IndicatorPublished 16 Dec 2025Updated 17 Dec 2025

ThreatFox IOCs for 2025-12-16

Source ThreatFox MISP Feed

TLP:WHITE, disclosure is not limited

Indicators of compromise

Domains 279

mediatron.eu.comQuasar RAT botnet C2 domain (confidence level: 75%)
hazystripe2004.shopUnknown RAT botnet C2 domain (confidence level: 100%)
separatto.xyzUnknown malware payload delivery domain (confidence level: 100%)
fttyyu-could.icuStealc botnet C2 domain (confidence level: 100%)
sunwin.moiAsyncRAT botnet C2 domain (confidence level: 100%)
ltaw.thrumblex.ruClearFake payload delivery domain (confidence level: 100%)
ya.thrumblex.ruClearFake payload delivery domain (confidence level: 100%)
copper.jaxmorrow.ruClearFake payload delivery domain (confidence level: 100%)
uqnp.jaxmorrow.ruClearFake payload delivery domain (confidence level: 100%)
kibu.jaxmorrow.ruClearFake payload delivery domain (confidence level: 100%)

URLs 92

http://hazystripe2004.shop/b5a52ebb310b65f06dd10cfe69f72363/ejk52zwt2js16roUnknown Stealer botnet C2 (confidence level: 100%)
http://hazystripe2004.shop/b5a52ebb310b65f06dd10cfe69f72363/q7cherolivolejkUnknown Stealer botnet C2 (confidence level: 100%)
http://hazystripe2004.shop/b5a52ebb310b65f06dd10cfe69f72363/q38dyv0te345uf4Unknown Stealer botnet C2 (confidence level: 100%)
https://www.chess.com/member/slcbzUnknown Stealer botnet C2 (confidence level: 100%)
https://api.telegram.org/bot8393528187:aahe-fyrlen4e-tne4sqwpojxcobztmq5me/Agent Tesla botnet C2 (confidence level: 50%)
http://www.052atelier.com/rn10/Formbook botnet C2 (confidence level: 50%)
http://www.1wrzv5r.bond/rn10/Formbook botnet C2 (confidence level: 50%)
http://www.39tka.bond/rn10/Formbook botnet C2 (confidence level: 50%)
http://www.4er.online/rn10/Formbook botnet C2 (confidence level: 50%)
http://www.5vip5.com/rn10/Formbook botnet C2 (confidence level: 50%)

IP addresses 319

144.172.104.178XMRIG botnet C2 server (confidence level: 75%)
91.208.184.203XMRIG botnet C2 server (confidence level: 75%)
144.172.105.58XMRIG botnet C2 server (confidence level: 75%)
94.156.102.130Unknown RAT botnet C2 server (confidence level: 100%)
95.181.212.171Unknown RAT botnet C2 server (confidence level: 100%)
143.20.185.252Mirai botnet C2 server (confidence level: 80%)
157.250.205.158Mirai botnet C2 server (confidence level: 80%)
176.117.107.202Remcos botnet C2 server (confidence level: 100%)
181.162.166.187Quasar RAT botnet C2 server (confidence level: 100%)
45.192.208.126DCRat botnet C2 server (confidence level: 100%)

Description

ThreatFox IOCs for 2025-12-16

Impact

For European organizations, the impact of this threat intelligence feed is primarily in enhancing situational awareness and improving detection of potential malware-related network activity. Since no active exploits or vulnerabilities are associated, there is no direct risk of compromise from this data alone. However, failure to incorporate these IOCs into security monitoring could result in missed detection opportunities, allowing malware or payload delivery attempts to go unnoticed. Organizations heavily reliant on threat intelligence for proactive defense, such as financial institutions, critical infrastructure, and government agencies, will benefit most. The medium severity suggests a moderate potential impact if these indicators correspond to emerging or evolving threats. The lack of patches or fixes means mitigation relies on detection and response rather than vulnerability remediation. Overall, the impact is indirect but important for maintaining robust defense postures against malware campaigns.

Defensive guidance

European organizations should integrate the ThreatFox IOCs into their existing Security Information and Event Management (SIEM) systems, intrusion detection/prevention systems (IDS/IPS), and endpoint detection and response (EDR) tools to enhance detection capabilities. Regularly updating threat intelligence feeds and correlating these IOCs with internal logs will help identify suspicious network activity or payload delivery attempts early. Security teams should conduct threat hunting exercises using these indicators to proactively search for signs of compromise. Additionally, organizations should maintain strong network segmentation and monitoring to limit potential malware spread if detected. Training and awareness programs should emphasize the importance of OSINT and threat intelligence in the security lifecycle. Since no patches are available, emphasis on detection and rapid incident response is critical. Collaboration with national cybersecurity centers and sharing findings with peers can improve collective defense. Finally, validating the authenticity and relevance of IOCs before deployment will reduce false positives and operational overhead.

Community reviews

Loading reviews…