IndicatorPublished 22 Sep 2025Updated 23 Sep 2025

type osint · ThreatFox IOCs for 2025-09-22

Affects type osintSource ThreatFox MISP Feed

TLP:WHITE, disclosure is not limited

Indicators of compromise

Domains 242

vi.dgod.ruClearFake payload delivery domain (confidence level: 100%)
w4.9a9o8.ruClearFake payload delivery domain (confidence level: 100%)
ed.dgod.ruClearFake payload delivery domain (confidence level: 100%)
pz8.9a9o8.ruClearFake payload delivery domain (confidence level: 100%)
ag.dgod.ruClearFake payload delivery domain (confidence level: 100%)
h.6y0u1.ruClearFake payload delivery domain (confidence level: 100%)
ia.fjot.ruClearFake payload delivery domain (confidence level: 100%)
zr.fjot.ruClearFake payload delivery domain (confidence level: 100%)
u1.6y0u1.ruClearFake payload delivery domain (confidence level: 100%)
xm.fjot.ruClearFake payload delivery domain (confidence level: 100%)

URLs 69

http://176.46.152.62:5858/e1dd06e1d6cb459aaa35c60451e2b323_build.bindonut_injector payload delivery URL (confidence level: 75%)
http://188.93.233.12/ppyu8xmf9978/panel.phpUnknown malware botnet C2 (confidence level: 100%)
http://62.60.148.41/pages/login.phpUnknown malware botnet C2 (confidence level: 100%)
http://107.174.26.40:8888/supershell/login/Unknown malware botnet C2 (confidence level: 100%)
https://soyummy.com/uncategorized/45-discontinued-soda-flavorsFAKEUPDATES botnet C2 (confidence level: 100%)
https://api.telegram.org/bot7517119306:aaeapci5rhgjfbvj-n4jlwm7kq3vg2mygyu/sendmessage?chat_id=1279485009MASS Logger botnet C2 (confidence level: 50%)
http://45.83.28.99Stealc botnet C2 (confidence level: 100%)
http://43.162.108.133:4000/loginUnknown malware botnet C2 (confidence level: 50%)
http://134.209.157.90:8080/Chaos botnet C2 (confidence level: 50%)
http://196.251.72.73/Hook botnet C2 (confidence level: 50%)

IP addresses 1,059

196.251.118.144Mirai botnet C2 server (confidence level: 100%)
134.122.204.97Ghost RAT botnet C2 server (confidence level: 100%)
196.251.117.217Remcos botnet C2 server (confidence level: 100%)
172.245.209.211Remcos botnet C2 server (confidence level: 100%)
185.241.208.252Sliver botnet C2 server (confidence level: 100%)
102.117.170.146Unknown malware botnet C2 server (confidence level: 100%)
196.251.72.73Hook botnet C2 server (confidence level: 100%)
147.182.242.24Hook botnet C2 server (confidence level: 100%)
79.215.187.254Quasar RAT botnet C2 server (confidence level: 100%)
92.107.200.176Quasar RAT botnet C2 server (confidence level: 100%)

Hashes 199

d1e91d44bfd7d8384e15847d3b7529784ac27c46f5110da20be1cb16beb8a73bMASS Logger payload (confidence level: 50%)
2f667b642bbc868f32614c7289987cc913eae9eaRedLine Stealer payload (confidence level: 95%)
c0fb591995b977161934bbc31f33752c1bc8a7e399a0ce38a37fe7e1facf547fRedLine Stealer payload (confidence level: 95%)
6a43d142104436e3f0323245c3b7567aRedLine Stealer payload (confidence level: 95%)
273d31bf4e03a780ab5f84635c1cce6df125b30bAsyncRAT payload (confidence level: 95%)
d02aaed66b0f5d3b7aafd34537621875beb5aac2f2340f3f49075ce2691af6acAsyncRAT payload (confidence level: 95%)
3d04939369d11c0be16086835db29745AsyncRAT payload (confidence level: 95%)
5ef696df29248ba8472fe88d80c61b45142307deAsyncRAT payload (confidence level: 95%)
d37e3928a676a9ff21c7b1b215e272447478bdd99ef03035edc2f0f7105d9733AsyncRAT payload (confidence level: 95%)
f871921c9173567188e2bb197324f7fbAsyncRAT payload (confidence level: 95%)

Description

ThreatFox IOCs for 2025-09-22

Impact

For European organizations, the potential impact of this threat is currently limited due to the lack of detailed information and absence of known exploits in the wild. However, as it involves payload delivery and network activity, there is a risk that if this malware or campaign evolves, it could lead to unauthorized access, data exfiltration, or disruption of services. Organizations relying heavily on open-source intelligence or those with extensive network exposure might be more susceptible to initial reconnaissance or targeted payload delivery attempts. The medium severity rating suggests a moderate risk, but without concrete indicators or exploitation data, the immediate threat level remains controlled. European entities should remain vigilant, especially those in critical infrastructure, finance, and government sectors, where malware campaigns often aim to gain footholds for espionage or sabotage.

Defensive guidance

Given the limited specifics, mitigation should focus on enhancing detection and prevention capabilities related to malware and network-based threats. Organizations should: 1) Maintain up-to-date endpoint protection and network monitoring tools capable of detecting anomalous payload delivery and network activity patterns. 2) Implement robust OSINT monitoring to identify emerging threats and IOCs from trusted sources like ThreatFox and MISP. 3) Conduct regular threat hunting exercises focusing on unusual network traffic or payload signatures. 4) Enforce strict network segmentation to limit lateral movement in case of compromise. 5) Educate staff on recognizing phishing or social engineering attempts that could serve as initial infection vectors. 6) Since no patches are available, prioritize incident response readiness and ensure backups and recovery plans are current. 7) Collaborate with national cybersecurity centers to share intelligence and receive timely alerts about evolving threats.

Community reviews

Loading reviews…