IndicatorPublished 11 Aug 2024Updated 12 Aug 2024

type osint · ThreatFox IOCs for 2024-08-11

Affects type osintSource ThreatFox MISP Feed

TLP:WHITE, disclosure is not limited

Indicators of compromise

Domains 1

FAKEUPDATES payload delivery domain (confidence level: 100%)

k1gkl25as.top

URLs 12

http://185.7.214.148/p2pPoseidon Stealer botnet C2 (confidence level: 100%)
https://k1gkl25as.top/cdn-vs/original.jsFAKEUPDATES payload delivery URL (confidence level: 100%)
https://k1gkl25as.top/cdn-vs/main.phpFAKEUPDATES payload delivery URL (confidence level: 100%)
https://k1gkl25as.top/cdn-vs/download.phpFAKEUPDATES payload delivery URL (confidence level: 100%)
https://k1gkl25as.top/cdn-vs/data.phpFAKEUPDATES payload delivery URL (confidence level: 100%)
http://82.147.84.78/116b775395f6d155.phpStealc botnet C2 (confidence level: 100%)
http://knafi2hc.beget.tech/l1nc0in.phpDCRat botnet C2 (confidence level: 100%)
http://149387cm.n9sh.top/authuniversaltrackpublic.phpDCRat botnet C2 (confidence level: 100%)
http://764337cm.nyashsens.top/externalvideojavascript_polllongpollserversqllinuxtemporary.phpDCRat botnet C2 (confidence level: 100%)
https://enthusiandsi.shop/apiLumma Stealer botnet C2 (confidence level: 75%)

IP addresses 300

198.49.23.145NjRAT botnet C2 server (confidence level: 100%)
198.185.159.145RedLine Stealer botnet C2 server (confidence level: 100%)
198.49.23.144RedLine Stealer botnet C2 server (confidence level: 100%)
185.215.113.9RedLine Stealer botnet C2 server (confidence level: 100%)
45.134.225.249Cobalt Strike botnet C2 server (confidence level: 100%)
197.115.250.167Cobalt Strike botnet C2 server (confidence level: 100%)
198.23.227.140AsyncRAT botnet C2 server (confidence level: 100%)
34.30.200.104AsyncRAT botnet C2 server (confidence level: 100%)
91.92.246.91AsyncRAT botnet C2 server (confidence level: 100%)
64.225.100.125Unknown malware botnet C2 server (confidence level: 100%)

Hashes 87

27fa12e9f8da06637e65bce23ceac81166a69339DCRat payload (confidence level: 95%)
ab71530434f64e6aa105732c42dbb5a409ac0aae4258b3c3e7db1a7d5914cc30DCRat payload (confidence level: 95%)
88ddfef19f1f2022465446130e90a446DCRat payload (confidence level: 95%)
3bc3cc20237e49eaa3a3e8b0cc1cd1f72557afafDCRat payload (confidence level: 95%)
35207a3471394e220d6fc21cf929907a26dee17ef697e4e6febf839806e81726DCRat payload (confidence level: 95%)
56d36ed6d8e1e05afbf614048570a913DCRat payload (confidence level: 95%)
d2836aa4d38c3f2b7c45b76054560192ab0d31eeZyklon payload (confidence level: 95%)
156cf00f84c98299430c13651ff982e634fb0ac072f1d230b9f3c272e8403097Zyklon payload (confidence level: 95%)
5bc972f4b568a85ef094f1552b888d63Zyklon payload (confidence level: 95%)
66bb8523fb2906a9f081e5fc5bf80d2674f5d1acDCRat payload (confidence level: 95%)

Description

ThreatFox IOCs for 2024-08-11

Impact

For European organizations, the impact of this threat is currently limited due to the absence of specific exploit details or active campaigns. However, the dissemination of IOCs related to malware network activity and payload delivery can aid in early detection and prevention of potential infections. If these IOCs correspond to emerging malware strains or campaigns targeting European networks, organizations could face risks including data exfiltration, system compromise, or service disruption. The medium severity rating suggests a moderate risk level, emphasizing the importance of integrating these IOCs into security monitoring tools to enhance situational awareness. Given the lack of known exploits in the wild, immediate operational impact is likely low, but vigilance is warranted to detect any shifts in threat actor activity that could leverage these indicators for targeted attacks within Europe.

Defensive guidance

European organizations should incorporate the provided IOCs into their existing threat intelligence platforms and security information and event management (SIEM) systems to improve detection capabilities. Specific mitigation steps include: 1) Regularly updating network intrusion detection and prevention systems (IDS/IPS) with the latest IOCs from ThreatFox and other reputable OSINT sources; 2) Enhancing endpoint detection and response (EDR) tools to recognize payload delivery patterns associated with the reported malware activity; 3) Conducting threat hunting exercises focused on the network behaviors and indicators described to identify potential early-stage infections; 4) Ensuring robust network segmentation to limit lateral movement if payload delivery attempts are successful; 5) Training security operations center (SOC) analysts to recognize the significance of these IOCs and respond promptly to alerts; 6) Maintaining up-to-date asset inventories and vulnerability management processes to reduce attack surface exposure, even though no patches are currently available for this specific threat; 7) Collaborating with national and European cybersecurity information sharing organizations to receive timely updates on evolving threat landscapes.

Community reviews

Loading reviews…