IndicatorPublished 11 Dec 2025Updated 12 Dec 2025

ThreatFox IOCs for 2025-12-11

Source ThreatFox MISP Feed

TLP:WHITE, disclosure is not limited

Indicators of compromise

Domains 481

members.affiliateincomecoach.comFAKEUPDATES botnet C2 domain (confidence level: 100%)
91clubgamez.comAsyncRAT botnet C2 domain (confidence level: 100%)
malware.91clubgamez.comAsyncRAT botnet C2 domain (confidence level: 100%)
z6yg.draftsnip.ruClearFake payload delivery domain (confidence level: 100%)
omega.quartzkip.ruClearFake payload delivery domain (confidence level: 100%)
patch.quartzkip.ruClearFake payload delivery domain (confidence level: 100%)
zu.quartzkip.ruClearFake payload delivery domain (confidence level: 100%)
nova.quartzkip.ruClearFake payload delivery domain (confidence level: 100%)
z9.st1ltwarp.ruClearFake payload delivery domain (confidence level: 100%)
crank.st1ltwarp.ruClearFake payload delivery domain (confidence level: 100%)

URLs 309

http://178.17.59.46/api/ntesn2qsn2usntgsnwisnjasnjisnjcsyyw3osw=SmartLoader botnet C2 (confidence level: 75%)
http://93.123.39.74/api/ntesn2qsn2usntgsnwisnjasnjisnjcsyyw3osw=SmartLoader botnet C2 (confidence level: 75%)
https://94.103.1.159/Vidar botnet C2 (confidence level: 100%)
https://lingering-my-verify-clouds-0.pages.dev/Unknown malware payload delivery URL (confidence level: 90%)
https://salator.ruSalatStealer botnet C2 (confidence level: 100%)
http://8.148.211.238:8888/supershell/login/Unknown malware botnet C2 (confidence level: 100%)
http://47.122.118.104:8888/supershell/login/Unknown malware botnet C2 (confidence level: 100%)
http://221.236.27.84:48888/supershell/login/Unknown malware botnet C2 (confidence level: 100%)
https://mail.jot.adw.mybluehost.me/Unknown malware payload delivery URL (confidence level: 90%)
https://sbludwig.de/Unknown malware payload delivery URL (confidence level: 90%)

IP addresses 463

94.103.1.159Vidar botnet C2 server (confidence level: 100%)
158.94.209.166Latrodectus botnet C2 server (confidence level: 100%)
178.16.53.86Latrodectus botnet C2 server (confidence level: 100%)
158.94.210.63Remcos botnet C2 server (confidence level: 100%)
62.164.177.65SectopRAT botnet C2 server (confidence level: 100%)
62.164.177.26SectopRAT botnet C2 server (confidence level: 100%)
62.164.177.46SectopRAT botnet C2 server (confidence level: 100%)
62.164.177.36SectopRAT botnet C2 server (confidence level: 100%)
62.164.177.52SectopRAT botnet C2 server (confidence level: 100%)
62.164.177.5SectopRAT botnet C2 server (confidence level: 100%)

Hashes 222

044ddfe42a3d70d6978820c2a441581359070c6bVidar payload (confidence level: 95%)
4c632e8ba569dc2f801bbe0f57d7fc0c658e9eeaf85939ef3720f31a15e8868eVidar payload (confidence level: 95%)
3dd4c3bb5dc990bbc260ae18c1519231Vidar payload (confidence level: 95%)
5e0a84a5208366f86671eef7699c3f22f6dbc07aAgent Tesla payload (confidence level: 95%)
2a084e79463e72c0933ec50e0b89aa2cdd5295584b6d6b211da98c5a3b4a8a8cAgent Tesla payload (confidence level: 95%)
cdd42dc7fde55600b226f27181d96120Agent Tesla payload (confidence level: 95%)
58e44456021fcc0abbf4ae169515ba0f8a3fdbbeVidar payload (confidence level: 95%)
47d3c52c7da0bffb9711ae9b3278aa17b1264858e26b0d1d9418ea782c4c2573Vidar payload (confidence level: 95%)
fcd9efb5bf802d60fce5ec6638029813Vidar payload (confidence level: 95%)
44bf77fd6ca8e82ae280b18b8667cc0bba880751Coinminer payload (confidence level: 95%)

Description

ThreatFox IOCs for 2025-12-11

Impact

For European organizations, the direct impact of this entry is limited since it does not describe a specific exploit or vulnerability. Instead, it serves as a source of threat intelligence that can improve detection and response capabilities. The medium severity suggests a moderate risk level, primarily related to potential malware payload delivery and network activity that could lead to compromise if not detected. Organizations lacking robust threat intelligence integration or network monitoring may be at higher risk of missing early signs of related malware campaigns. The absence of known exploits in the wild reduces immediate risk but does not eliminate the possibility of future exploitation. The impact is therefore more on the preparedness and detection side rather than on immediate confidentiality, integrity, or availability breaches. European entities with critical infrastructure or sensitive data should incorporate such intelligence to maintain situational awareness and enhance their security posture against evolving malware threats.

Defensive guidance

1. Integrate ThreatFox and similar OSINT feeds into Security Information and Event Management (SIEM) and Endpoint Detection and Response (EDR) platforms to enable real-time detection of emerging IOCs. 2. Regularly update network intrusion detection and prevention systems (IDS/IPS) with the latest threat intelligence to identify and block suspicious payload delivery attempts. 3. Conduct continuous monitoring of network traffic for anomalies consistent with malware delivery and command-and-control communications. 4. Implement strict network segmentation to limit the spread of malware if payload delivery is successful. 5. Train security analysts to interpret and act on OSINT-derived intelligence, ensuring timely response to new indicators. 6. Maintain up-to-date asset inventories to prioritize monitoring of critical systems that could be targeted by malware campaigns. 7. Collaborate with national and European cybersecurity centers to share and receive timely threat intelligence updates. 8. Employ threat hunting exercises focused on network activity patterns associated with payload delivery to detect stealthy intrusions. These measures go beyond generic advice by emphasizing integration of OSINT feeds, active monitoring, and analyst preparedness tailored to the nature of the intelligence provided.

Community reviews

Loading reviews…