IndicatorPublished 7 Oct 2025Updated 8 Oct 2025

type osint · ThreatFox IOCs for 2025-10-07

Affects type osintSource ThreatFox MISP Feed

TLP:WHITE, disclosure is not limited

Indicators of compromise

Domains 159

desk.miamionly.comFAKEUPDATES botnet C2 domain (confidence level: 100%)
cm.qoruva.ruClearFake payload delivery domain (confidence level: 100%)
if.xzb6i.ruClearFake payload delivery domain (confidence level: 100%)
t1.x-7daf.ruClearFake payload delivery domain (confidence level: 100%)
sushinoking.ddnsking.comUnknown malware botnet C2 domain (confidence level: 100%)
mythic.r.stf.printf.storeUnknown malware botnet C2 domain (confidence level: 100%)
k.m4d8q9.ruClearFake payload delivery domain (confidence level: 100%)
hm.x-7daf.ruClearFake payload delivery domain (confidence level: 100%)
z2.m4d8q9.ruClearFake payload delivery domain (confidence level: 100%)
pt.m4d8q9.ruClearFake payload delivery domain (confidence level: 100%)

URLs 54

http://144.31.221.127:5555/code777KongTuke payload delivery URL (confidence level: 100%)
http://31.14.40.12Unknown malware botnet C2 (confidence level: 100%)
http://31.14.41.25Unknown malware botnet C2 (confidence level: 100%)
http://190.2.146.4Unknown malware botnet C2 (confidence level: 100%)
http://185.165.240.207Unknown malware botnet C2 (confidence level: 100%)
http://89.39.149.230Unknown malware botnet C2 (confidence level: 100%)
http://185.180.221.98Unknown malware botnet C2 (confidence level: 100%)
http://89.39.149.228Unknown malware botnet C2 (confidence level: 100%)
http://185.180.223.142Unknown malware botnet C2 (confidence level: 100%)
http://185.100.235.88Unknown malware botnet C2 (confidence level: 100%)

IP addresses 160

157.250.195.74Unknown malware botnet C2 server (confidence level: 100%)
212.95.55.121Remcos botnet C2 server (confidence level: 100%)
108.174.56.177Remcos botnet C2 server (confidence level: 100%)
47.236.166.45Unknown malware botnet C2 server (confidence level: 100%)
45.141.215.108AsyncRAT botnet C2 server (confidence level: 100%)
64.227.126.87Unknown malware botnet C2 server (confidence level: 100%)
16.62.83.162NetSupportManager RAT botnet C2 server (confidence level: 100%)
40.172.67.160DeimosC2 botnet C2 server (confidence level: 100%)
47.79.95.100Unknown malware botnet C2 server (confidence level: 100%)
161.35.155.3Empire Downloader botnet C2 server (confidence level: 100%)

Hashes 22

838ef0c67d52e6b2eb22b4d80f9b960e1a7a05f78b138ce725088017c0b5832eUnknown Stealer payload (confidence level: 100%)
b3cc7abd90237c1e01a0b427935bcdd0821c40694671a88f2d766e3e9ef79b69Unknown malware payload (confidence level: 90%)
2ad9ff96aca438bfeb8a54fcb6e53f30efa5faa389e52372b4ca2306e7f2cccbUnknown malware payload (confidence level: 90%)
2018690845d5615fb84858ee635342e0cf9e0a359df352f89c02a11e4d6ff2e9Unknown malware payload (confidence level: 90%)
69a39343b65a15e7a7f07c0a123f4336d47d7d3277f177369321fbe348312ffcUnknown malware payload (confidence level: 90%)
c23029f315f2d0063ffaef0cb651cfcf8e39bd4f9d77aefb6a5866d73bf096dbUnknown malware payload (confidence level: 90%)
beaf4d8cab4d8bb64a2a950880e435ec040cc844a1cacc573e613073f55c3606Unknown malware payload (confidence level: 90%)
a02f741d30e33d72c6fdecf0ae1fafa2c44bfd40987a9480c2a11d8f5cd058d4Unknown malware payload (confidence level: 90%)
fc885e8a0a0c726561110aa6f887b377dd43243e3a911b7e1787f641f7c1b90cUnknown malware payload (confidence level: 90%)
03288d08eb6c30a205d8947c0ee0e055a864383b043090280840b0c822e3446fUnknown malware payload (confidence level: 90%)

Description

ThreatFox IOCs for 2025-10-07

Impact

For European organizations, the impact of these ThreatFox IOCs lies mainly in their utility for early detection and threat hunting rather than direct compromise. Since no active exploits or vulnerabilities are reported, the immediate risk of system compromise is low. However, failure to incorporate these indicators into security monitoring could result in missed detection opportunities for malware payload delivery or suspicious network activity. This could indirectly lead to delayed response to emerging threats, increasing the risk of data breaches or operational disruption. Organizations with critical infrastructure or high-value data may face increased risk if adversaries leverage similar indicators for reconnaissance or initial access. The medium severity reflects the potential for these indicators to aid in identifying threats before they escalate, emphasizing the importance of proactive threat intelligence integration.

Defensive guidance

European organizations should integrate the provided ThreatFox IOCs into their Security Information and Event Management (SIEM) systems, intrusion detection/prevention systems (IDS/IPS), and endpoint detection and response (EDR) tools to enhance detection capabilities. Regularly updating threat intelligence feeds and correlating these indicators with internal logs can improve early warning and incident response. Conducting threat hunting exercises focused on payload delivery mechanisms and anomalous network activity patterns related to these IOCs is recommended. Organizations should also ensure robust network segmentation and monitoring of outbound traffic to detect potential data exfiltration attempts. Training security analysts to interpret OSINT-based indicators and incorporate them into operational workflows will improve overall resilience. Since no patches are available, emphasis should be on detection, monitoring, and rapid response rather than remediation of a specific vulnerability.

Community reviews

Loading reviews…