IndicatorPublished 6 Feb 2025Updated 7 Feb 2025

type osint · ThreatFox IOCs for 2025-02-06

Affects type osintSource ThreatFox MISP Feed

TLP:WHITE, disclosure is not limited

Indicators of compromise

Domains 984

updatetroubleunloaded.shopVidar botnet C2 domain (confidence level: 100%)
statistics-gates.gl.at.ply.ggSpyNote botnet C2 domain (confidence level: 100%)
espada1233123-54643.portmap.hostSpyNote botnet C2 domain (confidence level: 100%)
gii-55854.portmap.hostSpyNote botnet C2 domain (confidence level: 100%)
accounts3.app-cloud.linkHavoc botnet C2 domain (confidence level: 100%)
ip115.ip-51-81-104.usUnknown malware botnet C2 domain (confidence level: 100%)
hextoriq99.ddns.netNjRAT botnet C2 domain (confidence level: 75%)
bfa.aeHavoc botnet C2 domain (confidence level: 100%)
sophoscore.comCobalt Strike botnet C2 domain (confidence level: 100%)
www.quadriosoulfood.shopUnknown malware botnet C2 domain (confidence level: 100%)

URLs 227

http://80.64.30.238/trip.psdClearFake botnet C2 (confidence level: 100%)
http://83.217.208.130/xfiles/trip.mp4ClearFake botnet C2 (confidence level: 50%)
https://updatetroubleunloaded.shop/b313d4a4588bd2e7bc9ece877caba58a.xllClearFake botnet C2 (confidence level: 100%)
https://2040-176-98-70-125.ngrok-free.appSpyNote botnet C2 (confidence level: 100%)
https://whisperingvale.xyz/yte5mzq1zwrkzjy1/Coper botnet C2 (confidence level: 100%)
https://firestormsite.xyz/mzzkntlintu4ndhl/Coper botnet C2 (confidence level: 100%)
http://cg79561.tw1.ru/l1nc0in.phpDCRat botnet C2 (confidence level: 100%)
https://updatetroubleunloaded.shop/b313d4a4588bd2e7bc9ece877caba58a.pngVidar botnet C2 (confidence level: 100%)
http://176.65.134.52/Hook botnet C2 (confidence level: 50%)
http://83.217.208.130/xfiles/vida.mp3Vidar botnet C2 (confidence level: 100%)

IP addresses 141

193.161.193.99SpyNote botnet C2 server (confidence level: 100%)
103.186.117.39Remcos botnet C2 server (confidence level: 100%)
37.120.151.102Remcos botnet C2 server (confidence level: 100%)
94.237.94.250Sliver botnet C2 server (confidence level: 100%)
186.169.52.131AsyncRAT botnet C2 server (confidence level: 100%)
62.182.85.200AsyncRAT botnet C2 server (confidence level: 100%)
78.179.128.55AsyncRAT botnet C2 server (confidence level: 100%)
78.179.128.55AsyncRAT botnet C2 server (confidence level: 100%)
38.85.247.159AsyncRAT botnet C2 server (confidence level: 100%)
195.177.94.54Venom RAT botnet C2 server (confidence level: 100%)

Hashes 10

BianLian payload (confidence level: 50%)

36171704cde087f839b10c2465d864e1
d10e0387e3d55dc1f82c23719e2b168b
0c756fc8f34e409650cd910b5e2a3f00
b3cdf0489ff37fe65141be9363b9489c
08e76dd242e64bb31aec09db8464b28f
14da9c0c4e3ac3b9abb2c48b37bece19
15cdfa777aa2db35229410d2fa9fb92e
7be61ea851f894d26bf57cf0f1f55ed6
e625ef18487a37a71b489d39c65a343a
de1c126af5134155646367feae0bc84a

Description

ThreatFox IOCs for 2025-02-06

Impact

For European organizations, the impact of this threat intelligence update is primarily in enhancing detection capabilities and situational awareness rather than mitigating an active or critical vulnerability. Since no specific affected products or versions are identified, and no active exploits are reported, the direct risk to confidentiality, integrity, or availability is low at this stage. However, the presence of network activity and payload delivery tags indicates potential malware campaigns or intrusion attempts that could lead to data breaches, service disruptions, or unauthorized access if leveraged by threat actors. European entities with mature security operations centers (SOCs) and threat intelligence teams can integrate these IOCs to improve monitoring and incident response. Organizations lacking such capabilities might face delayed detection of related malicious activities. Given the medium severity and absence of known exploits, the immediate operational impact is limited, but vigilance is warranted to prevent escalation or exploitation in targeted attacks.

Defensive guidance

1. Integrate the provided IOCs from the ThreatFox MISP Feed into existing Security Information and Event Management (SIEM) and endpoint detection and response (EDR) systems to enhance detection of related network activity and payload delivery attempts. 2. Conduct regular threat hunting exercises focusing on network traffic anomalies and suspicious payloads that align with the intelligence categories provided. 3. Maintain up-to-date network segmentation and strict access controls to limit lateral movement in case of payload delivery success. 4. Employ advanced malware detection tools that leverage behavioral analysis to identify unknown or polymorphic payloads. 5. Ensure continuous training and awareness programs for security teams to recognize and respond to emerging OSINT-based threat intelligence. 6. Collaborate with national and European cybersecurity information sharing organizations to receive timely updates and contextualize the threat within regional attack trends. 7. Since no patches are available, emphasize proactive detection and containment strategies rather than reactive patching.

Community reviews

Loading reviews…