IndicatorPublished 10 Apr 2024Updated 11 Apr 2024

type osint · ThreatFox IOCs for 2024-04-10

Affects type osintSource ThreatFox MISP Feed

TLP:WHITE, disclosure is not limited

Indicators of compromise

Domains 15

kuailianv.comDCRat botnet C2 domain (confidence level: 100%)
winarkamaps.comUnidentified 111 (Latrodectus) botnet C2 domain (confidence level: 75%)
stratimasesstr.comUnidentified 111 (Latrodectus) botnet C2 domain (confidence level: 75%)
boom.baiduboomboom.tkCobalt Strike botnet C2 domain (confidence level: 100%)
emv1.ib-comm-gateway.comMirai botnet C2 domain (confidence level: 100%)
zhudaji.comMirai botnet C2 domain (confidence level: 100%)
rubiconviewer.buzzMirai botnet C2 domain (confidence level: 100%)
hatsune.networkMirai botnet C2 domain (confidence level: 100%)
int.hatsune.networkMirai botnet C2 domain (confidence level: 100%)
dsbr.camLoki Password Stealer (PWS) botnet C2 domain (confidence level: 75%)

URLs 45

https://ahhhuu22cxxx.com/zdfmmdlmzwe1ztji/Coper botnet C2 (confidence level: 80%)
https://h23hxa22f3f2a.com/zdfmmdlmzwe1ztji/Coper botnet C2 (confidence level: 80%)
https://h13f2hah2aa.com/zdfmmdlmzwe1ztji/Coper botnet C2 (confidence level: 80%)
https://cwcwac3f422af.com/zdfmmdlmzwe1ztji/Coper botnet C2 (confidence level: 80%)
https://g2agfawfw.com/zdfmmdlmzwe1ztji/Coper botnet C2 (confidence level: 80%)
https://154.23.178.106/lets.exeDCRat payload delivery URL (confidence level: 100%)
http://38.181.35.175/lets.exeDCRat payload delivery URL (confidence level: 100%)
https://154.23.178.139/lets.exeDCRat payload delivery URL (confidence level: 100%)
http://154.23.178.70/lets.exeDCRat payload delivery URL (confidence level: 100%)
https://boom.baiduboomboom.tk:2096/__utm.gifCobalt Strike botnet C2 (confidence level: 100%)

IP addresses 85

77.221.137.22Rhadamanthys botnet C2 server (confidence level: 100%)
47.242.231.229DCRat botnet C2 server (confidence level: 100%)
51.68.169.77DCRat botnet C2 server (confidence level: 100%)
89.105.201.98DCRat botnet C2 server (confidence level: 100%)
179.13.0.175NjRAT botnet C2 server (confidence level: 75%)
1.15.247.249Cobalt Strike botnet C2 server (confidence level: 100%)
51.79.87.4Mirai botnet C2 server (confidence level: 75%)
116.203.15.18Vidar botnet C2 server (confidence level: 100%)
167.71.105.169Havoc botnet C2 server (confidence level: 50%)
47.245.38.152Havoc botnet C2 server (confidence level: 50%)

Description

ThreatFox IOCs for 2024-04-10

Impact

For European organizations, the impact of this threat is primarily related to the ability to detect and respond to malicious network activity and payload delivery attempts. Since no specific vulnerabilities or exploits are described, the direct risk of compromise depends on the organization's existing exposure to malware campaigns that these IOCs represent. If these indicators correspond to malware strains or attack campaigns targeting sectors prevalent in Europe, such as finance, manufacturing, or critical infrastructure, organizations could face risks including data exfiltration, service disruption, or unauthorized access. However, given the medium severity and lack of active known exploits, the immediate operational impact is likely limited to enhanced monitoring and incident response activities. European entities that integrate these IOCs into their security monitoring tools can improve threat detection and reduce dwell time for attackers leveraging these payload delivery methods. The absence of patches or fixes means that mitigation relies on detection and response rather than vulnerability remediation.

Defensive guidance

To effectively mitigate risks associated with these IOCs, European organizations should: 1) Integrate the provided IOCs into their Security Information and Event Management (SIEM) systems and intrusion detection/prevention systems (IDS/IPS) to enhance detection of related network activity and payload delivery attempts. 2) Conduct regular threat hunting exercises using these IOCs to identify potential compromises early. 3) Maintain up-to-date endpoint protection and network segmentation to limit malware spread if payload delivery is successful. 4) Employ network traffic analysis tools to monitor for anomalous behaviors consistent with the indicators. 5) Train security operations teams to recognize patterns associated with these IOCs and respond promptly. 6) Collaborate with threat intelligence sharing communities to receive updates on evolving indicators and related threats. Since no patches are available, emphasis should be on proactive detection and containment strategies rather than remediation of software vulnerabilities.

Community reviews

Loading reviews…