IndicatorPublished 31 Jan 2025Updated 1 Feb 2025

type osint · ThreatFox IOCs for 2025-01-31

Affects type osintSource ThreatFox MISP Feed

TLP:WHITE, disclosure is not limited

Indicators of compromise

Domains 95

ppdpharmaco.comFAKEUPDATES payload delivery domain (confidence level: 100%)
portable2016.topFAKEUPDATES payload delivery domain (confidence level: 100%)
solve.zyde.orgClearFake payload delivery domain (confidence level: 100%)
mstr-x2-giveaway.comCryptoNight payload delivery domain (confidence level: 50%)
saylor-giveaway.comCryptoNight payload delivery domain (confidence level: 50%)
saylor-giveaway.infoCryptoNight payload delivery domain (confidence level: 50%)
saylor-giveaway.proCryptoNight payload delivery domain (confidence level: 50%)
saylor-giveaways.comCryptoNight payload delivery domain (confidence level: 50%)
saylor-x2crypto.comCryptoNight payload delivery domain (confidence level: 50%)
saylor-x2giveaway.coCryptoNight payload delivery domain (confidence level: 50%)

URLs 49

http://touxzw.ir/sccc/five/pvqdq929bsx_a_d_m1n_a.phpLokiBot botnet C2 (confidence level: 100%)
http://52.229.166.98:8888/supershell/login/Unknown malware botnet C2 (confidence level: 100%)
http://47.97.114.229:8888/supershell/login/Unknown malware botnet C2 (confidence level: 100%)
https://occasional-peterson-blast-sussex.trycloudflare.com/cloudflsFAKEUPDATES payload delivery URL (confidence level: 100%)
https://ppdpharmaco.com/5k5g.jsFAKEUPDATES payload delivery URL (confidence level: 100%)
https://ppdpharmaco.com/js.phpFAKEUPDATES payload delivery URL (confidence level: 100%)
https://bit1.smogturfprance.shop/cacaduk.captchaUnknown Loader payload delivery URL (confidence level: 50%)
https://portable2016.top/work/original.jsFAKEUPDATES payload delivery URL (confidence level: 100%)
https://portable2016.top/work/index.phpFAKEUPDATES payload delivery URL (confidence level: 100%)
https://portable2016.top/work/upl.phpFAKEUPDATES payload delivery URL (confidence level: 100%)

IP addresses 145

18.217.210.12MooBot botnet C2 server (confidence level: 75%)
5.75.234.8NjRAT botnet C2 server (confidence level: 75%)
189.158.232.16Unknown malware botnet C2 server (confidence level: 100%)
179.13.3.202Remcos botnet C2 server (confidence level: 100%)
94.156.105.136AsyncRAT botnet C2 server (confidence level: 100%)
94.156.105.138AsyncRAT botnet C2 server (confidence level: 100%)
139.59.34.92Unknown malware botnet C2 server (confidence level: 100%)
91.132.51.35Hook botnet C2 server (confidence level: 100%)
111.227.97.43Quasar RAT botnet C2 server (confidence level: 100%)
18.171.153.42MooBot botnet C2 server (confidence level: 100%)

Hashes 18

362af8118f437f9139556c59437544ae1489376dc4118027c24c8d5ce4d84e48Unknown Stealer payload (confidence level: 50%)
330dffe834ebbe4042747bbe00b4575629ba8f2507bccf746763cacf63d655bbUnknown Stealer payload (confidence level: 50%)
33cba89eeeaf139a798b7fa07ff6919dd0c4c6cf4106b659e4e56f15b5809287Unknown Stealer payload (confidence level: 50%)
552d53f473096c55a3937c8512a06863133a97c3478ad6b1535e1976d1e0d45fUnknown Stealer payload (confidence level: 50%)
64209e2348e6d503ee518459d0487d636639fa5e5298d28093a5ad41390ef6b0Unknown Stealer payload (confidence level: 50%)
67f371a683b2be4c8002f89492cd29d96dceabdbfd36641a27be761ee64605b1Unknown Stealer payload (confidence level: 50%)
73ad6be67691b65cee251d098f2541eef3cab2853ad509dac72d8eff5bd85bc0Unknown Stealer payload (confidence level: 50%)
7cbfbce482071c6df823f09d83c6868d0b1208e8ceb70147b64c52bb8b48bdb8Unknown Stealer payload (confidence level: 50%)
839de445f714a32f36670b590eba7fc68b1115b885ac8d689d7b344189521012Unknown Stealer payload (confidence level: 50%)
bea4f753707eba4088e8a51818d9de8e9ad0138495338402f05c5c7a800695a6Unknown Stealer payload (confidence level: 50%)

Description

ThreatFox IOCs for 2025-01-31

Impact

For European organizations, the impact of this threat intelligence update is primarily in enhancing detection and response capabilities rather than indicating an immediate or active compromise risk. Since no specific exploit or vulnerability is identified, the direct risk to confidentiality, integrity, or availability is limited. However, the presence of new or updated IOCs related to malware payload delivery and network activity could help organizations identify ongoing or emerging malware campaigns targeting their networks. This can improve incident response times and reduce potential damage from malware infections. Organizations relying on threat intelligence feeds like ThreatFox can integrate these IOCs into their security monitoring tools (e.g., SIEM, IDS/IPS) to better detect malicious activity. The medium severity suggests that while the threat is not critical, it should not be ignored, especially in sectors with high exposure to malware attacks such as finance, critical infrastructure, and government. The lack of known exploits in the wild reduces immediate urgency but does not preclude future exploitation. Therefore, European organizations should consider this intelligence as part of their broader threat landscape awareness and maintain vigilance in monitoring network traffic and payload delivery attempts.

Defensive guidance

1. Integrate the provided IOCs into existing security monitoring platforms such as SIEM, IDS/IPS, and endpoint detection and response (EDR) solutions to enhance detection capabilities. 2. Conduct regular network traffic analysis focusing on payload delivery patterns and anomalous network activity that align with the indicators. 3. Maintain up-to-date threat intelligence feeds and ensure security teams are trained to interpret and act on OSINT-derived indicators. 4. Implement network segmentation and strict egress filtering to limit the spread and communication of malware payloads within the network. 5. Conduct regular phishing and malware awareness training for employees to reduce the risk of initial infection vectors. 6. Perform routine vulnerability assessments and patch management to reduce the attack surface, even though no specific patches are indicated here. 7. Establish incident response playbooks that incorporate the use of updated IOCs for rapid containment and remediation. 8. Collaborate with national and European cybersecurity centers (e.g., ENISA) to share and receive timely threat intelligence updates.

Community reviews

Loading reviews…