IndicatorPublished 2 Nov 2024Updated 3 Nov 2024

type osint · ThreatFox IOCs for 2024-11-02

Affects type osintSource ThreatFox MISP Feed

TLP:WHITE, disclosure is not limited

Indicators of compromise

Domains 19

mundiprep.comFAKEUPDATES payload delivery domain (confidence level: 100%)
loader.ssag00v-0ffical.comUnknown malware botnet C2 domain (confidence level: 100%)
teebro1800.dynamic-dns.netRemcos botnet C2 domain (confidence level: 100%)
mx5.deitie.asiaQuasar RAT botnet C2 domain (confidence level: 100%)
orchestratb.cyouLumma Stealer botnet C2 domain (confidence level: 100%)
www.izoa.netsons.orgUnknown malware botnet C2 domain (confidence level: 100%)
releases.gotraffic.frMimiKatz botnet C2 domain (confidence level: 100%)
ninjo19ht.topCryptBot botnet C2 domain (confidence level: 100%)
onejo1ht.topCryptBot botnet C2 domain (confidence level: 100%)
sevjoi17ht.topCryptBot botnet C2 domain (confidence level: 100%)

URLs 12

https://mundiprep.com/work/index.phpFAKEUPDATES payload delivery URL (confidence level: 100%)
http://62.204.41.163/c882d91d1df1bdb3.phpStealc botnet C2 (confidence level: 100%)
http://95.215.207.167/076106d399a0a4a4.phpStealc botnet C2 (confidence level: 100%)
http://k83398f9.beget.tech/l1nc0in.phpDCRat botnet C2 (confidence level: 100%)
http://147.45.45.201/pipesql/provider/eternalvoiddb/wordpress6/uploads67/6windows/linepipejavascriptgeobasedatalifewppubliccdn.phpDCRat botnet C2 (confidence level: 100%)
http://cm45075.tw1.ru/603c38ec.phpDCRat botnet C2 (confidence level: 100%)
http://109.120.176.203/api/crazyfish.phpPrivateLoader botnet C2 (confidence level: 100%)
http://194.135.20.4/8/traffic/dumpprivatewp2/bigload8/downloadsgame/temporarymulti6/wplinux/line1/3packetbase/downloadsapipublicto/3tempcdnpublic/private8towp/58cpuasync/26api/javascriptjs/javascript/default/eternalimageprovider/eternaltopollpacketlowapiprotecttrafficwordpress.phpDCRat botnet C2 (confidence level: 100%)
http://39.106.152.236:11443/loadCobalt Strike botnet C2 (confidence level: 75%)
http://95.215.207.66/f4e83cc9bf3bad72.phpStealc botnet C2 (confidence level: 100%)

IP addresses 112

39.100.100.54Cobalt Strike botnet C2 server (confidence level: 100%)
124.70.141.78Cobalt Strike botnet C2 server (confidence level: 100%)
82.115.223.88Unknown malware botnet C2 server (confidence level: 100%)
88.209.248.69AsyncRAT botnet C2 server (confidence level: 100%)
192.3.95.164AsyncRAT botnet C2 server (confidence level: 100%)
192.3.95.164AsyncRAT botnet C2 server (confidence level: 100%)
161.35.88.226Unknown malware botnet C2 server (confidence level: 100%)
217.107.219.171Hook botnet C2 server (confidence level: 100%)
45.149.241.241Hook botnet C2 server (confidence level: 100%)
45.149.241.241Hook botnet C2 server (confidence level: 100%)

Description

ThreatFox IOCs for 2024-11-02

Impact

For European organizations, the impact of this threat is currently difficult to quantify precisely due to the lack of detailed technical information. However, malware associated with OSINT and network payload delivery can lead to significant risks including data exfiltration, system compromise, and disruption of services. Medium severity suggests that while the threat is notable, it may not be immediately critical or widespread. European entities that rely heavily on networked infrastructure and have exposure to open internet services could be vulnerable to initial infection vectors such as phishing or drive-by downloads. The potential impact includes loss of confidentiality if sensitive data is accessed or stolen, integrity issues if malware alters data or system configurations, and availability concerns if payloads include ransomware or destructive components. The lack of known exploits in the wild may indicate that this threat is either emerging or under active monitoring, but organizations should remain vigilant as malware threats can evolve rapidly. The use of OSINT techniques by attackers may also imply targeted reconnaissance against European organizations, increasing the risk for sectors with high-value data or critical infrastructure.

Defensive guidance

Given the nature of the threat and the limited specific details, European organizations should implement targeted mitigations beyond generic advice: 1) Enhance OSINT monitoring capabilities to detect and analyze emerging threat indicators relevant to their sector and geography. 2) Strengthen network defenses by deploying advanced intrusion detection and prevention systems capable of identifying unusual payload delivery patterns. 3) Conduct regular phishing simulation exercises and user awareness training focused on recognizing social engineering tactics that leverage OSINT data. 4) Implement strict network segmentation and least privilege access controls to limit malware propagation if an infection occurs. 5) Maintain up-to-date endpoint detection and response (EDR) solutions with behavioral analysis to detect unknown or polymorphic malware payloads. 6) Collaborate with national and European cybersecurity information sharing platforms to receive timely updates on emerging threats and IOCs. 7) Prepare incident response plans that include procedures for malware containment, eradication, and forensic analysis to quickly address infections related to this threat type.

Community reviews

Loading reviews…