IndicatorPublished 26 Nov 2024Updated 27 Nov 2024

type osint · ThreatFox IOCs for 2024-11-26

Affects type osintSource ThreatFox MISP Feed

TLP:WHITE, disclosure is not limited

Indicators of compromise

Domains 13

electrum-sol.orgUnknown malware payload delivery domain (confidence level: 100%)
www.electrum-sol.orgUnknown malware payload delivery domain (confidence level: 100%)
electrum-doge.orgUnknown malware payload delivery domain (confidence level: 100%)
www.electrum-sol.orgUnknown malware payload delivery domain (confidence level: 100%)
naturealmikaly.sytes.netLoki Password Stealer (PWS) botnet C2 domain (confidence level: 75%)
crypto-way.proLumma Stealer botnet C2 domain (confidence level: 100%)
pozza.cyouVidar botnet C2 domain (confidence level: 100%)
nastictac.comFAKEUPDATES payload delivery domain (confidence level: 75%)
blaekindustry.comFAKEUPDATES payload delivery domain (confidence level: 100%)
www.syofi.comFAKEUPDATES payload delivery domain (confidence level: 100%)

URLs 31

http://93.123.85.37/pages/login.phpUnknown malware botnet C2 (confidence level: 100%)
http://www.falamucci.com/hello_a.phpUnknown malware botnet C2 (confidence level: 100%)
http://192.210.141.106:8888/supershell/login/Unknown malware botnet C2 (confidence level: 100%)
https://nastictac.com/365h.jsFAKEUPDATES payload delivery URL (confidence level: 75%)
https://peacefulmind.shop/apiLumma Stealer botnet C2 (confidence level: 100%)
http://ct10906.tw1.ru/fe82f542.phpDCRat botnet C2 (confidence level: 100%)
https://blaekindustry.com/work/original.jsFAKEUPDATES payload delivery URL (confidence level: 100%)
https://blaekindustry.com/work/index.phpFAKEUPDATES payload delivery URL (confidence level: 100%)
https://blaekindustry.com/work/fix2.phpFAKEUPDATES payload delivery URL (confidence level: 100%)
https://blaekindustry.com/work/xxx.zipFAKEUPDATES payload delivery URL (confidence level: 100%)

IP addresses 27

45.149.241.168Loki Password Stealer (PWS) botnet C2 server (confidence level: 75%)
135.181.185.254AsyncRAT botnet C2 server (confidence level: 100%)
39.107.136.241Cobalt Strike botnet C2 server (confidence level: 100%)
3.253.95.83Cobalt Strike botnet C2 server (confidence level: 100%)
43.226.125.42Cobalt Strike botnet C2 server (confidence level: 100%)
47.108.159.178Cobalt Strike botnet C2 server (confidence level: 100%)
149.88.75.159Cobalt Strike botnet C2 server (confidence level: 100%)
180.184.34.123Cobalt Strike botnet C2 server (confidence level: 100%)
34.92.41.65Cobalt Strike botnet C2 server (confidence level: 100%)
104.168.148.234Cobalt Strike botnet C2 server (confidence level: 100%)

Hashes 2

Unknown malware payload (confidence level: 100%)

220c13ed547eefe13afc446bbd84f5fe8790dd9d109905f583f5ffb97520a872
2d36c1e2dbd05433e3fadb7bd6dca2e01e0ba895e161f07218197d9712d35648

Description

ThreatFox IOCs for 2024-11-26

Impact

For European organizations, the impact of this threat intelligence update is primarily in enhancing detection and response capabilities rather than immediate risk from a new exploit. Since no specific affected products or vulnerabilities are identified, the direct operational impact is limited. However, the presence of payload delivery and network activity indicators could signal ongoing or emerging malware campaigns that may target European networks. Organizations relying on OSINT feeds like ThreatFox can leverage these IOCs to improve their threat hunting and incident response processes. The medium severity suggests a moderate risk level, emphasizing the importance of maintaining robust network monitoring and malware detection controls. Without concrete exploit details, the impact is more about preparedness and situational awareness than immediate compromise or data loss.

Defensive guidance

To mitigate risks associated with the malware-related IOCs and payload delivery activities described, European organizations should: 1) Integrate ThreatFox and similar OSINT feeds into their Security Information and Event Management (SIEM) and Endpoint Detection and Response (EDR) systems to automate IOC matching and alerting. 2) Enhance network traffic monitoring to detect anomalous payload delivery patterns, including unusual outbound connections or command-and-control communications. 3) Conduct regular threat hunting exercises using the provided IOCs to identify potential infections early. 4) Maintain up-to-date endpoint protection solutions capable of detecting and blocking known malware payloads. 5) Train security teams to interpret OSINT feed updates and correlate them with internal telemetry for proactive defense. 6) Since no patches are available, focus on detection and containment rather than remediation of a specific vulnerability. 7) Implement strict network segmentation and least privilege principles to limit malware propagation if an infection occurs.

Community reviews

Loading reviews…