IndicatorPublished 19 Sep 2025Updated 20 Sep 2025

type osint · ThreatFox IOCs for 2025-09-19

Affects type osintSource ThreatFox MISP Feed

TLP:WHITE, disclosure is not limited

Indicators of compromise

Domains 108

y.h8y0.ruClearFake payload delivery domain (confidence level: 100%)
b.h8y0.ruClearFake payload delivery domain (confidence level: 100%)
schedule.eliteworkxmarketing.comFAKEUPDATES botnet C2 domain (confidence level: 100%)
ar.q8e5.ruClearFake payload delivery domain (confidence level: 100%)
u1r.ror6.ruClearFake payload delivery domain (confidence level: 100%)
xq8.juq0.ruClearFake payload delivery domain (confidence level: 100%)
n.wuk0.ruClearFake payload delivery domain (confidence level: 100%)
t.zik9.ruClearFake payload delivery domain (confidence level: 100%)
k3.wuk0.ruClearFake payload delivery domain (confidence level: 100%)
vp.wuk0.ruClearFake payload delivery domain (confidence level: 100%)

URLs 20

http://pailchange.info/okut.phpUnknown Loader botnet C2 (confidence level: 100%)
https://ext.aztu.edu.azVidar botnet C2 (confidence level: 75%)
https://ext.demoserviciopcmendoza.com.arVidar botnet C2 (confidence level: 75%)
http://179.43.176.37:8080/loginUnknown Loader botnet C2 (confidence level: 75%)
http://49.232.21.222:80/9croCobalt Strike botnet C2 (confidence level: 75%)
http://5.8.18.242:443/xoscCobalt Strike botnet C2 (confidence level: 75%)
http://193.164.4.23:1337/sendUnknown Stealer botnet C2 (confidence level: 100%)
http://47.93.2.89:8888/supershell/login/Unknown malware botnet C2 (confidence level: 100%)
http://8.138.185.255:8888/supershell/login/Unknown malware botnet C2 (confidence level: 100%)
http://123.57.82.185:8888/supershell/login/Unknown malware botnet C2 (confidence level: 100%)

IP addresses 145

124.222.187.184Cobalt Strike botnet C2 server (confidence level: 100%)
111.229.28.253Cobalt Strike botnet C2 server (confidence level: 100%)
185.196.10.219Remcos botnet C2 server (confidence level: 100%)
72.39.190.141Sliver botnet C2 server (confidence level: 100%)
167.71.43.36Sliver botnet C2 server (confidence level: 100%)
143.92.35.9Unknown malware botnet C2 server (confidence level: 100%)
172.111.169.164AsyncRAT botnet C2 server (confidence level: 100%)
102.117.168.227Unknown malware botnet C2 server (confidence level: 100%)
85.23.245.182Havoc botnet C2 server (confidence level: 100%)
118.193.38.154Cobalt Strike botnet C2 server (confidence level: 75%)

Hashes 221

8241557fb0230ac109c765dda11a86a1db531c97Amadey payload (confidence level: 95%)
666f527c4c079d4e8e46fd3afd40491ba28b8df1fcc7aba30fb333003aeb0352Amadey payload (confidence level: 95%)
7d5ce8a854554e60cfdcbdde4198aa32Amadey payload (confidence level: 95%)
50c1dcc9ce623fa5c989a61835845b5a8865148bAmadey payload (confidence level: 95%)
d17fbdccb55a602246b26034b6ce9d64ae1c3b5ad48fd93a732d2fb1dd8de6dfAmadey payload (confidence level: 95%)
91038e60e0d3fddbc279c2b9b7311a09Amadey payload (confidence level: 95%)
b867c9641d7b58bd5c729aa5becc2dba9b6c8a2aAmadey payload (confidence level: 95%)
eea0252ad1d6a926f9c389a67d68bf4e21c24f843770f92b47d9cf10bf91748eAmadey payload (confidence level: 95%)
b23c208f9edf7873141ab84ea51dd465Amadey payload (confidence level: 95%)
ddf4de41e13441eba6427b3ac7f0d8e9242ea435Formbook payload (confidence level: 95%)

Description

ThreatFox IOCs for 2025-09-19

Impact

For European organizations, the impact of these IOCs is primarily in the realm of threat detection and situational awareness rather than immediate compromise. Since no specific software or hardware vulnerabilities are identified, the direct risk to confidentiality, integrity, or availability is low at this stage. However, the presence of payload delivery and network activity indicators suggests that these IOCs could be used to detect or prevent malware infections or network intrusions if integrated into security monitoring tools. European entities with mature security operations centers (SOCs) and threat intelligence capabilities can leverage these IOCs to enhance their detection capabilities and reduce dwell time of potential attackers. Conversely, organizations lacking robust threat intelligence integration may miss early warning signs, potentially increasing their exposure to malware campaigns. The medium severity rating implies that while the threat is not critical, it should not be ignored, especially in sectors with high-value targets such as finance, critical infrastructure, and government institutions. The lack of known exploits in the wild reduces the urgency but does not eliminate the need for vigilance.

Defensive guidance

To effectively mitigate risks associated with these IOCs, European organizations should: 1) Integrate the provided IOCs into existing Security Information and Event Management (SIEM) systems and Endpoint Detection and Response (EDR) tools to enable real-time detection of related malicious activity. 2) Continuously update threat intelligence feeds to ensure the latest indicators are incorporated, improving the accuracy of detection and response. 3) Conduct regular network traffic analysis focusing on unusual payload delivery patterns and suspicious network activity that align with the IOCs. 4) Enhance employee awareness and training on recognizing phishing and social engineering tactics that often serve as initial infection vectors for malware payloads. 5) Implement network segmentation and strict access controls to limit the lateral movement of malware if an infection occurs. 6) Collaborate with national and European cybersecurity centers (e.g., ENISA) to share intelligence and receive timely alerts about emerging threats. 7) Regularly review and update incident response plans to incorporate procedures for handling malware infections identified through these IOCs. These steps go beyond generic advice by emphasizing integration of specific threat intelligence, proactive monitoring, and inter-organizational collaboration.

Community reviews

Loading reviews…