IndicatorPublished 15 Sep 2025Updated 16 Sep 2025

type osint · ThreatFox IOCs for 2025-09-15

Affects type osintSource ThreatFox MISP Feed

TLP:WHITE, disclosure is not limited

Indicators of compromise

Domains 87

2m.s836.ruClearFake payload delivery domain (confidence level: 100%)
v1.q780.ruClearFake payload delivery domain (confidence level: 100%)
w.q780.ruClearFake payload delivery domain (confidence level: 100%)
h8.l-5228.ruClearFake payload delivery domain (confidence level: 100%)
9.v9542.ruClearFake payload delivery domain (confidence level: 100%)
static.198.219.245.188.clients.your-server.deCobalt Strike botnet C2 domain (confidence level: 100%)
buriallifeinsurancepolicies.comHavoc botnet C2 domain (confidence level: 100%)
x.l-5228.ruClearFake payload delivery domain (confidence level: 100%)
r3v.v9542.ruClearFake payload delivery domain (confidence level: 100%)
q.m074.ruClearFake payload delivery domain (confidence level: 100%)

URLs 25

http://213.209.157.114/pi00/pin.phpLoki Password Stealer (PWS) botnet C2 (confidence level: 100%)
http://178.16.54.200/du4ko7hd/index.phpAmadey botnet C2 (confidence level: 100%)
https://morticmbnr.run/gakoLumma Stealer botnet C2 (confidence level: 100%)
http://178.16.54.200/du4ko7hd/login.phpAmadey botnet C2 (confidence level: 100%)
http://94.156.154.121/api/ytasodysodisowqsytesodgsotasotusnjusn2qsSmartLoader botnet C2 (confidence level: 75%)
http://a1167812.xsph.ru/75b0673e.phpDCRat botnet C2 (confidence level: 100%)
https://dll.amajed.comVidar botnet C2 (confidence level: 75%)
https://dll.schermgebroken.nlVidar botnet C2 (confidence level: 75%)
https://dropphef.shop/iuxdLumma Stealer botnet C2 (confidence level: 75%)
https://permanz.qpon/talxLumma Stealer botnet C2 (confidence level: 75%)

IP addresses 324

51.254.96.114Loki Password Stealer (PWS) botnet C2 server (confidence level: 75%)
108.187.6.98Ghost RAT botnet C2 server (confidence level: 100%)
108.187.6.166Ghost RAT botnet C2 server (confidence level: 100%)
108.187.6.254Ghost RAT botnet C2 server (confidence level: 100%)
195.177.94.190Remcos botnet C2 server (confidence level: 100%)
196.251.116.98Remcos botnet C2 server (confidence level: 100%)
213.209.143.110Remcos botnet C2 server (confidence level: 100%)
209.94.60.139Sliver botnet C2 server (confidence level: 100%)
185.231.227.245AsyncRAT botnet C2 server (confidence level: 100%)
185.208.156.153AsyncRAT botnet C2 server (confidence level: 100%)

Hashes 203

e5c0471b080f6b4fd5161bdf81e20ebc64f7ab8dXWorm payload (confidence level: 95%)
bd0919ee3e36fc61894b7ce7aedfd47fe56fc18beaa03d9baedf22a40186d0c6XWorm payload (confidence level: 95%)
919ae664d7901babd114dfb122ff3c7fXWorm payload (confidence level: 95%)
695b59085df23fff75bed9014d4bb8a983c1e5c8ValleyRAT payload (confidence level: 95%)
4e46867650327f0e3419be229e9dd1c67528bd00df72f505ef08e8d6a40f6760ValleyRAT payload (confidence level: 95%)
20674ce21bb9c5fdca35f606acf9712dValleyRAT payload (confidence level: 95%)
5bfd0be866c7a60b08dcfcb62d443e3fe870ba2ftroystealer payload (confidence level: 95%)
3838297c3967860e650e074164bf84b7fdd8c06e6bd63831b31c0a9bd6e46a1etroystealer payload (confidence level: 95%)
bcc9db90289a036fd301212c663ac791troystealer payload (confidence level: 95%)
5234c40cae90bfd1f0df6bffc649394d71e749cdAurotun Stealer payload (confidence level: 95%)

Description

ThreatFox IOCs for 2025-09-15

Impact

For European organizations, the impact of this threat primarily lies in its role as a source of threat intelligence that can enhance detection and response capabilities against malware-related network activities and payload delivery attempts. Since no specific affected products or vulnerabilities are identified, the direct impact on confidentiality, integrity, or availability is unclear. However, failure to incorporate these IOCs into security monitoring tools could result in missed detection opportunities for malware infections or network intrusions. Organizations with mature security operations centers (SOCs) and threat intelligence programs can leverage this data to improve situational awareness and reduce dwell time of threats. Conversely, organizations lacking such capabilities may not benefit directly from this intelligence, potentially increasing their exposure to undetected malware activity. The medium severity suggests a moderate risk level, emphasizing the importance of integrating updated threat intelligence feeds to maintain effective defenses against evolving malware threats.

Defensive guidance

1. Integrate the ThreatFox IOCs into existing security information and event management (SIEM) systems, intrusion detection/prevention systems (IDS/IPS), and endpoint detection and response (EDR) tools to enhance detection of related network activities and payload delivery attempts. 2. Regularly update threat intelligence feeds and ensure automated ingestion to maintain current awareness of emerging threats. 3. Conduct proactive threat hunting exercises using these IOCs to identify potential compromises or suspicious activities within the network. 4. Strengthen network segmentation and monitoring to limit the spread and impact of malware payloads if detected. 5. Train SOC analysts and incident responders on interpreting and utilizing OSINT-based IOCs effectively to improve incident response times. 6. Since no patches are available, focus on detection, containment, and remediation strategies rather than patch management for this specific threat intelligence. 7. Collaborate with information sharing communities to exchange insights and validate the relevance of these IOCs in the local threat landscape.

Community reviews

Loading reviews…