IndicatorPublished 10 Sep 2025Updated 11 Sep 2025

type osint · ThreatFox IOCs for 2025-09-10

Affects type osintSource ThreatFox MISP Feed

TLP:WHITE, disclosure is not limited

Indicators of compromise

Domains 202

sec.xudofiu02.ruClearFake payload delivery domain (confidence level: 100%)
let.gesybue11.ruClearFake payload delivery domain (confidence level: 100%)
get.gesybue11.ruClearFake payload delivery domain (confidence level: 100%)
best.jibiw8aa5.ruClearFake payload delivery domain (confidence level: 100%)
add.homohay31.ruClearFake payload delivery domain (confidence level: 100%)
doll.jytoceo30.ruClearFake payload delivery domain (confidence level: 100%)
soft.zanax6aa1.ruClearFake payload delivery domain (confidence level: 100%)
cool.zanax6aa1.ruClearFake payload delivery domain (confidence level: 100%)
files.colin001.topUnknown malware botnet C2 domain (confidence level: 100%)
sanhao-th.comUnknown malware botnet C2 domain (confidence level: 100%)

URLs 103

http://91.238.50.169/f8nus4b/login.phpAmadey botnet C2 (confidence level: 100%)
http://mnbvcxz.biz/pony/gate.phpPony botnet C2 (confidence level: 100%)
http://lol.proxxied.serv00.net/abc1093d.phpDCRat botnet C2 (confidence level: 100%)
https://steamcommunity.com/profiles/76561198790051498Vidar botnet C2 (confidence level: 100%)
https://t.me/k3rsdtVidar botnet C2 (confidence level: 100%)
https://49.13.35.129/Vidar botnet C2 (confidence level: 100%)
https://9.9.jami.bio/Vidar botnet C2 (confidence level: 100%)
http://42.112.26.45/t/skid.armMirai payload delivery URL (confidence level: 100%)
http://42.112.26.45/t/skid.arm5Mirai payload delivery URL (confidence level: 100%)
http://42.112.26.45/t/skid.arm7Mirai payload delivery URL (confidence level: 100%)

IP addresses 1,344

167.71.220.83Lumma Stealer botnet C2 server (confidence level: 100%)
101.34.66.77Cobalt Strike botnet C2 server (confidence level: 100%)
114.132.169.168Cobalt Strike botnet C2 server (confidence level: 100%)
109.120.137.203Latrodectus botnet C2 server (confidence level: 100%)
20.120.248.82Sliver botnet C2 server (confidence level: 100%)
196.251.71.193Hook botnet C2 server (confidence level: 100%)
52.79.150.33Venom RAT botnet C2 server (confidence level: 100%)
144.86.38.158NetSupportManager RAT botnet C2 server (confidence level: 100%)
2.56.246.166Kaiji botnet C2 server (confidence level: 100%)
43.226.229.133Nanocore RAT botnet C2 server (confidence level: 100%)

Hashes 183

14001cbabc9faacd9961441787419bafbfa00210RedEnergy Stealer payload (confidence level: 95%)
d8b805089d2e3a320747f39785258f9db4fffc4e69f3f6b614b411f68b0d8745RedEnergy Stealer payload (confidence level: 95%)
1579e6dafdc1c614c17d0a570bcd3abdRedEnergy Stealer payload (confidence level: 95%)
04114f2a21f16be1b20105de03c2abf2415d5237Agent Tesla payload (confidence level: 95%)
dfb4dc821f2262bac5286080dd8276fe4306fa5cbe19fd795e3480510bd78415Agent Tesla payload (confidence level: 95%)
4ee6b3ff22244e09052132dc9cae7561Agent Tesla payload (confidence level: 95%)
80d0b5c43d45073389e7f763dbb3783b2010669fDCRat payload (confidence level: 95%)
de3f60d3fecad3572199d1342f5c5051810c30ebe2dfa0f0566dd6d1bcc475e1DCRat payload (confidence level: 95%)
c889f1dd65a410f4c84dd5f13ca70cb9DCRat payload (confidence level: 95%)
b404b8d99bbda77f41641a09e232e0c824cfdfaeAmadey payload (confidence level: 95%)

Description

ThreatFox IOCs for 2025-09-10

Impact

For European organizations, the impact of these IOCs depends on their integration into security monitoring and incident response workflows. Since these are indicators related to malware and network activity, they can help organizations detect and mitigate potential intrusions or payload delivery attempts early. However, without specific exploit details or active campaigns, the immediate risk is moderate. Organizations that do not utilize threat intelligence feeds or lack robust network monitoring may miss early warning signs, increasing their exposure. The absence of patches or known exploits suggests this is not a zero-day threat but rather intelligence to enhance detection capabilities. European entities in sectors with high exposure to network-based attacks, such as finance, critical infrastructure, and government, could benefit from incorporating these IOCs to reduce dwell time of attackers and prevent lateral movement.

Defensive guidance

1. Integrate the provided IOCs into existing Security Information and Event Management (SIEM) and Intrusion Detection/Prevention Systems (IDS/IPS) to enhance detection of related network activity and payload delivery attempts. 2. Regularly update threat intelligence feeds and correlate with internal logs to identify potential compromise indicators early. 3. Conduct network traffic analysis focusing on unusual payload delivery patterns or communications matching the IOCs. 4. Implement strict network segmentation and least privilege principles to limit the impact of any detected payload delivery. 5. Train security teams to interpret OSINT-based IOCs and incorporate them into incident response playbooks. 6. Since no patches are available, emphasize proactive detection and containment rather than remediation. 7. Collaborate with national and European cybersecurity centers (e.g., ENISA) to share intelligence and best practices related to these IOCs.

Community reviews

Loading reviews…