IndicatorPublished 21 Sep 2025Updated 22 Sep 2025

type osint · ThreatFox IOCs for 2025-09-21

Affects type osintSource ThreatFox MISP Feed

TLP:WHITE, disclosure is not limited

Indicators of compromise

Domains 170

ftp.smashingboss.comFAKEUPDATES botnet C2 domain (confidence level: 100%)
docker.smashingboss.comFAKEUPDATES botnet C2 domain (confidence level: 100%)
mv.m33h.ruClearFake payload delivery domain (confidence level: 100%)
qm9.2p62.ruClearFake payload delivery domain (confidence level: 100%)
qq.m33h.ruClearFake payload delivery domain (confidence level: 100%)
l.6k47.ruClearFake payload delivery domain (confidence level: 100%)
ea.n44s.ruClearFake payload delivery domain (confidence level: 100%)
af.n44s.ruClearFake payload delivery domain (confidence level: 100%)
c5.6k47.ruClearFake payload delivery domain (confidence level: 100%)
ki.n44s.ruClearFake payload delivery domain (confidence level: 100%)

URLs 60

http://185.76.243.96/frlb.odgLumma Stealer payload delivery URL (confidence level: 75%)
http://150.241.105.82/api/ytasodysodisowqsytesodgsotasotusnjusn2qsSmartLoader botnet C2 (confidence level: 100%)
http://150.241.108.62/api/ytasodysodisowqsytesodgsotasotusnjusn2qsSmartLoader botnet C2 (confidence level: 100%)
http://159.255.37.200/api/ytasodysodisowqsytesodgsotasotusnjusn2qsSmartLoader botnet C2 (confidence level: 100%)
http://178.236.243.5/api/ytasodysodisowqsytesodgsotasotusnjusn2qsSmartLoader botnet C2 (confidence level: 100%)
http://185.170.153.243/api/ytasodysodisowqsytesodgsotasotusnjusn2qsSmartLoader botnet C2 (confidence level: 100%)
http://185.184.122.38/api/ytasodysodisowqsytesodgsotasotusnjusn2qsSmartLoader botnet C2 (confidence level: 100%)
http://185.184.122.75/api/ytasodysodisowqsytesodgsotasotusnjusn2qsSmartLoader botnet C2 (confidence level: 100%)
http://193.23.200.26/api/ytasodysodisowqsytesodgsotasotusnjusn2qsSmartLoader botnet C2 (confidence level: 100%)
http://193.233.126.91/api/ytasodysodisowqsytesodgsotasotusnjusn2qsSmartLoader botnet C2 (confidence level: 100%)

IP addresses 161

128.199.112.114Cobalt Strike botnet C2 server (confidence level: 100%)
206.123.152.47Remcos botnet C2 server (confidence level: 100%)
128.90.106.186Remcos botnet C2 server (confidence level: 100%)
77.83.207.133Matanbuchus botnet C2 server (confidence level: 100%)
45.74.8.8AsyncRAT botnet C2 server (confidence level: 100%)
195.65.41.209Unknown malware botnet C2 server (confidence level: 100%)
165.22.119.30AdaptixC2 botnet C2 server (confidence level: 100%)
46.30.190.85BianLian botnet C2 server (confidence level: 100%)
45.150.128.160Meterpreter botnet C2 server (confidence level: 75%)
147.185.221.211XWorm botnet C2 server (confidence level: 100%)

Hashes 214

1092053c0267398a80a625fb463b208b8fa8ebadCoinminer payload (confidence level: 95%)
d8d4c136068c9c5aad47a796b1e5f075bae4ded6c9e547ddba00ca9e112cb279Coinminer payload (confidence level: 95%)
09c60a5121f89102560ab606c3f185adCoinminer payload (confidence level: 95%)
bcd959780f471d96e30cec39b727342ac18e1cd8Vidar payload (confidence level: 95%)
63d70551a7e2ba9803837fdb397ace5f719e18963eb3bf7af3cba5f163567f32Vidar payload (confidence level: 95%)
02e8593f15ddc359edf0454e9eef995cVidar payload (confidence level: 95%)
d1dd09dfeaa172e97c053e739a77130c241082f0XWorm payload (confidence level: 95%)
39a43ccb4d5295214586a645cfd977031be5680cad5a316db4326c42ba3d91fdXWorm payload (confidence level: 95%)
fb0e5dfc9707e89deb23f5db9ebb3845XWorm payload (confidence level: 95%)
b72f4cac03fa6f0c30473b04da3d912ff75be5c5Aurotun Stealer payload (confidence level: 95%)

Description

ThreatFox IOCs for 2025-09-21

Impact

For European organizations, the impact of this threat is primarily related to the potential for undetected malware infections or network intrusions facilitated by the payload delivery mechanisms indicated. Since the IOCs are intended for detection and response, failure to incorporate these indicators into security monitoring tools could result in delayed identification of malicious activity, leading to possible data breaches, operational disruptions, or lateral movement within networks. The medium severity suggests that while the threat is not immediately critical, it could be leveraged by threat actors to compromise confidentiality, integrity, or availability if left unmitigated. European entities with extensive network infrastructure or those in sectors with high regulatory requirements (e.g., finance, healthcare, critical infrastructure) may face increased risks if these IOCs correspond to emerging or evolving malware campaigns. However, the lack of known exploits in the wild and absence of patches imply that this threat currently represents a moderate risk primarily useful for proactive defense rather than an active widespread attack vector.

Defensive guidance

European organizations should integrate the provided IOCs from the ThreatFox feed into their existing security information and event management (SIEM) systems, intrusion detection/prevention systems (IDS/IPS), and endpoint detection and response (EDR) tools to enhance detection capabilities. Regularly updating threat intelligence feeds and correlating these indicators with internal logs will improve early warning and incident response. Network segmentation and strict egress filtering can limit the impact of payload delivery attempts. Additionally, organizations should conduct threat hunting exercises using these IOCs to identify any latent infections or suspicious network activity. Employee awareness training focused on recognizing phishing or social engineering attempts that could deliver malware payloads will further reduce risk. Since no patches are available, emphasis should be placed on detection, containment, and response rather than remediation of a software flaw. Collaboration with national cybersecurity centers and sharing intelligence within European cybersecurity communities will enhance collective defense against such threats.

Community reviews

Loading reviews…