IndicatorPublished 20 Nov 2025Updated 21 Nov 2025

ThreatFox IOCs for 2025-11-20

Source ThreatFox MISP Feed

TLP:WHITE, disclosure is not limited

Indicators of compromise

Domains 202

t4au.deane4y5not.ruClearFake payload delivery domain (confidence level: 100%)
we1iss.test6yvarn1sh.ruClearFake payload delivery domain (confidence level: 100%)
be2rg.test6yvarn1sh.ruClearFake payload delivery domain (confidence level: 100%)
fl3uss.test6yvarn1sh.ruClearFake payload delivery domain (confidence level: 100%)
li2cht.aphrh1tc4h.ruClearFake payload delivery domain (confidence level: 100%)
qu1arz.aphrh1tc4h.ruClearFake payload delivery domain (confidence level: 100%)
e1is.aphrh1tc4h.ruClearFake payload delivery domain (confidence level: 100%)
st3eg.aphrh1tc4h.ruClearFake payload delivery domain (confidence level: 100%)
ethupdate.topUnknown Stealer botnet C2 domain (confidence level: 100%)
ha1in.rec1aimswal1.ruClearFake payload delivery domain (confidence level: 100%)

URLs 18

http://qreenmaple.com/baba/baba1/fre.phpLoki Password Stealer (PWS) botnet C2 (confidence level: 100%)
https://telegram.me/dead1cfVidar botnet C2 (confidence level: 75%)
https://gjt.wallyapp.xyz/Vidar botnet C2 (confidence level: 100%)
https://fra.wallyapp.xyz/Vidar botnet C2 (confidence level: 100%)
https://gjt.nigeriaafricatime.com/Vidar botnet C2 (confidence level: 100%)
http://180.93.239.176/Hook botnet C2 (confidence level: 50%)
http://91.92.240.190/fbfde0da45a9450b.phpStealc botnet C2 (confidence level: 50%)
https://14.128.53.148:8888/Unknown malware botnet C2 (confidence level: 50%)
https://petitesalope.com/5t6t.jsKongTuke payload delivery URL (confidence level: 100%)
https://petitesalope.com/js.phpKongTuke payload delivery URL (confidence level: 100%)

IP addresses 139

193.25.217.13Mirai botnet C2 server (confidence level: 100%)
95.63.135.121Unknown malware botnet C2 server (confidence level: 100%)
45.88.186.191Remcos botnet C2 server (confidence level: 100%)
143.110.187.124Hook botnet C2 server (confidence level: 100%)
47.84.30.113Cobalt Strike botnet C2 server (confidence level: 100%)
155.102.175.138Cobalt Strike botnet C2 server (confidence level: 75%)
155.102.181.184Cobalt Strike botnet C2 server (confidence level: 75%)
156.234.101.164Cobalt Strike botnet C2 server (confidence level: 75%)
163.181.228.146Cobalt Strike botnet C2 server (confidence level: 75%)
43.159.99.39Cobalt Strike botnet C2 server (confidence level: 75%)

Hashes 213

a661be6f1fa66f07a4d2a62d43585303b5adc3130761c2585bbd8c31f878fcd2Unknown Stealer payload (confidence level: 100%)
c4a21f0dd51b921239c63dc447cf5c776df68aabde83a78908353d6b7ca05982Unknown Stealer payload (confidence level: 100%)
43e141ee2c3a4981c0afc6c23899073b65d594f5c5216c7ca078a39299f1f8d8Unknown Stealer payload (confidence level: 100%)
fd235bd0c5167cc384ddd9b5b1026da41cfe020aRedLine Stealer payload (confidence level: 95%)
8bb5d2b02382bada9e89319fc4052144ba9e3dfc07bec8748e62eddc821ff993RedLine Stealer payload (confidence level: 95%)
a19ed03fd2cc1453e373bbc88debcb5aRedLine Stealer payload (confidence level: 95%)
f6ead5715c132435ea5ff5690612b475419b985bMASS Logger payload (confidence level: 95%)
00597e762d01342c2760be2b5d76b870a127f10cfc8184b8c0fb82d3619ff365MASS Logger payload (confidence level: 95%)
21acc271e9be7ebbbeb36a28a86c2d89MASS Logger payload (confidence level: 95%)
467e3379acee968daa39e97fd58188df4a055c4dRedLine Stealer payload (confidence level: 95%)

Description

ThreatFox IOCs for 2025-11-20

Impact

For European organizations, the impact of this threat is currently moderate due to the lack of active exploitation and specific targeting information. However, the presence of network activity and payload delivery indicators means that organizations with exposed network services or insufficient network monitoring could be at risk of malware infections or data interception. Critical infrastructure, financial institutions, and large enterprises that rely heavily on networked systems and threat intelligence sharing platforms may experience increased exposure if these IOCs correlate with emerging attack campaigns. The absence of patches or direct exploits limits immediate damage but also means that detection and response capabilities are crucial to mitigate potential infections. The threat could lead to confidentiality breaches if payloads are designed for data exfiltration or integrity issues if destructive malware is delivered. Availability impacts are less likely unless the payloads include ransomware or denial-of-service components, which are not explicitly indicated here. Overall, the threat underscores the importance of proactive network monitoring and threat intelligence integration to reduce exposure and respond swiftly to emerging malware activities.

Defensive guidance

European organizations should integrate the ThreatFox IOCs into their existing security information and event management (SIEM) systems and intrusion detection/prevention systems (IDS/IPS) to enhance detection of related network activity and payload delivery attempts. Network segmentation and strict access controls should be enforced to limit lateral movement in case of infection. Regularly updating and tuning network monitoring tools to detect anomalous traffic patterns associated with these IOCs will improve early warning capabilities. Organizations should also participate in threat intelligence sharing communities to receive timely updates and contextual information. Conducting threat hunting exercises focused on the indicators and related network behaviors can help identify potential compromises early. Since no patches are available, emphasis should be placed on endpoint protection, network traffic analysis, and user awareness training to recognize phishing or social engineering attempts that may deliver payloads. Incident response plans should be reviewed and tested to ensure readiness for malware containment and eradication. Finally, organizations should maintain up-to-date backups and verify their integrity to mitigate potential data loss from malware payloads.

Community reviews

Loading reviews…