IndicatorPublished 27 Oct 2024Updated 28 Oct 2024

type osint · ThreatFox IOCs for 2024-10-27

Affects type osintSource ThreatFox MISP Feed

TLP:WHITE, disclosure is not limited

Indicators of compromise

Domains 12

race-frequent.gl.at.ply.ggNjRAT botnet C2 domain (confidence level: 75%)
www.185-150-24-68.cprapid.comBashlite botnet C2 domain (confidence level: 100%)
search-slv.comBashlite botnet C2 domain (confidence level: 100%)
search-spd.comBashlite botnet C2 domain (confidence level: 100%)
search-gld.comBashlite botnet C2 domain (confidence level: 100%)
111-90-140-34.cprapid.comRemcos botnet C2 domain (confidence level: 100%)
stats.search-st1.comBashlite botnet C2 domain (confidence level: 100%)
mail.webpanel777.plUnknown malware botnet C2 domain (confidence level: 100%)
mail.111-90-140-34.cprapid.comRemcos botnet C2 domain (confidence level: 100%)
cpcontacts.spainparkvillas.comBashlite botnet C2 domain (confidence level: 100%)

URLs 27

http://185.215.113.217/coreopt/login.phpAmadey botnet C2 (confidence level: 100%)
https://94.156.253.20/nznlmdmzywexmzk1/Coper botnet C2 (confidence level: 80%)
https://staris7542352r23.net/nznlmdmzywexmzk1/Coper botnet C2 (confidence level: 80%)
https://staris6442352r23.net/nznlmdmzywexmzk1/Coper botnet C2 (confidence level: 80%)
https://staris5342352r23.net/nznlmdmzywexmzk1/Coper botnet C2 (confidence level: 80%)
https://staris4242352r23.net/nznlmdmzywexmzk1/Coper botnet C2 (confidence level: 80%)
https://staris3142352r23.net/nznlmdmzywexmzk1/Coper botnet C2 (confidence level: 80%)
http://304773cm.n9shteam.in/jscpugamegeneratorprivate.phpDCRat botnet C2 (confidence level: 100%)
http://93.127.223.191:8888/supershell/login/Unknown malware botnet C2 (confidence level: 100%)
https://opinieni.store/apiLumma Stealer botnet C2 (confidence level: 75%)

IP addresses 96

147.185.221.23NjRAT botnet C2 server (confidence level: 75%)
156.238.252.65Cobalt Strike botnet C2 server (confidence level: 100%)
52.250.71.36Sliver botnet C2 server (confidence level: 100%)
3.71.225.231NjRAT botnet C2 server (confidence level: 75%)
18.192.31.30NjRAT botnet C2 server (confidence level: 75%)
3.74.27.83NjRAT botnet C2 server (confidence level: 75%)
49.113.79.193Unknown malware botnet C2 server (confidence level: 100%)
103.106.202.21Unknown malware botnet C2 server (confidence level: 100%)
34.70.255.193AsyncRAT botnet C2 server (confidence level: 100%)
198.167.199.173Quasar RAT botnet C2 server (confidence level: 100%)

Description

ThreatFox IOCs for 2024-10-27

Impact

For European organizations, the impact of this IOC set is primarily in enhancing detection capabilities rather than mitigating an immediate active threat. Since no specific malware or exploit is detailed, the direct risk to confidentiality, integrity, or availability is unclear. However, these IOCs can help security teams identify suspicious network activity or payload delivery attempts that might be part of broader attack campaigns. Organizations relying on threat intelligence feeds can integrate these IOCs into their security monitoring tools to improve early detection and response. The medium severity rating suggests a moderate level of concern, likely reflecting the potential for these indicators to be associated with ongoing or emerging threats. Without concrete exploit details, the impact remains largely preventive and intelligence-driven rather than reactive to an active compromise.

Defensive guidance

European organizations should incorporate these IOCs into their existing security monitoring and threat detection platforms such as SIEMs, IDS/IPS, and endpoint detection and response (EDR) systems. Regularly updating threat intelligence feeds and correlating these IOCs with internal logs can help identify suspicious activity early. Network segmentation and strict payload inspection policies can reduce the risk of successful payload delivery. Additionally, organizations should maintain robust incident response plans to investigate alerts triggered by these IOCs. Since no patches are available, emphasis should be placed on detection and containment. Sharing findings with relevant national cybersecurity centers or ISACs can enhance collective defense. Finally, continuous training for security analysts on interpreting and acting upon OSINT-derived IOCs will improve operational effectiveness.

Community reviews

Loading reviews…