IndicatorPublished 29 Sep 2025Updated 30 Sep 2025

type osint · ThreatFox IOCs for 2025-09-29

Affects type osintSource ThreatFox MISP Feed

TLP:WHITE, disclosure is not limited

Indicators of compromise

Domains 208

r3.bvqu-7.ruClearFake payload delivery domain (confidence level: 100%)
pancakewap.co.comUnknown malware botnet C2 domain (confidence level: 100%)
u.bvqu-7.ruClearFake payload delivery domain (confidence level: 100%)
y7.bvqu-7.ruClearFake payload delivery domain (confidence level: 100%)
cm.bvqu-7.ruClearFake payload delivery domain (confidence level: 100%)
a.tfpe6.ruClearFake payload delivery domain (confidence level: 100%)
aa.tfpe6.ruClearFake payload delivery domain (confidence level: 100%)
ab.tfpe6.ruClearFake payload delivery domain (confidence level: 100%)
ad.tfpe6.ruClearFake payload delivery domain (confidence level: 100%)
ae.tsqe2.ruClearFake payload delivery domain (confidence level: 100%)

URLs 84

http://mi.candyendurable.com/kawt2qxfppuenm/index.phpAmadey botnet C2 (confidence level: 100%)
http://178.128.54.210:8888/supershell/login/Unknown malware botnet C2 (confidence level: 100%)
http://94.154.35.238/mich/five/fre.phpLoki Password Stealer (PWS) botnet C2 (confidence level: 100%)
http://94.154.35.238/mich/five/pvqdq929bsx_a_d_m1n_a.phpLokiBot botnet C2 (confidence level: 100%)
https://ff.liberatorpremiercompany.com/Vidar botnet C2 (confidence level: 100%)
https://xp.liberatorpremiercompany.com/Vidar botnet C2 (confidence level: 100%)
https://ez.liberatorpremiercompany.com/Vidar botnet C2 (confidence level: 100%)
https://df.liberatorpremiercompany.com/Vidar botnet C2 (confidence level: 100%)
https://xs.liberatorpremiercompany.com/Vidar botnet C2 (confidence level: 100%)
https://pi.liberatorpremiercompany.com/Vidar botnet C2 (confidence level: 100%)

IP addresses 145

47.122.119.55Cobalt Strike botnet C2 server (confidence level: 100%)
117.72.199.157Cobalt Strike botnet C2 server (confidence level: 100%)
84.19.175.165Remcos botnet C2 server (confidence level: 100%)
167.86.145.81NetSupportManager RAT botnet C2 server (confidence level: 100%)
54.93.181.242NetSupportManager RAT botnet C2 server (confidence level: 100%)
54.93.181.242NetSupportManager RAT botnet C2 server (confidence level: 100%)
60.205.113.167MimiKatz botnet C2 server (confidence level: 100%)
8.136.48.237AdaptixC2 botnet C2 server (confidence level: 100%)
103.124.105.209Cobalt Strike botnet C2 server (confidence level: 100%)
209.97.166.232Cobalt Strike botnet C2 server (confidence level: 100%)

Hashes 260

578044be67e6489d663f42c5b2d4a140ed4045e9XWorm payload (confidence level: 95%)
71a6435b10eb503615005a484cd98d54830c59e17ddcb4b24f4f0076312f46eeXWorm payload (confidence level: 95%)
c41ac9f42218b65e02f19b2e11a34317XWorm payload (confidence level: 95%)
89fa36ddc0adcf8857bacfe0074003fcf5e62362XWorm payload (confidence level: 95%)
1e029eee711e1aa63facd59de6860d8096280099caabd32c39d83984f00ca5b4XWorm payload (confidence level: 95%)
83e15376c487ed62360b425867a47b37XWorm payload (confidence level: 95%)
a344f82ac0eb9ceeadb9b06e6e2c6255cb2ede01XWorm payload (confidence level: 95%)
f11d1482e16e56c330a956b18e9a744968ca1f0ccb053b6476f32898e308b463XWorm payload (confidence level: 95%)
55f76cf05fa1bec4267cf9181e92c96eXWorm payload (confidence level: 95%)
3cc89f6309454f7434f8532410a3c065d0c0d9d2ValleyRAT payload (confidence level: 95%)

Description

ThreatFox IOCs for 2025-09-29

Impact

For European organizations, the impact of this threat is currently uncertain due to the lack of detailed technical information and absence of known exploits in the wild. However, given the malware's association with payload delivery and network activity, there is a potential risk of unauthorized access, data exfiltration, or disruption of services if exploited. Organizations relying heavily on OSINT tools or those with extensive network exposure could be more susceptible. The medium severity rating indicates that while the threat is not immediately critical, it could evolve or be leveraged in targeted attacks, especially against sectors with high-value data or critical infrastructure. The lack of patches and IOCs complicates detection and response efforts, potentially increasing the window of exposure. European entities should remain vigilant, particularly those in finance, government, and technology sectors, where the strategic value of data and services is high.

Defensive guidance

Given the limited information, mitigation should focus on strengthening network defenses and monitoring for unusual payload delivery and network activity patterns. Specific recommendations include: 1) Enhancing network segmentation to limit lateral movement in case of infection. 2) Deploying advanced threat detection systems capable of identifying anomalous network behavior and potential payload delivery attempts. 3) Regularly updating and hardening OSINT tools and related software to minimize vulnerabilities. 4) Implementing strict access controls and multi-factor authentication to reduce the risk of unauthorized access. 5) Conducting threat hunting exercises focused on detecting early signs of this malware, even in the absence of specific IOCs. 6) Maintaining up-to-date incident response plans that include procedures for unknown or emerging malware threats. 7) Collaborating with threat intelligence sharing communities to receive timely updates if new indicators or exploits emerge.

Community reviews

Loading reviews…