IndicatorPublished 4 Sep 2025Updated 5 Sep 2025

type osint · ThreatFox IOCs for 2025-09-04

Affects type osintSource ThreatFox MISP Feed

TLP:WHITE, disclosure is not limited

Indicators of compromise

Domains 96

xux.xonulee9.ruClearFake payload delivery domain (confidence level: 100%)
bbj.subozaa7.ruClearFake payload delivery domain (confidence level: 100%)
gqy.zelojue1.ruClearFake payload delivery domain (confidence level: 100%)
zr.velyzeu3.ruClearFake payload delivery domain (confidence level: 100%)
iv.qehucuu5.ruClearFake payload delivery domain (confidence level: 100%)
marvelvod.comLumma Stealer botnet C2 domain (confidence level: 100%)
digitbasket.comLumma Stealer botnet C2 domain (confidence level: 100%)
voando26.comLumma Stealer botnet C2 domain (confidence level: 100%)
iaed.linkLumma Stealer botnet C2 domain (confidence level: 100%)
pyscalp.comLumma Stealer botnet C2 domain (confidence level: 100%)

URLs 47

http://82.22.200.35:1337/get-infoUnknown Stealer botnet C2 (confidence level: 100%)
http://45.66.248.249:443/loginBroomstick botnet C2 (confidence level: 100%)
http://45.66.248.249:443/regBroomstick botnet C2 (confidence level: 100%)
http://51.222.96.108/api/kcehcBroomstick botnet C2 (confidence level: 100%)
http://51.222.96.108/api/jgfnsfnuefcnegfnehjbfncejfhBroomstick botnet C2 (confidence level: 100%)
https://digitbasket.com/pqoxLumma Stealer botnet C2 (confidence level: 75%)
https://iaed.link/ndbhLumma Stealer botnet C2 (confidence level: 75%)
https://lzh.fr/mnsnLumma Stealer botnet C2 (confidence level: 75%)
https://marvelvod.com/uqiaLumma Stealer botnet C2 (confidence level: 75%)
https://phoenix-brands.dev/qyzbLumma Stealer botnet C2 (confidence level: 75%)

IP addresses 233

69.167.11.99Quasar RAT botnet C2 server (confidence level: 88%)
178.16.52.154Latrodectus botnet C2 server (confidence level: 100%)
95.111.252.39Remcos botnet C2 server (confidence level: 100%)
18.221.191.90Sliver botnet C2 server (confidence level: 100%)
108.165.147.181Unknown malware botnet C2 server (confidence level: 100%)
8.138.185.255Unknown malware botnet C2 server (confidence level: 100%)
46.246.80.18AsyncRAT botnet C2 server (confidence level: 100%)
216.144.226.242Unknown malware botnet C2 server (confidence level: 100%)
102.117.163.190Unknown malware botnet C2 server (confidence level: 100%)
181.161.30.67Quasar RAT botnet C2 server (confidence level: 100%)

Hashes 426

7bc38fd304e331cad9d055469d9ee42c6ea72a44Quasar RAT payload (confidence level: 95%)
db728098ee83742156ca473750c72cc14ea5d249cb61a1168009eacbd880c1b3Quasar RAT payload (confidence level: 95%)
54db4bcd3c3846802ab5cbca41a46feaQuasar RAT payload (confidence level: 95%)
dc0a94bb380492fb543f6ed6d07919a2d43f1873Nitol payload (confidence level: 95%)
a4fe410865c4277efe42382e954fe2f33fd74854662fc575f2e29cd361931f50Nitol payload (confidence level: 95%)
28d953a3203a9b3c587a3ba4e0f92bb8Nitol payload (confidence level: 95%)
2b092674f6b33d55c87ebc3c11d2e3b2499ceebcAsyncRAT payload (confidence level: 95%)
bf139e8d4cc73239afcbbac7591c0fd609d2ca358ff2c4aedf991ad08f1bbe12AsyncRAT payload (confidence level: 95%)
eda231aeeaaa67506cc277d13e683854AsyncRAT payload (confidence level: 95%)
8e3ea9f56f2b0642c251fcdf3bd9b11d526a9bdcQuasar RAT payload (confidence level: 95%)

Description

ThreatFox IOCs for 2025-09-04

Impact

For European organizations, the impact of this threat is currently limited due to the lack of specific exploit details or affected products. The medium severity rating and the focus on OSINT and network activity imply that this intelligence could be used to enhance detection capabilities against emerging malware payload delivery techniques. However, without concrete exploit or vulnerability information, the immediate risk to confidentiality, integrity, or availability is low. Organizations may benefit from integrating these IOCs into their threat hunting and network monitoring tools to identify potential malicious activity early. The threat's distribution score suggests some level of spread, which could translate into increased scanning or reconnaissance activity targeting European networks, potentially leading to increased alert volumes and the need for enhanced monitoring. Overall, the threat serves as a preparatory intelligence input rather than an active, high-impact attack vector.

Defensive guidance

Given the nature of this intelligence update, European organizations should focus on enhancing their network monitoring and threat detection capabilities. Specific recommendations include: 1) Integrate the provided IOCs into SIEM (Security Information and Event Management) and IDS/IPS (Intrusion Detection/Prevention Systems) to detect related network activity promptly. 2) Conduct regular threat hunting exercises using updated OSINT feeds to identify early signs of payload delivery attempts. 3) Maintain up-to-date network segmentation and least privilege access controls to limit potential lateral movement if payload delivery is successful. 4) Ensure endpoint detection and response (EDR) solutions are configured to detect anomalous payload execution and network behavior. 5) Train security teams to recognize and analyze emerging malware delivery patterns highlighted by OSINT sources. These steps go beyond generic advice by emphasizing proactive intelligence integration and operational readiness rather than reactive patching or incident response.

Community reviews

Loading reviews…