ThreatFox: Unknown malware IOCs

Hunt Hypothesis

This detection rule identifies potential unknown malware infections by correlating network and endpoint telemetry against a curated set of seventeen distinct Indicators of Compromise (IOCs). Proactively hunting for these signals in Azure Sentinel is critical to uncover stealthy threats that evade signature-based defenses, allowing the SOC team to isolate compromised assets before lateral movement or data exfiltration occurs.

IOC Summary

Malware Family: Unknown malware Total IOCs: 17 IOC Types: md5_hash, url, ip:port

Type	Value	Threat Type	First Seen	Confidence
url	`hxxps://vesinhmoitruonghy.com/`	payload_delivery	2026-08-27	90%
url	`hxxps://www.herreraalvaradoasociados.com/`	payload_delivery	2026-08-27	90%
ip:port	`45[.]61[.]170[.]105:7443`	botnet_cc	2026-08-27	100%
url	`hxxps://www.avi-wallpapers.co.il/`	payload_delivery	2026-08-27	90%
ip:port	`62[.]238[.]110[.]216:443`	botnet_cc	2026-08-27	75%
url	`hxxps://tempsgraphie.com/`	payload_delivery	2026-08-27	90%
url	`hxxps://lootguys.com/`	payload_delivery	2026-08-27	90%
url	`hxxps://gascreative.com/`	payload_delivery	2026-08-27	90%
ip:port	`27[.]124[.]17[.]164:8801`	botnet_cc	2026-08-27	75%
ip:port	`27[.]124[.]17[.]173:8801`	botnet_cc	2026-08-27	75%
ip:port	`47[.]242[.]62[.]96:15800`	botnet_cc	2026-08-27	75%
ip:port	`49[.]235[.]130[.]208:888`	botnet_cc	2026-08-27	100%
ip:port	`67[.]216[.]197[.]83:8443`	botnet_cc	2026-08-27	100%
md5_hash	`ac9d11435d475086b80ebe7d6943fc83`	payload	2026-08-27	100%
md5_hash	`ede70699452c4bf8ec5adef4aff6ba44`	payload	2026-08-27	100%
ip:port	`135[.]136[.]135[.]54:443`	botnet_cc	2026-08-27	75%
url	`hxxps://ratatwista.com:50051/agent-control/upload`	botnet_cc	2026-08-27	100%

KQL: Ip Hunt

// Hunt for network connections to known malicious IPs
// Source: ThreatFox - Unknown malware
let malicious_ips = dynamic(["45.61.170.105", "27.124.17.173", "49.235.130.208", "62.238.110.216", "67.216.197.83", "135.136.135.54", "47.242.62.96", "27.124.17.164"]);
CommonSecurityLog
| where DestinationIP in (malicious_ips) or SourceIP in (malicious_ips)
| project TimeGenerated, SourceIP, DestinationIP, DestinationPort, DeviceAction, Activity
| order by TimeGenerated desc

KQL: Ip Hunt Device

// Hunt in Defender for Endpoint network events
let malicious_ips = dynamic(["45.61.170.105", "27.124.17.173", "49.235.130.208", "62.238.110.216", "67.216.197.83", "135.136.135.54", "47.242.62.96", "27.124.17.164"]);
DeviceNetworkEvents
| where RemoteIP in (malicious_ips)
| project Timestamp, DeviceName, RemoteIP, RemotePort, InitiatingProcessFileName, ActionType
| order by Timestamp desc

KQL: Url Hunt

// Hunt for access to known malicious URLs
// Source: ThreatFox - Unknown malware
let malicious_urls = dynamic(["https://vesinhmoitruonghy.com/", "https://www.herreraalvaradoasociados.com/", "https://www.avi-wallpapers.co.il/", "https://tempsgraphie.com/", "https://lootguys.com/", "https://gascreative.com/", "https://ratatwista.com:50051/agent-control/upload"]);
UrlClickEvents
| where Url has_any (malicious_urls)
| project Timestamp, AccountUpn, Url, ActionType, IsClickedThrough
| order by Timestamp desc

KQL: Hash Hunt

// Hunt for files matching known malicious hashes
// Source: ThreatFox - Unknown malware
let malicious_hashes = dynamic(["ac9d11435d475086b80ebe7d6943fc83", "ede70699452c4bf8ec5adef4aff6ba44"]);
DeviceFileEvents
| where SHA256 in (malicious_hashes) or SHA1 in (malicious_hashes) or MD5 in (malicious_hashes)
| project Timestamp, DeviceName, FileName, FolderPath, SHA256, InitiatingProcessFileName
| order by Timestamp desc

Required Data Sources

Sentinel Table	Notes
`CommonSecurityLog`	Ensure this data connector is enabled
`DeviceFileEvents`	Ensure this data connector is enabled
`DeviceNetworkEvents`	Ensure this data connector is enabled
`UrlClickEvents`	Ensure this data connector is enabled

References

ThreatFox — Unknown malware

False Positive Guidance

Scenario: Automated Endpoint Protection Scans Generating Network Traffic
- Context: Enterprise-wide scheduled scans by Microsoft Defender for Endpoint or CrowdStrike Falcon often trigger network connections to update definition databases or upload telemetry. These legitimate scan processes may match the “Unknown malware” IOCs (specifically hash values or domain lookups) if the detection logic relies on generic connection patterns rather than specific process trees.
- Filter/Exclusion: Create a rule exclusion that suppresses alerts where the Process_Name matches known security agents (e.g., MsMpEng.exe, FalconSensorService.exe) and the Parent_Process_Name is the OS scheduler or the agent’s own service, provided the connection destination falls within the vendor’s trusted IP ranges.
Scenario: Software Deployment via Configuration Management Tools
- Context: During routine patching cycles, tools like Microsoft SCCM (Configuration Manager) or Ivanti Neurons push new applications to endpoints. The installation packages often contain temporary scripts or installers with hashes that do not yet exist in the threat intelligence feed, triggering false positives for “Unknown malware” IOCs during the deployment window.
- Filter/Exclusion: Implement a time-based exclusion for alerts occurring within 2 hours of scheduled maintenance windows (e.g., 01:00 - 05:00 UTC on Tuesdays and Thursdays) where the User_Account is a service account (e.g., DOMAIN\SCCM-Deploy-Svc) and the process path resides in standard deployment directories like C:\Windows\CCM\.
Scenario: Legacy Application Updates via Windows Update
- Context: Older business applications or internal line-of-business tools often rely on Windows Update to fetch patches. These updates may introduce new executable versions with fresh hashes that the ThreatFox package