IndicatorPublished 31 Aug 2025Updated 1 Sep 2025

type osint · ThreatFox IOCs for 2025-08-31

Affects type osintSource ThreatFox MISP Feed

TLP:WHITE, disclosure is not limited

Indicators of compromise

Domains 118

cevyfoy.ruClearFake payload delivery domain (confidence level: 100%)
rihuwuo.ruClearFake payload delivery domain (confidence level: 100%)
hyhiqaa.ruClearFake payload delivery domain (confidence level: 100%)
zyxyqie.ruClearFake payload delivery domain (confidence level: 100%)
ziqyrae.ruClearFake payload delivery domain (confidence level: 100%)
siradyo1.ruClearFake payload delivery domain (confidence level: 100%)
kywuzeo4.ruClearFake payload delivery domain (confidence level: 100%)
qg.tyjysoe0.ruClearFake payload delivery domain (confidence level: 100%)
tl.reluxiy6.ruClearFake payload delivery domain (confidence level: 100%)
ym.vadykoe7.ruClearFake payload delivery domain (confidence level: 100%)

URLs 31

http://5.206.224.85:8080/panel_xyz123/panel.phpUnknown malware botnet C2 (confidence level: 100%)
http://8.210.214.111:8888/supershell/login/Unknown malware botnet C2 (confidence level: 100%)
http://gamestoredownload.download/autoconfig/level3sp/fre.phpLoki Password Stealer (PWS) botnet C2 (confidence level: 100%)
http://pokimokipoka.comStealc botnet C2 (confidence level: 100%)
http://bprof.dobriyk8.beget.tech/e9456ecb.phpDCRat botnet C2 (confidence level: 100%)
http://a1163330.xsph.ru/fffe1446.phpDCRat botnet C2 (confidence level: 100%)
http://cu21409.tw1.ru/38d8171a.phpDCRat botnet C2 (confidence level: 100%)
https://keepass.online/download/keepass.htmlUnknown malware payload delivery URL (confidence level: 100%)
https://2908.photolives.info/update/2908.pdfUnknown malware payload delivery URL (confidence level: 100%)
http://213.232.114.169/d.shUnknown malware payload delivery URL (confidence level: 75%)

IP addresses 112

5.206.224.85Unknown malware botnet C2 server (confidence level: 100%)
23.160.168.174Nanocore RAT botnet C2 server (confidence level: 75%)
103.38.81.221Cobalt Strike botnet C2 server (confidence level: 100%)
144.91.82.9Remcos botnet C2 server (confidence level: 100%)
196.251.73.97Remcos botnet C2 server (confidence level: 100%)
45.144.55.160Unknown malware botnet C2 server (confidence level: 100%)
45.144.55.160Unknown malware botnet C2 server (confidence level: 100%)
77.223.214.71Unknown malware botnet C2 server (confidence level: 100%)
87.106.52.7XWorm botnet C2 server (confidence level: 100%)
178.16.52.248Latrodectus botnet C2 server (confidence level: 90%)

Hashes 204

bc8fff1fcba7d747262e1194c8cb87c106de3f9dStrelaStealer payload (confidence level: 95%)
051ef36a8d16c5fb219169e84f46aa60761b87a01db4a4aa930148239c139d09StrelaStealer payload (confidence level: 95%)
2b343ea5480bfd4ae2281ffe83c391b8StrelaStealer payload (confidence level: 95%)
a69d8dcbd46f9b9062eb946ea622e3043f2b5729ValleyRAT payload (confidence level: 95%)
5e7da7e614a6116880f751efe743b04c59187d362d4ec51d06ab2f59edc6685bValleyRAT payload (confidence level: 95%)
088cae382da1d498c51d7e403ce30adcValleyRAT payload (confidence level: 95%)
9c62567a92428116296a3b71abf0db1a1c8601c8AsyncRAT payload (confidence level: 95%)
be0178c728db0cafc7d9ece06fb679cf5f90eae79633111914b03dfa8f9e3c82AsyncRAT payload (confidence level: 95%)
3f990ed73658d8e9f16614ba83e6bc4eAsyncRAT payload (confidence level: 95%)
2754e5209f2719ba9eb213244994938bfa2e6525XWorm payload (confidence level: 95%)

Description

ThreatFox IOCs for 2025-08-31

Impact

For European organizations, the impact of this threat is currently moderate due to the medium severity rating and the absence of known active exploits. However, the involvement of payload delivery and network activity categories suggests potential risks such as unauthorized access, data exfiltration, or disruption of network services if the malware were to be deployed effectively. Organizations relying heavily on OSINT tools or network-exposed services could be at increased risk. The lack of patches and specific mitigations means that organizations must rely on detection and prevention strategies rather than remediation. If exploited, the threat could compromise confidentiality and integrity of data, and potentially availability if network disruptions occur. Given the evolving nature of malware threats, European entities should consider this an early warning to enhance monitoring and incident response capabilities.

Defensive guidance

1. Enhance network monitoring to detect unusual payload delivery attempts or anomalous network activity, using advanced intrusion detection and prevention systems (IDS/IPS) with updated threat intelligence feeds. 2. Employ threat hunting practices focusing on OSINT-related indicators and network traffic anomalies to identify early signs of compromise. 3. Implement strict network segmentation and access controls to limit the spread and impact of potential malware infections. 4. Regularly update and tune endpoint detection and response (EDR) tools to recognize emerging malware behaviors associated with payload delivery. 5. Conduct employee awareness training emphasizing phishing and social engineering tactics that could be used to deliver payloads. 6. Collaborate with national and European cybersecurity information sharing platforms to receive timely updates and share intelligence on emerging threats. 7. Since no patches are available, prioritize rapid incident response planning and containment strategies to minimize impact if an infection occurs.

Community reviews

Loading reviews…