IndicatorPublished 10 Dec 2024Updated 11 Dec 2024

type osint · ThreatFox IOCs for 2024-12-10

Affects type osintSource ThreatFox MISP Feed

TLP:WHITE, disclosure is not limited

Indicators of compromise

Domains 47

keqirai.shopLumma Stealer botnet C2 domain (confidence level: 100%)
doqevue.shopLumma Stealer botnet C2 domain (confidence level: 100%)
lieutenant-beaudry.comFAKEUPDATES payload delivery domain (confidence level: 100%)
cxlugg.sbsVidar botnet C2 domain (confidence level: 100%)
zblmt.gjc1314.comCobalt Strike botnet C2 domain (confidence level: 100%)
0xawad.xyzCobalt Strike botnet C2 domain (confidence level: 100%)
gifted-ellis.194-26-192-51.plesk.pageHook botnet C2 domain (confidence level: 100%)
ipv6.172-96-161-26.cprapid.comHook botnet C2 domain (confidence level: 100%)
admin.woocloud.vipHook botnet C2 domain (confidence level: 100%)
www.c11.wltstockalerts.comHavoc botnet C2 domain (confidence level: 100%)

URLs 696

https://keqirai.shop/apiLumma Stealer botnet C2 (confidence level: 100%)
https://doqevue.shop/apiLumma Stealer botnet C2 (confidence level: 100%)
http://154.216.18.25/gd85kkjf/login.phpAmadey botnet C2 (confidence level: 100%)
https://lieutenant-beaudry.com/work/original.jsFAKEUPDATES payload delivery URL (confidence level: 100%)
https://lieutenant-beaudry.com/work/index.phpFAKEUPDATES payload delivery URL (confidence level: 100%)
https://lieutenant-beaudry.com/work/download.phpFAKEUPDATES payload delivery URL (confidence level: 100%)
https://lieutenant-beaudry.com/work/yyy.zipFAKEUPDATES payload delivery URL (confidence level: 100%)
https://78.46.160.87Vidar botnet C2 (confidence level: 100%)
https://37.27.43.98Vidar botnet C2 (confidence level: 100%)
https://cococokeys.com/licenseuser.phpSatacom botnet C2 (confidence level: 100%)

IP addresses 174

191.91.176.72Remcos botnet C2 server (confidence level: 100%)
31.13.224.16ReverseRAT botnet C2 server (confidence level: 100%)
38.180.79.175Cobalt Strike botnet C2 server (confidence level: 75%)
120.46.212.33Cobalt Strike botnet C2 server (confidence level: 75%)
124.221.146.118Cobalt Strike botnet C2 server (confidence level: 75%)
192.227.234.140Cobalt Strike botnet C2 server (confidence level: 75%)
212.192.15.218Cobalt Strike botnet C2 server (confidence level: 75%)
119.23.208.137Cobalt Strike botnet C2 server (confidence level: 75%)
120.53.102.197Cobalt Strike botnet C2 server (confidence level: 75%)
120.53.102.197Cobalt Strike botnet C2 server (confidence level: 75%)

Hashes 18

becad96938fc5fe700c1c829a371947aAkira payload (confidence level: 50%)
22c5858ff8c7815c34b4386c3b4c83f2b8bb23502d153f5d8fb9f55bd784e764Zloader payload (confidence level: 100%)
603bd9ee50f7dc6de37f314bda227561f0fd67cdebf53a672ea32cce73a2efd3Zloader payload (confidence level: 100%)
d212042504f851253347754c3d3624628e7ebf7c0bbd8160220bf6edcff24f16Zloader payload (confidence level: 100%)
ec8414631644269ab230c222055beb36546ff3ee39cebbbfa7e794e2e609c8d9Zloader payload (confidence level: 100%)
17a9900aff30928d54ce77bdcd0cdde441dd0215f8187bac0a270c5f8e4db9ccZloader payload (confidence level: 100%)
2794a703aff5549a89834d0ef8ad4b97ce12e27fa37852dd2a504e5a0078b093Zloader payload (confidence level: 100%)
3610f213db22a9de07dbbed4fbf6cec78b6dd4d58982c91f3a4ef994b53a8adcZloader payload (confidence level: 100%)
cbff717783ee597448c56a408a066aaae0279dd8606e6d99e52a04f0a7a55e03Zloader payload (confidence level: 100%)
a9f2c4bc268765fc6d72d8e00363d2440cf1dcbd1ef7ee08978959fc118922c9Zloader payload (confidence level: 100%)

Description

ThreatFox IOCs for 2024-12-10

Impact

For European organizations, the impact of this threat intelligence update is primarily in enhancing situational awareness and improving detection capabilities. Since no active exploits or vulnerabilities are described, the immediate risk to confidentiality, integrity, or availability is low. However, the distribution of these IOCs could help defenders identify and mitigate potential malware infections or network intrusions that align with the indicators shared. Organizations that rely heavily on OSINT and network monitoring tools may benefit from integrating these IOCs into their security operations to preemptively detect suspicious activity. The medium severity rating suggests that while the threat is not critical, it should not be ignored, especially in sectors with high exposure to cyber threats such as finance, critical infrastructure, and government entities.

Defensive guidance

1. Integrate the provided IOCs into existing Security Information and Event Management (SIEM) systems and threat intelligence platforms to enhance detection capabilities. 2. Conduct regular network traffic analysis to identify any matches with the shared indicators, focusing on unusual payload delivery mechanisms. 3. Update firewall and intrusion detection/prevention system (IDS/IPS) rules to block or alert on network activity matching the IOCs. 4. Train security operations center (SOC) personnel to recognize patterns associated with the indicators and respond promptly. 5. Maintain up-to-date threat intelligence feeds and cross-reference with other sources to validate and enrich the context around these IOCs. 6. Since no patches are available, emphasize preventive controls such as network segmentation, least privilege access, and endpoint protection to reduce attack surface. 7. Engage in information sharing with industry peers and national cybersecurity centers to stay informed about evolving threats related to these IOCs.

Community reviews

Loading reviews…