IndicatorPublished 3 Dec 2025Updated 4 Dec 2025

ThreatFox IOCs for 2025-12-03

Source ThreatFox MISP Feed

TLP:WHITE, disclosure is not limited

Indicators of compromise

Domains 289

midiavideostv.clickMetamorfo botnet C2 domain (confidence level: 100%)
cargafactura.lifeMetamorfo botnet C2 domain (confidence level: 100%)
url27.shopMetamorfo payload delivery domain (confidence level: 100%)
adbd.techMetamorfo payload delivery domain (confidence level: 100%)
archivosdwn.cloudMetamorfo payload delivery domain (confidence level: 100%)
cfdimex.cloudMetamorfo payload delivery domain (confidence level: 100%)
facturacioncontable.comMetamorfo payload delivery domain (confidence level: 100%)
facturas.co.inMetamorfo payload delivery domain (confidence level: 100%)
facturasm.cloudMetamorfo payload delivery domain (confidence level: 100%)
facturasmex.cloudMetamorfo payload delivery domain (confidence level: 100%)

URLs 78

https://spark-news.xyz/Unknown malware payload delivery URL (confidence level: 90%)
http://156.226.175.32/bins.shUnknown malware payload delivery URL (confidence level: 75%)
http://156.226.175.32/ssh.shUnknown malware payload delivery URL (confidence level: 75%)
https://delix.misecretaria.com.ar/Unknown malware payload delivery URL (confidence level: 90%)
https://profyfk.click/apiLumma Stealer botnet C2 (confidence level: 100%)
https://fcm1sx3iteasdfyn2ewds.zipUnknown malware botnet C2 (confidence level: 50%)
https://pastebin.com/raw/1vz2u0jxAsyncRAT botnet C2 (confidence level: 50%)
https://unncap.com/energenia/Unknown malware payload delivery URL (confidence level: 100%)
https://unncap.com/gbainc/Unknown malware payload delivery URL (confidence level: 100%)
https://adobereader.pdfautoview.com/reader/Unknown malware payload delivery URL (confidence level: 100%)

IP addresses 193

81.94.156.24Mirai botnet C2 server (confidence level: 80%)
178.16.55.188Socks5 Systemz botnet C2 server (confidence level: 99%)
38.190.198.35Cobalt Strike botnet C2 server (confidence level: 100%)
120.48.43.140Cobalt Strike botnet C2 server (confidence level: 100%)
154.94.19.243DarkComet botnet C2 server (confidence level: 100%)
162.243.106.164Unknown malware botnet C2 server (confidence level: 100%)
147.185.221.224Venom RAT botnet C2 server (confidence level: 100%)
139.159.183.246Unknown malware botnet C2 server (confidence level: 100%)
122.51.124.118Unknown malware botnet C2 server (confidence level: 100%)
39.100.86.6Unknown malware botnet C2 server (confidence level: 100%)

Hashes 191

39f79a0feb07f6f02635700fa7f8abc9af6f04b2Quasar RAT payload (confidence level: 95%)
a7148acaabcee8323ea08dc1c3547c79cd0cab58a7b30a6bff16e721c194c9cfQuasar RAT payload (confidence level: 95%)
09b0a41cce5a5ce2d0566c467c16e04bQuasar RAT payload (confidence level: 95%)
e33668d1ad563be9c946b91a9a609c3d56ccd8e8Remcos payload (confidence level: 95%)
67dcb03549ffff37f461654efb7ade244bcd032d9f68a598771d3d0cacf1de2cRemcos payload (confidence level: 95%)
5e98e4dfb80ddbeb480fb37c233d6f44Remcos payload (confidence level: 95%)
20a1b6463a9f57b58a89995c193c391dcb1faef9GUIDLOADER payload (confidence level: 95%)
f58c14370ca887ef557112732534fa842b8e443719285a962f1a4d66400a7123GUIDLOADER payload (confidence level: 95%)
fe5569462d9ca145f78bc520e1e9a53eGUIDLOADER payload (confidence level: 95%)
36be4acf4ebc50e69e40fc7fac498e5fb5c64149Nanocore RAT payload (confidence level: 95%)

Description

ThreatFox IOCs for 2025-12-03

Impact

For European organizations, the impact of this threat is moderate. Since no specific vulnerabilities or exploits are identified, the primary risk lies in potential malware payload delivery through network activity, which could lead to unauthorized access, data exfiltration, or service disruption if successful. Organizations with extensive network exposure or insufficient monitoring may be more vulnerable to infection attempts. The absence of known exploits in the wild reduces immediate risk, but the presence of IOCs indicates ongoing malware campaigns that could evolve. The medium severity suggests that while the threat is not critical, it requires attention to prevent escalation. Industries with high-value data or critical infrastructure in Europe could face operational and reputational impacts if malware payloads are delivered and executed. However, the lack of detailed technical indicators limits the ability to assess specific attack vectors or targeted sectors. Overall, the threat underscores the importance of proactive network defense and threat intelligence integration to detect and mitigate emerging malware delivery attempts.

Defensive guidance

European organizations should enhance their network monitoring capabilities to detect suspicious payload delivery activities, leveraging updated threat intelligence feeds such as ThreatFox. Implementing advanced intrusion detection and prevention systems (IDS/IPS) with behavioral analysis can help identify anomalous network traffic indicative of malware delivery. Regularly updating and tuning endpoint protection platforms to recognize emerging malware signatures is critical. Organizations should integrate OSINT-derived IOCs into their security information and event management (SIEM) systems to improve detection accuracy. Conducting threat hunting exercises focused on network payload delivery patterns can uncover early signs of compromise. Network segmentation and strict access controls reduce the potential impact of successful payload delivery. Employee awareness training on phishing and social engineering can mitigate initial infection vectors. Since no patches are available, reliance on layered defense and rapid incident response planning is essential. Collaboration with national cybersecurity centers and sharing intelligence within European cybersecurity communities enhances collective defense against evolving threats.

Community reviews

Loading reviews…