IndicatorPublished 23 Nov 2025Updated 24 Nov 2025

ThreatFox IOCs for 2025-11-23

Source ThreatFox MISP Feed

TLP:WHITE, disclosure is not limited

Indicators of compromise

Domains 378

data.womensoundoff.comQuasar RAT botnet C2 domain (confidence level: 75%)
data.xoilacv.acQuasar RAT botnet C2 domain (confidence level: 75%)
data.xoilaczzzhz.tvQuasar RAT botnet C2 domain (confidence level: 75%)
data.xoilaczzzmz.tvQuasar RAT botnet C2 domain (confidence level: 75%)
dcfl.cn.comQuasar RAT botnet C2 domain (confidence level: 75%)
ddos.womensoundoff.comQuasar RAT botnet C2 domain (confidence level: 75%)
ddos.xoilacv.acQuasar RAT botnet C2 domain (confidence level: 75%)
ddos.xoilaczzzhz.tvQuasar RAT botnet C2 domain (confidence level: 75%)
ddos.xoilaczzzmz.tvQuasar RAT botnet C2 domain (confidence level: 75%)
hostdgg.ddns.netQuasar RAT botnet C2 domain (confidence level: 75%)

URLs 28

https://prepstarcenter.com/app/linux.binXMRIG payload delivery URL (confidence level: 100%)
https://raw.githubusercontent.com/whereveryouare666/linuxsys/refs/heads/main/linux.binXMRIG payload delivery URL (confidence level: 100%)
http://43.98.175.8:8888/supershell/login/Unknown malware botnet C2 (confidence level: 100%)
http://seekerdoxg.temp.swtest.ru/securedatalifelocal.phpDCRat botnet C2 (confidence level: 100%)
https://lacuobl.cyou/apiLumma Stealer botnet C2 (confidence level: 100%)
https://www.nycdesignco.webexploride.us/Unknown malware payload delivery URL (confidence level: 90%)
http://47.237.171.208:8080/Chaos botnet C2 (confidence level: 50%)
https://drive.google.com/uc?export=download&id=1rdwbudrladalzjmykdlndpms9bh-4oreUnknown Loader payload delivery URL (confidence level: 50%)
https://pastebin.com/raw/icyjbcnfXWorm botnet C2 (confidence level: 50%)
https://file-na-lax-1.gofile.io/download/direct/399d7543-430b-4bda-b559-488c295b8298/revised-contract.exeUnknown RAT payload delivery URL (confidence level: 50%)

IP addresses 152

107.172.212.46Sliver botnet C2 server (confidence level: 90%)
213.199.61.109AsyncRAT botnet C2 server (confidence level: 100%)
89.116.164.107AsyncRAT botnet C2 server (confidence level: 100%)
197.15.115.198Unknown malware botnet C2 server (confidence level: 100%)
154.222.20.155Venom RAT botnet C2 server (confidence level: 100%)
103.77.214.15MooBot botnet C2 server (confidence level: 100%)
149.202.73.215Unknown malware botnet C2 server (confidence level: 100%)
34.197.226.251Unknown malware botnet C2 server (confidence level: 100%)
184.174.32.12Unknown malware botnet C2 server (confidence level: 100%)
212.12.184.83Unknown malware botnet C2 server (confidence level: 100%)

Hashes 7

Unknown Stealer payload (confidence level: 50%)

470d0df78818cab01970927fa7b076d723530efa4d8bacc580e95e24c2724cd1
b21c9c5e0a67f7ce3a031d0a6d08926e840af180eb616bee2e54d9c49b2c3da8
480e8e46bf171c2ca2e7243386f793d205bc077e0eb9558d64d52ba3f18b96ab
0f545ef0804f837ee172bdbd37184a48915cac5e8f6cbf5aa310160d2cff5c37
f3a7ce69a05da9b1faa6323f1ff7c5366d9a155212e391d13faaf84d4f23e20f
a963b903353ff7027c95e19edb4cb89aa1680ce3d325aae53f78a437056ae8b7
8e655bff39e42f6a6f694f481ed476319c54f0595ad33392fc2ff7243f2f2843

Description

ThreatFox IOCs for 2025-11-23

Impact

For European organizations, the impact of this threat is currently moderate. Since no specific vulnerabilities or exploits are identified, the immediate risk to confidentiality, integrity, or availability is limited. However, the focus on payload delivery and network activity means that if exploited, it could lead to malware infections that compromise systems or exfiltrate data. Organizations heavily reliant on OSINT tools or those with extensive network exposure may face increased risk of targeted payload delivery attacks. The lack of patches and known exploits suggests that the threat actors may be in early stages, but the potential for escalation exists if payload delivery mechanisms are successful. Disruption could affect critical infrastructure, data confidentiality, and operational continuity, especially in sectors like finance, government, and telecommunications. The medium severity rating reflects this balanced risk profile. Proactive monitoring and threat intelligence integration are key to minimizing impact. The absence of user interaction requirements or authentication details limits assessment but suggests that network-based delivery could be a primary vector, which is significant for perimeter defense strategies.

Defensive guidance

European organizations should implement enhanced network monitoring to detect unusual payload delivery attempts and anomalous network activity consistent with the threat profile. Integration of ThreatFox and other MISP feed indicators into Security Information and Event Management (SIEM) systems will improve detection capabilities. Regularly updating and tuning intrusion detection/prevention systems (IDS/IPS) to recognize emerging payload delivery patterns is critical. Organizations should conduct threat hunting exercises focusing on network traffic and OSINT tool usage to identify early signs of compromise. Segmentation of networks and strict access controls can limit lateral movement if payloads are delivered. Since no patches are available, emphasis should be on detection and containment rather than remediation. Employee awareness programs should highlight the risks of payload delivery via network vectors, even if user interaction is not explicitly required. Collaboration with national cybersecurity centers and sharing intelligence on emerging indicators will enhance collective defense. Finally, maintaining robust incident response plans that include scenarios involving OSINT-related payload delivery will prepare organizations for potential escalation.

Community reviews

Loading reviews…