IndicatorPublished 28 Nov 2025Updated 29 Nov 2025

ThreatFox IOCs for 2025-11-28

Source ThreatFox MISP Feed

TLP:WHITE, disclosure is not limited

Indicators of compromise

Domains 8,406

eju.ju-4-en-pare-1.ruClearFake payload delivery domain (confidence level: 100%)
snow.ju-4-en-pare-1.ruClearFake payload delivery domain (confidence level: 100%)
vh1xr.ju4enpare1.ruClearFake payload delivery domain (confidence level: 100%)
altobg.cyouLumma Stealer botnet C2 domain (confidence level: 75%)
bajzii.cyouLumma Stealer botnet C2 domain (confidence level: 75%)
falofao.cyouLumma Stealer botnet C2 domain (confidence level: 75%)
lopeixn.cyouLumma Stealer botnet C2 domain (confidence level: 75%)
unakpn.cyouLumma Stealer botnet C2 domain (confidence level: 75%)
geapezk.cyouLumma Stealer botnet C2 domain (confidence level: 75%)
noidprb.cyouLumma Stealer botnet C2 domain (confidence level: 75%)

URLs 31

http://38.162.116.86:8888/supershell/login/Unknown malware botnet C2 (confidence level: 100%)
http://20.196.147.118:8888/supershell/login/Unknown malware botnet C2 (confidence level: 100%)
https://dvasilaki.dynacomp2.eu/Unknown malware payload delivery URL (confidence level: 90%)
https://lumadigital.net/Unknown malware payload delivery URL (confidence level: 90%)
https://secure-719-process-3384.clickUnknown malware payload delivery URL (confidence level: 100%)
https://bloggerstan.com/26111.mp3Unknown malware payload delivery URL (confidence level: 100%)
https://auth-909-check-142-3895.clickUnknown malware payload delivery URL (confidence level: 100%)
https://modestopowerwashing.comUnknown malware payload delivery URL (confidence level: 100%)
https://solidgate8.com/d/boss19123Unknown Stealer payload delivery URL (confidence level: 100%)
http://144.31.221.85:8080/pages/login.phpUnknown malware botnet C2 (confidence level: 100%)

IP addresses 152

216.126.237.122Remcos botnet C2 server (confidence level: 100%)
193.26.115.170Remcos botnet C2 server (confidence level: 100%)
212.162.149.221Remcos botnet C2 server (confidence level: 100%)
45.74.17.6AsyncRAT botnet C2 server (confidence level: 100%)
162.243.28.13AsyncRAT botnet C2 server (confidence level: 100%)
45.61.135.229SectopRAT botnet C2 server (confidence level: 100%)
209.227.217.214Unknown malware botnet C2 server (confidence level: 100%)
193.149.176.45AdaptixC2 botnet C2 server (confidence level: 100%)
94.154.172.221AdaptixC2 botnet C2 server (confidence level: 100%)
45.155.53.136AdaptixC2 botnet C2 server (confidence level: 100%)

Hashes 300

f662135bdd8bf792a941ea222e8a1330KrustyLoader payload (confidence level: 100%)
aed7eef30dbb0e95290b82d8cdb80cefKrustyLoader payload (confidence level: 100%)
88c13ad71798482ab15da86fed33a09dKrustyLoader payload (confidence level: 100%)
4336ce2c934bdabc0ef24ebc883a97b5KrustyLoader payload (confidence level: 100%)
071d0f76e0af21f0a6903523abe90d33KrustyLoader payload (confidence level: 100%)
120df631123af5a9273b0f9b3b7592d3KrustyLoader payload (confidence level: 100%)
29bc17fa1e32bee1c5beb4f556b1e59aKrustyLoader payload (confidence level: 100%)
34d118e804d3eb46c82cfbcb73772abeKrustyLoader payload (confidence level: 100%)
04b6bf6e2538a5a4043258185a1fd853KrustyLoader payload (confidence level: 100%)
0307d0b1ce5aca62021ddd4cc6a8de16KrustyLoader payload (confidence level: 100%)

Description

ThreatFox IOCs for 2025-11-28

Impact

For European organizations, the impact of this threat is primarily related to the risk of malware infection through network-based payload delivery. While no active exploits or specific vulnerabilities are identified, the presence of malware IOCs indicates ongoing or potential malicious activity that could lead to data compromise, service disruption, or unauthorized access if successful. The medium severity suggests that while the threat is not immediately critical, it could facilitate further attacks or lateral movement within networks if not detected and mitigated. Organizations with extensive network infrastructure or those operating critical services may face increased risk from undetected payload delivery attempts. The lack of patches means organizations must rely on detection and response capabilities rather than vulnerability remediation. European entities with high-value targets or exposure to advanced persistent threats (APTs) should prioritize integrating this intelligence to enhance their situational awareness and incident response readiness.

Defensive guidance

1. Integrate the provided IOCs into existing security information and event management (SIEM) systems and intrusion detection/prevention systems (IDS/IPS) to enhance detection capabilities. 2. Conduct regular network traffic analysis focusing on unusual payload delivery patterns and suspicious network activity consistent with the threat intelligence. 3. Employ endpoint detection and response (EDR) tools to identify and contain malware infections early. 4. Maintain up-to-date threat intelligence feeds and ensure security teams are trained to interpret and act on OSINT data effectively. 5. Implement network segmentation to limit the spread of malware if an infection occurs. 6. Conduct regular security awareness training emphasizing phishing and social engineering risks that often accompany malware delivery. 7. Perform proactive threat hunting exercises using the IOCs to identify potential compromises before they escalate. 8. Ensure robust incident response plans are in place to quickly isolate and remediate affected systems. 9. Collaborate with national and European cybersecurity centers to share intelligence and receive updates on emerging threats. 10. Monitor for updates from ThreatFox and similar OSINT sources to stay informed about evolving malware tactics and indicators.

Community reviews

Loading reviews…