IndicatorPublished 1 Oct 2025Updated 2 Oct 2025

type osint · ThreatFox IOCs for 2025-10-01

Affects type osintSource ThreatFox MISP Feed

TLP:WHITE, disclosure is not limited

Indicators of compromise

Domains 176

wa.sgdi-6.ruClearFake payload delivery domain (confidence level: 100%)
daom2gaslioryrocky.comLatrodectus botnet C2 domain (confidence level: 100%)
fexelxilkopory.comLatrodectus botnet C2 domain (confidence level: 100%)
gansroroyfgdst.comLatrodectus botnet C2 domain (confidence level: 100%)
geargasporuion.comLatrodectus botnet C2 domain (confidence level: 100%)
triosdoryumkas.comLatrodectus botnet C2 domain (confidence level: 100%)
ariokliasklfdnok.comLatrodectus botnet C2 domain (confidence level: 100%)
dorevilokpadjghs.comLatrodectus botnet C2 domain (confidence level: 100%)
kwestgidokudiojek.comLatrodectus botnet C2 domain (confidence level: 100%)
lilikutliputsdf.comLatrodectus botnet C2 domain (confidence level: 100%)

URLs 8

https://5.75.222.230Vidar botnet C2 (confidence level: 75%)
https://girondh.pics/apiLumma Stealer botnet C2 (confidence level: 100%)
https://re.andreeamunteanu.com/Vidar botnet C2 (confidence level: 100%)
https://re.valmetfinance.com/Vidar botnet C2 (confidence level: 100%)
https://www.aisasport.it/wp-content/plugins/wp-can-cyberpsychology/index.php?r=bd1odhrwczovl3rozwzhbnmucgfnzxmuzgv2Latrodectus payload delivery URL (confidence level: 95%)
https://visionpro-optical.com/?cid=njcyotexLatrodectus payload delivery URL (confidence level: 95%)
http://064790cm.nyash.es/eternaltojsprocessorlongpollgeneratordatalife.phpDCRat botnet C2 (confidence level: 100%)
https://sorvetenopote.com/apiLumma Stealer botnet C2 (confidence level: 100%)

IP addresses 98

198.23.175.59Remcos botnet C2 server (confidence level: 100%)
196.251.73.238Remcos botnet C2 server (confidence level: 100%)
196.251.80.78Remcos botnet C2 server (confidence level: 100%)
204.136.10.72Sliver botnet C2 server (confidence level: 100%)
45.158.169.29SectopRAT botnet C2 server (confidence level: 100%)
195.2.78.187Unknown malware botnet C2 server (confidence level: 100%)
181.161.10.57Quasar RAT botnet C2 server (confidence level: 100%)
216.245.184.2Havoc botnet C2 server (confidence level: 100%)
13.216.130.82Havoc botnet C2 server (confidence level: 100%)
16.63.226.179NetSupportManager RAT botnet C2 server (confidence level: 100%)

Hashes 177

a70a58eefc179458ca56367a49cdcc9bf165b379XWorm payload (confidence level: 95%)
50385f90b9760b40b8253b2968981a14f25c8d1fd3289a84ec97dcf630fdd646XWorm payload (confidence level: 95%)
fa7a8ef32bc266f26fcb2921ae9d784fXWorm payload (confidence level: 95%)
2f44b0a62fa86e88f79579b004df42f53df1f97cQuasar RAT payload (confidence level: 95%)
961118b62f65cad09c31054ab3d9dafeca8c9018fb8e5d1fef5bd74db3b81859Quasar RAT payload (confidence level: 95%)
bfd703372867a96223b12391ce9d0fecQuasar RAT payload (confidence level: 95%)
5303bbf3b7d9a177f212207b250802346f1837d9Formbook payload (confidence level: 95%)
9d854ef77324e13432f5a59bdc1551e6425c8a5c533ee15a7e497e886636d30aFormbook payload (confidence level: 95%)
e61e48054bfa965857ca251cab8194bbFormbook payload (confidence level: 95%)
aa9c7941b3d77ef9004f64b8bda2f29db2ec60bfDarkTortilla payload (confidence level: 95%)

Description

ThreatFox IOCs for 2025-10-01

Impact

Given the limited technical details and absence of known exploits or affected software versions, the immediate impact on European organizations is likely low to medium. The threat intelligence update may help organizations enhance their detection capabilities against malware payload delivery and network-based threats. However, without specific malware signatures or attack vectors, organizations cannot directly correlate this IOC update to active compromises or ongoing campaigns. European entities that rely heavily on OSINT feeds for threat detection may benefit from integrating these IOCs into their security monitoring tools, potentially improving early warning and incident response. The medium severity suggests some risk but not an imminent or critical threat. The impact would be more pronounced if these IOCs correspond to emerging malware campaigns targeting network infrastructure or critical payload delivery mechanisms, but such details are not provided here.

Defensive guidance

To effectively leverage this IOC update, European organizations should: 1) Integrate ThreatFox IOCs into their Security Information and Event Management (SIEM) and Endpoint Detection and Response (EDR) systems to enhance detection of related network activity and payload delivery attempts. 2) Regularly update threat intelligence feeds and correlate these IOCs with internal logs to identify potential indicators of compromise early. 3) Conduct network traffic analysis focusing on unusual payload delivery patterns or connections matching the IOC data once available. 4) Strengthen network segmentation and enforce strict egress filtering to limit the impact of potential malware payload delivery. 5) Train security analysts to interpret OSINT-based threat intelligence and incorporate it into incident response workflows. 6) Since no patches are available, emphasize proactive detection and containment rather than remediation. These steps go beyond generic advice by focusing on operationalizing OSINT IOCs in security monitoring and response.

Community reviews

Loading reviews…