IndicatorPublished 9 Dec 2025Updated 10 Dec 2025

ThreatFox IOCs for 2025-12-09

Source ThreatFox MISP Feed

TLP:WHITE, disclosure is not limited

Indicators of compromise

Domains 1,412

google.vn168.casaAsyncRAT botnet C2 domain (confidence level: 100%)
googlecom.vn168.casaAsyncRAT botnet C2 domain (confidence level: 100%)
phising.vn168.casaAsyncRAT botnet C2 domain (confidence level: 100%)
virus.vn168.casaAsyncRAT botnet C2 domain (confidence level: 100%)
cherokeemech.netBashlite botnet C2 domain (confidence level: 100%)
wild.vexdapper.ruClearFake payload delivery domain (confidence level: 100%)
yje.vexdapper.ruClearFake payload delivery domain (confidence level: 100%)
fyed6.pe7fectp7oc.ruClearFake payload delivery domain (confidence level: 100%)
yfx.pe7fectp7oc.ruClearFake payload delivery domain (confidence level: 100%)
l5qal.pe7fectp7oc.ruClearFake payload delivery domain (confidence level: 100%)

URLs 246

https://www.check-list.jp/Unknown malware payload delivery URL (confidence level: 90%)
https://first-film.com/Unknown malware payload delivery URL (confidence level: 90%)
http://178.16.53.7/xvzpjyddlu/login.phpTinyLoader botnet C2 (confidence level: 100%)
https://www.lead-mc.jp/Unknown malware payload delivery URL (confidence level: 90%)
http://64.120.88.36:8888/supershell/login/Unknown malware botnet C2 (confidence level: 100%)
http://thenerditorium.com/wp-content/plugins/wp-automatic/msrwlq.php?uow=8x65b44Latrodectus payload delivery URL (confidence level: 95%)
https://www.satwikskincare.com.digitaljaydeep.in/Unknown malware payload delivery URL (confidence level: 90%)
http://46.226.161.131/Hook botnet C2 (confidence level: 50%)
https://api.telegram.org/bot8259516548:aahq8gr23gv1xmyhsw6mmk09shneycvsqja/Agent Tesla botnet C2 (confidence level: 50%)
http://aaeuauaueieiier.su/Phorpiex botnet C2 (confidence level: 50%)

IP addresses 170

82.117.87.188Mirai botnet C2 server (confidence level: 80%)
38.55.199.104Cobalt Strike botnet C2 server (confidence level: 100%)
186.169.59.54Remcos botnet C2 server (confidence level: 100%)
74.119.195.181Remcos botnet C2 server (confidence level: 100%)
3.8.155.215Sliver botnet C2 server (confidence level: 100%)
107.174.115.101Unknown malware botnet C2 server (confidence level: 100%)
45.11.183.184SectopRAT botnet C2 server (confidence level: 100%)
46.226.161.131Hook botnet C2 server (confidence level: 100%)
207.126.162.205Unknown malware botnet C2 server (confidence level: 100%)
101.99.90.62Unknown malware botnet C2 server (confidence level: 100%)

Hashes 195

2168228311e69214883173b5d8ec63a47b2ea36dStrelaStealer payload (confidence level: 95%)
2e8d23b7f77e7578af862bfb3a5ad652fe19cd2be13da309a65e0402ebdbd7fdStrelaStealer payload (confidence level: 95%)
a1ba70ff00ae2282efe8d2e175611e72StrelaStealer payload (confidence level: 95%)
036d7322a3ca1cf24fabfb17e0676a3c8364f5cbStrelaStealer payload (confidence level: 95%)
bae2b47193c08a9f98f390845d8a2d25040bc2b2cee6c36f10cfff5d245b24eaStrelaStealer payload (confidence level: 95%)
999190bdbf9716143f68977747ec0824StrelaStealer payload (confidence level: 95%)
20694dd4f49b9ccfc79600acde864593ee64a0c1Cobalt Strike payload (confidence level: 95%)
4376f6c5bd63c9472dc1575b26f70cc2320682a47881e1a9283904bcdec43fd8Cobalt Strike payload (confidence level: 95%)
b6b156e89d24f5452137b558d7b74353Cobalt Strike payload (confidence level: 95%)
c0f2e946ea49e72aa2181bbfca392a8e6ee3d44eCoinminer payload (confidence level: 95%)

Description

ThreatFox IOCs for 2025-12-09

Impact

For European organizations, the potential impact of this threat is moderate given its medium severity and association with payload delivery. If exploited, it could lead to unauthorized payload execution, potentially compromising confidentiality, integrity, or availability of systems. The lack of specific affected products or versions means that the threat could be broad and opportunistic rather than targeted, increasing the risk to organizations with extensive network exposure or those relying on OSINT for threat intelligence. Payload delivery via network activity could facilitate malware infections, data exfiltration, or lateral movement within networks. However, the absence of known exploits in the wild and no patches suggests that the threat is not currently active or widespread, reducing immediate risk. European entities involved in intelligence, defense, or critical infrastructure sectors may face higher risk due to their strategic importance and potential attractiveness to threat actors leveraging OSINT. Overall, the impact is potentially disruptive but not critical at this stage.

Defensive guidance

European organizations should enhance monitoring of network traffic for unusual payload delivery patterns, especially those linked to OSINT-related reconnaissance or data gathering activities. Implement advanced threat detection tools capable of identifying anomalous network behavior and payload execution attempts. Regularly update and harden endpoint protection systems to detect and block malware payloads. Conduct employee awareness training focused on recognizing social engineering tactics that may be informed by OSINT. Since no patches are available, emphasize proactive defense measures such as network segmentation, strict access controls, and the use of threat intelligence feeds to stay informed about emerging indicators. Collaborate with national cybersecurity centers to share intelligence and receive timely alerts. Employ sandboxing and behavioral analysis tools to safely analyze suspicious payloads. Finally, maintain robust incident response plans to quickly contain and remediate infections if they occur.

Community reviews

Loading reviews…