IndicatorPublished 4 Dec 2025Updated 5 Dec 2025

ThreatFox IOCs for 2025-12-04

Source ThreatFox MISP Feed

TLP:WHITE, disclosure is not limited

Indicators of compromise

Domains 184

safepal.in.netQuasar RAT botnet C2 domain (confidence level: 75%)
email.whyyoushouldwalk.comFAKEUPDATES botnet C2 domain (confidence level: 100%)
gate.nevp0yob5tet.ruClearFake payload delivery domain (confidence level: 100%)
wild.nevp0yob5tet.ruClearFake payload delivery domain (confidence level: 100%)
qr4z.nevp0yob5tet.ruClearFake payload delivery domain (confidence level: 100%)
rrc.nevp0yob5tet.ruClearFake payload delivery domain (confidence level: 100%)
cloudy.8oodt1me.ruClearFake payload delivery domain (confidence level: 100%)
soft.8oodt1me.ruClearFake payload delivery domain (confidence level: 100%)
l8iwt.8oodt1me.ruClearFake payload delivery domain (confidence level: 100%)
5o.8oodt1me.ruClearFake payload delivery domain (confidence level: 100%)

URLs 67

https://qexmz.com/Unknown malware payload delivery URL (confidence level: 90%)
https://etpur.com/Unknown malware payload delivery URL (confidence level: 90%)
http://towerbingobongoboom.com:8080/updater?for=76262f4263b30a25bb81956ea98986edUnknown malware botnet C2 (confidence level: 100%)
http://217.156.64.221/1.shUnknown malware payload delivery URL (confidence level: 75%)
https://alsaqrdelivery.online/Unknown malware payload delivery URL (confidence level: 90%)
https://hobmjoi.click/apiLumma Stealer botnet C2 (confidence level: 100%)
https://99d04a7a-345a-48sc-8ea3-a9a626aa773e-00-3qpe7ieitscyb.live/vzob/windows/invite.phpUnknown malware payload delivery URL (confidence level: 50%)
https://id3basketball.com/zoom/windows/invite.phpUnknown malware payload delivery URL (confidence level: 50%)
https://myzoomlive.netlify.app/Unknown malware payload delivery URL (confidence level: 50%)
https://www.zoom.donittech.com/Unknown malware payload delivery URL (confidence level: 50%)

IP addresses 176

158.220.93.201Stealc payload delivery server (confidence level: 90%)
95.217.39.238Stealc payload delivery server (confidence level: 90%)
196.251.107.94Stealc payload delivery server (confidence level: 85%)
107.167.83.34Stealc payload delivery server (confidence level: 85%)
114.132.90.105Cobalt Strike botnet C2 server (confidence level: 100%)
45.74.9.54AsyncRAT botnet C2 server (confidence level: 100%)
144.172.107.116Havoc botnet C2 server (confidence level: 100%)
187.116.67.182Havoc botnet C2 server (confidence level: 100%)
8.140.250.105Unknown malware botnet C2 server (confidence level: 100%)
57.128.225.231Unknown malware botnet C2 server (confidence level: 100%)

Hashes 233

23c909ea83cd7428a37189f228f4782693c1726381c886712135defca5924a68Stealc payload (confidence level: 95%)
4ac33e95d7d1bf205c8bd021886a8edc5d405d65389edb3b0c65d62c12ace47dStealc payload (confidence level: 85%)
a3894003ad1d293ba96d77881ccd2071446dc3f65f434669b49b3da92421901aShai-Hulud payload (confidence level: 95%)
62ee164b9b306250c1172583f138c9614139264f889fa99614903c12755468d0Shai-Hulud payload (confidence level: 95%)
9d59fd0bcc14b671079824c704575f201b74276238dc07a9c12a93a84195648aShai-Hulud payload (confidence level: 95%)
fb285840950e2be85e0f6fd12f8b7019b4bd3babOwlproxy payload (confidence level: 95%)
a0833c96c647a67c9ea6cb2545e3c157f2ef6a062d2e9e8e05871845dbd40c1aOwlproxy payload (confidence level: 95%)
97a13dbf605b7a363473ac6648567888Owlproxy payload (confidence level: 95%)
85e9d299582c3645b10d4791e2f2099f0ec7780cSocks5 Systemz payload (confidence level: 95%)
bae5d9c81d7142b9cf994402b2648d70cf90271a31435d92fdcb87c422b00a17Socks5 Systemz payload (confidence level: 95%)

Description

ThreatFox IOCs for 2025-12-04

Impact

Given the lack of specific affected systems or exploit details, the direct impact on European organizations is limited. The threat intelligence may help organizations improve detection of malware-related network activity and payload delivery attempts, enhancing their defensive posture. However, without concrete indicators or affected products, the immediate risk of compromise or operational disruption is low. European entities relying heavily on OSINT and network security monitoring can integrate this intelligence to better identify potential threats, but no direct operational impact or data breach risk is evident from the provided information. The medium severity rating suggests a moderate level of concern, primarily for awareness and preparedness rather than urgent mitigation. The absence of known exploits in the wild further reduces the likelihood of imminent attacks targeting European infrastructure based on this data.

Defensive guidance

Organizations should incorporate the ThreatFox IOCs into their existing threat intelligence platforms and security information and event management (SIEM) systems to enhance detection capabilities. Regularly updating OSINT feeds and correlating this data with internal logs can improve identification of suspicious payload delivery and network activity patterns. Security teams should maintain robust network monitoring and anomaly detection mechanisms to catch early signs of malware activity. While no patches or direct fixes are available, ensuring endpoint protection solutions are up to date and enforcing strict network segmentation can reduce potential attack surfaces. Additionally, conducting regular threat hunting exercises using the latest OSINT feeds can help identify latent threats. Collaboration with national and European cybersecurity centers to share and receive updated intelligence will further strengthen defenses. Finally, training staff on recognizing signs of malware infection and suspicious network behavior remains essential.

Community reviews

Loading reviews…