← Back to SOC feed Coverage →

URLhaus: malware_download Malicious URLs

ioc-hunt HIGH URLhaus
CommonSecurityLogDnsEvents
iocurlhaus
This rule was pulled from an open-source repository and enriched with AI. Validate in a test environment before deploying to production.
View original rule at URLhaus →
Retrieved: 2026-09-04T23:00:00Z · Confidence: medium

Hunt Hypothesis

This rule detects potential malware staging or payload delivery by identifying network traffic to known malicious URLs associated with the malware_download tag. Proactively hunting for these indicators allows the SOC team to identify compromised hosts or lateral movement attempts before the downloaded payloads execute and establish a foothold in the Azure environment.

This rule detects potential malware staging or payload delivery by identifying network traffic to known malicious URLs associated with the malware_download tag. Proactively hunting for these indicators allows the SOC team to identify compromised hosts or lateral movement attempts before the downloaded payloads execute and establish a foothold in the Azure environment.

IOC Summary

Threat: malware_download Total URLs: 21 Active URLs: 8

URLStatusThreatDate Added
hxxp://120.84.213.251:54475/ionlinemalware_download2026-09-04
hxxp://150.241.65.250:889/venv/lib/python3.12/site-packages/bcrypt/_bcrypt.abi3.soofflinemalware_download2026-09-04
hxxp://150.241.65.250:889/venv/lib64/python3.12/site-packages/cryptography/hazmat/bindings/_rust.abi3.soofflinemalware_download2026-09-04
hxxp://150.241.65.250:889/venv/lib/python3.12/site-packages/cffi-2.1.1.dist-info/METADATAofflinemalware_download2026-09-04
hxxp://115.63.245.146:39613/bin.shofflinemalware_download2026-09-04
hxxp://115.63.245.146:39613/iofflinemalware_download2026-09-04
hxxp://202.189.12.244/66666.binonlinemalware_download2026-09-04
hxxps://seobandung.site/raw/alfa.txtofflinemalware_download2026-09-04
hxxp://209.99.189.200/img_094855.pngofflinemalware_download2026-09-04
hxxp://209.99.189.200/img_094254.pngofflinemalware_download2026-09-04
hxxp://209.99.189.200/core_091457.isoofflinemalware_download2026-09-04
hxxp://filecon.sbs//driver.jpgonlinemalware_download2026-09-04
hxxp://filecon.sbs//pas.jpgonlinemalware_download2026-09-04
hxxp://filecon.sbs//bk.jpgonlinemalware_download2026-09-04
hxxp://ccoffice.site//pas.jpgofflinemalware_download2026-09-04
hxxp://ccoffice.site//bk.jpgofflinemalware_download2026-09-04
hxxp://ccoffice.site//driver.jpgofflinemalware_download2026-09-04
hxxp://113.228.158.110:48412/iofflinemalware_download2026-09-04
hxxp://193.90.12.80/aminer.gzonlinemalware_download2026-09-04
hxxp://123.190.28.100:58407/bin.shonlinemalware_download2026-09-04
hxxp://42.55.48.13:57019/ionlinemalware_download2026-09-04

KQL: Url Dns Hunt

// Hunt for DNS resolution of URLhaus malicious domains
// Threat: malware_download
let malicious_domains = dynamic(["123.190.28.100", "filecon.sbs", "120.84.213.251", "202.189.12.244", "42.55.48.13", "193.90.12.80"]);
DnsEvents
| where Name has_any (malicious_domains)
| project TimeGenerated, Computer, Name, IPAddresses
| order by TimeGenerated desc

KQL: Url Proxy Hunt

// Hunt for web traffic to URLhaus malicious domains
let malicious_domains = dynamic(["123.190.28.100", "filecon.sbs", "120.84.213.251", "202.189.12.244", "42.55.48.13", "193.90.12.80"]);
CommonSecurityLog
| where RequestURL has_any (malicious_domains) or DestinationHostName has_any (malicious_domains)
| project TimeGenerated, SourceIP, RequestURL, DestinationHostName, DeviceAction
| order by TimeGenerated desc

Required Data Sources

Sentinel TableNotes
CommonSecurityLogEnsure this data connector is enabled
DnsEventsEnsure this data connector is enabled

References

False Positive Guidance

Original source: https://urlhaus.abuse.ch/