1906e35472b900649249240a7a09e1f4df02ValleyRAT payload (confidence level: 95%)
962e7dc10f4c87016fd3880dd261ff93ValleyRAT payload (confidence level: 95%)
54da98df4aecf92c3015bba991f5b0ceae5adc86StrelaStealer payload (confidence level: 95%)
1d6a54881c5c2cf4a712697ac4a91ae19f5a04de92ed652882c175fa2ce91bf2StrelaStealer payload (confidence level: 95%)
2cdbcdf52dbceeb00bbea178a2b1968eStrelaStealer payload (confidence level: 95%)
f942cc721c79c07420a8f7f8156cd53645d6c45bDarkCloud Stealer payload (confidence level: 95%)
4b8732ba48e279bad32a8e2c4f8fa46285b65f8a965e8005a6f991f924e1d9ebDarkCloud Stealer payload (confidence level: 95%)
7b044369fad1ca21c404364a89febb6aDarkCloud Stealer payload (confidence level: 95%)

Description

ThreatFox IOCs for 2025-08-22

Impact

For European organizations, the impact of these IOCs depends largely on their integration into security monitoring and threat detection systems. Since the data represents indicators related to malware and network activity, organizations that effectively consume and act on such OSINT feeds can enhance their detection capabilities and reduce the risk of successful payload delivery or network intrusion. However, the lack of specific exploit details or affected products means that the direct impact is limited unless these IOCs correlate with active campaigns targeting European entities. If these indicators are part of a broader malware campaign, organizations could face risks including data exfiltration, service disruption, or compromise of network assets. The medium severity suggests a moderate threat level, implying that while the threat is not critical, it warrants attention to prevent potential escalation. European organizations with mature security operations centers (SOCs) and threat intelligence teams can leverage these IOCs to improve situational awareness and preemptively block or monitor suspicious network activity. Conversely, organizations lacking such capabilities may be less prepared to detect or respond to threats associated with these IOCs.

Defensive guidance

1. Integrate ThreatFox IOCs into existing Security Information and Event Management (SIEM) and Intrusion Detection/Prevention Systems (IDS/IPS) to enable automated detection and alerting on related network activity. 2. Regularly update threat intelligence feeds and correlate these IOCs with internal logs to identify potential compromises or suspicious behavior. 3. Conduct network segmentation and enforce strict egress filtering to limit the ability of malware to communicate with command and control servers identified by these IOCs. 4. Employ endpoint detection and response (EDR) solutions capable of detecting payload delivery attempts and anomalous network connections. 5. Train SOC analysts to recognize patterns associated with these IOCs and to escalate incidents promptly. 6. Since no patches are available, focus on proactive detection and containment rather than remediation. 7. Collaborate with national and European cybersecurity information sharing organizations to stay informed about any escalation or new developments related to these IOCs.

Community reviews

Loading reviews…