IndicatorPublished 7 Sep 2025Updated 8 Sep 2025

type osint · ThreatFox IOCs for 2025-09-07

Affects type osintSource ThreatFox MISP Feed

TLP:WHITE, disclosure is not limited

Indicators of compromise

Domains 111

qd.pylohao.ruClearFake payload delivery domain (confidence level: 100%)
zmi.pylohao.ruClearFake payload delivery domain (confidence level: 100%)
lt.pylohao.ruClearFake payload delivery domain (confidence level: 100%)
cobyrose.comSmokeLoader botnet C2 domain (confidence level: 100%)
vcn.pylohao.ruClearFake payload delivery domain (confidence level: 100%)
rk.pylohao.ruClearFake payload delivery domain (confidence level: 100%)
wa.kujywii.ruClearFake payload delivery domain (confidence level: 100%)
bzl.kujywii.ruClearFake payload delivery domain (confidence level: 100%)
yc.kujywii.ruClearFake payload delivery domain (confidence level: 100%)
pqt.kujywii.ruClearFake payload delivery domain (confidence level: 100%)

URLs 29

http://45.153.34.123Stealc botnet C2 (confidence level: 100%)
https://stc.s3.masterclasstonewow.comVidar botnet C2 (confidence level: 75%)
https://plataukz.xin/nbvgLumma Stealer botnet C2 (confidence level: 100%)
https://tetrwoo.asia/niuoLumma Stealer botnet C2 (confidence level: 100%)
https://figueqhk.xin/qyvvLumma Stealer botnet C2 (confidence level: 100%)
https://hffiahz.asia/pppmLumma Stealer botnet C2 (confidence level: 100%)
https://sprimvd.my/zcbhLumma Stealer botnet C2 (confidence level: 100%)
https://renohhde.xin/nvhuLumma Stealer botnet C2 (confidence level: 100%)
https://lithfzx.my/bvcgLumma Stealer botnet C2 (confidence level: 100%)
https://titlexy.my/bavgLumma Stealer botnet C2 (confidence level: 100%)

IP addresses 154

91.98.120.131ACR Stealer botnet C2 server (confidence level: 100%)
91.98.129.69ACR Stealer botnet C2 server (confidence level: 100%)
37.27.40.177ACR Stealer botnet C2 server (confidence level: 100%)
138.201.185.57ACR Stealer botnet C2 server (confidence level: 100%)
38.207.178.73Cobalt Strike botnet C2 server (confidence level: 100%)
134.122.155.143Ghost RAT botnet C2 server (confidence level: 100%)
134.122.155.141Ghost RAT botnet C2 server (confidence level: 100%)
95.217.97.220Sliver botnet C2 server (confidence level: 100%)
128.90.113.220AsyncRAT botnet C2 server (confidence level: 100%)
150.40.119.238Hook botnet C2 server (confidence level: 100%)

Hashes 133

097a5601056afd48bdb3db24d8a7c773fc2afc87XWorm payload (confidence level: 95%)
68a367884639037f1e1e7619df3ae3fcc6177034e8bd3d0da2f62383762b3dc8XWorm payload (confidence level: 95%)
d3c223256f7a719ecf40f5054e6ecdefXWorm payload (confidence level: 95%)
cd9002c13ddb6aefe04f64d716bbf30ee31c7124XWorm payload (confidence level: 95%)
16504ecdf01e0666a5a41542568fb228f23d2f65a8fe499c7924f28f4422dc72XWorm payload (confidence level: 95%)
135ffe18f7b1349db0d9d2346db1bdcdXWorm payload (confidence level: 95%)
1b2654b1d795b8ce647942ec20f2373ddf08ab89ValleyRAT payload (confidence level: 95%)
3f61f2626ae164481484e1145ab87bf220e38f7dfd425fd3e533f03803a44189ValleyRAT payload (confidence level: 95%)
8a1ff5d1961a6b050e0a9085d63134efValleyRAT payload (confidence level: 95%)
cc227585010c85d6cf43e177286b393a3c06798fDCRat payload (confidence level: 95%)

Description

ThreatFox IOCs for 2025-09-07

Impact

For European organizations, the impact of these IOCs depends largely on their integration into security monitoring and incident response processes. Since the IOCs relate to malware payload delivery and network activity, failure to incorporate them into detection systems could result in missed identification of malicious traffic or payloads, potentially leading to compromise. However, given the medium severity and lack of known active exploits, the immediate risk is moderate. Organizations with mature security operations centers (SOCs) and threat intelligence capabilities can leverage these IOCs to enhance their detection capabilities, reducing the likelihood of successful attacks. Conversely, organizations lacking such capabilities may face increased risk of undetected intrusion attempts. The absence of patches or specific vulnerable products suggests that the threat is more about detection of malicious activity rather than mitigation of a software vulnerability. Therefore, the primary impact is on the confidentiality and integrity of systems if payload delivery attempts succeed, potentially leading to malware infections or data breaches.

Defensive guidance

European organizations should integrate these IOCs into their existing security infrastructure, including intrusion detection/prevention systems (IDS/IPS), firewalls, endpoint detection and response (EDR) tools, and security information and event management (SIEM) platforms. Automated ingestion of ThreatFox IOCs can improve real-time detection of suspicious network activity and payload delivery attempts. Regular updates and validation of threat intelligence feeds are essential to maintain relevance. Additionally, organizations should conduct network traffic analysis to identify anomalies that match the provided IOCs. Employee awareness and phishing prevention training remain important, as payload delivery often involves social engineering. Since no patches are available, emphasis should be on detection, containment, and response. Incident response plans should be reviewed and tested to ensure rapid reaction to detections based on these IOCs. Finally, collaboration with national and European cybersecurity centers (e.g., ENISA) can enhance collective defense efforts.

Community reviews

Loading reviews…