IndicatorPublished 19 Dec 2025Updated 20 Dec 2025

ThreatFox IOCs for 2025-12-19

Source ThreatFox MISP Feed

TLP:WHITE, disclosure is not limited

Indicators of compromise

Domains 242

buradakimvar.comUnknown malware botnet C2 domain (confidence level: 100%)
areuhuman.topClearFake payload delivery domain (confidence level: 100%)
cedar.defore5tm0unt.ruClearFake payload delivery domain (confidence level: 100%)
ocrdatabase.comHavoc botnet C2 domain (confidence level: 100%)
stump.defore5tm0unt.ruClearFake payload delivery domain (confidence level: 100%)
saw2.defore5tm0unt.ruClearFake payload delivery domain (confidence level: 100%)
clear.defore5tm0unt.ruClearFake payload delivery domain (confidence level: 100%)
choir.b2ptistda7k.ruClearFake payload delivery domain (confidence level: 100%)
pulpit.b2ptistda7k.ruClearFake payload delivery domain (confidence level: 100%)
psalm2.b2ptistda7k.ruClearFake payload delivery domain (confidence level: 100%)

URLs 34

https://winnipeglandscapingpros.com/Unknown malware payload delivery URL (confidence level: 90%)
http://31.42.185.135:8080/updater?for=5120d3fedd36eac912db54c863ce59bbUnknown malware botnet C2 (confidence level: 100%)
http://23.94.252.171/60cdc8e27a6d4451.phpStealc botnet C2 (confidence level: 100%)
http://193.177.0.235/Unknown Stealer botnet C2 (confidence level: 100%)
http://185.208.158.242/Unknown Stealer payload delivery URL (confidence level: 50%)
https://progoncol0.floresflorcravoroxo.cfd/?2/Astaroth payload delivery URL (confidence level: 100%)
https://msn.marcialongman.com.br/Vidar botnet C2 (confidence level: 100%)
https://msn.djvirus.kiev.ua/Vidar botnet C2 (confidence level: 100%)
http://8.137.106.28:8888/supershell/login/Unknown malware botnet C2 (confidence level: 100%)
http://122.10.52.27:8888/supershell/login/Unknown malware botnet C2 (confidence level: 100%)

IP addresses 197

45.93.20.61Stealc botnet C2 server (confidence level: 100%)
148.251.11.209XWorm botnet C2 server (confidence level: 99%)
148.251.11.209DarkVision RAT botnet C2 server (confidence level: 88%)
88.218.64.78NetSupportManager RAT botnet C2 server (confidence level: 75%)
88.218.64.76NetSupportManager RAT botnet C2 server (confidence level: 75%)
5.182.210.61Cobalt Strike botnet C2 server (confidence level: 100%)
103.48.135.214Cobalt Strike botnet C2 server (confidence level: 100%)
47.92.168.170Cobalt Strike botnet C2 server (confidence level: 100%)
23.235.188.169Cobalt Strike botnet C2 server (confidence level: 100%)
23.235.188.166Cobalt Strike botnet C2 server (confidence level: 100%)

Hashes 172

f4ba0876034e7f20a8dfafbb6365353e55945d71Stealc payload (confidence level: 95%)
03224277f831034a084fcbcc5def473d113edef62842e5337db2408b6281d501Stealc payload (confidence level: 95%)
47aa6081a8c4457ea63993dd092c297fStealc payload (confidence level: 95%)
390e3bff719003884c6eb7fba0d7a31293318cb3Owlproxy payload (confidence level: 95%)
2e2535caf6e0158b160eb23d74ee67d827fb8764c1bf2c6d299e08cb67750f59Owlproxy payload (confidence level: 95%)
00b5ef8fec4793d13a0f32d993c22c5eOwlproxy payload (confidence level: 95%)
ea585a502ef2a89adf507d7e8a26129c3faaff63NjRAT payload (confidence level: 95%)
4a65c27c890a97e68fbc5dd25b4d8828f834f60f307acb2a4979df3223dcba4bNjRAT payload (confidence level: 95%)
15e12235e0ff99601bcf926331d50610NjRAT payload (confidence level: 95%)
57e8df5da599483555e30633e3d403ddfc9f0089NjRAT payload (confidence level: 95%)

Description

ThreatFox IOCs for 2025-12-19

Impact

For European organizations, the impact of these ThreatFox IOCs lies primarily in their potential to enhance situational awareness and detection capabilities against malware campaigns involving network-based payload delivery. While no active exploitation is reported, the presence of these indicators suggests ongoing or emerging threats that could lead to data breaches, service disruptions, or unauthorized access if payload delivery attempts succeed. Organizations with critical infrastructure, financial services, and large digital footprints are at higher risk due to their attractiveness to threat actors. The medium severity rating reflects moderate risk, emphasizing the need for vigilance but not indicating an immediate crisis. Failure to incorporate these IOCs into security monitoring could delay detection of malware infections, increasing the potential damage. However, since no specific vulnerabilities or exploits are identified, the direct impact on confidentiality, integrity, or availability is currently limited but could escalate if threat actors leverage these indicators in active campaigns.

Defensive guidance

European organizations should integrate the ThreatFox IOCs into their existing security information and event management (SIEM) systems and threat intelligence platforms to enhance detection of suspicious network activity and payload delivery attempts. Regularly updating and tuning intrusion detection and prevention systems (IDS/IPS) with these indicators can improve early warning capabilities. Network segmentation and strict egress filtering can limit the impact of potential payload delivery. Conducting threat hunting exercises using these IOCs can help identify latent infections or reconnaissance activity. Organizations should also ensure robust endpoint detection and response (EDR) solutions are in place to detect and contain malware payloads. Sharing intelligence with trusted partners and participating in information sharing communities will improve collective defense. Since no patches are available, emphasis should be on detection, monitoring, and rapid incident response. Training security teams to recognize and respond to network-based malware delivery techniques will further reduce risk.

Community reviews

Loading reviews…