IndicatorPublished 11 Sep 2025Updated 12 Sep 2025

type osint · ThreatFox IOCs for 2025-09-11

Affects type osintSource ThreatFox MISP Feed

TLP:WHITE, disclosure is not limited

Indicators of compromise

Domains 112

hi.sacyzie58.ruClearFake payload delivery domain (confidence level: 100%)
day.sacyzie58.ruClearFake payload delivery domain (confidence level: 100%)
joy.sacyzie58.ruClearFake payload delivery domain (confidence level: 100%)
up.dasurie36.ruClearFake payload delivery domain (confidence level: 100%)
fun.dasurie36.ruClearFake payload delivery domain (confidence level: 100%)
way.dasurie36.ruClearFake payload delivery domain (confidence level: 100%)
do.pykokiu43.ruClearFake payload delivery domain (confidence level: 100%)
so.pykokiu43.ruClearFake payload delivery domain (confidence level: 100%)
suu.sed-i.orgVidar botnet C2 domain (confidence level: 75%)
air.pykokiu43.ruClearFake payload delivery domain (confidence level: 100%)

URLs 31

http://202.71.14.75/precomposition.exeRhadamanthys payload delivery URL (confidence level: 100%)
https://185.141.216.98/gateway/o4obvot8.h7itsRhadamanthys botnet C2 (confidence level: 100%)
https://suu.sed-i.orgVidar botnet C2 (confidence level: 75%)
http://198.55.98.114/pi00/pin.phpLoki Password Stealer (PWS) botnet C2 (confidence level: 100%)
http://95.164.53.109/f8nus4b/index.phpAmadey botnet C2 (confidence level: 100%)
http://95.164.53.109/f8nus4b/login.phpAmadey botnet C2 (confidence level: 100%)
http://213.209.150.159/lgMirai payload delivery URL (confidence level: 100%)
http://213.209.150.159/goaheadMirai payload delivery URL (confidence level: 100%)
http://213.209.150.159/awsMirai payload delivery URL (confidence level: 100%)
http://213.209.150.159/yarnMirai payload delivery URL (confidence level: 100%)

IP addresses 379

178.156.143.111ACR Stealer botnet C2 server (confidence level: 100%)
49.13.13.91ACR Stealer botnet C2 server (confidence level: 100%)
37.27.9.21ACR Stealer botnet C2 server (confidence level: 100%)
5.78.86.200ACR Stealer botnet C2 server (confidence level: 100%)
5.223.75.1ACR Stealer botnet C2 server (confidence level: 100%)
157.180.112.163ACR Stealer botnet C2 server (confidence level: 100%)
103.97.89.98Nanocore RAT botnet C2 server (confidence level: 75%)
192.227.246.79XWorm botnet C2 server (confidence level: 100%)
8.216.84.159Cobalt Strike botnet C2 server (confidence level: 100%)
43.226.17.50Ghost RAT botnet C2 server (confidence level: 100%)

Hashes 243

3f761b68fa640d82e335bcb109777d978c3ccc8dNewCT payload (confidence level: 95%)
bbdc1202c69ce9c6ff5d2bbd11ad24f57fda5f92f0c045f86430cff52055a284NewCT payload (confidence level: 95%)
efb4008da73f0e21a67a1b11eba62f81NewCT payload (confidence level: 95%)
7adcd774bb32fb32f1d0609c7492ad4cace5fcd1KrakenKeylogger payload (confidence level: 95%)
37599b38dcbe50dd01c413d2c5aeccc6582d640cf81ad4eb1f5877ed25c40d5dKrakenKeylogger payload (confidence level: 95%)
fa4613ae467ff64ad4c14def549eac1cKrakenKeylogger payload (confidence level: 95%)
1fcca581a0fcd3f723dea820b227af2a379f4495StrelaStealer payload (confidence level: 95%)
c35d1a4aeb871825d371887c2f08b15597503cf28a2e0164d8fb0b5913ac6612StrelaStealer payload (confidence level: 95%)
2be8a8c1383f487913a9ebfa81828a18StrelaStealer payload (confidence level: 95%)
3a37982cb7629bac715b07bd204663f0c186f953StrelaStealer payload (confidence level: 95%)

Description

ThreatFox IOCs for 2025-09-11

Impact

For European organizations, this threat could result in unauthorized access, data exfiltration, or disruption of services if the malware payloads are successfully delivered and executed. Given the network activity and payload delivery focus, organizations with extensive external network exposure or those relying heavily on open-source intelligence for operational security may be at increased risk. The medium severity indicates that while the threat is not currently critical, it could lead to moderate confidentiality, integrity, or availability impacts if exploited. Potential impacts include compromise of sensitive data, lateral movement within networks, and potential footholds for further attacks. European entities in sectors such as finance, critical infrastructure, and government could face targeted campaigns leveraging OSINT to tailor attacks, increasing the likelihood of successful payload delivery. The absence of known exploits in the wild reduces immediate risk but does not eliminate the possibility of future exploitation or escalation. The lack of patches implies that mitigation must focus on detection and prevention rather than remediation of a software flaw.

Defensive guidance

European organizations should enhance network monitoring to detect unusual payload delivery and network activity patterns associated with this threat. Implementing advanced threat detection tools that leverage behavioral analytics and anomaly detection can help identify early signs of compromise. Since no patches are available, focus should be on strengthening email and web filtering to block malicious payloads, enforcing strict access controls, and conducting regular OSINT hygiene to limit exposure of sensitive information that could be used for targeting. Incident response plans should be updated to include scenarios involving network-based malware delivery without known exploits. Employee awareness training on phishing and social engineering remains critical to reduce the risk of initial infection. Additionally, organizations should integrate ThreatFox and similar threat intelligence feeds into their security operations to stay updated on emerging IOCs and adjust defenses accordingly.

Community reviews

Loading reviews…