IndicatorPublished 6 Nov 2024Updated 7 Nov 2024

type osint · ThreatFox IOCs for 2024-11-06

Affects type osintSource ThreatFox MISP Feed

TLP:WHITE, disclosure is not limited

Indicators of compromise

Domains 28

votae.topVidar botnet C2 domain (confidence level: 100%)
dovip.winUnknown malware botnet C2 domain (confidence level: 100%)
d.dovip.winUnknown malware botnet C2 domain (confidence level: 100%)
sevjp17vt.topCryptBot botnet C2 domain (confidence level: 100%)
80-253-246-234.cprapid.comQuasar RAT botnet C2 domain (confidence level: 100%)
7zlp2024.shopNetSupportManager RAT payload delivery domain (confidence level: 100%)
parduawarj.siteLumma Stealer botnet C2 domain (confidence level: 100%)
painttfel.funLumma Stealer botnet C2 domain (confidence level: 100%)
tventjp20vt.topCryptBot botnet C2 domain (confidence level: 100%)
moviecentral-petparade3.comAmadey botnet C2 domain (confidence level: 100%)

URLs 42

https://dd5da.com/api/index/installAndroRAT payload delivery URL (confidence level: 100%)
https://dd5da.com/api/index/recordAndroRAT payload delivery URL (confidence level: 100%)
https://raincoatfg.cfd/ytzhzjlioddlyti4/Coper botnet C2 (confidence level: 100%)
https://154.197.69.165/xclient.exeXWorm payload delivery URL (confidence level: 50%)
https://154.197.69.165/crss.exeAsyncRAT payload delivery URL (confidence level: 50%)
https://154.197.69.165/system.exeDarkComet payload delivery URL (confidence level: 50%)
http://103.203.72.222:58469/mozi.mMozi payload delivery URL (confidence level: 50%)
https://parduawarj.site/apiLumma Stealer botnet C2 (confidence level: 100%)
http://152.67.212.187:443/accelerate/irc/z0lcy5jyzl5Cobalt Strike botnet C2 (confidence level: 75%)
http://pedrobyst.beget.tech/l1nc0in.phpDCRat botnet C2 (confidence level: 100%)

IP addresses 99

65.109.241.94Vidar botnet C2 server (confidence level: 100%)
87.120.113.37Remcos botnet C2 server (confidence level: 100%)
54.83.79.81Sliver botnet C2 server (confidence level: 100%)
185.241.208.88AsyncRAT botnet C2 server (confidence level: 100%)
172.235.128.191AsyncRAT botnet C2 server (confidence level: 100%)
67.217.244.177AsyncRAT botnet C2 server (confidence level: 100%)
37.60.251.9Hook botnet C2 server (confidence level: 100%)
158.69.41.123Hook botnet C2 server (confidence level: 100%)
65.108.205.106Quasar RAT botnet C2 server (confidence level: 100%)
148.113.192.160Havoc botnet C2 server (confidence level: 100%)

Hashes 587

33e59eecf2930c764a4ca7ccfb3cadfbfdd6d522959298bb6993a809e07257c5StrelaStealer payload (confidence level: 100%)
f26e200dbd6e0da507951068207d14a61a106b1b38681f4f7e241f183a97fbfdStrelaStealer payload (confidence level: 100%)
6713c0448d1d2a4473eede9ea545f8f533d5ccddadb593e52215c6a446f86e95StrelaStealer payload (confidence level: 100%)
621d171ad5e28c2f3aebbf06502f767b3b1fcec27860f03cb8bd50ad32a072a6StrelaStealer payload (confidence level: 100%)
57e02774daa8e5db7691cb9f0757d82dfd3f27854e16e13806fabc0016d539c4StrelaStealer payload (confidence level: 100%)
765335a32bb7aaa50032c456d0517438a3cbe673c9afe22fa76cff337741e945StrelaStealer payload (confidence level: 100%)
e96c78753011ae019f029b0caa3591b544465a1c64dfeb68b71b4630661e287eStrelaStealer payload (confidence level: 100%)
b002beb2ffec00710ca0e89c29690e022adf2332f139d83d3b9c6165fa6e8ae3StrelaStealer payload (confidence level: 100%)
efbd63fbc0f6f524da4cfa38dc7824d6fc301bb4c68d02d056553dea63f98a3fStrelaStealer payload (confidence level: 100%)
add2cb2569506f5f626d218e3360839c3c91cc4d9a4ff46b7fa4e55576d6b00fStrelaStealer payload (confidence level: 100%)

Description

ThreatFox IOCs for 2024-11-06

Impact

For European organizations, the potential impact of this threat depends largely on the nature of the malware payload and its delivery mechanism, which are not specified. Given the medium severity and the focus on payload delivery and network activity, the threat could lead to unauthorized access, data exfiltration, or disruption of network services if successfully deployed. The absence of known exploits in the wild suggests that immediate widespread impact may be limited, but organizations should remain vigilant. European entities with extensive network infrastructure or those involved in critical sectors such as finance, healthcare, or government could face increased risk if the malware targets network vulnerabilities or leverages social engineering for payload delivery. The lack of patches or mitigation details means that detection and response capabilities will be crucial in limiting impact. Additionally, since the threat is tracked via OSINT, organizations that monitor threat intelligence feeds may have an advantage in early detection and response.

Defensive guidance

Given the limited technical details, mitigation should focus on enhancing detection and prevention capabilities specific to malware payload delivery and network activity. European organizations should: 1) Implement robust network monitoring and anomaly detection systems to identify unusual payload delivery attempts or suspicious network traffic patterns. 2) Maintain up-to-date endpoint protection solutions capable of detecting and blocking malware payloads, including heuristic and behavior-based detection methods. 3) Leverage threat intelligence feeds, including ThreatFox and MISP, to stay informed about emerging indicators of compromise (IOCs) and adjust detection rules accordingly. 4) Conduct regular security awareness training to reduce the risk of social engineering attacks that may facilitate payload delivery. 5) Employ network segmentation and strict access controls to limit the lateral movement of malware within organizational networks. 6) Prepare incident response plans that include procedures for malware containment, eradication, and recovery, given the absence of patches. 7) Collaborate with national cybersecurity centers and information sharing organizations to exchange intelligence and best practices related to this threat.

Summary

The provided information describes a security threat categorized as malware, sourced from the ThreatFox MISP Feed, with a publication date of November 6, 2024. The threat is associated with OSINT (Open Source Intelligence), payload delivery, and network activity. However, the details are minimal: no specific affected product versions are listed, no known exploits in the wild are reported, and no patches are available. The threat level is indicated as 2 (on an unspecified scale), with analysis and distribution values provided but without further elaboration. The absence of concrete technical indicators, such as malware behavior, attack vectors, or exploitation techniques, limits the ability to fully characterize the threat. The tags and categories suggest that this threat involves the delivery of malicious payloads potentially detected or tracked via OSINT methods, implying it may be part of ongoing malware campaigns or infrastructure monitoring. The lack of CWE identifiers and patch information further indicates that this is likely a newly observed or emerging threat without established remediation paths. Overall, the threat appears to be a medium-severity malware-related activity focused on payload delivery and network-based operations, but with limited actionable technical details.

Community reviews

Loading reviews…