IndicatorPublished 28 Oct 2025Updated 29 Oct 2025

ThreatFox IOCs for 2025-10-28

Source ThreatFox MISP Feed

TLP:WHITE, disclosure is not limited

Indicators of compromise

Domains 334

up.yq-4n.ruClearFake payload delivery domain (confidence level: 100%)
q7m.3jw5u.ruClearFake payload delivery domain (confidence level: 100%)
d6pl.6-19t.ruClearFake payload delivery domain (confidence level: 100%)
we.bo-x2.ruClearFake payload delivery domain (confidence level: 100%)
am.z3-lu.ruClearFake payload delivery domain (confidence level: 100%)
x0p.3jw5u.ruClearFake payload delivery domain (confidence level: 100%)
w2cx.6-19t.ruClearFake payload delivery domain (confidence level: 100%)
i5.ra-9x.ruClearFake payload delivery domain (confidence level: 100%)
n0j.6-19t.ruClearFake payload delivery domain (confidence level: 100%)
xi.ko-8r.ruClearFake payload delivery domain (confidence level: 100%)

URLs 110

http://162.252.198.162:7777/codebase5533KongTuke payload delivery URL (confidence level: 100%)
http://178.17.50.15Stealc botnet C2 (confidence level: 100%)
https://194.50.153.23/9af57c9106bf2c01.phpStealc botnet C2 (confidence level: 50%)
https://server9.ninhaine.com/Glupteba botnet C2 (confidence level: 50%)
https://server11.ninhaine.com/Glupteba botnet C2 (confidence level: 50%)
https://server14.ninhaine.com/Glupteba botnet C2 (confidence level: 50%)
https://pastebin.com/raw/4dsyh9swAsyncRAT botnet C2 (confidence level: 50%)
http://gulfscaffolding.com.sa/mk_sxfds128.binUnknown Loader payload delivery URL (confidence level: 50%)
https://iit.tweethost.com/Vidar botnet C2 (confidence level: 100%)
https://iit.teba-forexport.com/Vidar botnet C2 (confidence level: 100%)

IP addresses 117

62.60.131.193SystemBC botnet C2 server (confidence level: 100%)
62.60.131.194SystemBC botnet C2 server (confidence level: 100%)
62.60.131.185SystemBC botnet C2 server (confidence level: 100%)
62.60.131.202SystemBC botnet C2 server (confidence level: 100%)
62.60.131.197SystemBC botnet C2 server (confidence level: 100%)
62.60.131.183SystemBC botnet C2 server (confidence level: 100%)
62.60.131.200SystemBC botnet C2 server (confidence level: 100%)
62.60.131.192SystemBC botnet C2 server (confidence level: 100%)
62.60.131.188SystemBC botnet C2 server (confidence level: 100%)
62.60.131.181SystemBC botnet C2 server (confidence level: 100%)

Hashes 413

6e1253d3b0368c8e02a778b0406b8b252a727567ValleyRAT payload (confidence level: 95%)
ebc01c36d9377d699159823708e03c9fd17b36f507d752fc193b3233ffd16ed7ValleyRAT payload (confidence level: 95%)
dd9d2444e4923e80025ef3224611d6d7ValleyRAT payload (confidence level: 95%)
14225156b7d2398e06cecce52edbae5792e40955Formbook payload (confidence level: 95%)
c621cdef483f72a72f9e9b3296c85c7c8d064a707dfdd2c11d7fc21d75d123efFormbook payload (confidence level: 95%)
59b45720ffdec913119cabc379980082Formbook payload (confidence level: 95%)
be56283eb946cbf81c7fac7543e2d12590be5760StrelaStealer payload (confidence level: 95%)
54c9a7b2d0118b16cc093ffe52bce2018e15fdee6827cb6deba928d71d67c93cStrelaStealer payload (confidence level: 95%)
12bfbe5fe642a549541282b4c6e06f8eStrelaStealer payload (confidence level: 95%)
62da63ced4a8a425f707deee083b83ac3745bf7cSalatStealer payload (confidence level: 95%)

Description

ThreatFox IOCs for 2025-10-28

Impact

For European organizations, the impact of this threat is currently moderate due to the lack of specific exploit details or active attacks. However, organizations heavily reliant on OSINT tools and network monitoring could face increased risk if the underlying malware or payload delivery mechanisms evolve or are leveraged in targeted campaigns. Potential impacts include unauthorized network access, data exfiltration, or disruption of services if payloads are successfully delivered and executed. The absence of patches or direct mitigation guidance means organizations must rely on proactive detection and response capabilities. The threat could also contribute to broader cyber espionage or cybercrime activities, affecting confidentiality and integrity of sensitive information. The medium severity rating suggests that while immediate damage is unlikely, the threat should not be ignored, especially in sectors with critical infrastructure or sensitive data.

Defensive guidance

European organizations should enhance their network monitoring and threat intelligence integration to detect unusual payload delivery or network activity patterns associated with this threat. Deploying advanced endpoint detection and response (EDR) solutions capable of identifying suspicious behaviors related to malware payloads is recommended. Regularly updating and tuning intrusion detection/prevention systems (IDS/IPS) with the latest threat intelligence feeds, including ThreatFox IOCs, will improve early detection. Organizations should also conduct threat hunting exercises focused on network anomalies and payload delivery vectors. Since no patches are available, emphasis should be placed on segmentation of critical networks, strict access controls, and user awareness training to reduce the risk of successful payload execution. Collaboration with national cybersecurity centers and sharing intelligence within trusted communities can enhance collective defense. Finally, maintaining robust incident response plans to quickly contain and remediate infections is essential.

Community reviews

Loading reviews…