IndicatorPublished 26 Dec 2025Updated 27 Dec 2025

ThreatFox IOCs for 2025-12-26

Source ThreatFox MISP Feed

TLP:WHITE, disclosure is not limited

Indicators of compromise

Domains 154

mamonol.cyouLumma Stealer botnet C2 domain (confidence level: 75%)
nutlios.cyouLumma Stealer botnet C2 domain (confidence level: 75%)
remareq.cyouLumma Stealer botnet C2 domain (confidence level: 75%)
servict.cyouLumma Stealer botnet C2 domain (confidence level: 75%)
gleamus.cyouLumma Stealer botnet C2 domain (confidence level: 75%)
readyca.cyouLumma Stealer botnet C2 domain (confidence level: 75%)
scarleu.cyouLumma Stealer botnet C2 domain (confidence level: 75%)
treponj.cyouLumma Stealer botnet C2 domain (confidence level: 75%)
www.justformyeyes.comUnknown malware botnet C2 domain (confidence level: 100%)
morqet.b1uesgr2mp.ruClearFake payload delivery domain (confidence level: 100%)

URLs 9

http://130.12.180.20:30677/cat.shUnknown malware payload delivery URL (confidence level: 75%)
http://carkalashop.ir/aaa/receive.phpBlackNET RAT botnet C2 (confidence level: 100%)
http://87.121.84.181/catgirl.mipsUnknown malware payload delivery URL (confidence level: 75%)
http://192.168.139.137:6868/2zmdCobalt Strike botnet C2 (confidence level: 75%)
https://67ef004eb58d960eb348ede9041aef0c.fitStealc botnet C2 (confidence level: 100%)
http://84.201.25.198/d038a0451b0e491c.phpStealc botnet C2 (confidence level: 100%)
http://a1210273.xsph.ru/be7d5f26.phpDCRat botnet C2 (confidence level: 100%)
http://bobrecurwarmumsworms.com:8080/updater?for=0aa6b9f07a5b27b2069c137c69ec91ebUnknown malware botnet C2 (confidence level: 100%)
http://217.156.122.82Stealc botnet C2 (confidence level: 75%)

IP addresses 97

103.176.23.5Unknown Stealer botnet C2 server (confidence level: 100%)
137.220.223.159Ghost RAT botnet C2 server (confidence level: 75%)
103.86.47.226Ghost RAT botnet C2 server (confidence level: 75%)
198.13.47.54Unknown malware botnet C2 server (confidence level: 100%)
165.232.141.208Unknown malware botnet C2 server (confidence level: 100%)
38.190.196.30Cobalt Strike botnet C2 server (confidence level: 100%)
95.85.239.180SectopRAT botnet C2 server (confidence level: 100%)
77.120.165.2Unknown malware botnet C2 server (confidence level: 100%)
185.116.193.105Unknown malware botnet C2 server (confidence level: 100%)
178.79.182.67Unknown malware botnet C2 server (confidence level: 100%)

Hashes 150

a23c39b7b0fb8f6e3e614835b0969bf87e4dae1eAgent Tesla payload (confidence level: 95%)
458c119a3b7fd9a59a26a9f0af3f6490f131d5d5a6a01f293b728645df9f50ccAgent Tesla payload (confidence level: 95%)
2029a7514371ad92aed661c171836120Agent Tesla payload (confidence level: 95%)
01a5d87b6a3bb0dce9b03bd4974c82d268ae76c4Agent Tesla payload (confidence level: 95%)
e1345fb134e131300974cc55448bdc0f547c13502a298496f0762e09fbe9be7aAgent Tesla payload (confidence level: 95%)
1701eced369e4644e33f52e242fdfc61Agent Tesla payload (confidence level: 95%)
c2209bd8a27a6655682bc63dcf6be529d41e26a6Agent Tesla payload (confidence level: 95%)
cf9d3ba6a9a8771d398902e71e90000752e25c4dbe9aa86ad3c6f29a7d5c843dAgent Tesla payload (confidence level: 95%)
a2eef5aea3b07e5587f4afd98f2b6ab4Agent Tesla payload (confidence level: 95%)
7bc0333cb116308de650ab36deed078fe5011b47Agent Tesla payload (confidence level: 95%)

Description

ThreatFox IOCs for 2025-12-26

Impact

For European organizations, the impact of this threat is currently limited due to the lack of known active exploits and absence of affected software versions. However, the presence of IOCs related to malware payload delivery and network activity means that organizations could potentially detect early signs of malicious activity if these indicators are integrated into their security monitoring tools. The medium severity rating suggests that while the threat is not immediately critical, it could facilitate reconnaissance or initial stages of an attack if leveraged by threat actors. Organizations with extensive network infrastructure and critical digital assets may face increased risk if these IOCs correspond to emerging malware campaigns. The lack of patches or direct remediation steps means that detection and response capabilities are the primary defense. Failure to monitor these indicators could result in delayed detection of malware infections or network intrusions, potentially impacting confidentiality, integrity, and availability of systems. Overall, the threat serves as a valuable intelligence input but does not represent an imminent or severe risk on its own.

Defensive guidance

European organizations should incorporate the provided ThreatFox IOCs into their existing Security Information and Event Management (SIEM) systems and intrusion detection/prevention systems (IDS/IPS) to enhance detection capabilities. Regularly updating threat intelligence feeds and correlating these IOCs with internal logs can help identify suspicious network activity or payload delivery attempts early. Conduct targeted network traffic analysis focusing on unusual outbound connections or payload signatures that match the IOCs. Implement network segmentation and strict egress filtering to limit potential malware propagation. Enhance endpoint detection and response (EDR) solutions to recognize behaviors associated with the types of malware indicated by the IOCs. Conduct regular threat hunting exercises using these indicators to proactively identify compromised assets. Train security teams to interpret OSINT-based threat intelligence effectively and integrate it into incident response workflows. Since no patches are available, emphasize rapid containment and eradication procedures upon detection. Collaborate with European cybersecurity information sharing organizations to stay informed about any updates or emerging threats related to these IOCs.

Community reviews

Loading reviews…