IndicatorPublished 16 Oct 2025Updated 17 Oct 2025

ThreatFox IOCs for 2025-10-16

Source ThreatFox MISP Feed

TLP:WHITE, disclosure is not limited

Indicators of compromise

Domains 200

www.slickwebads.comUnknown RAT botnet C2 domain (confidence level: 100%)
b.4y2o5.ruClearFake payload delivery domain (confidence level: 100%)
q1n.4y2o5.ruClearFake payload delivery domain (confidence level: 100%)
a.1o6y4.ruClearFake payload delivery domain (confidence level: 100%)
n3.1o6y4.ruClearFake payload delivery domain (confidence level: 100%)
zc.1o6y4.ruClearFake payload delivery domain (confidence level: 100%)
t1.1o6y4.ruClearFake payload delivery domain (confidence level: 100%)
x.1o6y4.ruClearFake payload delivery domain (confidence level: 100%)
h7.1o6y4.ruClearFake payload delivery domain (confidence level: 100%)
p9.1o6y4.ruClearFake payload delivery domain (confidence level: 100%)

URLs 17

https://176.46.141.5/gateway/4hl0nqt9.0rlraRhadamanthys botnet C2 (confidence level: 100%)
http://78.90.248.149:2862/.iUnknown malware payload delivery URL (confidence level: 75%)
http://198.251.84.9Stealc botnet C2 (confidence level: 100%)
http://107.189.17.242/7a86d8aa76374f16.phpStealc botnet C2 (confidence level: 50%)
https://p.d.myolt.my.id/Vidar botnet C2 (confidence level: 100%)
https://p.d.compuegypt.net/Vidar botnet C2 (confidence level: 100%)
https://pastebin.com/ynmkkhlrCoinminer payload delivery URL (confidence level: 100%)
https://pastebin.com/raw/ynmkkhlrCoinminer payload delivery URL (confidence level: 100%)
https://gitlab.com/bebra81/bebraprime/-/raw/main/cheatupd.exeUmbral payload delivery URL (confidence level: 100%)
https://gitlab.com/bebra81/bebraprime/-/raw/main/bypasserupd.exeCoinminer payload delivery URL (confidence level: 100%)

IP addresses 99

196.251.86.238zgRAT botnet C2 server (confidence level: 75%)
117.72.214.50Cobalt Strike botnet C2 server (confidence level: 100%)
193.26.115.160Remcos botnet C2 server (confidence level: 100%)
212.192.13.63Unknown malware botnet C2 server (confidence level: 100%)
139.224.103.68Unknown malware botnet C2 server (confidence level: 100%)
172.94.111.194AsyncRAT botnet C2 server (confidence level: 100%)
137.74.43.218Unknown malware botnet C2 server (confidence level: 100%)
165.232.168.59Havoc botnet C2 server (confidence level: 100%)
165.232.168.59Havoc botnet C2 server (confidence level: 100%)
43.204.24.54NetSupportManager RAT botnet C2 server (confidence level: 100%)

Hashes 164

3d37edeb86f1be3abbab989e2419667655281e27caa67ff26e7a4f64237ef891Unknown Stealer payload (confidence level: 100%)
65036efbb6befc29d27ef1ab26344428Unknown Stealer payload (confidence level: 100%)
108814bbc9e12fc6407258ae1330f5cf189b9a48Nanocore RAT payload (confidence level: 95%)
ac7c3c0c3906c4d93e34b91fa34941277f044ac26d037c113c9756a4f18619ddNanocore RAT payload (confidence level: 95%)
d93fc3df442b53a288ba0a379f542a66Nanocore RAT payload (confidence level: 95%)
12e00cf3e7398108497f6c4456eaafc71e0ea178Agent Tesla payload (confidence level: 95%)
436c3122ade820817ca6b87ae7b69a45f68df50af5bb193acace508e78904283Agent Tesla payload (confidence level: 95%)
46b86269771272c888d31f6782ae3797Agent Tesla payload (confidence level: 95%)
5eacba2d117350cd3795b5007e8a04ef8366894fXWorm payload (confidence level: 95%)
5228cdea84a04c9047fd321efcde0b729a7b2fb036328f8c68c4379ea50c9f9aXWorm payload (confidence level: 95%)

Description

ThreatFox IOCs for 2025-10-16

Impact

For European organizations, the direct impact of this threat intelligence feed is limited as it does not describe an active exploit or vulnerability. However, the shared IOCs can enhance detection and response capabilities by informing security teams about emerging malware behaviors and network activity patterns. Organizations relying on threat intelligence to tune their security monitoring tools, such as SIEMs and IDS/IPS, can improve their ability to identify and mitigate potential payload delivery attempts. The medium severity rating suggests a moderate risk level, emphasizing the importance of maintaining updated threat intelligence and proactive network monitoring. Failure to integrate such OSINT data could result in delayed detection of malware campaigns or payload delivery mechanisms, potentially leading to data breaches or service disruptions. The lack of patches or direct remediation steps means that impact mitigation relies heavily on operational security measures rather than software fixes.

Defensive guidance

European organizations should prioritize the integration of ThreatFox and similar OSINT feeds into their security operations centers (SOCs) and threat intelligence platforms to enhance early detection of malicious network activity and payload delivery attempts. Implement advanced network monitoring and anomaly detection systems capable of leveraging IOCs for real-time alerts. Regularly update and tune intrusion detection and prevention systems (IDS/IPS) with the latest threat intelligence to identify suspicious traffic patterns. Conduct threat hunting exercises using the provided IOCs to proactively identify potential compromises. Enhance employee awareness and training on recognizing phishing and social engineering tactics that may be used to deliver payloads. Establish robust incident response procedures to quickly contain and remediate detected threats. Collaborate with national and European cybersecurity information sharing organizations to stay informed about evolving threats and mitigation strategies. Since no patches are available, focus on defense-in-depth strategies including network segmentation, endpoint protection, and strict access controls to limit potential attack surfaces.

Community reviews

Loading reviews…