IndicatorPublished 28 Dec 2025Updated 29 Dec 2025

ThreatFox IOCs for 2025-12-28

Source ThreatFox MISP Feed

TLP:WHITE, disclosure is not limited

Indicators of compromise

Domains 120

dxyiz.sa.comAsyncRAT botnet C2 domain (confidence level: 100%)
general-invention.sa.comAsyncRAT botnet C2 domain (confidence level: 100%)
78win.it.comQuasar RAT botnet C2 domain (confidence level: 100%)
svis.in.netDCRat botnet C2 domain (confidence level: 100%)
yhlgut.za.comDCRat botnet C2 domain (confidence level: 100%)
aacademica.uk.comAsyncRAT botnet C2 domain (confidence level: 100%)
brightcleaners.uk.comAsyncRAT botnet C2 domain (confidence level: 100%)
sarkariexamresult.in.netQuasar RAT botnet C2 domain (confidence level: 100%)
tczflw.za.comAsyncRAT botnet C2 domain (confidence level: 100%)
pyeyen.za.comQuasar RAT botnet C2 domain (confidence level: 100%)

URLs 34

https://74.207.236.7/Unknown malware payload delivery URL (confidence level: 90%)
https://103.221.252.52/Unknown malware payload delivery URL (confidence level: 90%)
https://159.223.173.232/Unknown malware payload delivery URL (confidence level: 90%)
https://3.89.221.73/Unknown malware payload delivery URL (confidence level: 90%)
https://169.51.48.11/Unknown malware payload delivery URL (confidence level: 90%)
http://130.12.180.20:59989/cat.shUnknown malware payload delivery URL (confidence level: 75%)
https://banlieuefashion.com/Unknown malware payload delivery URL (confidence level: 90%)
https://43.157.56.250/Unknown malware payload delivery URL (confidence level: 90%)
https://159.223.105.127/Unknown malware payload delivery URL (confidence level: 90%)
https://124.70.99.232/Unknown malware payload delivery URL (confidence level: 90%)

IP addresses 120

209.145.52.163Cobalt Strike botnet C2 server (confidence level: 100%)
195.20.17.253Sliver botnet C2 server (confidence level: 90%)
37.72.172.58AsyncRAT botnet C2 server (confidence level: 100%)
77.93.154.243Hook botnet C2 server (confidence level: 100%)
116.102.237.0Venom RAT botnet C2 server (confidence level: 100%)
23.237.106.60DCRat botnet C2 server (confidence level: 100%)
23.237.106.61DCRat botnet C2 server (confidence level: 100%)
23.237.106.62DCRat botnet C2 server (confidence level: 100%)
130.12.180.2MooBot botnet C2 server (confidence level: 100%)
45.38.20.154Unknown malware botnet C2 server (confidence level: 100%)

Hashes 200

ef846baabc14fe461cff4c4a0fd5056fNova Stealer payload (confidence level: 50%)
4566f5ba6d1a1db0dd7794ea8d791b3fNova Stealer payload (confidence level: 50%)
66ca089cd347d18ae8ab200a4e7602a5Nova Stealer payload (confidence level: 50%)
45ac577dcbf721988b49768497ba3bb8Nova Stealer payload (confidence level: 50%)
826cc4ca915f9a49ec28b119a6655a5bNova Stealer payload (confidence level: 50%)
4b93b2341974f36c9e464632e94d68b3Nova Stealer payload (confidence level: 50%)
c9f3f7a6a36a43c295afa2352c97d1c3Nova Stealer payload (confidence level: 50%)
05f1a39c0902297debceb4c9c4c6674cDragonForce payload (confidence level: 50%)
e67e7b8e0fb6baff4f25bb05dd5a5e21DragonForce payload (confidence level: 50%)
3a6e2c775c9c1060c54a9a94e80d923aDragonForce payload (confidence level: 50%)

Description

ThreatFox IOCs for 2025-12-28

Impact

For European organizations, the impact of this threat intelligence update is primarily informational. Since no active exploits or vulnerabilities are identified, the direct risk to confidentiality, integrity, or availability is low at this time. However, the presence of malware-related IOCs related to network activity and payload delivery indicates potential threats that could be leveraged in future attacks. Organizations relying heavily on OSINT for threat detection and network security monitoring may find value in integrating these IOCs to improve detection capabilities. The lack of patches or fixes means that preventive controls must focus on detection and response rather than remediation. If these IOCs correspond to emerging malware campaigns, failure to incorporate them into security monitoring could delay detection and increase exposure. Overall, the impact is moderate, emphasizing preparedness and proactive threat intelligence consumption rather than immediate operational disruption.

Defensive guidance

Given the nature of this threat intelligence update, mitigation should focus on enhancing detection and response capabilities. European organizations should: 1) Integrate the provided IOCs into existing security information and event management (SIEM) systems and endpoint detection and response (EDR) tools to improve detection of related malware activity. 2) Maintain up-to-date network monitoring to identify unusual payload delivery or network activity patterns consistent with the IOCs. 3) Conduct regular threat hunting exercises using the latest OSINT feeds to identify potential compromises early. 4) Ensure robust incident response plans are in place to quickly contain and remediate infections if detected. 5) Educate security teams on the importance of continuous threat intelligence updates and the interpretation of OSINT data. 6) Collaborate with national and European cybersecurity centers to share and receive timely threat intelligence. Since no patches are available, emphasis should be on detection, containment, and minimizing attack surface through network segmentation and least privilege principles.

Community reviews

Loading reviews…