IndicatorPublished 17 Sep 2025Updated 18 Sep 2025

type osint · ThreatFox IOCs for 2025-09-17

Affects type osintSource ThreatFox MISP Feed

TLP:WHITE, disclosure is not limited

Indicators of compromise

Domains 111

mkt.97jt.ruClearFake payload delivery domain (confidence level: 100%)
g.527w.ruClearFake payload delivery domain (confidence level: 100%)
tc.527w.ruClearFake payload delivery domain (confidence level: 100%)
v5.s57o.ruClearFake payload delivery domain (confidence level: 100%)
2w1.527w.ruClearFake payload delivery domain (confidence level: 100%)
s.802d.ruClearFake payload delivery domain (confidence level: 100%)
h1.802d.ruClearFake payload delivery domain (confidence level: 100%)
cm0.s57o.ruClearFake payload delivery domain (confidence level: 100%)
v3.802d.ruClearFake payload delivery domain (confidence level: 100%)
ret.aztu.edu.azVidar botnet C2 domain (confidence level: 75%)

URLs 33

https://ret.aztu.edu.azVidar botnet C2 (confidence level: 75%)
https://ret.demoserviciopcmendoza.com.arVidar botnet C2 (confidence level: 75%)
http://cm31471.tw1.ru/f243cc5e.phpDCRat botnet C2 (confidence level: 100%)
https://famixsk.shop/oxwiLumma Stealer botnet C2 (confidence level: 100%)
http://202.181.148.70/sanya.phpDCRat botnet C2 (confidence level: 100%)
http://mi.raisindispose.com/kawt2qxfppuenm/index.phpAmadey botnet C2 (confidence level: 100%)
https://joebesser.com/6n8v.jsKongTuke payload delivery URL (confidence level: 100%)
https://joebesser.com/js.phpKongTuke payload delivery URL (confidence level: 100%)
https://duz.aztu.edu.azVidar botnet C2 (confidence level: 75%)
https://duz.demoserviciopcmendoza.com.arVidar botnet C2 (confidence level: 75%)

IP addresses 156

46.62.198.245Cobalt Strike botnet C2 server (confidence level: 100%)
104.223.122.120Cobalt Strike botnet C2 server (confidence level: 100%)
47.120.70.161Cobalt Strike botnet C2 server (confidence level: 100%)
47.108.217.44Cobalt Strike botnet C2 server (confidence level: 100%)
172.111.244.107Remcos botnet C2 server (confidence level: 100%)
49.113.78.131Unknown malware botnet C2 server (confidence level: 100%)
94.249.236.169AsyncRAT botnet C2 server (confidence level: 100%)
209.38.147.179SectopRAT botnet C2 server (confidence level: 100%)
196.251.88.76RedLine Stealer botnet C2 server (confidence level: 100%)
45.94.47.200Stealc botnet C2 server (confidence level: 100%)

Hashes 162

c7bebcad25339203ca7035541a3703c94aed8ab1ValleyRAT payload (confidence level: 95%)
28c1575ef28fc5e3b5eb4a63327bec10b399ce17bd65ea1b2e53562cfcd7e8a4ValleyRAT payload (confidence level: 95%)
3a8efb57ea0bc0b19df7b582d9011688ValleyRAT payload (confidence level: 95%)
0935da4fc0cda6b625f340b840a0c0ccd7fbe8d4Cobalt Strike payload (confidence level: 95%)
d8cf13cc9834e0b66070974c9c2b1694ca3dd63e253718509ddc95c5942eb38aCobalt Strike payload (confidence level: 95%)
6a1721ec4fba9bda05035ba151650ddbCobalt Strike payload (confidence level: 95%)
39b3a4ed53fc026dd99958f79a06c4a439560ae5DCRat payload (confidence level: 95%)
bca5ffb9737d1a5153b454a1ad91c91340c7176b31ef102f7958042818e031faDCRat payload (confidence level: 95%)
0dfc61a83241ea7f8e72053218a1a0ceDCRat payload (confidence level: 95%)
2311f22444c3a4f0140750f6c3f8e395ad7a8d55GCleaner payload (confidence level: 95%)

Description

ThreatFox IOCs for 2025-09-17

Impact

For European organizations, the impact of this threat lies primarily in the potential for improved situational awareness and detection of malware campaigns through updated IOCs. Since no specific exploit or vulnerability is identified, the direct risk of compromise is low to medium, depending on the organization's ability to integrate and act on the provided intelligence. Organizations that rely heavily on OSINT feeds for threat hunting and incident response can leverage these IOCs to detect and mitigate payload delivery attempts and suspicious network activity. However, the lack of known exploits in the wild and absence of patchable vulnerabilities means that the threat does not currently pose an immediate operational risk but should be monitored as part of ongoing threat intelligence efforts. Failure to incorporate such intelligence could result in delayed detection of malware infections or network intrusions, potentially leading to data breaches or service disruptions if payload delivery attempts succeed.

Defensive guidance

European organizations should focus on integrating the ThreatFox IOCs into their existing security monitoring and incident response platforms, such as SIEMs, IDS/IPS, and endpoint detection and response (EDR) tools. Regularly updating threat intelligence feeds and automating IOC ingestion will enhance early detection of related malware activity. Network segmentation and strict egress filtering can limit the impact of payload delivery attempts. Additionally, organizations should conduct regular threat hunting exercises using these IOCs to identify potential compromises early. Since no patches are available, emphasis should be placed on proactive detection, user awareness training to recognize phishing or social engineering attempts that may deliver payloads, and maintaining robust backup and recovery procedures to mitigate potential damage from malware infections. Collaboration with national and European cybersecurity centers can also improve contextual understanding and response coordination.

Community reviews

Loading reviews…