IndicatorPublished 29 Nov 2024Updated 30 Nov 2024

type osint · ThreatFox IOCs for 2024-11-29

Affects type osintSource ThreatFox MISP Feed

TLP:WHITE, disclosure is not limited

Indicators of compromise

Domains 6

kotov.lolVidar botnet C2 domain (confidence level: 100%)
mirailogin.xyzMirai botnet C2 domain (confidence level: 75%)
fushishandm.infoFAKEUPDATES payload delivery domain (confidence level: 75%)
blessedwirrow.orgFAKEUPDATES payload delivery domain (confidence level: 100%)
hearforpower.orgFAKEUPDATES payload delivery domain (confidence level: 100%)
smthwentwrong.comFAKEUPDATES payload delivery domain (confidence level: 100%)

URLs 21

https://pidlirmidlir23.com/ztzkoduzmtbjyta3/Coper botnet C2 (confidence level: 100%)
https://roskingming3333.site/mwqxmmuxnmeyymu4/Coper botnet C2 (confidence level: 100%)
http://94.156.177.41/davinci/five/fre.phpLoki Password Stealer (PWS) botnet C2 (confidence level: 100%)
https://powermasteryonline.com/xmlrpc.phpGootLoader botnet C2 (confidence level: 75%)
https://encryption-code-verification.b-cdn.net/verify-human-recaptcha.htmlLumma Stealer payload delivery URL (confidence level: 100%)
http://kjbnfdkbf74.b-cdn.net/human-verify-system.htmlLumma Stealer payload delivery URL (confidence level: 100%)
https://92.255.57.88/7bbacc20a3bd2eb5.phpStealc botnet C2 (confidence level: 100%)
https://195.201.44.101/Vidar botnet C2 (confidence level: 100%)
https://kotov.lol/Vidar botnet C2 (confidence level: 100%)
http://94.156.177.41/davinci/five/pvqdq929bsx_a_d_m1n_a.phpLokiBot botnet C2 (confidence level: 100%)

IP addresses 42

207.90.238.101FAKEUPDATES botnet C2 server (confidence level: 100%)
137.220.63.132FAKEUPDATES botnet C2 server (confidence level: 100%)
45.200.148.215Mirai botnet C2 server (confidence level: 75%)
192.169.69.26Nanocore RAT botnet C2 server (confidence level: 100%)
86.124.170.114FAKEUPDATES botnet C2 server (confidence level: 100%)
216.146.25.130FAKEUPDATES botnet C2 server (confidence level: 100%)
47.95.201.133DCRat botnet C2 server (confidence level: 100%)
113.45.192.130Cobalt Strike botnet C2 server (confidence level: 100%)
64.176.37.157Cobalt Strike botnet C2 server (confidence level: 100%)
185.92.183.140Cobalt Strike botnet C2 server (confidence level: 100%)

Description

ThreatFox IOCs for 2024-11-29

Impact

For European organizations, the impact of this threat is currently limited due to the absence of specific exploit details or active attack reports. However, the presence of IOCs related to malware and payload delivery implies potential risks if these indicators correspond to ongoing or emerging campaigns targeting network infrastructure or endpoints. Organizations relying on threat intelligence feeds like ThreatFox can use these IOCs to enhance detection capabilities and preemptively identify malicious activity. The medium severity rating suggests a moderate risk level, which may translate into targeted phishing, malware delivery, or network intrusion attempts. Without concrete exploit data or affected product versions, the direct operational impact remains uncertain but warrants vigilance in monitoring network traffic and endpoint behavior. European entities with critical infrastructure or sensitive data could face increased risk if threat actors leverage these IOCs in coordinated attacks, especially in sectors with high exposure to malware campaigns.

Defensive guidance

Given the nature of this threat as an OSINT feed update with IOCs, mitigation should focus on integrating these indicators into existing security monitoring and response frameworks. Specifically, European organizations should: 1) Update intrusion detection and prevention systems (IDS/IPS) and endpoint detection and response (EDR) tools with the latest IOCs from ThreatFox to improve detection accuracy. 2) Conduct network traffic analysis to identify any matches with the provided IOCs, focusing on unusual payload delivery patterns or suspicious network activity. 3) Enhance user awareness training to recognize potential phishing or social engineering attempts that could serve as initial infection vectors. 4) Maintain robust network segmentation and least privilege access controls to limit malware propagation if an infection occurs. 5) Collaborate with national and European cybersecurity information sharing organizations to contextualize these IOCs within broader threat landscapes. 6) Regularly review and update incident response plans to incorporate intelligence-driven detection and containment strategies. Since no patches are available, proactive detection and containment remain the primary defenses.

Community reviews

Loading reviews…