IndicatorPublished 13 Sep 2025Updated 14 Sep 2025

type osint · ThreatFox IOCs for 2025-09-13

Affects type osintSource ThreatFox MISP Feed

TLP:WHITE, disclosure is not limited

Indicators of compromise

Domains 209

cllcktlme.comUnknown Loader payload delivery domain (confidence level: 90%)
if.boku-0.ruClearFake payload delivery domain (confidence level: 100%)
is.buno8.ruClearFake payload delivery domain (confidence level: 100%)
cmqsqomiwwksmcsw.xyzMetaStealer botnet C2 domain (confidence level: 100%)
me.buno8.ruClearFake payload delivery domain (confidence level: 100%)
no.buno8.ruClearFake payload delivery domain (confidence level: 100%)
on.ciqe8.ruClearFake payload delivery domain (confidence level: 100%)
hap.vumarifa.comVidar botnet C2 domain (confidence level: 75%)
so.ciqe8.ruClearFake payload delivery domain (confidence level: 100%)
1.fe1it.ruClearFake payload delivery domain (confidence level: 100%)

URLs 70

https://hap.vumarifa.comVidar botnet C2 (confidence level: 75%)
http://134.122.207.54:8888/supershell/login/Unknown malware botnet C2 (confidence level: 100%)
http://193.23.200.19/api/ytasodysodisowqsytesodgsotasotusnjusn2qsSmartLoader botnet C2 (confidence level: 75%)
http://108.186.255.114:8696/rzy8Cobalt Strike botnet C2 (confidence level: 75%)
http://37.114.41.96/ohshit.shUnknown malware payload delivery URL (confidence level: 75%)
https://t.me/dfwgwgwgwLumma Stealer botnet C2 (confidence level: 100%)
https://secrequ.top/tieqLumma Stealer botnet C2 (confidence level: 100%)
https://t.me/sadv123v23vasLumma Stealer botnet C2 (confidence level: 100%)
https://lingzvl.top/zdgtLumma Stealer botnet C2 (confidence level: 100%)
https://nonckucg.top/xkznLumma Stealer botnet C2 (confidence level: 100%)

IP addresses 255

46.62.193.230ACR Stealer botnet C2 server (confidence level: 100%)
5.161.82.163ACR Stealer botnet C2 server (confidence level: 100%)
94.177.171.56Cobalt Strike botnet C2 server (confidence level: 100%)
69.165.68.209Cobalt Strike botnet C2 server (confidence level: 100%)
115.190.127.112Cobalt Strike botnet C2 server (confidence level: 100%)
43.156.101.186Cobalt Strike botnet C2 server (confidence level: 100%)
74.48.96.109Sliver botnet C2 server (confidence level: 100%)
144.208.127.243Sliver botnet C2 server (confidence level: 100%)
172.86.90.22Sliver botnet C2 server (confidence level: 100%)
8.216.84.159Unknown malware botnet C2 server (confidence level: 100%)

Hashes 336

5300b6e660bdc7d8398e51249ff8c52e252f4c68Remcos payload (confidence level: 95%)
523742b433e73faccb563bf9dec48ce0665c8235b3307aaab9347ce5d161de49Remcos payload (confidence level: 95%)
223c08a09dea2effa2d0fa15a0cd7b2bRemcos payload (confidence level: 95%)
b12e9e312281604220aabf485350dd4669f626c9ValleyRAT payload (confidence level: 95%)
2f99f89baa3385d879e5d687874e8595c0ba23f1540fa406c045208af10837e3ValleyRAT payload (confidence level: 95%)
1f0b90912b01c78823f0235d32fa0ef3ValleyRAT payload (confidence level: 95%)
4815ffb346727ccf3ceb6cf5d0f03158209f883dLoki Password Stealer (PWS) payload (confidence level: 95%)
1bc87c4f205cd112b2cec3f67c577ae7b604ed56c6cd6a15d8ad1ae6438598b8Loki Password Stealer (PWS) payload (confidence level: 95%)
1e8b10fdcf06a6305fb7bf0e80e3c4a2Loki Password Stealer (PWS) payload (confidence level: 95%)
230755ca6804affa2958308fedee1b959e5bb78bAurotun Stealer payload (confidence level: 95%)

Description

ThreatFox IOCs for 2025-09-13

Impact

For European organizations, the potential impact of this threat is currently uncertain due to the lack of detailed information. Given its classification involving payload delivery and network activity, there is a risk that successful exploitation could lead to unauthorized access, data exfiltration, or disruption of network services. Medium severity suggests moderate risk to confidentiality and integrity, with possible availability impacts depending on the payload. Organizations relying heavily on open-source intelligence tools or those with extensive network exposure might face increased risk. However, without known exploits or specific affected products, the immediate threat level to European entities is likely limited. The threat could serve as a precursor to more targeted attacks, so organizations should maintain heightened monitoring and incident response readiness.

Defensive guidance

Given the limited specifics, mitigation should focus on strengthening general defenses against malware and network-based threats. European organizations should ensure robust network segmentation and monitoring to detect unusual payload delivery or network activity. Employ advanced threat detection systems capable of identifying anomalous OSINT-related reconnaissance behaviors. Maintain up-to-date endpoint protection solutions and enforce strict access controls to limit lateral movement in case of compromise. Conduct regular threat intelligence updates from feeds like ThreatFox to incorporate emerging IOCs once available. Additionally, enhance employee awareness training about phishing and social engineering, as these are common initial vectors for payload delivery. Finally, implement strict logging and alerting mechanisms to quickly identify and respond to suspicious network activities potentially related to this threat.

Community reviews

Loading reviews…