IndicatorPublished 16 Aug 2021Updated 17 Aug 2021

type osint · ThreatFox IOCs for 2021-08-16

Affects type osintSource ThreatFox MISP Feed

TLP:WHITE, disclosure is not limited

Indicators of compromise

Domains 8

whereihjeu3.xyzServHelper botnet C2 domain (confidence level: 100%)
nupahe.comCobalt Strike botnet C2 domain (confidence level: 100%)
slimworkslose.topIcedID botnet C2 domain (confidence level: 100%)
zappazappos.topIcedID botnet C2 domain (confidence level: 100%)
dilingomer.topIcedID botnet C2 domain (confidence level: 100%)
illioredesazerro.topIcedID botnet C2 domain (confidence level: 100%)
tumolerunosell.websiteISFB botnet C2 domain (confidence level: 100%)
danylmassey574.xyzHydra botnet C2 domain (confidence level: 100%)

URLs 32

http://185.227.139.5/sxisodifntose.php/hek4b4c6xdxedLoki Password Stealer (PWS) botnet C2 (confidence level: 100%)
http://112.126.60.177:443/design/img/list.jpgCobalt Strike botnet C2 (confidence level: 75%)
http://112.126.60.177:443/uri2?test1=test2Cobalt Strike botnet C2 (confidence level: 75%)
http://nupahe.com:443/files/r-arrow.pngCobalt Strike botnet C2 (confidence level: 75%)
http://nupahe.com:443/sq.htmlCobalt Strike botnet C2 (confidence level: 75%)
http://185.227.139.5/sxisodifntose.php/m6blptnvd3wd9Loki Password Stealer (PWS) botnet C2 (confidence level: 100%)
http://tor.browser.ideaprog.download/Pony botnet C2 (confidence level: 100%)
http://tor.browser.ideaprog.download/gates.phpPony botnet C2 (confidence level: 100%)
http://185.227.139.5/sxisodifntose.php/j572nmrhsdmecLoki Password Stealer (PWS) botnet C2 (confidence level: 100%)
http://185.227.139.5/sxisodifntose.php/7kyds3toufmfdLoki Password Stealer (PWS) botnet C2 (confidence level: 100%)

IP addresses 22

91.142.79.35RedLine Stealer botnet C2 server (confidence level: 100%)
80.85.140.26RedLine Stealer botnet C2 server (confidence level: 100%)
79.134.225.37Nanocore RAT botnet C2 server (confidence level: 100%)
79.134.225.9AsyncRAT botnet C2 server (confidence level: 100%)
45.147.230.80Cobalt Strike botnet C2 server (confidence level: 75%)
142.44.163.110Tsunami botnet C2 server (confidence level: 75%)
136.144.41.122Mirai botnet C2 server (confidence level: 75%)
85.204.116.32Bashlite botnet C2 server (confidence level: 75%)
185.140.53.134BitRAT botnet C2 server (confidence level: 100%)
94.242.224.231RedLine Stealer botnet C2 server (confidence level: 100%)

Hashes 1,244

e9efe4b714b9e606f25b8812cb8f66e1a5c4993264a2f038613f615ff5e8d835Dridex payload (confidence level: 100%)
bf78087fd649d8dc4109765208bfdf01b538aed79c11bdb1dab0d26b31a6c27fDridex payload (confidence level: 100%)
e749a141ffcde294c8096038320b1a0094ed2b1fd427ef17970f492b166d36a7Dridex payload (confidence level: 100%)
5bcbcd7ac386c4d4bd844e2706082946af3ee67a88d280c266afd1ea8720d6c0Dridex payload (confidence level: 100%)
d38faf4431415d50bc81a626c6b55fee7032edd7e60606c4904f34025a83827fDridex payload (confidence level: 100%)
02aa50a2e55e07e204bf9b36466f69243ceb6e2561a9758555c27834122be811Dridex payload (confidence level: 100%)
9f133ea06d33667b92d9ef201ebf796ae14aa2db6439189467c202cf7a280dfcDridex payload (confidence level: 100%)
0256799eb8528197caf5892c2553498f21e1b8f3f747c127f4a2479336381779Dridex payload (confidence level: 100%)
eced331ef8935d915f3e136e2b03ddf5b4f4d4be27fa8869f3824102a8ee402eDridex payload (confidence level: 100%)
0c7fa9e251427d6881cd2de5047f4ee792ca4d1efb1e8b93c0cf771e170d865eDridex payload (confidence level: 100%)

Description

ThreatFox IOCs for 2021-08-16

Impact

For European organizations, the impact of this ThreatFox IOC feed is indirect. It serves as a resource for cybersecurity teams to enhance their detection capabilities by integrating these IOCs into their security monitoring tools such as SIEMs, IDS/IPS, and endpoint protection platforms. While the feed itself does not represent an active exploit or vulnerability, failure to utilize such intelligence can result in delayed detection of malware or network intrusions that use similar indicators. Given the medium severity and absence of known exploits, the immediate risk to confidentiality, integrity, or availability is low. However, organizations that do not leverage OSINT feeds may be at a disadvantage in identifying emerging threats or payload delivery mechanisms. The impact is therefore more strategic and operational, improving threat awareness and response rather than mitigating a direct attack.

Defensive guidance

European organizations should integrate ThreatFox IOCs into their existing threat intelligence platforms and security monitoring infrastructure to enhance detection capabilities. This includes regularly updating SIEM correlation rules, IDS/IPS signatures, and endpoint detection systems with the latest IOCs. Security teams should conduct threat hunting exercises using these indicators to identify potential compromises early. Additionally, organizations should participate in information sharing communities such as MISP to contribute and receive timely threat intelligence. Since no patches or direct fixes are available, emphasis should be placed on proactive monitoring, network segmentation to limit lateral movement, and user awareness training to reduce the risk of payload delivery via phishing or other social engineering methods. Finally, organizations should validate the relevance of these IOCs to their environment to avoid alert fatigue and focus on high-fidelity indicators.

Community reviews

Loading reviews…