IndicatorPublished 9 Sep 2025Updated 10 Sep 2025

type osint · ThreatFox IOCs for 2025-09-09

Affects type osintSource ThreatFox MISP Feed

TLP:WHITE, disclosure is not limited

Indicators of compromise

Domains 66

up.tydubyo66.ruClearFake payload delivery domain (confidence level: 100%)
day.tydubyo66.ruClearFake payload delivery domain (confidence level: 100%)
joy.tydubyo66.ruClearFake payload delivery domain (confidence level: 100%)
do.xudofiu02.ruClearFake payload delivery domain (confidence level: 100%)
cabunca.mypets.wsJanelaRAT botnet C2 domain (confidence level: 100%)
so.xudofiu02.ruClearFake payload delivery domain (confidence level: 100%)
fun.xudofiu02.ruClearFake payload delivery domain (confidence level: 100%)
me.xudofiu02.ruClearFake payload delivery domain (confidence level: 100%)
way.xudofiu02.ruClearFake payload delivery domain (confidence level: 100%)
it.gesybue11.ruClearFake payload delivery domain (confidence level: 100%)

URLs 19

http://62.60.226.113/d1a2d2be9fcb458f.phpStealc botnet C2 (confidence level: 50%)
http://5.237.231.14:11015/.iUnknown malware payload delivery URL (confidence level: 75%)
http://68.154.1.115/cs/index.php?vs=v1.0&pl=simJanelaRAT botnet C2 (confidence level: 100%)
http://194.87.128.233/ohshit.shUnknown malware payload delivery URL (confidence level: 75%)
https://govallrfqrfp.live/webpanel/panel/login.phpUnknown malware botnet C2 (confidence level: 100%)
http://51.195.60.102/loginUnknown malware botnet C2 (confidence level: 100%)
http://179.43.176.30/loginUnknown malware botnet C2 (confidence level: 100%)
https://62.60.245.136/pages/login.phpUnknown malware botnet C2 (confidence level: 100%)
http://213.165.43.31:8080/loginUnknown malware botnet C2 (confidence level: 100%)
https://pow.t.xifuhalim.comVidar botnet C2 (confidence level: 75%)

IP addresses 143

62.60.226.113Stealc botnet C2 server (confidence level: 100%)
193.233.112.145XWorm botnet C2 server (confidence level: 75%)
82.146.49.236Cobalt Strike botnet C2 server (confidence level: 100%)
47.99.218.12Cobalt Strike botnet C2 server (confidence level: 100%)
178.16.53.140Remcos botnet C2 server (confidence level: 100%)
45.74.8.89AsyncRAT botnet C2 server (confidence level: 100%)
207.154.205.11Unknown malware botnet C2 server (confidence level: 100%)
154.12.87.24DCRat botnet C2 server (confidence level: 100%)
16.51.152.223NetSupportManager RAT botnet C2 server (confidence level: 100%)
213.165.43.31Unknown malware botnet C2 server (confidence level: 100%)

Hashes 147

628757dd854d21fcbbe85179962c67d6df6cd863AsyncRAT payload (confidence level: 95%)
f88fcc7bb8329dc8684ac61f3a9a91248303ae5a80c4332bbfe4bf87471a7d64AsyncRAT payload (confidence level: 95%)
d4857622852c67a99a06ced85abd05d1AsyncRAT payload (confidence level: 95%)
6756f7ebaf3889a5a126d9c7022a69424c470d4fAgent Tesla payload (confidence level: 95%)
d54a472954e38a400de20de2d78fb2d7a7e634fee16c0f1a5209ba31f19f8175Agent Tesla payload (confidence level: 95%)
c6495dfa135438f7eeaa0e99258ac44dAgent Tesla payload (confidence level: 95%)
9c3f9458991320b837126e2d899801f8796b0e28Agent Tesla payload (confidence level: 95%)
14459695ca37ef7b1fd47751b6d695b5504d42326cb8b5230d9d8baafe54b37aAgent Tesla payload (confidence level: 95%)
a1d5f61f030b6e1b93cd1aeb6a686a00Agent Tesla payload (confidence level: 95%)
652a31566727ee8ea397fda4b6cd1b61920c00edRemcos payload (confidence level: 95%)

Description

ThreatFox IOCs for 2025-09-09

Impact

For European organizations, this threat could pose risks primarily related to network security and potential payload delivery mechanisms that may lead to malware infections. The medium severity suggests that while the threat is not currently critical, it could facilitate unauthorized access, data exfiltration, or disruption if leveraged effectively. The lack of known exploits in the wild reduces immediate risk, but the presence of OSINT and network activity tags implies attackers might use publicly available information to tailor attacks, increasing the likelihood of targeted campaigns. European entities with extensive network infrastructure or those involved in sensitive sectors such as finance, government, or critical infrastructure could face increased exposure. The absence of patches or specific mitigations means organizations must rely on proactive detection and network monitoring to identify and respond to suspicious activity. The potential impact includes confidentiality breaches, integrity compromise, and availability disruptions depending on the payload delivered.

Defensive guidance

Given the limited technical details and absence of patches, European organizations should focus on enhancing network monitoring and threat detection capabilities. Implement advanced intrusion detection and prevention systems (IDPS) that can analyze network traffic for anomalous payload delivery patterns. Employ threat intelligence feeds, including ThreatFox, to update detection rules with emerging IOCs. Conduct regular OSINT-based threat hunting to identify potential reconnaissance activities targeting the organization. Enforce strict network segmentation to limit lateral movement in case of compromise. Utilize endpoint detection and response (EDR) solutions to detect and contain malware payloads early. Regularly train security teams on emerging threat landscapes and ensure incident response plans are updated to handle malware infections. Additionally, organizations should review and harden firewall and proxy configurations to restrict unauthorized network communications. Since no patches are available, these proactive detection and containment strategies are critical.

Community reviews

Loading reviews…