IndicatorPublished 5 Sep 2025Updated 6 Sep 2025

type osint · ThreatFox IOCs for 2025-09-05

Affects type osintSource ThreatFox MISP Feed

TLP:WHITE, disclosure is not limited

Indicators of compromise

Domains 84

lm.hihijie3.ruClearFake payload delivery domain (confidence level: 100%)
st.hihijie3.ruClearFake payload delivery domain (confidence level: 100%)
uvw.hihijie3.ruClearFake payload delivery domain (confidence level: 100%)
xy.winenoy5.ruClearFake payload delivery domain (confidence level: 100%)
kl.winenoy5.ruClearFake payload delivery domain (confidence level: 100%)
simplwordwide.comFAKEUPDATES payload delivery domain (confidence level: 100%)
uvw.cofepoi2.ruClearFake payload delivery domain (confidence level: 100%)
trade-view-hub.comUnknown malware payload delivery domain (confidence level: 100%)
st.cofepoi2.ruClearFake payload delivery domain (confidence level: 100%)
pqr.cofepoi2.ruClearFake payload delivery domain (confidence level: 100%)

URLs 27

http://85.209.129.105:6060/capcha9856KongTuke payload delivery URL (confidence level: 100%)
http://electrico.co.zw/putty/five/five/pvqdq929bsx_a_d_m1n_a.phpLokiBot botnet C2 (confidence level: 100%)
http://109.199.115.244/a174c62af3784e49.phpStealc botnet C2 (confidence level: 100%)
http://81.17.103.184/81ac635d30c84930.phpStealc botnet C2 (confidence level: 100%)
http://193.111.248.238/ohshit.shUnknown malware payload delivery URL (confidence level: 75%)
https://sx.11.duitmasyuk.asiaVidar botnet C2 (confidence level: 75%)
https://t.me/wfqasg2131Lumma Stealer botnet C2 (confidence level: 75%)
https://bastxtu.top/zaldLumma Stealer botnet C2 (confidence level: 75%)
https://voando.in/pqpaLumma Stealer botnet C2 (confidence level: 100%)
http://starshipcrown.shopStealc botnet C2 (confidence level: 100%)

IP addresses 174

87.120.93.155StormKittyRAT botnet C2 server (confidence level: 100%)
196.251.83.33Remcos botnet C2 server (confidence level: 100%)
193.111.248.238Mirai botnet C2 server (confidence level: 100%)
103.130.213.44Mirai botnet C2 server (confidence level: 100%)
38.54.14.81Cobalt Strike botnet C2 server (confidence level: 100%)
8.140.248.184Cobalt Strike botnet C2 server (confidence level: 100%)
124.223.199.39Cobalt Strike botnet C2 server (confidence level: 100%)
89.31.126.176Cobalt Strike botnet C2 server (confidence level: 100%)
178.16.52.149Latrodectus botnet C2 server (confidence level: 100%)
103.86.44.162Ghost RAT botnet C2 server (confidence level: 100%)

Hashes 207

ff28b5cc55e3f8b09f20e9d02796f2eb45b0b0a6XWorm payload (confidence level: 95%)
fc9fac3327bd128f91307ae1d251340fbf803759d96a88ff9a1694406a164cefXWorm payload (confidence level: 95%)
5e1cec6f6e326b5d9e61cc504491511eXWorm payload (confidence level: 95%)
84e519bcd0e41f6d897e9c693f894c3a4fb43a3aXWorm payload (confidence level: 95%)
8fa6a5b34fac89062c13172061b58a0afeb4c034edf3a2de0f8c3a37ba444419XWorm payload (confidence level: 95%)
3605489cbc52559f6d32d1cf004ea3e5XWorm payload (confidence level: 95%)
4896c3a4a3e2cf2fa3eb16074c9caf57ac66965bXWorm payload (confidence level: 95%)
8a9782e3cef81e3cf475f812ede556f66c9aed6e634ef70489212ddce6dad0adXWorm payload (confidence level: 95%)
2e587d3a628576df1f32b23a029550baXWorm payload (confidence level: 95%)
93c231dcc1859d2841e9c31da6b1ace8cb344774DCRat payload (confidence level: 95%)

Description

ThreatFox IOCs for 2025-09-05

Impact

For European organizations, the impact of these IOCs primarily lies in their utility for threat detection and situational awareness rather than direct compromise. Organizations leveraging these IOCs can improve their security monitoring by identifying malicious network activity or payload delivery attempts linked to the referenced malware. However, since no active exploits or vulnerabilities are reported, the immediate risk of breach or operational disruption is low. The medium severity rating suggests that while the threat is not critical, ignoring these indicators could result in missed detection opportunities, potentially allowing malware infections or data exfiltration to go unnoticed. European entities with mature security operations centers (SOCs) and threat intelligence capabilities will benefit most from integrating these IOCs into their defensive measures. Conversely, organizations lacking such capabilities may not realize the full protective value, potentially increasing their exposure to undetected threats.

Defensive guidance

To effectively mitigate risks associated with the threat intelligence provided by these IOCs, European organizations should: 1) Integrate the IOCs into existing Security Information and Event Management (SIEM) systems and intrusion detection/prevention systems (IDS/IPS) to enable automated detection of related malicious activities. 2) Regularly update threat intelligence feeds to ensure the latest indicators are incorporated, enhancing the accuracy of threat hunting and incident response. 3) Conduct proactive network traffic analysis focusing on payload delivery patterns and unusual network activity that align with the provided IOCs. 4) Train SOC analysts to recognize and respond to alerts generated from these indicators, improving incident handling efficiency. 5) Collaborate with national and European cybersecurity information sharing platforms (e.g., ENISA, CERT-EU) to contextualize these IOCs within broader threat landscapes. 6) Since no patches are available, emphasize layered security controls such as network segmentation, endpoint protection, and strict access controls to reduce potential attack surfaces.

Community reviews

Loading reviews…