IndicatorPublished 7 Dec 2024Updated 8 Dec 2024

type osint · ThreatFox IOCs for 2024-12-07

Affects type osintSource ThreatFox MISP Feed

TLP:WHITE, disclosure is not limited

Indicators of compromise

Domains 103

66-245-194-159.ipv4.staticdns3.ioUnknown malware botnet C2 domain (confidence level: 100%)
www.172-96-161-26.cprapid.comHook botnet C2 domain (confidence level: 100%)
167-172-29-103.ipv4.staticdns3.ioHavoc botnet C2 domain (confidence level: 100%)
host-77-238-233-217.hosted-by-vdsina.comHavoc botnet C2 domain (confidence level: 100%)
www.icicidiirect.comHavoc botnet C2 domain (confidence level: 100%)
restoindia.meOrcus RAT payload delivery domain (confidence level: 100%)
two-besides.gl.at.ply.ggNjRAT botnet C2 domain (confidence level: 75%)
zoloft-indianapolis-riders-convinced.trycloudflare.comFAKEUPDATES payload delivery domain (confidence level: 100%)
bidder-horizontal-wildlife-invoice.trycloudflare.comFAKEUPDATES payload delivery domain (confidence level: 100%)
name-kw-papua-booking.trycloudflare.comFAKEUPDATES payload delivery domain (confidence level: 100%)

URLs 72

http://94.156.177.33/lv2d7fgdopb/login.phpAmadey botnet C2 (confidence level: 75%)
http://connect.resourcecloud.shop/plqvfd4d5/login.phpAmadey botnet C2 (confidence level: 75%)
http://185.208.158.96/mzmtrpwoe113eelxn/login.phpAmadey botnet C2 (confidence level: 75%)
http://185.215.113.43/zu7junko/login.phpAmadey botnet C2 (confidence level: 75%)
http://62.60.226.15/8fj482jd9/login.phpAmadey botnet C2 (confidence level: 75%)
http://147.45.47.35/bdjkb2xsd/login.phpAmadey botnet C2 (confidence level: 75%)
http://154.216.20.42/h9k4kfklcdszz3/login.phpAmadey botnet C2 (confidence level: 75%)
http://185.172.128.100/u6vhsc3ppq/login.phpAmadey botnet C2 (confidence level: 75%)
http://185.172.128.99/u6vhsc3ppq/login.phpAmadey botnet C2 (confidence level: 75%)
http://77.91.77.140/g9bkfkwf/login.phpAmadey botnet C2 (confidence level: 75%)

IP addresses 115

45.74.38.211Orcus RAT botnet C2 server (confidence level: 100%)
103.30.77.141Cobalt Strike botnet C2 server (confidence level: 100%)
116.198.229.197Cobalt Strike botnet C2 server (confidence level: 100%)
117.72.39.147Cobalt Strike botnet C2 server (confidence level: 100%)
106.75.61.100Cobalt Strike botnet C2 server (confidence level: 100%)
8.130.67.146Cobalt Strike botnet C2 server (confidence level: 100%)
120.46.212.33Cobalt Strike botnet C2 server (confidence level: 100%)
124.71.74.122Cobalt Strike botnet C2 server (confidence level: 100%)
52.238.29.163Cobalt Strike botnet C2 server (confidence level: 100%)
84.32.44.82Cobalt Strike botnet C2 server (confidence level: 100%)

Hashes 17

6b8848b38b3e239a0df83efc456ad22bf5e59e7145b59d1f8e154881ebb9f8e3Orcus RAT payload (confidence level: 100%)
fc5be86c846e93b0a65dd18849205514Akira payload (confidence level: 100%)
b71956ba98abacf4b4dcc5a0453baaa2Akira payload (confidence level: 100%)
7486f1a88d6a3ae96fa08f882d452399Akira payload (confidence level: 100%)
5eadd67bec799465fa27a17d6bf93e2dAkira payload (confidence level: 100%)
7bf5cbca413b327c655e2270645955d9Akira payload (confidence level: 100%)
feb81a8d7e0f91d6f74b440cdd3c2f28Akira payload (confidence level: 100%)
436c014614477e79696e838d6b605f4eAkira payload (confidence level: 100%)
f59d26d27cbab79fe84ef2e7e3b718f9Akira payload (confidence level: 100%)
e58ed2788bada8d807ebb29e18d86f86Akira payload (confidence level: 100%)

Description

ThreatFox IOCs for 2024-12-07

Impact

For European organizations, the impact of this threat is currently limited due to the lack of specific exploit details or confirmed active attacks. However, the presence of payload delivery network activity and associated IOCs means that organizations could be targeted by malware campaigns leveraging these indicators. If these payloads are successfully delivered and executed, they could compromise confidentiality, integrity, or availability depending on the malware's nature. European entities with significant network exposure or those involved in sectors commonly targeted by malware (e.g., finance, critical infrastructure, government) should remain vigilant. The threat intelligence can aid in early detection and prevention, reducing the risk of infection or data compromise. Since no patches or direct exploits are noted, the immediate operational impact is low, but the potential for escalation exists if threat actors develop or deploy exploits based on these IOCs.

Defensive guidance

European organizations should integrate the provided IOCs from the ThreatFox feed into their security monitoring and detection systems, such as SIEMs, IDS/IPS, and endpoint protection platforms. Network traffic should be analyzed for suspicious payload delivery patterns matching the threat intelligence. Enhanced network segmentation and strict egress filtering can limit the spread and impact of any delivered payloads. Organizations should maintain up-to-date malware detection signatures and behavioral analytics to identify anomalous activity. Employee awareness training on phishing and social engineering can reduce the risk of initial infection vectors. Since no patches are available, focus should be on detection, containment, and response capabilities. Regular threat intelligence updates and collaboration with national cybersecurity centers in Europe can improve preparedness against evolving threats related to these IOCs.

Community reviews

Loading reviews…