IndicatorPublished 23 Sep 2025Updated 24 Sep 2025

type osint · ThreatFox IOCs for 2025-09-23

Affects type osintSource ThreatFox MISP Feed

TLP:WHITE, disclosure is not limited

Indicators of compromise

Domains 180

coursedillema.comNetSupportManager RAT payload delivery domain (confidence level: 100%)
founderevo.comNetSupportManager RAT payload delivery domain (confidence level: 100%)
storage.westinsinsurance.comFAKEUPDATES botnet C2 domain (confidence level: 100%)
vps.denissalazar.comFAKEUPDATES payload delivery domain (confidence level: 100%)
i.xqix.ruClearFake payload delivery domain (confidence level: 100%)
c7.dy-53.ruClearFake payload delivery domain (confidence level: 100%)
r2.t940.ruClearFake payload delivery domain (confidence level: 100%)
mn.xxos.ruClearFake payload delivery domain (confidence level: 100%)
wq9.dy-53.ruClearFake payload delivery domain (confidence level: 100%)
h.k807.ruClearFake payload delivery domain (confidence level: 100%)

URLs 31

https://coursedillema.com/ajax/pixi.min.jsNetSupportManager RAT payload delivery URL (confidence level: 100%)
https://founderevo.com/res/bundlecrispobligeNetSupportManager RAT payload delivery URL (confidence level: 100%)
http://lokingworldkapitaling.autos:8080/updater?for=ebf74cbb675052bbf7d05ac4036f8050Unknown malware botnet C2 (confidence level: 100%)
http://lokingworldkapitaling.autos:8080/updater?for=0aa6b9f07a5b27b2069c137c69ec91ebUnknown malware botnet C2 (confidence level: 100%)
http://216.170.114.4/send/the/index.phpAzorult botnet C2 (confidence level: 100%)
https://ity.uwintech.com/Vidar botnet C2 (confidence level: 100%)
https://ity.psigestioncomercial.com.ar/Vidar botnet C2 (confidence level: 100%)
https://syswolupdatesupp1.com/sign-inAmatera botnet C2 (confidence level: 50%)
https://v361422.hosted-by-vdsina.com/sign-inAmatera botnet C2 (confidence level: 50%)
http://45.83.28.99/bc864e9030754883.phpStealc botnet C2 (confidence level: 50%)

IP addresses 651

94.158.245.170NetSupportManager RAT botnet C2 server (confidence level: 100%)
219.137.164.117Cobalt Strike botnet C2 server (confidence level: 100%)
185.205.209.59Cobalt Strike botnet C2 server (confidence level: 100%)
158.160.179.129Cobalt Strike botnet C2 server (confidence level: 100%)
134.122.204.10Ghost RAT botnet C2 server (confidence level: 100%)
124.66.208.108Ghost RAT botnet C2 server (confidence level: 100%)
196.251.80.78Remcos botnet C2 server (confidence level: 100%)
213.227.129.32Remcos botnet C2 server (confidence level: 100%)
35.92.162.47Unknown malware botnet C2 server (confidence level: 100%)
102.117.160.78Unknown malware botnet C2 server (confidence level: 100%)

Hashes 5

5510f6e9de383f3c84d052309ecd31fcad9de22db2b884ae805062c85ad10be5Unknown Stealer payload (confidence level: 100%)
44b9786e5ab0376ef426f7eb3bd503605436bcefea066dbb0a445bb96eaf3459Unknown Stealer payload (confidence level: 100%)
3bc01f5ad52f4a3960efda58cb12a121a4cb8e709678c25181dfd19b61dbe1dcUnknown Stealer payload (confidence level: 100%)
e92db705ddc2a3406132652c665d01c523d57a771d80730ef94fb784800fe459RedTiger Stealer payload (confidence level: 100%)
83c33230835de61c86f684a830c996ca17f3ee8aef3629133bf77e91befed54dUnknown Stealer payload (confidence level: 100%)

Description

ThreatFox IOCs for 2025-09-23

Impact

For European organizations, the impact of this threat intelligence update is primarily in enhancing situational awareness and improving detection of potentially malicious network activity and payload delivery attempts. Since no specific malware or exploit details are provided, the direct operational impact is limited. However, integrating these IOCs into security monitoring tools can help identify early signs of compromise or malicious activity, reducing the risk of successful intrusions. The medium severity suggests that while the threat is not currently critical or widespread, it warrants attention to prevent escalation. Organizations relying heavily on network security monitoring, threat hunting, and incident response will benefit most. The lack of known exploits in the wild and absence of patches indicates that this intelligence is more preventive and diagnostic rather than reactive to an ongoing attack. European entities with mature cybersecurity operations can leverage this data to fine-tune detection rules and improve response times, thereby mitigating potential risks associated with malware payload delivery and network-based threats.

Defensive guidance

1. Integrate the provided IOCs into existing Security Information and Event Management (SIEM) systems, Intrusion Detection/Prevention Systems (IDS/IPS), and endpoint detection tools to enhance detection capabilities. 2. Conduct regular threat hunting exercises using these IOCs to identify any signs of compromise or suspicious network activity. 3. Maintain up-to-date network segmentation and strict access controls to limit the potential spread of malware if detected. 4. Enhance employee awareness and training on recognizing phishing and social engineering tactics that often serve as initial payload delivery vectors. 5. Regularly update and patch all systems and software to reduce the attack surface, even though no specific patches are linked to this threat. 6. Collaborate with threat intelligence sharing communities to stay informed about updates or changes related to these IOCs. 7. Employ network traffic analysis and anomaly detection tools to identify unusual patterns that may indicate payload delivery attempts or malware communication.

Community reviews

Loading reviews…