IndicatorPublished 5 Oct 2025Updated 6 Oct 2025

type osint · ThreatFox IOCs for 2025-10-05

Affects type osintSource ThreatFox MISP Feed

TLP:WHITE, disclosure is not limited

Indicators of compromise

Domains 107

la.xvqy8.ruClearFake payload delivery domain (confidence level: 100%)
ka.xvqy8.ruClearFake payload delivery domain (confidence level: 100%)
jo.xvqy8.ruClearFake payload delivery domain (confidence level: 100%)
q.faqyhi.ruClearFake payload delivery domain (confidence level: 100%)
pc.mexizo.ruClearFake payload delivery domain (confidence level: 100%)
pz8.0-c448.ruClearFake payload delivery domain (confidence level: 100%)
x2j.mexizo.ruClearFake payload delivery domain (confidence level: 100%)
h1.0-c448.ruClearFake payload delivery domain (confidence level: 100%)
bq.mexizo.ruClearFake payload delivery domain (confidence level: 100%)
aa.0-c448.ruClearFake payload delivery domain (confidence level: 100%)

URLs 2

http://43.161.221.153:8888/supershell/login/Unknown malware botnet C2 (confidence level: 100%)
http://491131cm.n9shteam1.top/tosecurepacketbigloadserversqlbaseflowertemp.phpDCRat botnet C2 (confidence level: 100%)

IP addresses 117

82.67.39.194Loki Password Stealer (PWS) botnet C2 server (confidence level: 75%)
113.45.205.53Cobalt Strike botnet C2 server (confidence level: 100%)
149.56.66.137AsyncRAT botnet C2 server (confidence level: 100%)
27.78.41.100Venom RAT botnet C2 server (confidence level: 100%)
161.35.47.34Bashlite botnet C2 server (confidence level: 100%)
54.46.18.227AdaptixC2 botnet C2 server (confidence level: 100%)
92.119.114.15NetSupportManager RAT botnet C2 server (confidence level: 100%)
216.126.236.247Cobalt Strike botnet C2 server (confidence level: 100%)
124.222.32.187Cobalt Strike botnet C2 server (confidence level: 100%)
27.78.41.100Venom RAT botnet C2 server (confidence level: 100%)

Hashes 147

cd98b4bc1fb6f639ec7398dfdcbcf89f7958507dDCRat payload (confidence level: 95%)
431f3847118cd3d86255c6406e622c5bf75da18576b2d8f17fbef878c5bb234bDCRat payload (confidence level: 95%)
ecfb9b4b9269ea9ab538fce181950dd9DCRat payload (confidence level: 95%)
3c55749daf93c8fd1c0d4a553a410d0f469e3a96NjRAT payload (confidence level: 95%)
6665a09f016607c1fb50c2680a0a6d16b6c4f7c761a3fcd326126b6b7a582f29NjRAT payload (confidence level: 95%)
da21e710f576cd7175a6190bce08f95dNjRAT payload (confidence level: 95%)
eda19cfe6599bb71b286101d9e3baabeb1b74a01Supper payload (confidence level: 95%)
80b8b696061e9f3f94c9889b0c51189ea3941a72432627e799fa2d65f4bf8f6dSupper payload (confidence level: 95%)
91c0f700b654707bfba6a18ab1e07914Supper payload (confidence level: 95%)
41051192d3786bfb404c3419672bbbe6d37c6e2eDCRat payload (confidence level: 95%)

Description

ThreatFox IOCs for 2025-10-05

Impact

For European organizations, the direct impact of this threat is limited due to the absence of active exploits or specific vulnerabilities. However, the shared IOCs can enhance detection capabilities against malware payload delivery and network-based threats. Organizations involved in critical infrastructure, finance, or government sectors may benefit from integrating this intelligence to preemptively identify suspicious network activity or payload attempts. The medium severity suggests a moderate risk level, primarily affecting the confidentiality and integrity of systems if the malware payloads are successfully delivered and executed. The lack of patches or known exploits indicates that the threat is not currently causing widespread disruption but could evolve. European entities with mature security operations centers (SOCs) and threat intelligence teams can leverage this data to strengthen defenses and reduce the risk of undetected compromise. Overall, the impact is more strategic and preventive rather than immediate operational disruption.

Defensive guidance

European organizations should focus on enhancing their threat intelligence ingestion processes by integrating the provided IOCs into existing security information and event management (SIEM) systems and endpoint detection and response (EDR) tools. Network monitoring should be intensified to detect unusual payload delivery attempts or suspicious network activity patterns consistent with the shared intelligence. Security teams should conduct threat hunting exercises using the updated IOCs to identify potential latent infections or reconnaissance activities. Regular training and awareness programs should emphasize the importance of OSINT in identifying emerging threats. Since no patches are available, maintaining robust network segmentation and strict access controls can limit potential malware spread. Collaboration with national cybersecurity centers and sharing updated intelligence can improve collective defense. Finally, organizations should validate and contextualize the IOCs to reduce false positives and optimize response actions.

Community reviews

Loading reviews…