IndicatorPublished 28 Sep 2025Updated 29 Sep 2025

type osint · ThreatFox IOCs for 2025-09-28

Affects type osintSource ThreatFox MISP Feed

TLP:WHITE, disclosure is not limited

Indicators of compromise

Domains 99

animefastflux.comMirai botnet C2 domain (confidence level: 100%)
x2m.ctze0.ruClearFake payload delivery domain (confidence level: 100%)
xq0.e-99n.ruClearFake payload delivery domain (confidence level: 100%)
p.fttu6.ruClearFake payload delivery domain (confidence level: 100%)
aa9.e-99n.ruClearFake payload delivery domain (confidence level: 100%)
me.xkqi8.ruClearFake payload delivery domain (confidence level: 100%)
k8.fttu6.ruClearFake payload delivery domain (confidence level: 100%)
my.xkqi8.ruClearFake payload delivery domain (confidence level: 100%)
g.a-91p.ruClearFake payload delivery domain (confidence level: 100%)
ve.fttu6.ruClearFake payload delivery domain (confidence level: 100%)

URLs 6

http://103.241.74.160:8888/supershell/login/Unknown malware botnet C2 (confidence level: 100%)
http://47.96.177.175:8888/supershell/login/Unknown malware botnet C2 (confidence level: 100%)
https://mainnet.solana-rpc-pool.workers.dev/Shai-Hulud botnet C2 (confidence level: 49%)
http://136.243.146.46:8898YiBackdoor botnet C2 (confidence level: 49%)
http://securebrainwork.site/redir/manage/size/fre.phpLoki Password Stealer (PWS) botnet C2 (confidence level: 100%)
http://80.49.182.145/videoprocessorapi.phpDCRat botnet C2 (confidence level: 100%)

IP addresses 133

178.16.52.40Stealc botnet C2 server (confidence level: 75%)
94.154.35.52Amadey botnet C2 server (confidence level: 50%)
178.16.55.189Amadey botnet C2 server (confidence level: 50%)
89.32.41.64Mirai botnet C2 server (confidence level: 100%)
195.177.94.50Mirai botnet C2 server (confidence level: 100%)
91.99.89.71ACR Stealer botnet C2 server (confidence level: 100%)
91.99.232.5ACR Stealer botnet C2 server (confidence level: 100%)
5.223.62.246ACR Stealer botnet C2 server (confidence level: 100%)
94.124.160.119ACR Stealer botnet C2 server (confidence level: 100%)
5.223.63.41ACR Stealer botnet C2 server (confidence level: 100%)

Hashes 199

c3797332f45280ad52d7f7520f1015fa437c3c03Vidar payload (confidence level: 95%)
c0387a08c64af61659e222bfadcf8cd528641cdb28e225b4b2d3d47683c200d5Vidar payload (confidence level: 95%)
e51c70d7d72181f013aadcbfbaa75892Vidar payload (confidence level: 95%)
7a6e0cfd7416af3827d846c764c97bdc4d476eabQuantLoader payload (confidence level: 95%)
36d21dd83d7c44184e0da1c744c060a883bcdf58abf91340bf3cbf27e0640be5QuantLoader payload (confidence level: 95%)
f67edfc87439588a505f65ab4df47519QuantLoader payload (confidence level: 95%)
2cb530011c244b5c474addf31e4a08f5f2d6c3d0Amadey payload (confidence level: 95%)
19b43280e8756f0955cb02a66789c5c4111f24366e384e89e913f5cd3639be9eAmadey payload (confidence level: 95%)
5613a45d6953cd6e0a923381946efb93Amadey payload (confidence level: 95%)
6646801fa61da514932a54ab5edf1ee879e84181StrelaStealer payload (confidence level: 95%)

Description

ThreatFox IOCs for 2025-09-28

Impact

For European organizations, the impact of this threat intelligence update is primarily in enhancing situational awareness and improving detection capabilities rather than indicating an immediate active threat. Since no specific exploits or vulnerabilities are identified, the direct risk to confidentiality, integrity, or availability is limited at this stage. However, organizations that rely heavily on networked infrastructure and have mature security operations centers (SOCs) can leverage these IOCs to identify and mitigate potential malware delivery attempts or network reconnaissance activities. Failure to integrate such intelligence could result in delayed detection of emerging threats, potentially leading to data breaches or service disruptions if the malware payloads referenced by these IOCs are later weaponized. The medium severity suggests a moderate level of concern, warranting attention but not immediate crisis response.

Defensive guidance

European organizations should incorporate these IOCs into their existing threat detection platforms, such as SIEM (Security Information and Event Management) systems, IDS/IPS (Intrusion Detection/Prevention Systems), and endpoint protection solutions. Specific actions include: 1) Regularly updating threat intelligence feeds to ensure timely incorporation of new IOCs; 2) Conducting network traffic analysis to detect unusual payload delivery patterns or reconnaissance activities; 3) Enhancing monitoring of external-facing assets to identify potential exploitation attempts; 4) Training SOC analysts to recognize behaviors associated with the types of malware and network activities indicated; 5) Implementing strict network segmentation and egress filtering to limit malware propagation and data exfiltration; 6) Performing threat hunting exercises using the provided IOCs to proactively identify latent infections or compromised systems. Since no patches are available, emphasis should be on detection and containment rather than remediation of a specific vulnerability.

Community reviews

Loading reviews…