IndicatorPublished 1 Sep 2025Updated 2 Sep 2025

type osint · ThreatFox IOCs for 2025-09-01

Affects type osintSource ThreatFox MISP Feed

TLP:WHITE, disclosure is not limited

Indicators of compromise

Domains 362

computers-favorite.gl.at.ply.ggXWorm botnet C2 domain (confidence level: 100%)
pkq.toludye0.ruClearFake payload delivery domain (confidence level: 100%)
miq.toludye0.ruClearFake payload delivery domain (confidence level: 100%)
iz.toludye0.ruClearFake payload delivery domain (confidence level: 100%)
cfb.goxuxuy4.ruClearFake payload delivery domain (confidence level: 100%)
vl.goxuxuy4.ruClearFake payload delivery domain (confidence level: 100%)
ebn.goxuxuy4.ruClearFake payload delivery domain (confidence level: 100%)
chromus.icuUnknown malware payload delivery domain (confidence level: 100%)
panelswp.comUnknown malware payload delivery domain (confidence level: 100%)
allworldnewses.comUnknown malware payload delivery domain (confidence level: 100%)

URLs 76

http://160.250.128.197:8888/supershell/login/Unknown malware botnet C2 (confidence level: 100%)
http://103.153.69.151/wget.shUnknown malware payload delivery URL (confidence level: 75%)
http://103.153.69.151/arm7Unknown malware payload delivery URL (confidence level: 75%)
http://103.153.69.151/mipsUnknown malware payload delivery URL (confidence level: 75%)
http://103.153.69.151/arm5Unknown malware payload delivery URL (confidence level: 75%)
http://103.153.69.151/mpslUnknown malware payload delivery URL (confidence level: 75%)
http://103.153.69.151/arm6Unknown malware payload delivery URL (confidence level: 75%)
http://103.153.69.151/x86Unknown malware payload delivery URL (confidence level: 75%)
http://fwcpafl.com/dam/ponnie/gate.phpPony botnet C2 (confidence level: 100%)
http://a1163354.xsph.ru/b3de9859.phpDCRat botnet C2 (confidence level: 100%)

IP addresses 620

45.143.203.229FAKEUPDATES payload delivery server (confidence level: 100%)
5.182.206.88XWorm botnet C2 server (confidence level: 50%)
187.126.137.202DarkComet botnet C2 server (confidence level: 100%)
187.126.137.202DarkComet botnet C2 server (confidence level: 100%)
187.126.137.202DarkComet botnet C2 server (confidence level: 100%)
187.126.137.202DarkComet botnet C2 server (confidence level: 100%)
187.126.137.202DarkComet botnet C2 server (confidence level: 100%)
187.126.137.202DarkComet botnet C2 server (confidence level: 100%)
187.126.137.202DarkComet botnet C2 server (confidence level: 100%)
187.126.137.202DarkComet botnet C2 server (confidence level: 100%)

Hashes 189

df14997741b706043c9d9dab79564cf8d6a1f0f9Amadey payload (confidence level: 95%)
238f2bfc3e1c6d1c486718b215005532fcbf66a775339089253aa6208139205aAmadey payload (confidence level: 95%)
46791467c13cf4718f680a8a14975949Amadey payload (confidence level: 95%)
3421a31495dd784750201b48d5bf2960386c5cd5Luca Stealer payload (confidence level: 95%)
4bdfcda0ec7e507468e4654dbb66811750a6f9d7ebd9077888cd803c75085a39Luca Stealer payload (confidence level: 95%)
f85305b36ad65ffb0b01d3fb73b262a3Luca Stealer payload (confidence level: 95%)
2077360e2828c4ed2f64233061a57c44de444fb5XWorm payload (confidence level: 95%)
3d7f6743ea132b221c213e8ccf751e57d9f7c274fbd0da2aed6a122487097a9eXWorm payload (confidence level: 95%)
086cc7fe839637dfb618e34ce2849d9dXWorm payload (confidence level: 95%)
64b4dbaf20399e9569d887fbdb37acf10dc5e048Coinminer payload (confidence level: 95%)

Description

ThreatFox IOCs for 2025-09-01

Impact

For European organizations, the impact of these IOCs depends largely on their integration into security monitoring and threat detection systems. Since these are OSINT-based indicators related to malware network activity and payload delivery, they can enhance the detection capabilities of security teams against emerging threats. However, given the medium severity and absence of known exploits or patches, the immediate risk is moderate. Organizations that do not incorporate such threat intelligence feeds may face increased exposure to undetected malware communications or payload delivery attempts. The impact could include potential data exfiltration, system compromise, or network disruptions if the underlying malware is active and successful in evading detection. The lack of specific affected products or versions suggests a broad applicability, potentially affecting any organization with internet-facing infrastructure or endpoints susceptible to malware infection.

Defensive guidance

European organizations should prioritize integrating these IOCs into their existing security information and event management (SIEM) systems, intrusion detection/prevention systems (IDS/IPS), and endpoint detection and response (EDR) tools to enhance threat detection capabilities. Specifically, organizations should: 1) Regularly update and validate threat intelligence feeds to ensure timely detection of emerging threats. 2) Conduct network traffic analysis focusing on indicators related to payload delivery and suspicious network activity highlighted by these IOCs. 3) Implement strict network segmentation and least privilege access controls to limit malware propagation. 4) Enhance employee awareness and training on recognizing phishing or social engineering attempts that could lead to payload delivery. 5) Employ sandboxing and behavioral analysis tools to detect and analyze suspicious payloads. 6) Collaborate with national and European cybersecurity centers to share and receive updated threat intelligence. Given no patches are available, proactive detection and response remain the primary defense.

Community reviews

Loading reviews…