IndicatorPublished 28 Jul 2024Updated 29 Jul 2024

type osint · ThreatFox IOCs for 2024-07-28

Affects type osintSource ThreatFox MISP Feed

TLP:WHITE, disclosure is not limited

Indicators of compromise

Domains 4

euphorianet.xyzMooBot botnet C2 domain (confidence level: 75%)
idea-bernard.gl.at.ply.ggNjRAT botnet C2 domain (confidence level: 75%)
linnrat.lolUnknown malware botnet C2 domain (confidence level: 100%)
cnc.gayMooBot botnet C2 domain (confidence level: 100%)

URLs 6

http://176.74.83.8:58947/mozi.mMozi payload delivery URL (confidence level: 50%)
http://code-yandex.ru/l1nc0in.phpDCRat botnet C2 (confidence level: 100%)
https://demandlinzei.shop/apiLumma Stealer botnet C2 (confidence level: 75%)
http://185.215.113.101/g99kdj4vsa/index.phpAmadey botnet C2 (confidence level: 100%)
http://185.244.219.53/l1nc0in.phpDCRat botnet C2 (confidence level: 100%)
http://92.63.193.127/js_api/bigloadeternal1local/updatetemp/0updatedump_/defaultpollsqllinux/pipe1dle5/update6/asyncmulti9/httpdbtrafficdatalifecdn.phpDCRat botnet C2 (confidence level: 100%)

IP addresses 33

94.156.79.190Venom RAT botnet C2 server (confidence level: 100%)
193.222.96.24Venom RAT botnet C2 server (confidence level: 100%)
185.150.26.210MooBot botnet C2 server (confidence level: 75%)
194.59.30.96RedLine Stealer botnet C2 server (confidence level: 100%)
122.89.105.29NjRAT botnet C2 server (confidence level: 75%)
79.137.202.22AMOS botnet C2 server (confidence level: 100%)
178.33.182.65RedLine Stealer botnet C2 server (confidence level: 100%)
147.182.130.25RedLine Stealer botnet C2 server (confidence level: 100%)
147.185.221.21NjRAT botnet C2 server (confidence level: 75%)
167.179.103.233pupy botnet C2 server (confidence level: 50%)

Hashes 131

212fd19e987c293a3e433514699bed10cbfdb77fDCRat payload (confidence level: 95%)
44f5338948229e66fa0843143857c1442c31137b02eedb34323f48502e27768fDCRat payload (confidence level: 95%)
f4b68c1d68ee0abb05a4a38f8cf08eb3DCRat payload (confidence level: 95%)
1d686b05f745875e28939abe357baedd169b59f5a0d8825b602fd803a6303ba3Quasar RAT payload (confidence level: 95%)
e3e1f7fa42dd68f410bb885f0aefe5e3Quasar RAT payload (confidence level: 95%)
becfa50992a0a2a797caada700dda2f7738faa5aSombRAT payload (confidence level: 95%)
8cf0382f7f56bc86f6d5cf41a76b23d0cbc64dacf467b84f3c94866951eb9561SombRAT payload (confidence level: 95%)
41eac7506fde8b7d8a7a5182a2c2d0ecSombRAT payload (confidence level: 95%)
08af5675922a91d7b1feb14cf2aba6aa436f1770DCRat payload (confidence level: 95%)
13b6effdaeff58f2ec36b3d353c6d7da8a3294e0f3486de26b5832c63bca91a7DCRat payload (confidence level: 95%)

Description

ThreatFox IOCs for 2024-07-28

Impact

Given the nature of the information as OSINT-based IOCs without specific exploit details or affected products, the direct impact on European organizations is currently limited. However, the presence of network activity and payload delivery indicators implies potential reconnaissance or early-stage attack activities that could precede more targeted intrusions. European organizations, especially those with mature security operations centers (SOCs) and threat hunting teams, can leverage these IOCs to enhance detection capabilities and prevent escalation. The medium severity rating suggests that while immediate damage is unlikely, ignoring such intelligence could allow adversaries to establish footholds or exfiltrate data over time. The impact is therefore primarily on the confidentiality and integrity of organizational data if these indicators are linked to active campaigns. Availability impact appears minimal at this stage. Organizations in sectors with high-value data or critical infrastructure should remain vigilant to avoid lateral movement or payload execution that could lead to more severe consequences.

Defensive guidance

To mitigate risks associated with these IOCs, European organizations should integrate the provided indicators into their existing threat intelligence platforms and security information and event management (SIEM) systems for continuous monitoring. Specific steps include: 1) Regularly updating firewall and intrusion detection/prevention system (IDS/IPS) rules to detect network activity matching the IOCs; 2) Conducting proactive threat hunting exercises using these indicators to identify any signs of compromise; 3) Enhancing endpoint detection and response (EDR) capabilities to recognize payload delivery attempts; 4) Ensuring robust network segmentation to limit potential lateral movement if payloads are delivered; 5) Training security analysts to interpret OSINT feeds effectively and correlate them with internal telemetry; 6) Collaborating with national and European cybersecurity information sharing organizations to contextualize these IOCs within broader threat landscapes; 7) Maintaining up-to-date asset inventories to quickly assess exposure to any emerging threats linked to these indicators. Since no patches are available, emphasis should be on detection and containment rather than remediation of a specific vulnerability.

Community reviews

Loading reviews…