IndicatorPublished 26 Nov 2025Updated 27 Nov 2025

ThreatFox IOCs for 2025-11-26

Source ThreatFox MISP Feed

TLP:WHITE, disclosure is not limited

Indicators of compromise

Domains 377

alpeoqa.cyouLumma Stealer botnet C2 domain (confidence level: 75%)
binauxa.cyouLumma Stealer botnet C2 domain (confidence level: 75%)
convuey.cyouLumma Stealer botnet C2 domain (confidence level: 75%)
impzowr.cyouLumma Stealer botnet C2 domain (confidence level: 75%)
manpfqa.cyouLumma Stealer botnet C2 domain (confidence level: 75%)
smipmue.cyouLumma Stealer botnet C2 domain (confidence level: 75%)
twobkgg.cyouLumma Stealer botnet C2 domain (confidence level: 75%)
unotinf.cyouLumma Stealer botnet C2 domain (confidence level: 75%)
kb-f.spaceUnknown malware payload delivery domain (confidence level: 100%)
cashforclutter.onlineUnknown malware payload delivery domain (confidence level: 100%)

URLs 122

https://kb-f.spaceUnknown malware payload delivery URL (confidence level: 100%)
https://cashforclutter.onlineUnknown malware payload delivery URL (confidence level: 100%)
https://tffoodindustries.comUnknown malware payload delivery URL (confidence level: 100%)
http://43.160.197.177:8888/supershell/login/Unknown malware botnet C2 (confidence level: 100%)
https://mauisoft.net/Unknown malware payload delivery URL (confidence level: 90%)
https://steamcommunity.com/profiles/76561198765046918Vidar botnet C2 (confidence level: 100%)
https://telegram.me/bul33btVidar botnet C2 (confidence level: 100%)
https://trp.theoptimizedbody.com/Vidar botnet C2 (confidence level: 100%)
https://her.theoptimizedbody.com/Vidar botnet C2 (confidence level: 100%)
https://trp.itermed.ar/Vidar botnet C2 (confidence level: 100%)

IP addresses 142

161.35.154.16Cobalt Strike botnet C2 server (confidence level: 100%)
108.181.184.9AsyncRAT botnet C2 server (confidence level: 100%)
39.101.165.180Unknown malware botnet C2 server (confidence level: 100%)
36.133.46.21Unknown malware botnet C2 server (confidence level: 100%)
54.38.54.119Unknown malware botnet C2 server (confidence level: 100%)
104.128.132.126Unknown malware botnet C2 server (confidence level: 100%)
18.134.66.83Unknown malware botnet C2 server (confidence level: 100%)
209.74.64.164Unknown malware botnet C2 server (confidence level: 100%)
91.92.242.138Mirai botnet C2 server (confidence level: 100%)
172.245.152.216Remcos botnet C2 server (confidence level: 100%)

Hashes 168

e2e55ae01f4fd6ee4a964c66e394aecb996db37dAsyncRAT payload (confidence level: 95%)
d7491c4e7c1981c039189cf7b772dc0b532b0bb6fd53f255aeafc9bbde029927AsyncRAT payload (confidence level: 95%)
2fd635888e1541f33d94e6f82f19e8f8AsyncRAT payload (confidence level: 95%)
d8f96192987675cfceb353ee40ea9788dc7dc290Formbook payload (confidence level: 95%)
5ca1cd75c510adff5ec4d592556594d86db181dc1e6bb3b8bc5cb98c70708921Formbook payload (confidence level: 95%)
a35ae5065bea3ac9e87a5d4db8aa584eFormbook payload (confidence level: 95%)
101d9bc6e52dd9feebe3518305dd18f93058186fSocks5 Systemz payload (confidence level: 95%)
58db91f6d4424c005b7ba22da17835a35083b1a28d00c515f59f2d6b2c07e6fcSocks5 Systemz payload (confidence level: 95%)
5e30ee9def561540bcdbde89eb9aac5aSocks5 Systemz payload (confidence level: 95%)
ff1b21f01e6ce0cefa9b92dac4c2d9fb08049e8bMasad Stealer payload (confidence level: 95%)

Description

ThreatFox IOCs for 2025-11-26

Impact

For European organizations, the impact of this threat is primarily related to potential reconnaissance and payload delivery attempts that could lead to malware infections or data exfiltration. Since no specific affected products or vulnerabilities are identified, the threat's impact is indirect and depends on the malware's payload and attack vectors used in campaigns leveraging these IOCs. Organizations with extensive network infrastructure and reliance on OSINT tools may face increased risk of targeted reconnaissance and subsequent exploitation attempts. The medium severity suggests moderate risk to confidentiality and integrity if payloads are successfully delivered, but the absence of known exploits in the wild reduces immediate threat levels. Disruptions could include unauthorized access, data leakage, or network performance degradation if payloads execute successfully. European entities involved in critical infrastructure, government, or technology sectors may be more attractive targets due to their strategic importance and data sensitivity. However, the lack of patchable vulnerabilities means mitigation focuses on detection and response rather than remediation of software flaws.

Defensive guidance

1. Integrate ThreatFox and other reputable threat intelligence feeds into Security Information and Event Management (SIEM) systems to enhance detection of related IOCs and network anomalies. 2. Implement advanced network monitoring and intrusion detection/prevention systems (IDS/IPS) capable of identifying suspicious payload delivery patterns and OSINT-related reconnaissance activities. 3. Conduct regular threat hunting exercises focusing on network traffic and endpoint behavior to identify early signs of payload delivery or malware execution. 4. Harden network segmentation to limit lateral movement in case of successful payload delivery. 5. Educate security teams on the nature of OSINT-based threats and the importance of correlating intelligence with observed network activity. 6. Maintain updated endpoint protection solutions with behavioral analysis capabilities to detect unknown or emerging malware payloads. 7. Collaborate with national and European cybersecurity centers to share intelligence and coordinate responses to emerging threats. 8. Since no patches are available, prioritize proactive detection and incident response readiness over patch management for this threat.

Community reviews

Loading reviews…