IndicatorPublished 23 Dec 2024Updated 24 Dec 2024

type osint · ThreatFox IOCs for 2024-12-23

Affects type osintSource ThreatFox MISP Feed

TLP:WHITE, disclosure is not limited

Indicators of compromise

Domains 63

satpr.comFAKEUPDATES payload delivery domain (confidence level: 100%)
publicspeaking.co.idLoki Password Stealer (PWS) botnet C2 domain (confidence level: 75%)
clickminded.agencyDarkGate botnet C2 domain (confidence level: 100%)
www.exciting-goldberg.193-239-86-216.plesk.pageHavoc botnet C2 domain (confidence level: 100%)
mail.coinhako.usHavoc botnet C2 domain (confidence level: 100%)
principledjs.clickLumma Stealer botnet C2 domain (confidence level: 100%)
neqi.shopLumma Stealer botnet C2 domain (confidence level: 50%)
ec2-3-114-169-53.ap-northeast-1.compute.amazonaws.comCobalt Strike botnet C2 domain (confidence level: 100%)
fb.cdn-10.mylnix.comCobalt Strike botnet C2 domain (confidence level: 100%)
asylumejkr.icuLumma Stealer botnet C2 domain (confidence level: 100%)

URLs 40

http://47.116.64.160:8888/supershell/login/Unknown malware botnet C2 (confidence level: 100%)
http://110.40.134.37:8888/supershell/login/Unknown malware botnet C2 (confidence level: 100%)
https://satpr.com/7y6y.jsFAKEUPDATES payload delivery URL (confidence level: 100%)
https://satpr.com/js.phpFAKEUPDATES payload delivery URL (confidence level: 100%)
http://poubnxu3jubz.top/1.phpFAKEUPDATES payload delivery URL (confidence level: 100%)
http://47.122.25.63:9999/supershell/login/Unknown malware botnet C2 (confidence level: 100%)
http://101.43.89.114:8888/supershell/login/Unknown malware botnet C2 (confidence level: 100%)
http://121.41.99.166:8888/supershell/login/Unknown malware botnet C2 (confidence level: 100%)
https://94.130.188.57Vidar botnet C2 (confidence level: 100%)
https://95.216.183.108Vidar botnet C2 (confidence level: 100%)

IP addresses 55

3.64.4.198NjRAT botnet C2 server (confidence level: 75%)
121.41.99.166Unknown malware botnet C2 server (confidence level: 100%)
192.169.69.26NjRAT botnet C2 server (confidence level: 75%)
87.120.112.234MooBot botnet C2 server (confidence level: 75%)
18.193.3.69NetSupportManager RAT botnet C2 server (confidence level: 100%)
18.193.3.69NetSupportManager RAT botnet C2 server (confidence level: 100%)
185.196.8.12Cobalt Strike botnet C2 server (confidence level: 100%)
124.222.22.192Cobalt Strike botnet C2 server (confidence level: 100%)
172.86.80.94Quasar RAT botnet C2 server (confidence level: 100%)
37.1.223.28Quasar RAT botnet C2 server (confidence level: 100%)

Hashes 14

LockBit payload (confidence level: 50%)

8ff61e4156c10b085e0c2233f24e8501
1319da1523ec2a67bda016c15334c195
0eff1f3ca94f1c8aeb4b720d6dd54fc3
e3a12d15768160d5c534cd99df9199e9
17a7cd1ead2d35ed5d69c71d4fd7386d
9bb6340600f80baa4eb6777266f5f0df
42cbb4743ea016868d7a049a6c9fb3fc
8015d634e9e5fd003885700bca4723d8
a8e97fe5a7115e42759d67f7e4d88b0d
d0457a54a4905ed5d2bb8a2b7ef7be0f

Description

ThreatFox IOCs for 2024-12-23

Impact

For European organizations, the impact of this threat depends on their ability to integrate and act upon the provided IOCs within their security monitoring and incident response processes. Since the threat involves malware payload delivery and network activity, organizations lacking robust network detection and endpoint protection could face risks of compromise, data exfiltration, or service disruption. However, the absence of known exploits in the wild and the medium severity rating suggest that immediate widespread impact is unlikely. Organizations that do not maintain updated threat intelligence feeds or fail to correlate these IOCs with their internal logs may experience delayed detection of potential intrusions. This could lead to increased dwell time for attackers and potential lateral movement within networks. The threat's OSINT nature implies it is primarily useful for enhancing situational awareness and improving detection capabilities rather than representing an imminent attack vector.

Defensive guidance

European organizations should focus on integrating these IOCs into their existing security information and event management (SIEM) systems, intrusion detection/prevention systems (IDS/IPS), and endpoint detection and response (EDR) tools to enhance detection capabilities. Specific recommendations include: 1) Regularly update and validate threat intelligence feeds to ensure timely ingestion of new IOCs. 2) Conduct network traffic analysis to identify suspicious payload delivery attempts matching the provided indicators. 3) Implement strict network segmentation and monitoring to limit lateral movement if a compromise occurs. 4) Perform proactive threat hunting exercises using the IOCs to identify potential undetected infections. 5) Educate security teams on interpreting OSINT-based threat intelligence to improve response times. 6) Maintain robust backup and recovery procedures to mitigate potential impacts of malware infections. Since no patches are available, emphasis should be on detection, containment, and response rather than remediation of a specific vulnerability.

Community reviews

Loading reviews…