IndicatorPublished 10 Feb 2025Updated 11 Feb 2025

type osint · ThreatFox IOCs for 2025-02-10

Affects type osintSource ThreatFox MISP Feed

TLP:WHITE, disclosure is not limited

Indicators of compromise

Domains 686

readysteaurants.comRemcos botnet C2 domain (confidence level: 100%)
elyeso.ip-ddns.comRemcos botnet C2 domain (confidence level: 100%)
infosblogwar.duckdns.orgRemcos botnet C2 domain (confidence level: 100%)
remaboki2025.duckdns.orgRemcos botnet C2 domain (confidence level: 100%)
bangerr.duckdns.orgRemcos botnet C2 domain (confidence level: 100%)
jeje.linkpc.netAve Maria botnet C2 domain (confidence level: 100%)
environmental-seeds.gl.at.ply.ggNjRAT botnet C2 domain (confidence level: 100%)
nice-otherwise.gl.at.ply.ggNjRAT botnet C2 domain (confidence level: 100%)
adventurolusspirit.clickLumma Stealer botnet C2 domain (confidence level: 100%)
bwrightfuture.clickLumma Stealer botnet C2 domain (confidence level: 100%)

URLs 187

http://home.fivepp5vs.top/okityplykwyzpzsduddr17CryptBot botnet C2 (confidence level: 100%)
http://home.thrtpp13sb.top/raozktqqsofbftfwpzpd11CryptBot botnet C2 (confidence level: 100%)
http://home.twelve12vs.top/avwhjxavcxpehbrictmj10CryptBot botnet C2 (confidence level: 100%)
http://home.fortenb14vs.top/yemccerranlfomqykhct57CryptBot botnet C2 (confidence level: 100%)
http://home.thrthh13pn.top/xcqemzdxgejbbjkcndnh1738611128CryptBot botnet C2 (confidence level: 100%)
http://home.fortth14vs.top/gduzhxvrrnstmmahdbgb18CryptBot botnet C2 (confidence level: 100%)
http://home.twntgg20sb.top/jgcamzywlkbdegdhzrsg11CryptBot botnet C2 (confidence level: 100%)
http://home.twentpp20vs.top/dibdpbvuecmcmipllqmm10CryptBot botnet C2 (confidence level: 100%)
http://home.twentykm20sr.top/iyueiwtrvzkhtkirypp737CryptBot botnet C2 (confidence level: 100%)
http://home.twelveff20pn.top/hfqvzftxgmzzemqbmmga1736773805CryptBot botnet C2 (confidence level: 100%)

IP addresses 139

173.211.106.67Remcos botnet C2 server (confidence level: 100%)
185.140.53.140Remcos botnet C2 server (confidence level: 100%)
88.208.246.143NjRAT botnet C2 server (confidence level: 100%)
38.85.247.35AsyncRAT botnet C2 server (confidence level: 100%)
107.170.60.30AsyncRAT botnet C2 server (confidence level: 100%)
93.198.191.146NetSupportManager RAT botnet C2 server (confidence level: 100%)
16.16.201.2NetSupportManager RAT botnet C2 server (confidence level: 100%)
13.232.216.28NetSupportManager RAT botnet C2 server (confidence level: 100%)
181.214.231.181MooBot botnet C2 server (confidence level: 100%)
46.247.108.173MooBot botnet C2 server (confidence level: 100%)

Hashes 27

c6c511ba966328c9497c8aa9264fb733Trigona payload (confidence level: 50%)
15d05dfa5cff0cfc86e5135155744385Trigona payload (confidence level: 50%)
d0291a6d151395076d7fb7ca9b798125Trigona payload (confidence level: 50%)
f58df2bfe9029301131370a318628026Trigona payload (confidence level: 50%)
10403f08a869a83d5c8d81162b711453Trigona payload (confidence level: 50%)
6ae62456341ad1a113597a50779c095aTrigona payload (confidence level: 50%)
68635ad9d12f683071611bfd34c1ec34Trigona payload (confidence level: 50%)
1852be15aa8dcf664291b3849bd348e4Trigona payload (confidence level: 50%)
145d3ae9d1c6f1d4aa67e31fa32c32e9Trigona payload (confidence level: 50%)
9bce9dae679419198574f4c9837085dbTrigona payload (confidence level: 50%)

Description

ThreatFox IOCs for 2025-02-10

Impact

For European organizations, the impact of this threat is currently limited due to the lack of detailed information and absence of known active exploitation. However, the presence of network activity and payload delivery components suggests potential risks such as unauthorized access, data exfiltration, or disruption of services if the malware were to be deployed successfully. Medium severity indicates that while the threat is not immediately critical, it could lead to moderate confidentiality, integrity, or availability impacts if leveraged by threat actors. European entities involved in sectors with high reliance on networked systems—such as finance, healthcare, and critical infrastructure—should remain vigilant. The lack of patches or specific affected versions means organizations cannot rely on straightforward remediation and must focus on detection and prevention strategies. The threat’s OSINT nature implies that attackers might be leveraging publicly available information to tailor attacks, increasing the risk of targeted campaigns against European organizations with valuable data or strategic importance.

Defensive guidance

Given the limited technical details and absence of patches, European organizations should adopt a layered defense approach. Specific recommendations include: 1) Enhance network monitoring to detect unusual or suspicious network activity indicative of payload delivery attempts, using updated threat intelligence feeds including the latest IOCs from ThreatFox. 2) Implement strict email and web filtering to reduce the risk of phishing or drive-by download attacks that could deliver the malware payload. 3) Conduct regular threat hunting exercises focusing on the indicators provided by ThreatFox and similar OSINT sources, even if no direct IOCs are currently listed. 4) Employ endpoint detection and response (EDR) solutions capable of identifying anomalous behavior related to payload execution or network communications. 5) Educate employees about social engineering tactics, as OSINT-driven attacks often rely on tailored phishing or spear-phishing. 6) Maintain up-to-date backups and incident response plans to mitigate potential impacts from payload execution. 7) Collaborate with national cybersecurity centers and share threat intelligence to improve detection and response capabilities across sectors.

Community reviews

Loading reviews…