IndicatorPublished 1 Feb 2025Updated 2 Feb 2025

type osint · ThreatFox IOCs for 2025-02-01

Affects type osintSource ThreatFox MISP Feed

TLP:WHITE, disclosure is not limited

Indicators of compromise

Domains 3,194

solve.wbth.orgClearFake payload delivery domain (confidence level: 100%)
solve.xclb.orgClearFake payload delivery domain (confidence level: 100%)
viperoleplay.netRemcos botnet C2 domain (confidence level: 100%)
kara2000.infoHavoc botnet C2 domain (confidence level: 100%)
img6.miicrosofts.orgUnknown malware botnet C2 domain (confidence level: 100%)
acctcdn.miicrosofts.orgUnknown malware botnet C2 domain (confidence level: 100%)
react.miicrosofts.orgUnknown malware botnet C2 domain (confidence level: 100%)
ec2-13-53-166-6.eu-north-1.compute.amazonaws.comUnknown malware botnet C2 domain (confidence level: 100%)
ph-testing.orgUnknown malware botnet C2 domain (confidence level: 100%)
clinakleee-44561.portmap.hostAsyncRAT botnet C2 domain (confidence level: 50%)

URLs 60

http://69.23.241.65:44835/mozi.mMozi payload delivery URL (confidence level: 50%)
https://abstract.claims/Unknown malware payload delivery URL (confidence level: 50%)
https://pecanclusteredjalapeno.shop/upUnknown malware botnet C2 (confidence level: 100%)
https://pecanclusteredjalapeno.shop/up/bUnknown malware botnet C2 (confidence level: 100%)
https://u2.servicelandingkaraoke.shop/cp_sh.emlUnknown malware botnet C2 (confidence level: 100%)
http://believezioep.com/apiLumma Stealer botnet C2 (confidence level: 100%)
http://cabbagepattof.net/apiLumma Stealer botnet C2 (confidence level: 100%)
http://clammypunero.com/apiLumma Stealer botnet C2 (confidence level: 100%)
http://garderjjerop.com/apiLumma Stealer botnet C2 (confidence level: 100%)
http://plasticreie.com/apiLumma Stealer botnet C2 (confidence level: 100%)

IP addresses 223

172.94.9.168Remcos botnet C2 server (confidence level: 100%)
188.245.209.124Remcos botnet C2 server (confidence level: 100%)
128.90.123.96AsyncRAT botnet C2 server (confidence level: 100%)
23.254.226.86AsyncRAT botnet C2 server (confidence level: 100%)
149.28.115.180AsyncRAT botnet C2 server (confidence level: 100%)
185.42.12.247SectopRAT botnet C2 server (confidence level: 100%)
102.117.169.103Unknown malware botnet C2 server (confidence level: 100%)
87.242.124.66Unknown malware botnet C2 server (confidence level: 100%)
46.246.12.17DCRat botnet C2 server (confidence level: 100%)
185.147.124.108PoshC2 botnet C2 server (confidence level: 100%)

Description

ThreatFox IOCs for 2025-02-01

Impact

For European organizations, the impact of this threat intelligence update is primarily in the realm of detection and preparedness rather than direct compromise. Since no active exploits or vulnerabilities are described, the immediate risk of system compromise is low. However, the presence of payload delivery and network activity indicators suggests potential threats that could be leveraged by attackers to infiltrate networks or deliver malicious payloads. Organizations relying on OSINT feeds like ThreatFox can use these IOCs to improve their security monitoring and incident response capabilities. Failure to integrate such intelligence could result in delayed detection of emerging threats, potentially leading to data breaches or service disruptions if attackers employ similar tactics. The medium severity rating indicates that while the threat is not critical, it warrants attention to maintain robust defense postures. European entities with mature security operations centers (SOCs) and threat intelligence teams are better positioned to utilize this information effectively.

Defensive guidance

1. Integrate ThreatFox IOCs into existing Security Information and Event Management (SIEM) and Intrusion Detection/Prevention Systems (IDS/IPS) to enhance detection capabilities for payload delivery and suspicious network activity. 2. Regularly update threat intelligence feeds and ensure automated ingestion of new IOCs to maintain up-to-date situational awareness. 3. Conduct network traffic analysis focusing on anomalies that match the behavioral patterns associated with payload delivery mechanisms. 4. Implement strict egress filtering and network segmentation to limit the potential impact of malicious payload delivery. 5. Train SOC analysts to recognize patterns related to the indicators and to perform timely investigations when alerts are triggered. 6. Since no patches are available, emphasize proactive monitoring and rapid incident response rather than relying on software fixes. 7. Collaborate with European CERTs and information sharing groups to exchange intelligence and best practices related to emerging threats.

Community reviews

Loading reviews…