IndicatorPublished 22 Jan 2025Updated 23 Jan 2025

type osint · ThreatFox IOCs for 2025-01-22

Affects type osintSource ThreatFox MISP Feed

TLP:WHITE, disclosure is not limited

Indicators of compromise

Domains 118

newgoodfoodmarket.comFAKEUPDATES payload delivery domain (confidence level: 100%)
newgreenvibes.comFAKEUPDATES payload delivery domain (confidence level: 100%)
cf.r8.lcCobalt Strike botnet C2 domain (confidence level: 75%)
cf.r8.lcCobalt Strike botnet C2 domain (confidence level: 75%)
cf.r8.lcCobalt Strike botnet C2 domain (confidence level: 75%)
cf.r8.lcCobalt Strike botnet C2 domain (confidence level: 75%)
cf.r8.lcCobalt Strike botnet C2 domain (confidence level: 75%)
susec.xyzCobalt Strike botnet C2 domain (confidence level: 100%)
cf.r8.lcCobalt Strike botnet C2 domain (confidence level: 75%)
nhjndjemlimakmk.topFAKEUPDATES payload delivery domain (confidence level: 75%)

URLs 86

https://metro-offset-imposed-behind.trycloudflare.com/ytjstastFAKEUPDATES payload delivery URL (confidence level: 100%)
https://llewen.com/4f1qw.jsFAKEUPDATES payload delivery URL (confidence level: 100%)
https://spa-step-hopkins-islands.trycloudflare.com/erfgtrttFAKEUPDATES payload delivery URL (confidence level: 100%)
http://nlafhhiffkceadc.top/1.phpFAKEUPDATES payload delivery URL (confidence level: 100%)
http://43.156.95.75:8888/supershell/login/Unknown malware botnet C2 (confidence level: 100%)
https://babbebange.cyou/apiLumma Stealer botnet C2 (confidence level: 100%)
https://sensatiogener.sbs/apiLumma Stealer botnet C2 (confidence level: 100%)
https://reflectepatt.click/apiLumma Stealer botnet C2 (confidence level: 100%)
https://writeimgaiin.cyou/apiLumma Stealer botnet C2 (confidence level: 100%)
https://kitestarepatt.click/apiLumma Stealer botnet C2 (confidence level: 100%)

IP addresses 455

116.62.8.222Cobalt Strike botnet C2 server (confidence level: 100%)
185.208.159.166AsyncRAT botnet C2 server (confidence level: 100%)
138.124.54.133Hook botnet C2 server (confidence level: 100%)
194.59.31.59Hook botnet C2 server (confidence level: 100%)
159.65.230.103Havoc botnet C2 server (confidence level: 100%)
171.41.199.170DCRat botnet C2 server (confidence level: 100%)
46.246.80.14DCRat botnet C2 server (confidence level: 100%)
46.246.6.5DCRat botnet C2 server (confidence level: 100%)
3.113.130.207Brute Ratel C4 botnet C2 server (confidence level: 100%)
172.233.163.104Unknown malware botnet C2 server (confidence level: 100%)

Hashes 20

f009ec775b2daa5a0f38dc2593a3c231611bea7cb579363915d9be1135b00455Unknown malware payload (confidence level: 50%)
3d0e55bd3c84e6cb35559ef1d0f2ef72a21e0f3793a9158d514f12f46b0aff85Unknown malware payload (confidence level: 50%)
801525d7239e46f9c22d7e7bcd163abcfb29fc0770ff417f5fc62bfb005ec7acUnknown malware payload (confidence level: 50%)
ea2b3bf32cc27e959e19c365fa2f6e5310ef2e76d3d0ed2df3fb5945f9afc9e7Unknown malware payload (confidence level: 50%)
4b6a008c8b85803dc19a8286f33cad963425d37c4ca0b1a9454a854db3273dadUnknown malware payload (confidence level: 50%)
a23560a3b9a9578dcd70bcd01434b2053940d6be36e543df8e4d36931ca9ea63Unknown malware payload (confidence level: 50%)
47830f7007b4317dc8ce1b16f3ae79f9f7e964db456c34e00473fba94bb713ebUnknown malware payload (confidence level: 50%)
6a104f07ab6c5711b6bc8bf6ff956ab8cd597a388002a966e980c5ec9678b5b0Unknown malware payload (confidence level: 50%)
2a9e9815739f5144d7442229cfb9bfcfAMOS payload (confidence level: 50%)
c90930423cae1497d13dd3e764ee35edAMOS payload (confidence level: 50%)

Description

ThreatFox IOCs for 2025-01-22

Impact

Given the nature of the information as a set of IOCs without specific exploit details or active attack campaigns, the direct impact on European organizations is limited. The primary value lies in enhancing situational awareness and improving detection capabilities within security operations centers (SOCs). Organizations that integrate these IOCs into their threat intelligence platforms can better identify potential malicious activity related to malware payload delivery or suspicious network behavior. However, without concrete exploit details or active campaigns, the risk of immediate compromise or operational disruption remains low. European entities relying on OSINT feeds for threat detection will benefit from this data to fine-tune their defenses, but it does not represent an immediate or critical threat vector.

Defensive guidance

To effectively utilize this intelligence, European organizations should: 1) Integrate the provided IOCs into existing Security Information and Event Management (SIEM) systems and endpoint detection and response (EDR) tools to enhance detection of related malicious activities. 2) Regularly update threat intelligence feeds to maintain current awareness of emerging threats and IOCs. 3) Conduct periodic threat hunting exercises using these IOCs to proactively identify potential compromises. 4) Ensure network monitoring solutions are configured to detect anomalous payload delivery and suspicious network activity patterns associated with the IOCs. 5) Maintain robust incident response procedures to quickly investigate and remediate any alerts triggered by these indicators. Since no patches or direct exploits are indicated, focus should remain on detection and response rather than remediation.

Community reviews

Loading reviews…