ThreatFox: Unknown malware IOCs

Hunt Hypothesis

This hunt targets the presence of 49 known indicators of compromise associated with unidentified malware, which may signal an active intrusion or a new variant of a threat family. Proactively hunting for these IOCs in Azure Sentinel allows the SOC to identify and isolate compromised assets before the unknown malware can establish persistence or execute lateral movement within the environment.

IOC Summary

Malware Family: Unknown malware Total IOCs: 49 IOC Types: ip:port, url, domain

Type	Value	Threat Type	First Seen	Confidence
ip:port	`36[.]248[.]232[.]190:7443`	botnet_cc	2026-09-28	75%
ip:port	`206[.]209[.]210[.]6:7443`	botnet_cc	2026-09-28	75%
url	`hxxp://172[.]81[.]182[.]244:8080/JellyD-Setup-1[.]2[.]1.exe`	payload_delivery	2026-09-28	85%
ip:port	`91[.]107[.]175[.]243:3333`	botnet_cc	2026-09-28	50%
ip:port	`66[.]135[.]7[.]129:443`	botnet_cc	2026-09-28	50%
ip:port	`60[.]251[.]0[.]151:443`	botnet_cc	2026-09-28	50%
ip:port	`54[.]38[.]203[.]62:3333`	botnet_cc	2026-09-28	50%
ip:port	`54[.]212[.]105[.]108:3333`	botnet_cc	2026-09-28	50%
ip:port	`54[.]206[.]240[.]39:443`	botnet_cc	2026-09-28	50%
ip:port	`54[.]164[.]43[.]64:443`	botnet_cc	2026-09-28	50%
ip:port	`51[.]38[.]34[.]102:3333`	botnet_cc	2026-09-28	50%
ip:port	`51[.]15[.]238[.]70:443`	botnet_cc	2026-09-28	50%
ip:port	`47[.]79[.]90[.]0:3333`	botnet_cc	2026-09-28	50%
ip:port	`46[.]175[.]147[.]67:443`	botnet_cc	2026-09-28	50%
ip:port	`44[.]195[.]190[.]174:443`	botnet_cc	2026-09-28	50%
ip:port	`40[.]76[.]104[.]170:443`	botnet_cc	2026-09-28	50%
ip:port	`35[.]213[.]77[.]199:443`	botnet_cc	2026-09-28	50%
ip:port	`34[.]57[.]136[.]30:10443`	botnet_cc	2026-09-28	50%
ip:port	`34[.]203[.]56[.]25:443`	botnet_cc	2026-09-28	50%
ip:port	`32[.]188[.]73[.]249:3333`	botnet_cc	2026-09-28	50%
ip:port	`31[.]31[.]219[.]87:3333`	botnet_cc	2026-09-28	50%
ip:port	`3[.]7[.]162[.]17:443`	botnet_cc	2026-09-28	50%
ip:port	`200[.]150[.]197[.]106:443`	botnet_cc	2026-09-28	50%
ip:port	`20[.]166[.]204[.]82:3333`	botnet_cc	2026-09-28	50%
ip:port	`195[.]22[.]17[.]59:443`	botnet_cc	2026-09-28	50%

KQL: Ip Hunt

// Hunt for network connections to known malicious IPs
// Source: ThreatFox - Unknown malware
let malicious_ips = dynamic(["138.201.193.32", "103.30.77.158", "185.225.226.77", "54.164.43.64", "20.166.204.82", "51.38.34.102", "47.79.90.0", "36.248.232.190", "165.245.190.70", "132.196.242.157", "145.241.235.97", "103.247.10.148", "144.121.108.141", "103.20.235.16", "40.76.104.170", "34.203.56.25", "54.212.105.108", "35.213.77.199", "91.107.175.243", "60.251.0.151", "32.188.73.249", "188.165.201.165", "34.57.136.30", "83.149.105.131", "46.175.147.67", "178.128.144.136", "54.38.203.62", "101.47.20.73", "51.15.238.70", "44.195.190.174", "106.75.232.169", "195.22.17.59", "66.135.7.129", "54.206.240.39", "43.157.228.92", "194.59.30.244", "124.222.21.29", "172.205.30.129", "3.7.162.17", "200.150.197.106", "206.209.210.6", "31.31.219.87"]);
CommonSecurityLog
| where DestinationIP in (malicious_ips) or SourceIP in (malicious_ips)
| project TimeGenerated, SourceIP, DestinationIP, DestinationPort, DeviceAction, Activity
| order by TimeGenerated desc

KQL: Ip Hunt Device

// Hunt in Defender for Endpoint network events
let malicious_ips = dynamic(["138.201.193.32", "103.30.77.158", "185.225.226.77", "54.164.43.64", "20.166.204.82", "51.38.34.102", "47.79.90.0", "36.248.232.190", "165.245.190.70", "132.196.242.157", "145.241.235.97", "103.247.10.148", "144.121.108.141", "103.20.235.16", "40.76.104.170", "34.203.56.25", "54.212.105.108", "35.213.77.199", "91.107.175.243", "60.251.0.151", "32.188.73.249", "188.165.201.165", "34.57.136.30", "83.149.105.131", "46.175.147.67", "178.128.144.136", "54.38.203.62", "101.47.20.73", "51.15.238.70", "44.195.190.174", "106.75.232.169", "195.22.17.59", "66.135.7.129", "54.206.240.39", "43.157.228.92", "194.59.30.244", "124.222.21.29", "172.205.30.129", "3.7.162.17", "200.150.197.106", "206.209.210.6", "31.31.219.87"]);
DeviceNetworkEvents
| where RemoteIP in (malicious_ips)
| project Timestamp, DeviceName, RemoteIP, RemotePort, InitiatingProcessFileName, ActionType
| order by Timestamp desc

KQL: Domain Hunt

// Hunt for DNS queries to known malicious domains
// Source: ThreatFox - Unknown malware
let malicious_domains = dynamic(["hunteroc.com", "kostaschristides.com", "info-u.net", "zmqh.com"]);
DnsEvents
| where Name has_any (malicious_domains)
| project TimeGenerated, Computer, Name, IPAddresses, QueryType
| order by TimeGenerated desc

KQL: Url Hunt

// Hunt for access to known malicious URLs
// Source: ThreatFox - Unknown malware
let malicious_urls = dynamic(["http://172.81.182.244:8080/JellyD-Setup-1.2.1.exe", "http://154.211.86.169:40000/?h=154.211.86.169&p=40000&t=tcp&a=m64&stage=true", "http://94.183.174.80/bins.sh"]);
UrlClickEvents
| where Url has_any (malicious_urls)
| project Timestamp, AccountUpn, Url, ActionType, IsClickedThrough
| order by Timestamp desc

Required Data Sources

Sentinel Table	Notes
`CommonSecurityLog`	Ensure this data connector is enabled
`DeviceNetworkEvents`	Ensure this data connector is enabled
`DnsEvents`	Ensure this data connector is enabled
`UrlClickEvents`	Ensure this data connector is enabled

References

ThreatFox — Unknown malware

False Positive Guidance

Scenario: A legacy application server running an outdated Java-based ESB (Enterprise Service Bus) generates a unique, high-entropy hash for a dynamically loaded native library that matches one of the 49 IOCs due to a rare build configuration.
- Filter/Exclusion: Exclude processes where the parent process is java.exe or jre.exe and the file path contains /lib/ or /plugins/, specifically for servers tagged with LegacyAppServer.
Scenario: An IT admin manually downloads a specific version of a third-party monitoring agent (e.g., Datadog or New Relic) for a one-off deployment on a development VM, where the installer binary’s hash coincidentally matches an IOC associated with a known benign but obscure tool.
- Filter/Exclusion: Exclude events where the user account belongs to the IT-Admins security group and the machine is in the Dev-VMs OU, provided the event timestamp is within 24 hours of a corresponding ticket creation in the ITSM tool.
Scenario: A scheduled PowerShell script used for nightly log rotation on web servers compresses and moves logs to a specific directory, creating a temporary file with a hash that matches an IOC for a known benign compression utility (e.g., a specific build of 7-Zip or WinRAR used internally).
- Filter/Exclusion: Exclude processes named 7z.exe, WinRAR.exe, or compress.ps1 where the command line contains -o or Compress-Archive and the parent process is powershell.exe or pwsh.exe.
Scenario: A CI/CD pipeline agent on a build server executes a custom Docker image build step that pulls a base image with a known layer hash that matches an IOC, triggered by a docker build command. *