IndicatorPublished 30 Jan 2025Updated 31 Jan 2025

type osint · ThreatFox IOCs for 2025-01-30

Affects type osintSource ThreatFox MISP Feed

TLP:WHITE, disclosure is not limited

Indicators of compromise

Domains 143

answerzeypher.bizLumma Stealer credit card skimming domain (confidence level: 100%)
aromaticridz.bizLumma Stealer credit card skimming domain (confidence level: 100%)
bluermaij.bizLumma Stealer credit card skimming domain (confidence level: 100%)
cleavemover.bizLumma Stealer credit card skimming domain (confidence level: 100%)
dayclammethir.bizLumma Stealer credit card skimming domain (confidence level: 100%)
drinkeracte.bizLumma Stealer credit card skimming domain (confidence level: 100%)
forcenodder.bizLumma Stealer credit card skimming domain (confidence level: 100%)
freeezemediccal.bizLumma Stealer credit card skimming domain (confidence level: 100%)
greatrabbid.bizLumma Stealer credit card skimming domain (confidence level: 100%)
hatesomeber.bizLumma Stealer credit card skimming domain (confidence level: 100%)

URLs 85

https://rebecca-nylon-invention-ii.trycloudflare.com/cloudfllFAKEUPDATES payload delivery URL (confidence level: 100%)
https://5.75.209.106/Vidar botnet C2 (confidence level: 100%)
https://95.216.181.234/Vidar botnet C2 (confidence level: 100%)
http://112.248.142.156:42033/mozi.mMozi payload delivery URL (confidence level: 50%)
http://94.156.177.41/alpha/five/fre.phpLoki Password Stealer (PWS) botnet C2 (confidence level: 75%)
http://touxzw.ir/sccc/five/fre.phpLoki Password Stealer (PWS) botnet C2 (confidence level: 75%)
http://3.17.10.250:80/ektyCobalt Strike botnet C2 (confidence level: 75%)
http://45.14.245.11/1477304b7b2e46dc/sqlite3.dllStealc payload delivery URL (confidence level: 50%)
http://128.140.91.217/16c60772756db6d6/sqlite3.dllStealc payload delivery URL (confidence level: 50%)
http://65.109.2.12/4b219a338978614c/vcruntime140.dllStealc payload delivery URL (confidence level: 50%)

IP addresses 153

146.19.24.68QakBot botnet C2 server (confidence level: 100%)
209.141.35.180QakBot botnet C2 server (confidence level: 100%)
141.98.10.142Mirai botnet C2 server (confidence level: 100%)
45.135.194.61QakBot botnet C2 server (confidence level: 100%)
45.135.194.61QakBot botnet C2 server (confidence level: 100%)
195.177.95.92Mirai botnet C2 server (confidence level: 100%)
195.177.95.92Mirai botnet C2 server (confidence level: 100%)
45.141.76.97Cobalt Strike botnet C2 server (confidence level: 100%)
38.55.239.26Cobalt Strike botnet C2 server (confidence level: 100%)
195.177.95.155Remcos botnet C2 server (confidence level: 100%)

Hashes 1

AMOS payload (confidence level: 50%)

422b322bc601e52a4c7c4f002f9dc9e4

Description

ThreatFox IOCs for 2025-01-30

Impact

For European organizations, the impact of this threat is primarily related to the potential for detection and prevention of malware infections through the use of updated threat intelligence. Since no specific exploit or vulnerability is detailed, the direct risk to confidentiality, integrity, or availability is unclear and likely low to medium. However, the presence of payload delivery and network activity tags suggests that organizations could face attempts of malware delivery or network-based intrusion attempts leveraging the indicators shared. If these IOCs correspond to active campaigns targeting European entities, there could be risks of data breaches, operational disruption, or espionage. The lack of known exploits in the wild reduces immediate risk, but organizations should remain vigilant, especially those in sectors commonly targeted by malware campaigns such as finance, critical infrastructure, and government. The use of OSINT implies that threat actors might be leveraging publicly available information to tailor attacks, increasing the sophistication and potential success of intrusion attempts.

Defensive guidance

European organizations should integrate the provided IOCs into their security monitoring tools such as SIEMs, IDS/IPS, and endpoint detection and response (EDR) systems to enhance detection capabilities. Regularly updating threat intelligence feeds and correlating alerts with these IOCs can help identify early signs of compromise. Network segmentation and strict egress filtering can limit the impact of payload delivery attempts. Given the lack of patches, focus should be on proactive detection and response rather than remediation. Security teams should conduct threat hunting exercises using the IOCs to identify any latent infections. Employee awareness training on phishing and social engineering, common vectors for payload delivery, remains critical. Additionally, organizations should ensure robust backup and recovery procedures to mitigate potential damage from malware infections. Collaboration with national cybersecurity centers and sharing intelligence within trusted communities can improve collective defense against such threats.

Community reviews

Loading reviews…