IndicatorPublished 30 Sep 2025Updated 1 Oct 2025

type osint · ThreatFox IOCs for 2025-09-30

Affects type osintSource ThreatFox MISP Feed

TLP:WHITE, disclosure is not limited

Indicators of compromise

Domains 179

op.tfpe-6.ruClearFake payload delivery domain (confidence level: 100%)
xn--pera-c7a.appUnknown malware botnet C2 domain (confidence level: 100%)
aster-dex.financeUnknown malware botnet C2 domain (confidence level: 100%)
partycybertrap.comBroomstick botnet C2 domain (confidence level: 100%)
ur.xrly-8.ruClearFake payload delivery domain (confidence level: 100%)
eh.jdho3.ruClearFake payload delivery domain (confidence level: 100%)
hm.jo-59.ruClearFake payload delivery domain (confidence level: 100%)
us.xrly-8.ruClearFake payload delivery domain (confidence level: 100%)
ut.xrly-8.ruClearFake payload delivery domain (confidence level: 100%)
d.fa-99.ruClearFake payload delivery domain (confidence level: 100%)

URLs 17

http://www.aieov.com/logo.gifFloxif botnet C2 (confidence level: 100%)
http://www.aieov.com/so.gifFloxif botnet C2 (confidence level: 100%)
http://eminai.tech/gw28/Formbook botnet C2 (confidence level: 100%)
https://webhook.site/bb8ca5f6-4175-45d2-b042-fc9ebb8170b7Shai-Hulud botnet C2 (confidence level: 100%)
https://rt.andreeacomansinger.com/Vidar botnet C2 (confidence level: 100%)
https://xt.americanmusclecars.eu/Vidar botnet C2 (confidence level: 100%)
https://rt.realassetsrealtors.com/Vidar botnet C2 (confidence level: 100%)
https://xt.liberatorpremiercompany.com/Vidar botnet C2 (confidence level: 100%)
http://x1.vototao9.ru/c8c7011c8d8dce568489e4983fd4606eClearFake payload delivery URL (confidence level: 100%)
https://holdonz.pics/apiLumma Stealer botnet C2 (confidence level: 100%)

IP addresses 143

5.101.82.32Remcos botnet C2 server (confidence level: 100%)
148.113.205.12Sliver botnet C2 server (confidence level: 100%)
172.86.117.176SectopRAT botnet C2 server (confidence level: 100%)
143.110.176.198Unknown malware botnet C2 server (confidence level: 100%)
54.86.224.232Unknown malware botnet C2 server (confidence level: 100%)
157.230.247.206Hook botnet C2 server (confidence level: 100%)
99.246.13.237Quasar RAT botnet C2 server (confidence level: 100%)
38.60.216.184Havoc botnet C2 server (confidence level: 100%)
149.50.135.215AdaptixC2 botnet C2 server (confidence level: 100%)
52.136.123.26Empire Downloader botnet C2 server (confidence level: 100%)

Hashes 19

b9a2a043e9297d42319eeb133e4a456b67f467a3990eca9cb5b0e196f5a32bfbWinsloader payload (confidence level: 100%)
cb9ba0af48019bb8f33f1a811d3426016896ddbd64975f2d5a2b5e920c1162c3Unknown RAT payload (confidence level: 100%)
39f94898eea1d829900a24cd5f3a9fe53ef93715b134ad86c2d12b8aff0f651eUnknown RAT payload (confidence level: 100%)
78d7e1920cbd3b94812124b58181001e88308cc9cbe292220c720bdb1b5aafe3Unknown RAT payload (confidence level: 100%)
775c517f70a0e508e72c00513951f3b1245f6a9f72ee251ff5b8e6968b9a5631Unknown RAT payload (confidence level: 100%)
dbd3b7e20136ee6bd9f9fae5025391a599c136283908eb0337f0b81d1409f0ceUnknown RAT payload (confidence level: 100%)
f284e220f47e675b9f75c134cd0298d81ae57b5f6728c1471fadb7631e1ed1f4Unknown RAT payload (confidence level: 100%)
eb8e08a571b40d591c49b2df7153eff0c62d6404857fc97f2667107fff5ec562Unknown RAT payload (confidence level: 100%)
dc40196f11280197b14e710d5ae2213ac8182d7b4905eb46590a437ae798dccbUnknown RAT payload (confidence level: 100%)
cc44ed928ce05a4df3e15fcb773865140a873fa6622ea381675011065c647083Unknown RAT payload (confidence level: 100%)

Description

ThreatFox IOCs for 2025-09-30

Impact

For European organizations, the impact of these IOCs depends largely on their integration into security monitoring and incident response workflows. Since no specific exploit or active malware campaign is described, the immediate risk is low to medium. However, failure to incorporate such threat intelligence into detection systems could result in missed opportunities to identify early signs of compromise or malicious network activity. Organizations that rely heavily on OSINT feeds for threat hunting and network defense can benefit from these indicators to enhance situational awareness and potentially prevent payload delivery attempts. Given the medium severity and lack of known active exploitation, the direct impact on confidentiality, integrity, or availability is limited unless these IOCs correspond to emerging threats that have not yet been widely observed. The primary risk is that these indicators may signal the presence or preparation of malware campaigns that could evolve into more severe threats if not monitored.

Defensive guidance

European organizations should ensure that their security operations centers (SOCs) and threat intelligence teams ingest and correlate these IOCs within their existing detection platforms such as SIEMs, IDS/IPS, and endpoint detection and response (EDR) tools. Specific recommendations include: 1) Automate the integration of ThreatFox MISP feed data into threat intelligence platforms to maintain up-to-date detection capabilities. 2) Conduct regular threat hunting exercises using these IOCs to identify potential early-stage compromises or suspicious network activity. 3) Enhance network segmentation and monitoring to detect and contain payload delivery attempts indicated by these IOCs. 4) Train SOC analysts to recognize patterns associated with the types of network activity and payload delivery methods suggested by the feed. 5) Maintain robust incident response plans that incorporate OSINT-derived intelligence for rapid containment and remediation. Since no patches or direct exploits are involved, focus should be on proactive detection and response rather than remediation of vulnerabilities.

Community reviews

Loading reviews…