IndicatorPublished 21 Dec 2023Updated 22 Dec 2023

type osint · ThreatFox IOCs for 2023-12-21

Affects type osintSource ThreatFox MISP Feed

TLP:WHITE, disclosure is not limited

Indicators of compromise

Domains 61

getfnewsolutions.comCobalt Strike botnet C2 domain (confidence level: 100%)
bluenetworking.netCobalt Strike botnet C2 domain (confidence level: 100%)
erihudeg.comCobalt Strike botnet C2 domain (confidence level: 100%)
mail.googlesmail.xyzCobalt Strike botnet C2 domain (confidence level: 50%)
adavanced-ip-scaner.comDanaBot payload delivery domain (confidence level: 75%)
adavanced-ip-scanner.comDanaBot payload delivery domain (confidence level: 75%)
adevancd-lp-scanner.comDanaBot payload delivery domain (confidence level: 75%)
adevanced-ip-scans.comDanaBot payload delivery domain (confidence level: 75%)
adevanced-lp-scaners.comDanaBot payload delivery domain (confidence level: 75%)
adevanced-lp-scanner.netDanaBot payload delivery domain (confidence level: 75%)

URLs 96

http://creepfleetconfusew.fun/apiLumma Stealer botnet C2 (confidence level: 100%)
http://moscow-post.ru/blogggg/blogger.phpMars Stealer botnet C2 (confidence level: 100%)
http://962855cm.nyashtech.top/datalifetemp.phpDCRat botnet C2 (confidence level: 100%)
http://bombertublestylebanws.fun/apiLumma Stealer botnet C2 (confidence level: 100%)
https://194.26.135.67/mtq4mmuxodbhmtvi/Coper botnet C2 (confidence level: 80%)
http://82.146.37.188/cdnmulti/linepollsqldlecdn.phpDCRat botnet C2 (confidence level: 100%)
http://zekhost.000webhostapp.com/396833e4.phpDCRat botnet C2 (confidence level: 100%)
https://95.216.178.71/Vidar botnet C2 (confidence level: 100%)
http://1.15.189.30/__utm.gifCobalt Strike botnet C2 (confidence level: 100%)
http://213.109.202.219/caCobalt Strike botnet C2 (confidence level: 100%)

IP addresses 86

171.5.184.236Meterpreter botnet C2 server (confidence level: 80%)
54.39.105.235Xtreme RAT botnet C2 server (confidence level: 80%)
77.105.132.87RedLine Stealer botnet C2 server (confidence level: 100%)
15.207.21.242Meterpreter botnet C2 server (confidence level: 80%)
121.37.82.36Cobalt Strike botnet C2 server (confidence level: 80%)
13.232.180.80Meterpreter botnet C2 server (confidence level: 80%)
94.131.107.198BianLian botnet C2 server (confidence level: 50%)
139.84.147.34Havoc botnet C2 server (confidence level: 50%)
91.92.250.227Havoc botnet C2 server (confidence level: 50%)
13.38.219.27Havoc botnet C2 server (confidence level: 50%)

Description

ThreatFox IOCs for 2023-12-21

Impact

For European organizations, the impact of this threat is currently limited due to the lack of detailed exploitation information and absence of known active exploits. However, the presence of IOCs related to malware and payload delivery implies potential risks of infection through network vectors, which could lead to unauthorized access, data exfiltration, or service disruption if exploited. Organizations relying on OSINT tools or monitoring network traffic for threat intelligence may find these IOCs useful for detection and prevention. The medium severity suggests a moderate risk that could escalate if further details or active exploitation emerge. European entities with critical infrastructure or sensitive data could face confidentiality and availability risks if the malware payloads are successfully delivered and executed.

Defensive guidance

Given the limited technical details, European organizations should enhance their network monitoring capabilities to detect unusual payload delivery attempts and network activity patterns. Integrating these IOCs into existing Security Information and Event Management (SIEM) systems and threat intelligence platforms can improve detection accuracy. Regularly updating and tuning intrusion detection/prevention systems (IDS/IPS) to recognize emerging malware signatures is recommended. Organizations should also conduct threat hunting exercises focusing on network traffic anomalies and payload delivery mechanisms. Since no patches are available, emphasis should be placed on network segmentation, strict access controls, and user awareness training to reduce the attack surface. Collaboration with national Computer Security Incident Response Teams (CSIRTs) and sharing intelligence within European cybersecurity communities will help in early identification and response.

Community reviews

Loading reviews…