IndicatorPublished 28 Aug 2025Updated 29 Aug 2025

type osint · ThreatFox IOCs for 2025-08-28

Affects type osintSource ThreatFox MISP Feed

TLP:WHITE, disclosure is not limited

Indicators of compromise

Domains 177

qunohei5.ruClearFake payload delivery domain (confidence level: 100%)
quickomat.comUnknown malware payload delivery domain (confidence level: 100%)
lyjydau5.ruClearFake payload delivery domain (confidence level: 100%)
gytovao5.ruClearFake payload delivery domain (confidence level: 100%)
jiriwia8.ruClearFake payload delivery domain (confidence level: 100%)
savenay2.ruClearFake payload delivery domain (confidence level: 100%)
dedyhao2.ruClearFake payload delivery domain (confidence level: 100%)
bitxps.topLumma Stealer botnet C2 domain (confidence level: 100%)
repottenfuc.funLumma Stealer botnet C2 domain (confidence level: 100%)
fractux.topLumma Stealer botnet C2 domain (confidence level: 100%)

URLs 154

http://91.206.178.27/vbnh.pdfLumma Stealer payload delivery URL (confidence level: 100%)
http://193.111.248.238/1.shUnknown malware payload delivery URL (confidence level: 75%)
https://capexzo.top/wqoxLumma Stealer botnet C2 (confidence level: 100%)
http://188.245.105.73/second.htmlKongTuke payload delivery URL (confidence level: 100%)
http://cz75749.tw1.ru/91903996.phpDCRat botnet C2 (confidence level: 100%)
https://carowf.top/edszLumma Stealer botnet C2 (confidence level: 100%)
http://ebalazhabagadyku.icuStealc botnet C2 (confidence level: 100%)
https://sweaterumbrella.xyz/mok.phpUnknown Loader botnet C2 (confidence level: 100%)
http://79.141.165.202/a9b024dccb2b4f24.phpStealc botnet C2 (confidence level: 50%)
https://80.66.89.146/task/owysn2ysn2ysytasowusodysogmsotysnjqsn2msUnknown Loader botnet C2 (confidence level: 50%)

IP addresses 246

5.181.187.146Mirai botnet C2 server (confidence level: 100%)
117.72.83.6Cobalt Strike botnet C2 server (confidence level: 100%)
114.55.226.54Cobalt Strike botnet C2 server (confidence level: 100%)
103.176.197.100Ghost RAT botnet C2 server (confidence level: 100%)
82.153.241.186DarkComet botnet C2 server (confidence level: 100%)
4.182.221.225Sliver botnet C2 server (confidence level: 100%)
185.174.135.178Sliver botnet C2 server (confidence level: 100%)
185.174.135.178Sliver botnet C2 server (confidence level: 100%)
16.163.145.28Unknown malware botnet C2 server (confidence level: 100%)
197.224.239.201Unknown malware botnet C2 server (confidence level: 100%)

Hashes 207

c7a2b1a98f2c1ef31c930874518814e1a7fd6801e0bd41950a06d2b2796157dbLumma Stealer payload (confidence level: 100%)
eca4f290f83894393fb41d464b6130f3e706def1Stration payload (confidence level: 95%)
70cc1e2b56cfe037923d50292a8eb8f448a43aa6b023c3c612c058c1ac6d2505Stration payload (confidence level: 95%)
3d2c4f00a1ea8c4d12560a4e1c9464cbStration payload (confidence level: 95%)
ebb5ea1955b99fb5fbcca61b4a42cd3ea5a14051Expiro payload (confidence level: 95%)
f9855dccc31c9d330163b9f1fece700d5bc483798f1c0f3ce2cf7364b7423c29Expiro payload (confidence level: 95%)
29bbaaad587a29204d0e6f7b0b66f2abExpiro payload (confidence level: 95%)
ab94da5e3094ce259171bc3db43a234ad8c05b28Chaos payload (confidence level: 95%)
97517b7480182b69b42dc58d2c61f7e0Chaos payload (confidence level: 95%)
0e115675331ccff68857adbba7f52bb11e7aa53fFormbook payload (confidence level: 95%)

Description

ThreatFox IOCs for 2025-08-28

Impact

For European organizations, the potential impact of this threat is currently ambiguous due to the lack of detailed technical information and absence of known exploits. However, given the malware classification and association with payload delivery and network activity, there is a risk of unauthorized access, data exfiltration, or disruption of services if the malware were to be deployed effectively. Organizations relying on OSINT for threat intelligence or those with exposed network services could be at increased risk. The medium severity indicates that while immediate widespread damage is unlikely, targeted attacks exploiting this threat could lead to confidentiality breaches or operational disruptions. The absence of patches and known exploits suggests that this threat might be in an early stage or primarily used for reconnaissance and preparatory activities rather than active exploitation. European entities involved in critical infrastructure, government, or sectors with high-value data should remain vigilant, as attackers often use OSINT to tailor attacks against strategic targets.

Defensive guidance

Given the limited technical details, mitigation should focus on strengthening general security posture and monitoring for suspicious network activity. Specific recommendations include: 1) Enhance network monitoring and anomaly detection to identify unusual payload delivery attempts or network traffic patterns. 2) Employ threat intelligence feeds, including ThreatFox, to update detection rules and indicators as they become available. 3) Conduct regular OSINT hygiene reviews to minimize exposure of sensitive information that could be leveraged by attackers. 4) Implement strict access controls and network segmentation to limit the spread and impact of potential malware infections. 5) Train security teams to recognize early signs of payload delivery mechanisms and to respond promptly to alerts. 6) Maintain up-to-date endpoint protection solutions capable of detecting unknown or emerging malware behaviors. 7) Prepare incident response plans that include scenarios involving OSINT-driven attacks and payload delivery via network vectors. These measures go beyond generic advice by focusing on proactive intelligence integration and network-level defenses tailored to the threat's characteristics.

Community reviews

Loading reviews…