ThreatFox: AnimateClipper IOCs

Hunt Hypothesis

This hunt detects adversary activity linked to the AnimateClipper threat actor by monitoring for three specific indicators of compromise known to facilitate their initial access and lateral movement within cloud environments. A proactive search in Azure Sentinel is critical because early identification of these IOCs enables the SOC team to rapidly isolate affected assets before the attacker can establish persistence or exfiltrate sensitive data.

IOC Summary

Malware Family: AnimateClipper Total IOCs: 3 IOC Types: ip:port, domain

KQL: Ip Hunt

// Hunt for network connections to known malicious IPs
// Source: ThreatFox - AnimateClipper
let malicious_ips = dynamic(["109.172.54.136", "45.155.68.45"]);
CommonSecurityLog
| where DestinationIP in (malicious_ips) or SourceIP in (malicious_ips)
| project TimeGenerated, SourceIP, DestinationIP, DestinationPort, DeviceAction, Activity
| order by TimeGenerated desc

KQL: Ip Hunt Device

// Hunt in Defender for Endpoint network events
let malicious_ips = dynamic(["109.172.54.136", "45.155.68.45"]);
DeviceNetworkEvents
| where RemoteIP in (malicious_ips)
| project Timestamp, DeviceName, RemoteIP, RemotePort, InitiatingProcessFileName, ActionType
| order by Timestamp desc

KQL: Domain Hunt

// Hunt for DNS queries to known malicious domains
// Source: ThreatFox - AnimateClipper
let malicious_domains = dynamic(["media.barmaidlushness.cc"]);
DnsEvents
| where Name has_any (malicious_domains)
| project TimeGenerated, Computer, Name, IPAddresses, QueryType
| order by TimeGenerated desc

Required Data Sources

References

• ThreatFox — AnimateClipper

False Positive Guidance

Here are 5 specific false positive scenarios for the ThreatFox: AnimateClipper IOCs detection rule, along with targeted filters and exclusions suitable for an enterprise environment:

• Scenario: Enterprise Endpoint Protection Scanning

  • Context: The organization uses CrowdStrike Falcon or Microsoft Defender for Endpoint (MDE) which performs nightly signature updates. These agents often download and cache the same IOCs (hashes, URLs, or file paths) associated with AnimateClipper as part of their internal threat intelligence feed synchronization, triggering the rule without actual malicious activity.
  • Filter/Exclusion: Exclude network traffic and file hash matches originating from specific Service Accounts used by EDR agents (e.g., svc-crowdstrike, mdefender-agent) or filter out events where the source process is FalconSensor.exe or MsMpEng.exe.

• Scenario: Scheduled Backup Job Execution

  • Context: A nightly backup job orchestrated by Veeam Backup & Replication or Rubrik accesses a specific shared folder containing legacy media assets. The AnimateClipper IOC list includes file hashes that match the naming convention of these archived video files, causing the detection to fire during the windowed backup execution (e.g., 02:00–04:00 UTC).
  • Filter/Exclusion: Create a time-based exclusion for events occurring between 01:30 and 05:00 on weekdays where the source process is VeeamAgent.exe or rubrik-agent, specifically targeting the known backup share path (e.g., \\FileServer\Media_Archive).

• Scenario: CI/CD Pipeline Artifact Deployment

  • Context: The DevOps team utilizes Jenkins or GitHub Actions to deploy