IndicatorPublished 25 Aug 2024Updated 26 Aug 2024

type osint · ThreatFox IOCs for 2024-08-25

Affects type osintSource ThreatFox MISP Feed

TLP:WHITE, disclosure is not limited

Indicators of compromise

Domains 11

nova-screen-webview.comNova Stealer botnet C2 domain (confidence level: 100%)
hellokittymeowmeow.xyzUnknown malware botnet C2 domain (confidence level: 100%)
api.hellokittymeowmeow.xyzUnknown malware botnet C2 domain (confidence level: 100%)
zealous-pine-98499.pktriot.netNjRAT botnet C2 domain (confidence level: 75%)
eloquentcs.comLoki Password Stealer (PWS) botnet C2 domain (confidence level: 75%)
ajsdiaolke.shopClearFake payload delivery domain (confidence level: 100%)
caffegclasiqwp.shopLumma Stealer botnet C2 domain (confidence level: 100%)
traineiwnqo.shopLumma Stealer botnet C2 domain (confidence level: 100%)
millyscroqwp.shopLumma Stealer botnet C2 domain (confidence level: 100%)
deadlywarfare.comUnknown malware botnet C2 domain (confidence level: 100%)

URLs 8

http://39.65.243.230:43209/mozi.mMozi payload delivery URL (confidence level: 50%)
http://572335cm.n9sh.top/cpuserverasyncuniversal.phpDCRat botnet C2 (confidence level: 100%)
http://ntkdnj.oy4wvawf.pro:80/functionalstatus/spssrjtsgp21e9h7ytlyk9p87tixirl61fmtj5aCobalt Strike botnet C2 (confidence level: 75%)
https://reagoofydwqioo.shop/apiLumma Stealer botnet C2 (confidence level: 75%)
http://671893cm.n9shka.top/eternalpipelowprocessdbdatalifewppubliccdn.phpDCRat botnet C2 (confidence level: 100%)
https://calcuatllitwop.shop/apiLumma Stealer botnet C2 (confidence level: 75%)
https://largerryskwhq.shop/apiLumma Stealer botnet C2 (confidence level: 75%)
http://182.117.41.106:42748/mozi.mMozi payload delivery URL (confidence level: 50%)

IP addresses 80

92.249.48.64Nova Stealer botnet C2 server (confidence level: 100%)
92.249.48.64Nova Stealer botnet C2 server (confidence level: 100%)
142.171.227.226Cobalt Strike botnet C2 server (confidence level: 100%)
47.120.52.176Cobalt Strike botnet C2 server (confidence level: 100%)
83.233.243.109DarkComet botnet C2 server (confidence level: 100%)
118.163.177.120Remcos botnet C2 server (confidence level: 100%)
35.91.95.28Sliver botnet C2 server (confidence level: 100%)
2.59.134.73AsyncRAT botnet C2 server (confidence level: 100%)
34.30.202.89Unknown malware botnet C2 server (confidence level: 100%)
176.98.40.202Stealc botnet C2 server (confidence level: 100%)

Hashes 155

0fe2fbc84387624cd894a02f4b4ba6b8ce92003bMars Stealer payload (confidence level: 95%)
a59640e1fd35cc864861dda2e4fb1fdcadbb6a0668fcb3bf9ff5ab2675ad8d4eMars Stealer payload (confidence level: 95%)
e22588b227673158f945994b75891b19Mars Stealer payload (confidence level: 95%)
bc9c7bdb87936f580871374b60ccb9392770594dQuasar RAT payload (confidence level: 95%)
378d287411180c7a4a675116862bd810b8250a7c11a3c5fd04b04ef59e0e4cf8Quasar RAT payload (confidence level: 95%)
ca283d3c1cccde01d5fca1e37c3fddb6Quasar RAT payload (confidence level: 95%)
6ae60c2879ebe69ac40d149ed5a608250d022dceQuasar RAT payload (confidence level: 95%)
c1dd6ce8d69876282a88739c537d5a2369a19c4b6cf360af5983c12c9dc3f2d6Quasar RAT payload (confidence level: 95%)
3053a2a43ba2fbc6e3e3ecbecde806d1Quasar RAT payload (confidence level: 95%)
dddbf37fe2be08bccb2ebf153a5639a22ac7bf3eCobalt Strike payload (confidence level: 95%)

Description

ThreatFox IOCs for 2024-08-25

Impact

For European organizations, the impact of this threat intelligence update is primarily in the realm of enhanced situational awareness and improved detection capabilities. Since no active exploits or specific vulnerabilities are identified, the direct risk to confidentiality, integrity, or availability is limited at this stage. However, the presence of new IOCs related to malware and payload delivery means that organizations should be vigilant for potential network intrusions or malware infections that could leverage these indicators. The medium severity rating suggests a moderate risk level, implying that while no immediate widespread attacks are reported, the threat actors may be preparing or conducting low-level reconnaissance or delivery attempts. European entities with critical infrastructure, financial services, or government networks should consider integrating these IOCs into their security monitoring tools to detect early signs of compromise. Failure to do so could delay incident detection and response, potentially increasing the impact if the threat evolves into active exploitation.

Defensive guidance

1. Integrate the provided IOCs into existing Security Information and Event Management (SIEM) systems and threat intelligence platforms to enhance detection of related network activity and payload delivery attempts. 2. Conduct proactive network traffic analysis focusing on anomalies that match the behavioral patterns suggested by the OSINT and network activity tags. 3. Update intrusion detection and prevention systems (IDS/IPS) with signatures derived from these IOCs to block or alert on suspicious communications. 4. Perform regular endpoint and network scans to identify any signs of malware infections or unauthorized payload deliveries. 5. Educate security teams on the nature of OSINT-based threat intelligence to improve contextual understanding and response prioritization. 6. Maintain up-to-date asset inventories and ensure segmentation of critical systems to limit potential lateral movement if an infection occurs. 7. Monitor threat intelligence feeds continuously for updates that may provide more detailed indicators or exploit information related to this threat. 8. Since no patches are available, focus on detection and containment strategies rather than remediation of a specific vulnerability.

Community reviews

Loading reviews…