IndicatorPublished 16 Feb 2025Updated 17 Feb 2025

type osint · ThreatFox IOCs for 2025-02-16

Affects type osintSource ThreatFox MISP Feed

TLP:WHITE, disclosure is not limited

Indicators of compromise

Domains 433

aesthzeticday.topLumma Stealer botnet C2 domain (confidence level: 100%)
ampklevision.topLumma Stealer botnet C2 domain (confidence level: 100%)
blisksfulfuture.topLumma Stealer botnet C2 domain (confidence level: 100%)
blissfzuljourney.topLumma Stealer botnet C2 domain (confidence level: 100%)
brhightfusion.topLumma Stealer botnet C2 domain (confidence level: 100%)
calhmhaven.topLumma Stealer botnet C2 domain (confidence level: 100%)
cherikshedideas.topLumma Stealer botnet C2 domain (confidence level: 100%)
cherishzmoments.topLumma Stealer botnet C2 domain (confidence level: 100%)
creatiyvegroove.topLumma Stealer botnet C2 domain (confidence level: 100%)
dreamcrazfters.topLumma Stealer botnet C2 domain (confidence level: 100%)

URLs 52

https://check.gaxfd.icu/gkcxv.googleClearFake payload delivery URL (confidence level: 100%)
https://u1.sulkuntie.shop/guajira.mp3ClearFake payload delivery URL (confidence level: 100%)
https://sunsetvale.xyz/mdqyztc1mju5mjzi/Coper botnet C2 (confidence level: 100%)
https://frozenpeak.xyz/ndi3yjdmytrlzjy3/Coper botnet C2 (confidence level: 100%)
http://800811cm.nyashk.ru/eternalimageauthdblinuxwindowsuniversal.phpDCRat botnet C2 (confidence level: 100%)
http://123.58.220.204:8888/supershell/login/Unknown malware botnet C2 (confidence level: 100%)
https://pastebin.com/raw/gu7qawaqXWorm botnet C2 (confidence level: 50%)
https://check.piqcz.icu/gkcxv.googleClearFake payload delivery URL (confidence level: 100%)
https://intentionalklife.top/apiLumma Stealer botnet C2 (confidence level: 100%)
https://hopefulpatkh.top/apiLumma Stealer botnet C2 (confidence level: 100%)

IP addresses 321

31.171.131.83Mirai botnet C2 server (confidence level: 75%)
31.59.131.238Mirai botnet C2 server (confidence level: 75%)
42.235.154.113Mirai payload delivery server (confidence level: 100%)
59.95.85.40Mirai payload delivery server (confidence level: 100%)
120.61.68.97Mirai payload delivery server (confidence level: 100%)
117.215.249.82Mirai payload delivery server (confidence level: 100%)
59.88.140.173Mirai payload delivery server (confidence level: 100%)
61.2.151.2Mirai payload delivery server (confidence level: 100%)
102.33.80.182Mirai payload delivery server (confidence level: 100%)
103.207.124.49Mirai payload delivery server (confidence level: 100%)

Description

ThreatFox IOCs for 2025-02-16

Impact

Given the nature of this entry as a collection of IOCs without specific exploit details or affected products, the direct impact on European organizations is limited. However, the presence of network activity and payload delivery tags indicates potential reconnaissance or preparatory stages of malware campaigns that could target European networks. Organizations relying on threat intelligence feeds like ThreatFox could use these IOCs to enhance detection capabilities. The medium severity rating suggests a moderate risk, primarily from potential network intrusions or malware infections if these IOCs correspond to active threats elsewhere. European entities with mature security operations centers (SOCs) and threat hunting teams can leverage this intelligence to preemptively identify suspicious activity. The lack of known exploits in the wild reduces immediate risk but does not eliminate the possibility of future exploitation. Therefore, the impact is more about preparedness and situational awareness rather than imminent compromise.

Defensive guidance

1. Integrate the provided IOCs into existing Security Information and Event Management (SIEM) and Endpoint Detection and Response (EDR) systems to enhance detection of related network activity and payload delivery attempts. 2. Conduct regular threat hunting exercises using these IOCs to identify any early signs of compromise or reconnaissance within the network. 3. Maintain up-to-date network segmentation and strict access controls to limit lateral movement if payload delivery attempts are detected. 4. Ensure robust email and web filtering solutions are in place to reduce the risk of initial infection vectors commonly associated with payload delivery. 5. Regularly update and patch all systems, even though no specific patches are indicated here, to reduce the attack surface for potential future exploits related to these IOCs. 6. Collaborate with threat intelligence sharing communities to stay informed about any developments related to these IOCs or associated malware campaigns. 7. Train security teams to recognize and respond to network anomalies and suspicious payload delivery mechanisms that may correlate with these indicators.

Community reviews

Loading reviews…