IndicatorPublished 15 Oct 2025Updated 16 Oct 2025

ThreatFox IOCs for 2025-10-15

Source ThreatFox MISP Feed

TLP:WHITE, disclosure is not limited

Indicators of compromise

Domains 151

prixmatech.comKongTuke payload delivery domain (confidence level: 100%)
fsafasjasgia.liveSalatStealer botnet C2 domain (confidence level: 100%)
196dot247dot163dot8.webrat.inSalatStealer botnet C2 domain (confidence level: 100%)
store.alignfrisco.comFAKEUPDATES botnet C2 domain (confidence level: 100%)
pox.ibzr-2.ruClearFake payload delivery domain (confidence level: 100%)
h7lp.vorn5.ruClearFake payload delivery domain (confidence level: 100%)
www.6119.com.cnCobalt Strike botnet C2 domain (confidence level: 75%)
ss.cybiz.ggff.netUnknown malware botnet C2 domain (confidence level: 100%)
address-buffer.gl.at.ply.ggRedLine Stealer botnet C2 domain (confidence level: 100%)
prakashjadhav.dynu.netAsyncRAT botnet C2 domain (confidence level: 50%)

URLs 39

https://prixmatech.com/5r7h.jsKongTuke payload delivery URL (confidence level: 100%)
http://144.31.221.84:5555/code777KongTuke payload delivery URL (confidence level: 100%)
http://87.120.165.1:1448/loginUnknown Stealer botnet C2 (confidence level: 100%)
http://87.120.165.1:1448/uploadUnknown Stealer botnet C2 (confidence level: 100%)
http://87.120.165.1:1337/libs.exeUnknown Stealer payload delivery URL (confidence level: 100%)
https://prixmatech.com/js.phpKongTuke payload delivery URL (confidence level: 100%)
https://vale-sanete-investment.sbs/fkstkUnknown Stealer botnet C2 (confidence level: 100%)
https://vale-sanete-investment.sbs/uploadfileUnknown Stealer botnet C2 (confidence level: 100%)
https://vale-sanete-investment.sbs/browserinfoUnknown Stealer botnet C2 (confidence level: 100%)
https://vale-sanete-investment.sbs/browsersdynamicUnknown Stealer botnet C2 (confidence level: 100%)

IP addresses 114

51.79.62.93Nanocore RAT botnet C2 server (confidence level: 75%)
210.21.11.212Cobalt Strike botnet C2 server (confidence level: 100%)
113.47.146.242Cobalt Strike botnet C2 server (confidence level: 100%)
178.16.55.18Latrodectus botnet C2 server (confidence level: 100%)
178.16.55.30Latrodectus botnet C2 server (confidence level: 100%)
192.159.99.171Remcos botnet C2 server (confidence level: 100%)
193.26.115.230Remcos botnet C2 server (confidence level: 100%)
45.88.186.177Remcos botnet C2 server (confidence level: 100%)
185.110.191.88Sliver botnet C2 server (confidence level: 100%)
31.42.127.229Unknown malware botnet C2 server (confidence level: 100%)

Hashes 204

34784175788212bc73886e63406b2e065b5a5fa8Agent Tesla payload (confidence level: 95%)
b6435d167628a91820c8440d2fbf10fe6f823e64c33a597eca56021322c47bb4Agent Tesla payload (confidence level: 95%)
623f50ad88aa92d583259a29fe5f9354Agent Tesla payload (confidence level: 95%)
2c4f6adb00fd49552d2e7030ff255ad3bd6b97ddFormbook payload (confidence level: 95%)
65140ae2ddd1e19e3dcdd80ad3b6bd652e7388334e1bd1c526486a12b25df026Formbook payload (confidence level: 95%)
e8c3cf465dcd453a10cea3158132ffb0Formbook payload (confidence level: 95%)
a773f2999ab7b108ca4ae31c8ef0b844992a0a0eCoinminer payload (confidence level: 95%)
88db7224a27c32a9c8e5b12e7be3204d483d2e1dcdd7038ca2d9e553de4a397bCoinminer payload (confidence level: 95%)
36dafaed8ee9d0258aba8180c4be7b0fCoinminer payload (confidence level: 95%)
62d4f06e5066eb90ade757ef0bbfba8fcaca956bLuca Stealer payload (confidence level: 95%)

Description

ThreatFox IOCs for 2025-10-15

Impact

For European organizations, the impact of this threat is currently moderate due to the lack of known active exploits and unspecified affected products. However, the presence of malware-related IOCs focused on payload delivery and network activity suggests potential risks of intrusion attempts or malware infections if these IOCs are leveraged by attackers. Organizations relying heavily on OSINT tools or those with extensive network exposure may face increased risk of detection evasion or targeted payload delivery. The threat could lead to unauthorized access, data exfiltration, or disruption if exploited, but the absence of patches or known exploits indicates that immediate operational impact is limited. The medium severity rating reflects a balanced risk profile where vigilance and proactive monitoring are warranted but no urgent crisis response is required.

Defensive guidance

European organizations should integrate the provided IOCs into their security monitoring and detection systems such as SIEMs, IDS/IPS, and endpoint protection platforms to enhance visibility of potential malicious activity. Network traffic analysis should be intensified to detect unusual payload delivery attempts or suspicious network behavior. Regular threat intelligence updates from feeds like ThreatFox should be incorporated to maintain awareness of emerging indicators. Organizations should also conduct targeted OSINT tool security reviews to ensure these tools are not exploited as attack vectors. Network segmentation and strict access controls can limit the impact of any successful payload delivery. Since no patches are available, emphasis should be on detection, containment, and incident response readiness. Employee awareness training on recognizing phishing or social engineering attempts related to payload delivery can further reduce risk.

Community reviews

Loading reviews…