IndicatorPublished 17 Nov 2025Updated 18 Nov 2025

ThreatFox IOCs for 2025-11-17

Source ThreatFox MISP Feed

TLP:WHITE, disclosure is not limited

Indicators of compromise

Domains 178

recenjc.qponLumma Stealer botnet C2 domain (confidence level: 75%)
familjw.qponLumma Stealer botnet C2 domain (confidence level: 75%)
account-captchapulse.comUnknown malware payload delivery domain (confidence level: 100%)
mijkar.comUnknown malware payload delivery domain (confidence level: 100%)
account-extranetpulse.comUnknown malware payload delivery domain (confidence level: 100%)
account-partner.comUnknown malware payload delivery domain (confidence level: 100%)
account-captchapulse.infoUnknown malware payload delivery domain (confidence level: 100%)
sonyarafferty.comUnknown malware payload delivery domain (confidence level: 100%)
civicleague.netUnknown malware payload delivery domain (confidence level: 100%)
ommanilegend.comUnknown malware botnet C2 domain (confidence level: 100%)

URLs 41

http://194.38.20.95/3Phorpiex payload delivery URL (confidence level: 100%)
https://mijkar.com/m.txtUnknown malware payload delivery URL (confidence level: 100%)
https://account-captchapulse.comUnknown malware payload delivery URL (confidence level: 100%)
https://mijkar.com/j.txtUnknown malware payload delivery URL (confidence level: 100%)
https://account-extranetpulse.comUnknown malware payload delivery URL (confidence level: 100%)
https://account-partner.comUnknown malware payload delivery URL (confidence level: 100%)
https://account-captchapulse.infoUnknown malware payload delivery URL (confidence level: 100%)
https://sonyarafferty.comUnknown malware payload delivery URL (confidence level: 100%)
https://civicleague.netUnknown malware payload delivery URL (confidence level: 100%)
https://www.valley-of-butterflies.com/Unknown malware payload delivery URL (confidence level: 90%)

IP addresses 127

38.55.205.55Cobalt Strike botnet C2 server (confidence level: 100%)
8.136.232.24Sliver botnet C2 server (confidence level: 90%)
52.230.7.104Unknown malware botnet C2 server (confidence level: 100%)
103.60.12.64AsyncRAT botnet C2 server (confidence level: 100%)
195.54.171.5Hook botnet C2 server (confidence level: 100%)
213.209.143.26MooBot botnet C2 server (confidence level: 100%)
38.14.248.143Unknown malware botnet C2 server (confidence level: 100%)
47.236.136.195Unknown malware botnet C2 server (confidence level: 100%)
68.211.123.231Unknown malware botnet C2 server (confidence level: 100%)
158.160.80.59Unknown malware botnet C2 server (confidence level: 100%)

Hashes 154

0d32cf02611a158e4d9a955d13f26680db836e3eValleyRAT payload (confidence level: 95%)
608639e4b592cfdcc7d6bf3de6e6bd38e70c61f4e07bc9f47ed3fb3dbfae8c21ValleyRAT payload (confidence level: 95%)
14521699f0184011a3f083ddfbbb0bcaValleyRAT payload (confidence level: 95%)
93a0ed12ed7dc5f3f0ba82428a39b6c023d4e4b5AsyncRAT payload (confidence level: 95%)
41b2688b753738f8fe179c6517535fece2e4d22ddf52b6449635413056854cb6AsyncRAT payload (confidence level: 95%)
00e6d9c2ad3639de819e5fa8473cfc42AsyncRAT payload (confidence level: 95%)
2f90a4ec18c2597debdd5610aa3a3922f17d195cLuca Stealer payload (confidence level: 95%)
68bfdc8e5485211e4a6b409d266c98f1f18fb2b5ac06c0b2b83fb724a03ab319Luca Stealer payload (confidence level: 95%)
9149b449a89f24ebbc726c996a471ccfLuca Stealer payload (confidence level: 95%)
cfc5bfa40595fc7bc77cfd163a9ad2559a85d5f0Luca Stealer payload (confidence level: 95%)

Description

ThreatFox IOCs for 2025-11-17

Impact

For European organizations, the impact of this threat is primarily in the domain of situational awareness and detection readiness. Since no active exploits or vulnerabilities are identified, the immediate risk to confidentiality, integrity, or availability is limited. However, failure to incorporate these IOCs into security monitoring could result in missed detection of malware infections or network intrusions that use similar payload delivery techniques or network behaviors. Organizations with critical infrastructure or high-value data assets could face increased risk if these IOCs correspond to emerging malware campaigns targeting their sectors. The medium severity suggests moderate potential for operational disruption or data compromise if the threat actors leverage these indicators effectively. The absence of patches or direct exploitation means that mitigation relies heavily on proactive detection and response capabilities rather than vulnerability remediation. European entities with mature cybersecurity programs will benefit most by updating their threat intelligence repositories and tuning detection systems accordingly.

Defensive guidance

European organizations should integrate the ThreatFox IOCs into their Security Information and Event Management (SIEM) systems, Endpoint Detection and Response (EDR) tools, and network monitoring solutions to enhance detection of related malware activities. Regularly updating threat intelligence feeds and correlating these IOCs with internal logs can help identify early signs of compromise. Conducting threat hunting exercises focused on payload delivery and suspicious network activity patterns aligned with these IOCs is recommended. Organizations should also ensure that their incident response teams are familiar with the indicators and prepared to investigate alerts triggered by them. Since no patches are available, emphasis should be placed on network segmentation, least privilege access controls, and robust logging to limit potential malware spread. Collaboration with national Computer Emergency Response Teams (CERTs) and sharing findings can improve collective defense. Finally, maintaining user awareness about phishing and social engineering, common malware delivery vectors, remains a critical complementary measure.

Community reviews

Loading reviews…