IndicatorPublished 16 Jul 2024Updated 17 Jul 2024

type osint · ThreatFox IOCs for 2024-07-16

Affects type osintSource ThreatFox MISP Feed

TLP:WHITE, disclosure is not limited

Indicators of compromise

Domains 3

away-displays.gl.at.ply.ggNjRAT botnet C2 domain (confidence level: 75%)
verose.topLoki Password Stealer (PWS) botnet C2 domain (confidence level: 100%)
hippieblissprovising.comFAKEUPDATES payload delivery domain (confidence level: 100%)

URLs 18

http://ozero.top/pythonphp_cpubase.phpDCRat botnet C2 (confidence level: 100%)
http://rocheholding.top/rudolph/five/fre.phpLoki Password Stealer (PWS) botnet C2 (confidence level: 75%)
https://lettecoft.com/live/Unidentified 111 (Latrodectus) botnet C2 (confidence level: 49%)
https://ultroawest.com/live/Unidentified 111 (Latrodectus) botnet C2 (confidence level: 49%)
http://77.105.133.27/api/firepro.phpPrivateLoader botnet C2 (confidence level: 100%)
http://77.105.133.27/api/firecom.phpPrivateLoader botnet C2 (confidence level: 100%)
http://papka.top/pythondefaultsqlbasetrackcentral.phpDCRat botnet C2 (confidence level: 100%)
http://77.105.133.27/api/flash.phpPrivateLoader botnet C2 (confidence level: 100%)
http://77.105.133.27/api/twofish.phpPrivateLoader botnet C2 (confidence level: 100%)
http://117.198.11.56:55036/mozi.mMozi payload delivery URL (confidence level: 50%)

IP addresses 60

91.92.249.167RedLine Stealer botnet C2 server (confidence level: 100%)
38.181.25.40Venom RAT botnet C2 server (confidence level: 80%)
95.65.165.151Venom RAT botnet C2 server (confidence level: 80%)
64.190.113.27Venom RAT botnet C2 server (confidence level: 80%)
104.194.154.198RecordBreaker botnet C2 server (confidence level: 80%)
167.71.85.87Hook botnet C2 server (confidence level: 80%)
45.152.65.39Cobalt Strike botnet C2 server (confidence level: 80%)
198.46.145.130Cobalt Strike botnet C2 server (confidence level: 80%)
38.180.204.127RedLine Stealer botnet C2 server (confidence level: 100%)
150.158.155.208Cobalt Strike botnet C2 server (confidence level: 80%)

Hashes 192

5790e528e7a31624698be513cfde41434c00fa08Cobalt Strike payload (confidence level: 95%)
2d4791c66db346075cc3811dedc19b66cdda13d8deb7ef3c5aa44843e8e61597Cobalt Strike payload (confidence level: 95%)
5cebc6552eb1d0665391ddbe8a25bfffCobalt Strike payload (confidence level: 95%)
dea55ab65d2dd759039ea069fc1f7fe055a96da9DCRat payload (confidence level: 95%)
480f4a5849d419021dfa30782d4242f59415e83aca301abb1e2784f8eff882cfDCRat payload (confidence level: 95%)
3431f70e334efd4bc2d2620f26ea1dccDCRat payload (confidence level: 95%)
db48a055cb6b0a92aa87d77e96c0c31c68f63cecKrakenKeylogger payload (confidence level: 95%)
75128be2810392ee9cb9f4d4c847332bd943a321179bb3bc13395bf546caa2feKrakenKeylogger payload (confidence level: 95%)
8b7c477a89b7c69d52da4cc6c9656ac1KrakenKeylogger payload (confidence level: 95%)
7776a6811c5dd56540a085c48cccf7b900ae03f0SombRAT payload (confidence level: 95%)

Description

ThreatFox IOCs for 2024-07-16

Impact

For European organizations, the impact of this threat is currently assessed as low to medium due to the lack of specific exploit details or confirmed active campaigns. If the malware or network activity involves payload delivery, there is a potential risk of unauthorized access, data exfiltration, or disruption of services. However, without identified affected systems or known exploits, the immediate risk remains theoretical. Organizations relying heavily on OSINT for threat intelligence or those with extensive network exposure could be more susceptible if adversaries leverage these IOCs for targeted attacks. The absence of patches or mitigation guidance suggests that the threat is either not fully understood or not yet exploited in a way that requires urgent remediation. European entities should remain vigilant, especially those in critical infrastructure, finance, and government sectors, as these are common targets for malware campaigns involving network reconnaissance and payload delivery.

Defensive guidance

Given the limited technical details, mitigation should focus on strengthening general network security and OSINT handling practices. Specific recommendations include: 1) Enhancing network monitoring to detect unusual outbound or inbound traffic patterns that could indicate payload delivery or command and control communications. 2) Implementing strict access controls and segmentation to limit the spread of potential malware payloads. 3) Regularly updating threat intelligence feeds and correlating them with internal logs to identify any matches with emerging IOCs. 4) Training security teams to recognize OSINT-based reconnaissance activities and to validate the credibility of OSINT sources. 5) Employing sandboxing and behavioral analysis tools to detect suspicious payloads before they execute in production environments. 6) Maintaining robust incident response plans that include procedures for handling malware infections and network intrusions. These steps go beyond generic advice by focusing on proactive detection and containment strategies tailored to OSINT-related threats and payload delivery mechanisms.

Community reviews

Loading reviews…