IndicatorPublished 25 Sep 2025Updated 26 Sep 2025

type osint · ThreatFox IOCs for 2025-09-25

Affects type osintSource ThreatFox MISP Feed

TLP:WHITE, disclosure is not limited

Indicators of compromise

Domains 176

bullxneo.netUnknown malware botnet C2 domain (confidence level: 100%)
e.xavv.ruClearFake payload delivery domain (confidence level: 100%)
up.6h1p7.ruClearFake payload delivery domain (confidence level: 100%)
vw.xavv.ruClearFake payload delivery domain (confidence level: 100%)
us.6h1p7.ruClearFake payload delivery domain (confidence level: 100%)
t.xavv.ruClearFake payload delivery domain (confidence level: 100%)
we.6h1p7.ruClearFake payload delivery domain (confidence level: 100%)
za.xavv.ruClearFake payload delivery domain (confidence level: 100%)
s8.xavv.ruClearFake payload delivery domain (confidence level: 100%)
m7.9s4g2.ruClearFake payload delivery domain (confidence level: 100%)

URLs 28

http://43.162.114.240:4000/loginUnknown malware botnet C2 (confidence level: 50%)
http://163.53.219.73/Hook botnet C2 (confidence level: 50%)
https://158.247.220.229Kimsuky botnet C2 (confidence level: 50%)
https://27.102.138.163/Kimsuky botnet C2 (confidence level: 50%)
https://cailtteve.live-on.netKimsuky botnet C2 (confidence level: 50%)
https://pastebin.com/k7pefmatAsyncRAT botnet C2 (confidence level: 50%)
https://pastebin.com/raw/shbknr90AsyncRAT botnet C2 (confidence level: 50%)
https://houshan.shop/apiLumma Stealer botnet C2 (confidence level: 75%)
https://steamcommunity.com/profiles/76561198783900411Vidar botnet C2 (confidence level: 100%)
https://telegram.me/rif0lmVidar botnet C2 (confidence level: 100%)

IP addresses 1,294

216.250.105.196Cobalt Strike botnet C2 server (confidence level: 100%)
91.92.242.73Latrodectus botnet C2 server (confidence level: 100%)
89.238.176.4Remcos botnet C2 server (confidence level: 100%)
107.172.44.148Remcos botnet C2 server (confidence level: 100%)
91.92.242.68Remcos botnet C2 server (confidence level: 100%)
196.251.83.222Remcos botnet C2 server (confidence level: 100%)
49.113.74.119Unknown malware botnet C2 server (confidence level: 100%)
103.190.107.178AsyncRAT botnet C2 server (confidence level: 100%)
217.195.155.76Quasar RAT botnet C2 server (confidence level: 100%)
104.129.12.197Havoc botnet C2 server (confidence level: 100%)

Hashes 216

2320184955fd1be330df5ab8c81925f8d90b65c1BlackRemote payload (confidence level: 95%)
a2e6cc6a5b6d0717fe70542d56aa5e201d4c5ad0cd82d8662d25ce2eae8c691eBlackRemote payload (confidence level: 95%)
bece6593173293201f711de6dead8e83BlackRemote payload (confidence level: 95%)
2e12dbc4ef796f3a4d8ca2c4eae581fea9a2f106XWorm payload (confidence level: 95%)
9f64cb8fde71c95ef227494e8e57ca897fcda3453156ba054689cfbe135fb208XWorm payload (confidence level: 95%)
d88c8eee9db334347bf48dc4d67a21b9XWorm payload (confidence level: 95%)
fe4428f76c1921e8b8e348c461140ad86d95a1faOwlproxy payload (confidence level: 95%)
ae9a6b6438f5d41b03219aa9e5ccfa77bd2fb0edbc39f4b6e98d28bbf7ea80e1Owlproxy payload (confidence level: 95%)
ae56b5acb31f273cb6bc3c14a848d9a9Owlproxy payload (confidence level: 95%)
c3037c0ebf33b6e3a015e4afa74fc9c9c63d88d3GUIDLOADER payload (confidence level: 95%)

Description

ThreatFox IOCs for 2025-09-25

Impact

For European organizations, the impact of these IOCs depends on their integration into security monitoring and threat intelligence platforms. Since the information relates to network activity and payload delivery detection, organizations that fail to incorporate these IOCs into their security operations may miss early signs of malware infections or network intrusions. The medium severity suggests a moderate risk, potentially leading to unauthorized access, data exfiltration, or disruption if related malware payloads are successfully delivered and executed. However, without active exploitation or known vulnerabilities, the immediate risk is limited. European entities with mature cybersecurity frameworks and threat intelligence sharing capabilities stand to benefit most from these IOCs by enhancing detection capabilities. Conversely, organizations lacking such capabilities may remain vulnerable to undetected malware campaigns that these IOCs aim to identify.

Defensive guidance

To effectively mitigate risks associated with the threat intelligence provided by these IOCs, European organizations should: 1) Integrate the ThreatFox IOCs into their Security Information and Event Management (SIEM) systems and Intrusion Detection/Prevention Systems (IDS/IPS) to enable real-time detection of related network activities and payload delivery attempts. 2) Regularly update threat intelligence feeds and ensure automated ingestion of new IOCs to maintain up-to-date detection capabilities. 3) Conduct network traffic analysis focusing on anomalies that match the behavioral patterns indicated by the IOCs, even in the absence of specific signatures. 4) Enhance endpoint detection and response (EDR) tools to recognize payload delivery mechanisms associated with these IOCs. 5) Promote information sharing with industry peers and national cybersecurity centers to contextualize the threat and improve collective defense. 6) Implement network segmentation and strict access controls to limit the potential spread of malware if payload delivery is successful. 7) Conduct regular security awareness training to help staff recognize phishing or social engineering attempts that may be vectors for payload delivery.

Community reviews

Loading reviews…