ThreatFox: Unknown malware IOCs

Hunt Hypothesis

This hunt targets the presence of 12 specific IOCs linked to unknown malware, indicating potential compromise by an adversary leveraging novel or unclassified malicious artifacts. Proactively hunting for these indicators in Azure Sentinel is critical to identify early-stage infections and mitigate risks before the malware can establish persistence or execute lateral movement within the environment.

IOC Summary

Malware Family: Unknown malware Total IOCs: 12 IOC Types: url, ip:port, domain

KQL: Ip Hunt

// Hunt for network connections to known malicious IPs
// Source: ThreatFox - Unknown malware
let malicious_ips = dynamic(["94.154.43.253"]);
CommonSecurityLog
| where DestinationIP in (malicious_ips) or SourceIP in (malicious_ips)
| project TimeGenerated, SourceIP, DestinationIP, DestinationPort, DeviceAction, Activity
| order by TimeGenerated desc

KQL: Ip Hunt Device

// Hunt in Defender for Endpoint network events
let malicious_ips = dynamic(["94.154.43.253"]);
DeviceNetworkEvents
| where RemoteIP in (malicious_ips)
| project Timestamp, DeviceName, RemoteIP, RemotePort, InitiatingProcessFileName, ActionType
| order by Timestamp desc

KQL: Domain Hunt

// Hunt for DNS queries to known malicious domains
// Source: ThreatFox - Unknown malware
let malicious_domains = dynamic(["ransomoefralti2zh5nrv7iqybp3d5b4a2eeecz5yjosp7ggbepj7iyd.onion", "ransomocmou6mnbquqz44ewosbkjk3o5qjsl3orawojexfook2j7esad.onion", "everestndkvzcibcje2cqxhre2hmmybl3rn2gwzwsblz7gx6uryn5rad.onion", "gxp6yt3wdj7yky27j37jfrrbkuy24n2zo5uxyuoy23uf76d6m2gnfpid.onion", "aihvh6j6fbkfjyc6jqbsh2ed4s3rym2v2pu6kd3z3exdso2xc2qwcuqd.onion", "bifpwatchoxp7tsb2kpes37b23ogjrb2kj4wgr7yncf4hhgsfahu7jad.onion", "2vqamwfdpis5rkjtpkutigykp56n6hkxfurm6qukdxp6uz5uff5kkaid.onion", "4p2hmbuy36oau64fcvwz2yvdw7eptlkionm46p2m2cs6dmhone5mxiyd.onion", "wyviwn66c5fhgjkdzn7u3tcp2jc5gr3vamgzzrey5rtzogivofxsecyd.onion", "new-projection.zelenie.info"]);
DnsEvents
| where Name has_any (malicious_domains)
| project TimeGenerated, Computer, Name, IPAddresses, QueryType
| order by TimeGenerated desc

KQL: Url Hunt

// Hunt for access to known malicious URLs
// Source: ThreatFox - Unknown malware
let malicious_urls = dynamic(["https://new-projection.zelenie.info/projects"]);
UrlClickEvents
| where Url has_any (malicious_urls)
| project Timestamp, AccountUpn, Url, ActionType, IsClickedThrough
| order by Timestamp desc

Required Data Sources

References

• ThreatFox — Unknown malware

False Positive Guidance

• Scenario: A DevOps team uses curl or wget to download a specific version of a CLI tool (e.g., kubectl, terraform, or ansible) from a GitHub release or internal artifact repository that happens to match one of the 12 IP/URL IOCs.

  • Filter/Exclusion: Exclude events where the user agent is curl/7.x or Wget/1.x and the source IP belongs to the internal CI/CD runner subnet (e.g., 10.20.0.0/24). Alternatively, whitelist the specific URL path if it is a known internal artifact server.

• Scenario: An automated backup job (e.g., Veeam, Commvault, or NetBackup) connects to a storage gateway or backup repository that is hosted on a public IP address listed in the ThreatFox IOC set, often because the backup target is a cloud storage endpoint or a remote DR site.

  • Filter/Exclusion: Exclude connections from service accounts named svc-backup, backup-agent, or similar, and restrict the destination port to standard backup ports (e.g., 443, 8443, or 9000). Ensure the source process is vbr.exe, commvault.exe, or nbsvc.exe.

• Scenario: A software update mechanism for a third-party application (e.g., Adobe Creative Cloud, Java, or a specific vendor’s agent) checks for updates by contacting a CDN or update server that shares an IP address with the “Unknown malware” IOC, particularly if the vendor has recently changed their infrastructure.

  • Filter/Exclusion: Exclude events where the source process is a known updater binary (e.g., AdobeUpdate.exe, javaw.exe, update.exe) and the destination port is 44