IndicatorPublished 25 Aug 2025Updated 26 Aug 2025

type osint · ThreatFox IOCs for 2025-08-25

Affects type osintSource ThreatFox MISP Feed

TLP:WHITE, disclosure is not limited

Indicators of compromise

Domains 57

iosif-brodskiy.suLumma Stealer botnet C2 domain (confidence level: 100%)
ll.aass654.comXOR DDoS botnet C2 domain (confidence level: 100%)
ll.xxcc789.comXOR DDoS botnet C2 domain (confidence level: 100%)
ll.vvbb321.comXOR DDoS botnet C2 domain (confidence level: 100%)
ll.jjkk567.comXOR DDoS botnet C2 domain (confidence level: 100%)
ll.nnmm234.comXOR DDoS botnet C2 domain (confidence level: 100%)
approved-ccd.gl.at.ply.ggXWorm botnet C2 domain (confidence level: 100%)
needed-otherwise.gl.at.ply.ggXWorm botnet C2 domain (confidence level: 100%)
where-pleasure.gl.at.ply.ggXWorm botnet C2 domain (confidence level: 100%)
netbiosinterface.ydns.euAsyncRAT botnet C2 domain (confidence level: 100%)

URLs 146

http://120.60.226.189:39462/mozi.mMozi payload delivery URL (confidence level: 100%)
http://59.88.9.67:40666/mozi.mMozi payload delivery URL (confidence level: 100%)
http://103.146.158.19:8888/supershell/login/Unknown malware botnet C2 (confidence level: 100%)
http://118.195.183.125:8888/supershell/login/Unknown malware botnet C2 (confidence level: 100%)
http://124.221.125.254:8888/supershell/login/Unknown malware botnet C2 (confidence level: 100%)
http://180.76.144.175:8888/supershell/login/Unknown malware botnet C2 (confidence level: 100%)
http://117.72.122.195:8888/supershell/login/Unknown malware botnet C2 (confidence level: 100%)
https://cirwelh.top/xdogLumma Stealer botnet C2 (confidence level: 100%)
https://frameneck.xyz/mxi.phpUnknown Loader botnet C2 (confidence level: 100%)
http://cz52511.tw1.ru/5fea85c8.phpDCRat botnet C2 (confidence level: 100%)

IP addresses 565

193.111.248.188Mirai botnet C2 server (confidence level: 100%)
193.161.193.99XWorm botnet C2 server (confidence level: 100%)
43.163.112.217Cobalt Strike botnet C2 server (confidence level: 100%)
134.122.200.51Ghost RAT botnet C2 server (confidence level: 100%)
134.122.173.100Ghost RAT botnet C2 server (confidence level: 100%)
134.122.200.32Ghost RAT botnet C2 server (confidence level: 100%)
194.87.80.121Remcos botnet C2 server (confidence level: 100%)
45.158.8.240Remcos botnet C2 server (confidence level: 100%)
66.63.187.37Remcos botnet C2 server (confidence level: 100%)
193.233.48.187Sliver botnet C2 server (confidence level: 100%)

Hashes 213

4293c1d8574dc87c58360d6bac3daa182f64f7785c9d41da5e0741d2b1817fc7Mozi payload (confidence level: 100%)
10d664e9f7eca0bf6c9c58b81d0c564256ef90b09a8d02549b3342b598a7a6d1Unknown Stealer payload (confidence level: 100%)
2d9a3e3f2f40d82a662299909489d731ed85d79138bd08a2f76b57501f35f682Unknown Stealer payload (confidence level: 100%)
091f8e516b52c88d108ecc7bf7f5e34f27a8a60dStrelaStealer payload (confidence level: 95%)
2ee647ac7852be7cfbf2ab9b2b321292921ef9d0565715818adbcd7c0e9fbbb4StrelaStealer payload (confidence level: 95%)
3a95207caf2efac5b88b5a94d359474dStrelaStealer payload (confidence level: 95%)
3b3dadb3b94b70e37aa25f6e3054900f253a136aDCRat payload (confidence level: 95%)
fe52872f104c32ec7ebf1b43a8bea7de154abfb504a17d99b4756a1271f88c22DCRat payload (confidence level: 95%)
1197d1faff607b36cbca304f1d95c048DCRat payload (confidence level: 95%)
95c1a4c339e760769caa41ca3887c2cc7850897cMercurialGrabber payload (confidence level: 95%)

Description

ThreatFox IOCs for 2025-08-25

Impact

For European organizations, the impact of this threat is currently limited due to the lack of specific exploit details or active campaigns. The medium severity rating and the nature of the data as OSINT IOCs imply that the threat is more about enhancing detection capabilities rather than responding to an immediate, high-risk attack. However, organizations relying on threat intelligence feeds like ThreatFox can benefit from integrating these IOCs into their security monitoring tools to improve early detection of malware-related network activity. The absence of known exploits in the wild reduces the immediate risk, but the potential for payload delivery mechanisms means that if these IOCs correspond to emerging malware campaigns, European entities could face risks related to data exfiltration, system compromise, or service disruption. The impact is therefore contingent on how these IOCs correlate with ongoing or future malicious activities targeting European infrastructure or businesses.

Defensive guidance

Given the nature of this threat as an OSINT IOC update without specific exploit details, mitigation should focus on enhancing threat detection and response capabilities. European organizations should: 1) Integrate the latest ThreatFox IOCs into their Security Information and Event Management (SIEM) systems and Intrusion Detection/Prevention Systems (IDS/IPS) to enable real-time detection of related network activity. 2) Conduct regular threat hunting exercises using these IOCs to identify any signs of compromise early. 3) Maintain up-to-date network segmentation and strict access controls to limit the potential spread of malware if detected. 4) Ensure robust endpoint protection platforms are deployed and configured to detect payload delivery attempts. 5) Collaborate with national and European cybersecurity centers to share intelligence and receive timely updates on emerging threats. These steps go beyond generic advice by emphasizing proactive integration of threat intelligence and active hunting based on the provided IOCs.

Community reviews

Loading reviews…