IndicatorPublished 8 Oct 2025Updated 9 Oct 2025

type osint · ThreatFox IOCs for 2025-10-08

Affects type osintSource ThreatFox MISP Feed

TLP:WHITE, disclosure is not limited

Indicators of compromise

Domains 160

pc.w9k6m9.ruClearFake payload delivery domain (confidence level: 100%)
x2j.w9k6m9.ruClearFake payload delivery domain (confidence level: 100%)
bq.w9k6m9.ruClearFake payload delivery domain (confidence level: 100%)
r9.w9k6m9.ruClearFake payload delivery domain (confidence level: 100%)
t1n.w9k6m9.ruClearFake payload delivery domain (confidence level: 100%)
s.w5j7z0.ruClearFake payload delivery domain (confidence level: 100%)
h1.w5j7z0.ruClearFake payload delivery domain (confidence level: 100%)
c8.w5j7z0.ruClearFake payload delivery domain (confidence level: 100%)
v2.b-9lyb.ruClearFake payload delivery domain (confidence level: 100%)
1m.w5j7z0.ruClearFake payload delivery domain (confidence level: 100%)

URLs 62

http://221.15.20.128:40397/bin.shMozi payload delivery URL (confidence level: 80%)
https://ah.cpc8u.ru/qdhln3x7rd.md5ClearFake payload delivery URL (confidence level: 80%)
https://ah.cpc8u.ru/ci1jw6kja2.md5ClearFake payload delivery URL (confidence level: 80%)
http://182.124.167.221:56843/bin.shMozi payload delivery URL (confidence level: 80%)
https://ah.cpc8u.ru/nz6zq7l9cj.md5ClearFake payload delivery URL (confidence level: 80%)
https://y.x-6kox.ru/emkj9xt8xu.shClearFake payload delivery URL (confidence level: 80%)
http://175.151.103.232:56245/iMozi payload delivery URL (confidence level: 80%)
https://www.offshorereview.com/wp-admin/includes/noop.phpAsyncRAT botnet C2 (confidence level: 75%)
https://offshorereview.com/wp-admin/includes/noop.phpAsyncRAT botnet C2 (confidence level: 75%)
http://221.15.20.128:40397/iMozi payload delivery URL (confidence level: 80%)

IP addresses 170

46.77.52.190Loki Password Stealer (PWS) botnet C2 server (confidence level: 75%)
178.16.54.50Latrodectus botnet C2 server (confidence level: 100%)
128.90.106.61Remcos botnet C2 server (confidence level: 100%)
172.111.131.105Remcos botnet C2 server (confidence level: 100%)
145.223.116.113Sliver botnet C2 server (confidence level: 100%)
45.88.186.244AsyncRAT botnet C2 server (confidence level: 100%)
13.49.46.153Unknown malware botnet C2 server (confidence level: 100%)
188.166.182.197Unknown malware botnet C2 server (confidence level: 100%)
102.117.166.42Unknown malware botnet C2 server (confidence level: 100%)
185.95.156.22Hook botnet C2 server (confidence level: 100%)

Hashes 206

8eda75513c1913c0c8ce78215f2b5409c7cf909060a6898c7eb27ef67c78292cXWorm payload (confidence level: 90%)
cb7e336655e985361f6e1bda1e2b95bfab1eb27375c75c057f6ff29cc5f5cf22Unknown malware payload (confidence level: 90%)
b1376545c191242b2daff8f4c32a26f02b1b61df872e58173f9f53a3ec41d602Unknown malware payload (confidence level: 90%)
6bbc953eb5d0d660c75ddc2659d68fc2966e498e4baa2e9c6762527f71f383f7Unknown malware payload (confidence level: 90%)
774d12343b6973ab181ad9bc44043add84166d290ad4f8742ac924a22faeb773Unknown malware payload (confidence level: 90%)
0a4eb013779b9ac2c2bd3b57c2961f5eca3db4119b5b28b7a01cf4e324950939Unknown malware payload (confidence level: 90%)
d588897a66ca5f848f83f47734f4a1bc6dd80b0160d5c47e37fcc54660b66c55Unknown malware payload (confidence level: 90%)
1e088391109d45d0365b4750088ad5343496e06f5520db44c2144cc17c450ba0Unknown malware payload (confidence level: 90%)
b8f47151ed29fbcf8d9aec9e1b3e3a187de9f1130d0b16213e0001d48c9f1648XWorm payload (confidence level: 90%)
5f29a44082777948c77009b37df18b6a8f16233115bc0efc269db93b73955c39Amadey payload (confidence level: 90%)

Description

ThreatFox IOCs for 2025-10-08

Impact

For European organizations, the impact of this threat is primarily related to the potential for improved detection and response rather than direct compromise. Since no active exploits or vulnerabilities are detailed, the immediate risk of data breach, system compromise, or service disruption is low. However, failure to incorporate these IOCs into security monitoring could result in missed detection opportunities for malware payload delivery attempts or suspicious network activities. Organizations heavily reliant on network security monitoring and threat intelligence platforms will benefit most from integrating this data. The medium severity suggests that while the threat is not critical, it should not be ignored, especially in sectors with high exposure to cyber threats such as finance, critical infrastructure, and government. The lack of patches or fixes means that defensive measures must focus on detection, network segmentation, and incident response preparedness. Overall, the impact is mitigated by proactive intelligence use but could escalate if these IOCs correlate with emerging active threats.

Defensive guidance

1. Integrate the provided ThreatFox IOCs into existing Security Information and Event Management (SIEM) systems and threat intelligence platforms to enhance detection capabilities. 2. Conduct regular network traffic analysis focusing on payload delivery patterns and suspicious network activity as indicated by the IOCs. 3. Employ advanced endpoint detection and response (EDR) tools configured to recognize behaviors associated with the malware types referenced. 4. Maintain updated threat intelligence feeds and ensure security teams are trained to interpret and act on OSINT data effectively. 5. Implement network segmentation to limit potential lateral movement if malware is detected. 6. Establish robust incident response procedures that include validation and investigation of alerts triggered by these IOCs. 7. Collaborate with national cybersecurity centers and information sharing groups to contextualize these IOCs within broader threat landscapes. 8. Since no patches are available, focus on hardening systems against common exploitation techniques and ensure all software is up to date to reduce attack surface. 9. Regularly review and update firewall and intrusion detection/prevention system (IDS/IPS) rules to incorporate new threat intelligence. 10. Promote user awareness about phishing and social engineering tactics that often accompany payload delivery.

Community reviews

Loading reviews…