IndicatorPublished 2 Feb 2025Updated 3 Feb 2025

type osint · ThreatFox IOCs for 2025-02-02

Affects type osintSource ThreatFox MISP Feed

TLP:WHITE, disclosure is not limited

Indicators of compromise

Domains 61

solve.kxlv.orgClearFake payload delivery domain (confidence level: 100%)
goody.work.gdRemcos botnet C2 domain (confidence level: 100%)
hedra.app-tools.infoPoseidon Stealer botnet C2 domain (confidence level: 100%)
ulgroup.miicrosofts.orgUnknown malware botnet C2 domain (confidence level: 100%)
wcpstatic.miicrosofts.orgUnknown malware botnet C2 domain (confidence level: 100%)
ec2-18-170-59-177.eu-west-2.compute.amazonaws.comERMAC botnet C2 domain (confidence level: 100%)
mm.underarmpresumingsubscript.shopACR Stealer botnet C2 domain (confidence level: 100%)
table-hon.gl.at.ply.ggXWorm botnet C2 domain (confidence level: 50%)
solve.vsdd.orgClearFake payload delivery domain (confidence level: 100%)
solve.rlvw.orgClearFake payload delivery domain (confidence level: 100%)

URLs 23

https://goldenbirdzone.xyz/mzzkntlintu4ndhl/Coper botnet C2 (confidence level: 100%)
http://110.183.25.12:53456/mozi.mMozi payload delivery URL (confidence level: 50%)
https://solve.kxlv.org/awjsx.captchaClearFake payload delivery URL (confidence level: 100%)
http://tsukanjz.beget.tech/0cd9aef8.phpDCRat botnet C2 (confidence level: 100%)
http://185.215.113.115/c4becf79229cb002.phpStealc botnet C2 (confidence level: 50%)
http://223.11.60.184:35597/mozi.mMozi payload delivery URL (confidence level: 50%)
https://pastebin.com/raw/z20rzvuqXWorm botnet C2 (confidence level: 50%)
https://securesways.click/apiLumma Stealer botnet C2 (confidence level: 75%)
http://activequestion.ru/externallongpollflowerwpdlelocalprivatecentral.phpDCRat botnet C2 (confidence level: 100%)
http://a1077057.xsph.ru/ac5e408b.phpDCRat botnet C2 (confidence level: 100%)

IP addresses 119

3.71.225.231NjRAT botnet C2 server (confidence level: 75%)
166.108.238.159Cobalt Strike botnet C2 server (confidence level: 100%)
83.115.186.91DarkComet botnet C2 server (confidence level: 100%)
163.5.112.59Remcos botnet C2 server (confidence level: 100%)
123.11.142.103Unknown malware botnet C2 server (confidence level: 100%)
135.148.89.85AsyncRAT botnet C2 server (confidence level: 100%)
102.117.172.239Unknown malware botnet C2 server (confidence level: 100%)
111.196.132.41Brute Ratel C4 botnet C2 server (confidence level: 100%)
185.224.0.242MooBot botnet C2 server (confidence level: 100%)
151.236.16.144BianLian botnet C2 server (confidence level: 100%)

Description

ThreatFox IOCs for 2025-02-02

Impact

The medium severity suggests potential risks if the malware payloads or network activities become more widespread or targeted. Potential impacts could include unauthorized network access, data exfiltration, or service disruption if payload delivery mechanisms are successful. However, without specific affected products or vulnerabilities, the threat remains generic. European entities with extensive network exposure or those relying on OSINT feeds for threat intelligence might benefit from monitoring these IOCs to preemptively detect suspicious activity. The lack of detailed indicators reduces immediate operational impact but underscores the need for vigilance in network monitoring and incident response readiness.

Defensive guidance

Given the limited technical details, mitigation should focus on enhancing network security posture and threat detection capabilities. Organizations should: 1) Continuously update and tune intrusion detection/prevention systems (IDS/IPS) and endpoint detection and response (EDR) tools to recognize emerging malware behaviors and network anomalies. 2) Integrate ThreatFox and other OSINT feeds into Security Information and Event Management (SIEM) platforms to correlate and analyze potential indicators proactively. 3) Conduct regular network traffic analysis to identify unusual payload delivery attempts or suspicious network activity. 4) Maintain robust segmentation and least privilege principles to limit malware propagation if an infection occurs. 5) Educate security teams to interpret and act on OSINT-derived alerts, even when detailed exploit information is unavailable. 6) Prepare incident response plans that can adapt to emerging threats with limited initial data. These steps go beyond generic advice by emphasizing proactive OSINT integration and adaptive detection strategies.

Community reviews

Loading reviews…