IndicatorPublished 16 Dec 2024Updated 17 Dec 2024

type osint · ThreatFox IOCs for 2024-12-16

Affects type osintSource ThreatFox MISP Feed

TLP:WHITE, disclosure is not limited

Indicators of compromise

Domains 89

carolina-oxide.gl.at.ply.ggNjRAT botnet C2 domain (confidence level: 75%)
theinb.comFAKEUPDATES payload delivery domain (confidence level: 100%)
ferp.googledns.ioBlister botnet C2 domain (confidence level: 49%)
hk-dns.secssl.comBlister botnet C2 domain (confidence level: 49%)
hk-dns.winsiked.comBlister botnet C2 domain (confidence level: 49%)
hk-dns.wkossclsaleklddeff.isBlister botnet C2 domain (confidence level: 49%)
hk-dns.wkossclsaleklddeff.ioBlister botnet C2 domain (confidence level: 49%)
www.silentlegion.duckdns.orgUnknown malware botnet C2 domain (confidence level: 100%)
t1p9jbex8g.silentlegion.duckdns.orgUnknown malware botnet C2 domain (confidence level: 100%)
sedone.onlineVidar botnet C2 domain (confidence level: 100%)

URLs 77

https://theinb.com/6h6d4.jsFAKEUPDATES payload delivery URL (confidence level: 100%)
https://theinb.com/js.phpFAKEUPDATES payload delivery URL (confidence level: 100%)
https://matelitcleaning.com/webpanel/panel/login.phpGomorrah stealer botnet C2 (confidence level: 100%)
http://48.210.203.51:8888/supershell/login/Unknown malware botnet C2 (confidence level: 100%)
http://154.216.17.90Stealc botnet C2 (confidence level: 100%)
https://jimeqey.shop/apiLumma Stealer botnet C2 (confidence level: 100%)
https://sedone.online/Vidar botnet C2 (confidence level: 100%)
https://cineft.online/Vidar botnet C2 (confidence level: 100%)
https://65.109.242.111/Vidar botnet C2 (confidence level: 100%)
https://116.203.12.241/Vidar botnet C2 (confidence level: 100%)

IP addresses 175

147.185.221.24NjRAT botnet C2 server (confidence level: 75%)
47.98.185.157Cobalt Strike botnet C2 server (confidence level: 75%)
52.166.123.20Cobalt Strike botnet C2 server (confidence level: 75%)
18.170.117.232Cobalt Strike botnet C2 server (confidence level: 75%)
45.137.81.84Cobalt Strike botnet C2 server (confidence level: 75%)
34.244.213.212Cobalt Strike botnet C2 server (confidence level: 75%)
47.92.77.57Cobalt Strike botnet C2 server (confidence level: 100%)
61.135.130.190Cobalt Strike botnet C2 server (confidence level: 100%)
45.145.229.234Cobalt Strike botnet C2 server (confidence level: 100%)
120.79.135.77Cobalt Strike botnet C2 server (confidence level: 100%)

Hashes 3

ab6a985dbef013596ac79ca5117ef77cAkira payload (confidence level: 50%)
5bad559d96e10e6fd3ae45c16de8cc88c160231cf4300651aafbbd9dff313817Unknown malware payload (confidence level: 100%)
b558f0b1444be5df69027315f7aad563c54a3f791cebbb96a56fce7e5176f8f5Unknown malware payload (confidence level: 100%)

Description

ThreatFox IOCs for 2024-12-16

Impact

For European organizations, the impact of this threat is currently assessed as moderate due to the medium severity rating and the nature of the threat as OSINT-related malware activity. Potential impacts include unauthorized network activity leading to data exfiltration, reconnaissance, or delivery of malicious payloads that could compromise confidentiality and integrity of information systems. Given the lack of specific exploit details or known active campaigns, the immediate risk may be limited, but organizations should remain vigilant as such intelligence often precedes more targeted attacks. The impact could be more pronounced for sectors relying heavily on networked infrastructure and sensitive data, such as finance, government, and critical infrastructure. The threat's focus on payload delivery could lead to secondary infections or lateral movement within networks if exploited successfully.

Defensive guidance

European organizations should enhance their threat intelligence capabilities by integrating feeds like ThreatFox into their security monitoring systems to detect and respond to emerging IOCs promptly. Network segmentation and strict access controls can limit the spread of any payload delivered through network activity. Employing advanced network traffic analysis and anomaly detection tools will help identify suspicious communications indicative of this threat. Regular employee training on recognizing phishing or social engineering attempts that may serve as initial infection vectors is essential. Since no patches are available, organizations should focus on proactive detection and containment strategies, including timely updating of endpoint protection platforms and ensuring robust incident response plans are in place. Collaboration with national and European cybersecurity agencies to share intelligence and best practices will also strengthen defenses against evolving threats.

Community reviews

Loading reviews…