IndicatorPublished 10 Oct 2025Updated 11 Oct 2025

ThreatFox IOCs for 2025-10-10

Source ThreatFox MISP Feed

TLP:WHITE, disclosure is not limited

Indicators of compromise

Domains 529

3kyh9kntiomknv89.iloveanimals.shopUnknown Stealer botnet C2 domain (confidence level: 100%)
cloud.iloveanimals.shopUnknown Stealer botnet C2 domain (confidence level: 100%)
karabuk.kedi.zipUnknown Stealer botnet C2 domain (confidence level: 100%)
xpac.behtunisie.storeVidar botnet C2 domain (confidence level: 100%)
c3lestial.funUnknown RAT botnet C2 domain (confidence level: 100%)
saerw-caesre-scalova.sbsUnknown malware botnet C2 domain (confidence level: 100%)
accounts.aawe.financeUnknown malware botnet C2 domain (confidence level: 100%)
m2.jbffq.ruClearFake payload delivery domain (confidence level: 100%)
h9.o05h.ruClearFake payload delivery domain (confidence level: 100%)
u5.ea-43.ruClearFake payload delivery domain (confidence level: 100%)

URLs 186

http://31.170.22.205/dl404Unknown malware payload delivery URL (confidence level: 75%)
https://195.201.45.92/Vidar botnet C2 (confidence level: 100%)
http://31.170.22.205/dl405Unknown malware payload delivery URL (confidence level: 75%)
https://178.16.53.236:6343/gateway/abutnn0i.dnehdRhadamanthys botnet C2 (confidence level: 100%)
https://openai-pidor-with-ai.com:6343/gateway/abutnn0i.dnehdRhadamanthys botnet C2 (confidence level: 100%)
http://31.170.22.205/dl406Unknown malware payload delivery URL (confidence level: 75%)
http://mjgalumni.org/wp-content/plugins/wp-unlike-disorganization/index.php?r=bd1odhrwczovl2rxcmridi5jb20vLatrodectus payload delivery URL (confidence level: 95%)
https://consolerepairs.org.uk/newsite/wp-content/plugins/wp-databases-antiquated/index.php?r=bd1odhrwczovl2rxcmridi5jb20vLatrodectus payload delivery URL (confidence level: 95%)
https://sarwandhangers.nl/wp-content/plugins/wp-automatically-functionality/index.php?r=bd1odhrwczovl2rxcmridi5jb20vLatrodectus payload delivery URL (confidence level: 95%)
https://mstoursandtravels.com/wp-content/plugins/jivey/jinksanyhowdewans.php?jwesens=proposaltheai325Latrodectus payload delivery URL (confidence level: 95%)

IP addresses 318

198.1.195.210Unknown Stealer botnet C2 server (confidence level: 100%)
213.136.82.168Unknown Stealer botnet C2 server (confidence level: 100%)
144.31.188.134Unknown RAT botnet C2 server (confidence level: 100%)
89.144.20.51Mirai botnet C2 server (confidence level: 100%)
176.46.152.89Mirai botnet C2 server (confidence level: 100%)
47.121.31.109Cobalt Strike botnet C2 server (confidence level: 100%)
178.16.52.74Latrodectus botnet C2 server (confidence level: 100%)
178.16.52.64Latrodectus botnet C2 server (confidence level: 100%)
8.218.177.80GobRAT botnet C2 server (confidence level: 100%)
196.251.115.145Remcos botnet C2 server (confidence level: 100%)

Hashes 216

188305466de4c63032199a7f172d401f1e30df6eRadRAT payload (confidence level: 95%)
843cab5a9f5096b1d31297403abc61031051fef1fd426715d9cbbbe6dbdfc845RadRAT payload (confidence level: 95%)
f23e793cfb638d4f77dc29ad419d4df3RadRAT payload (confidence level: 95%)
6978147f10044d0288fb49213777efbbafc0fff8SalatStealer payload (confidence level: 95%)
b17e76508956b23f81c7ddc584fe45b331a99fde7eb337649e554c43ef6446cbSalatStealer payload (confidence level: 95%)
29eb8469e0b597aef5a0841ab85f61beSalatStealer payload (confidence level: 95%)
3a7dc3b6a891bdb2f9cc7a33a19ebc49d897ff4eNjRAT payload (confidence level: 95%)
ebedfc692b9aa9cff56d0d0fc3960e3608c647521c9287cddf3ab03b08af8120NjRAT payload (confidence level: 95%)
053d760fd3acad06ce0bff5ab5126ba6NjRAT payload (confidence level: 95%)
da9d7ecb7d2f6aeffa2cab57d26aac5aa1d9d1efSalatStealer payload (confidence level: 95%)

Description

ThreatFox IOCs for 2025-10-10

Impact

The impact of this threat on European organizations is currently limited due to the lack of active exploits or specific vulnerabilities. However, the presence of IOCs related to payload delivery and network activity suggests potential reconnaissance or preparatory stages of malware campaigns. If leveraged by threat actors, these IOCs could help identify malicious infrastructure or compromised hosts, enabling early detection and prevention. European organizations with mature security operations centers (SOCs) can integrate these IOCs into their monitoring tools to reduce dwell time and prevent lateral movement. The absence of patches or known exploits means no direct remediation is required, but failure to incorporate these IOCs could result in missed detection opportunities. The medium severity rating reflects a moderate risk that could escalate if these IOCs are linked to emerging malware campaigns. Overall, the threat is more informational, supporting defensive postures rather than indicating imminent compromise.

Defensive guidance

European organizations should incorporate the provided IOCs into their existing threat intelligence platforms, intrusion detection systems (IDS), and security information and event management (SIEM) solutions to enhance detection capabilities. Regularly updating network monitoring rules to identify payload delivery patterns and suspicious network activity aligned with these IOCs is recommended. Conduct proactive threat hunting exercises using the IOCs to identify potential early-stage compromises. Maintain up-to-date asset inventories and network segmentation to limit potential malware spread if payload delivery attempts are detected. Engage in information sharing with trusted partners and national cybersecurity centers to contextualize these IOCs within broader threat landscapes. Since no patches are available, focus on detection and response rather than remediation. Training SOC analysts to recognize behaviors associated with these IOCs can improve incident response times. Finally, ensure endpoint protection solutions are configured to detect and block common malware delivery techniques that may correlate with these indicators.

Community reviews

Loading reviews…