IndicatorPublished 26 Oct 2025Updated 27 Oct 2025

ThreatFox IOCs for 2025-10-26

Source ThreatFox MISP Feed

TLP:WHITE, disclosure is not limited

Indicators of compromise

Domains 247

banjuyj.asiaLumma Stealer botnet C2 domain (confidence level: 75%)
blasttw.asiaLumma Stealer botnet C2 domain (confidence level: 75%)
brothdy.asiaLumma Stealer botnet C2 domain (confidence level: 75%)
cutke.asiaLumma Stealer botnet C2 domain (confidence level: 75%)
cracka.asiaLumma Stealer botnet C2 domain (confidence level: 75%)
illuyxka.asiaLumma Stealer botnet C2 domain (confidence level: 75%)
pseuyms.asiaLumma Stealer botnet C2 domain (confidence level: 75%)
senegmx.asiaLumma Stealer botnet C2 domain (confidence level: 75%)
swepois.asiaLumma Stealer botnet C2 domain (confidence level: 75%)
tangebg.asiaLumma Stealer botnet C2 domain (confidence level: 75%)

URLs 33

https://webrat.top/panel/SalatStealer botnet C2 (confidence level: 50%)
https://www.browse-health-insurance-plans.unitedhealthcare-group.uhc-com.vision-solution.top/medicare-plans/?id=ufbs4nyxhcjzuuvjXWorm payload delivery URL (confidence level: 50%)
https://www.browse-health-insurance-plans.unitedhealthcare-group.uhc-com.vision-solution.top/medicare-plans/?id=awn4fdshadhwbsitXWorm payload delivery URL (confidence level: 50%)
https://reddesignandprint.co.uk/huc/?id=dutp02wdyqhvrinvXWorm payload delivery URL (confidence level: 50%)
https://server11.nisdably.com/Glupteba botnet C2 (confidence level: 50%)
https://dn.logllilssyou.mydns.bz/Kimsuky botnet C2 (confidence level: 50%)
https://pastebin.com/raw/jijqj12gAsyncRAT botnet C2 (confidence level: 50%)
https://stackoverflow.com/q/2152978/23354Unknown Loader botnet C2 (confidence level: 50%)
https://k9toothsolutions.com/Unknown malware payload delivery URL (confidence level: 50%)
https://ate.qen9.ru/wfe0ddqnUnknown malware payload delivery URL (confidence level: 50%)

IP addresses 112

91.151.95.13Mirai botnet C2 server (confidence level: 80%)
94.156.152.237Mirai botnet C2 server (confidence level: 80%)
81.88.18.108Mirai botnet C2 server (confidence level: 80%)
160.238.13.201Mirai botnet C2 server (confidence level: 80%)
195.74.93.158Loki Password Stealer (PWS) botnet C2 server (confidence level: 75%)
139.159.149.202Cobalt Strike botnet C2 server (confidence level: 100%)
196.251.83.89Cobalt Strike botnet C2 server (confidence level: 100%)
65.21.115.33Sliver botnet C2 server (confidence level: 90%)
220.246.201.233Unknown malware botnet C2 server (confidence level: 100%)
129.151.240.2Unknown malware botnet C2 server (confidence level: 100%)

Hashes 27

c0ccd705314d4c791edfee20ef9f99e056dc82775a42edd8653668a492b72a11Unknown Stealer payload (confidence level: 50%)
4e7660325701673b85065776b896c2cbbccc5d012022529956e127985726768bValleyRAT payload (confidence level: 100%)
105e8235a126ab0558e3979eda8bf9fd39f05f347b5470fe023b7338d1ad243fValleyRAT payload (confidence level: 100%)
46ee3acfa3837c39eabf397df4f382cf9937492d3cb00373c1428100d3858d33ValleyRAT payload (confidence level: 100%)
c1f4aa25f2e5d579f17a3ed7e2157c4514dc2979a6faef5343390e0851fa8df1ValleyRAT payload (confidence level: 100%)
0469a101d4ecca37f34552f4bf68266675838bef4f052fbe46818635ddd966c0ValleyRAT payload (confidence level: 100%)
45480fa93f1590db7bff99cf223abba8adae6715c3089c5814a826fe1fe0f5a0ValleyRAT payload (confidence level: 100%)
7fee87f4a7c83c63208c554cd3ff9b8bae5f94a76c8be8507dcf016834c73544ValleyRAT payload (confidence level: 100%)
f190ac6d127ce4a8b6d4703b7979425149bee7c0a705fa532a44f9c1b7c04054ValleyRAT payload (confidence level: 100%)
0a8cb617196f4aa7ae49fadc1edd86b4c71cf21307bc959a47040fdf2db705c9Unknown Stealer payload (confidence level: 75%)

Description

ThreatFox IOCs for 2025-10-26

Impact

For European organizations, the impact of this threat is currently limited due to the absence of specific exploits or targeted vulnerabilities. The primary value lies in the intelligence provided by the IOCs, which can enhance detection capabilities for malware-related network activity and payload delivery attempts. Organizations that rely heavily on OSINT and threat intelligence feeds can use this information to update their detection rules and improve situational awareness. However, without concrete exploit details or affected products, the direct risk to confidentiality, integrity, or availability remains low to medium. The threat could potentially serve as an early warning for emerging malware campaigns, so failure to incorporate such intelligence might delay detection of future attacks. Overall, the impact is more strategic and preparatory rather than immediate operational disruption.

Defensive guidance

European organizations should integrate the ThreatFox IOCs into their existing Security Information and Event Management (SIEM) systems and threat intelligence platforms to enhance detection of related network activity and payload delivery attempts. Regularly updating and tuning intrusion detection/prevention systems (IDS/IPS) with these IOCs can improve early warning capabilities. Organizations should maintain rigorous network monitoring and anomaly detection to identify suspicious activities that align with the shared indicators. Collaboration with national and European cybersecurity centers (e.g., ENISA) to share and receive updated intelligence will strengthen collective defense. Since no patches or direct fixes are available, emphasis should be on proactive detection, incident response readiness, and user awareness training to recognize potential malware delivery vectors. Additionally, organizations should validate and enrich these IOCs with other threat intelligence sources to improve context and relevance.

Community reviews

Loading reviews…