IndicatorPublished 23 Aug 2025Updated 24 Aug 2025

type osint · ThreatFox IOCs for 2025-08-23

Affects type osintSource ThreatFox MISP Feed

TLP:WHITE, disclosure is not limited

Indicators of compromise

Domains 93

wykupae1.ruClearFake payload delivery domain (confidence level: 100%)
tok-info.comUnknown malware payload delivery domain (confidence level: 100%)
budparbanjarnegara.comUnknown malware payload delivery domain (confidence level: 100%)
dragonshop.techUnknown malware payload delivery domain (confidence level: 100%)
dragonshop.cloudUnknown malware payload delivery domain (confidence level: 100%)
rootyan.messager.myUnknown malware botnet C2 domain (confidence level: 100%)
kws2-1.messager.myUnknown malware botnet C2 domain (confidence level: 100%)
venus.web.messager.myUnknown malware botnet C2 domain (confidence level: 100%)
britainsbrodcastingnews.comUnknown malware payload delivery domain (confidence level: 100%)
uytghkhl.sbsUnknown malware payload delivery domain (confidence level: 100%)

URLs 21

http://170.64.217.39:8888/supershell/login/Unknown malware botnet C2 (confidence level: 100%)
http://a1161183.xsph.ru/2bd939b4.phpDCRat botnet C2 (confidence level: 100%)
http://83.166.244.118/imagepipepythonrequestgenerator.phpDCRat botnet C2 (confidence level: 100%)
https://connbkg.top/zwiqLumma Stealer botnet C2 (confidence level: 100%)
https://195.201.254.191Vidar botnet C2 (confidence level: 75%)
https://momuus.com/google2/verify.shUnknown malware payload delivery URL (confidence level: 100%)
https://uytghkhl.sbs/fitUnknown malware payload delivery URL (confidence level: 100%)
https://appates.com/google2/curlyUnknown malware payload delivery URL (confidence level: 100%)
http://a1160945.xsph.ru/4ecf5632.phpDCRat botnet C2 (confidence level: 100%)
https://momuus.com/seo1/verify.shUnknown malware payload delivery URL (confidence level: 100%)

IP addresses 125

170.64.217.39Unknown malware botnet C2 server (confidence level: 100%)
185.219.7.138Loki Password Stealer (PWS) botnet C2 server (confidence level: 75%)
163.5.63.89Mirai botnet C2 server (confidence level: 100%)
163.5.63.89Mirai botnet C2 server (confidence level: 100%)
3.131.91.218Cobalt Strike botnet C2 server (confidence level: 100%)
173.254.201.23Cobalt Strike botnet C2 server (confidence level: 100%)
38.181.72.47Cobalt Strike botnet C2 server (confidence level: 100%)
103.86.47.232Ghost RAT botnet C2 server (confidence level: 100%)
34.66.252.36SectopRAT botnet C2 server (confidence level: 100%)
154.36.165.77Hook botnet C2 server (confidence level: 100%)

Hashes 204

6679f37d6a26813b0fdba90cfe8e62e57641edc0XWorm payload (confidence level: 95%)
f082791d3a71054e2becd94d68323ff2cbe2e597d94fc6135a3a8b524a179e4eXWorm payload (confidence level: 95%)
0d45449f3a01fdb7bfa67046a9b9a253XWorm payload (confidence level: 95%)
5b455d0611652401c98b0f483164a1ff6799d1c6troystealer payload (confidence level: 95%)
249ef587e4081e69b5cf472e6caa23cd57ca0621c1bb1150b98baaa00658e1d2troystealer payload (confidence level: 95%)
b183aa077bb2d83367602c1d34496360troystealer payload (confidence level: 95%)
fbbbfc72c1e992b8c871f9df4fa32656d4921503Remcos payload (confidence level: 95%)
971c47e1602e19ed5c2d65992bbd8ed9d8480e60849c355dd2e6909ae83dcfbaRemcos payload (confidence level: 95%)
7e37c52b146f4856df6eda03978c7070Remcos payload (confidence level: 95%)
e211686806a6c7eb905e78d6f8743ceafb91c20aXWorm payload (confidence level: 95%)

Description

ThreatFox IOCs for 2025-08-23

Impact

For European organizations, the impact of this threat intelligence update is primarily in enhancing detection and response capabilities rather than indicating an immediate active threat. Since no specific exploit or vulnerability is detailed, the direct risk to confidentiality, integrity, or availability is limited. However, the presence of malware-related IOCs related to network activity and payload delivery suggests that attackers may be using these indicators to conduct reconnaissance or deliver malicious payloads in targeted campaigns. Organizations that do not integrate such OSINT feeds into their security monitoring may miss early warning signs of emerging threats. The medium severity rating reflects a moderate risk level, emphasizing the need for vigilance but not indicating an imminent or critical compromise scenario. European entities with mature security operations centers (SOCs) can leverage these IOCs to improve threat hunting and incident response, thereby reducing potential impact. Conversely, organizations lacking such capabilities might face delayed detection of malware infections or network intrusions.

Defensive guidance

1. Integrate ThreatFox and other reputable OSINT feeds into Security Information and Event Management (SIEM) and Endpoint Detection and Response (EDR) platforms to enable automated correlation and alerting on known IOCs. 2. Regularly update network intrusion detection/prevention systems (IDS/IPS) with signatures derived from these IOCs to detect and block malicious payload delivery attempts. 3. Conduct proactive threat hunting exercises using the provided IOCs to identify any signs of compromise within internal networks. 4. Enhance employee awareness and training on phishing and social engineering tactics, as payload delivery often involves initial user interaction. 5. Maintain robust network segmentation and least privilege access controls to limit malware propagation if an infection occurs. 6. Since no patches are available, focus on detection and containment rather than remediation of a specific vulnerability. 7. Collaborate with national and European cybersecurity information sharing organizations to stay updated on evolving threats and share findings related to these IOCs.

Community reviews

Loading reviews…