← Back to SOC feed Coverage →

URLhaus: malware_download Malicious URLs

ioc-hunt HIGH URLhaus
CommonSecurityLogDnsEvents
iocurlhaus
This rule was pulled from an open-source repository and enriched with AI. Validate in a test environment before deploying to production.
View original rule at URLhaus →
Retrieved: 2026-05-19T11:00:00Z · Confidence: medium

Hunt Hypothesis

Adversaries may be using known malicious URLs to download malware into the network, leveraging compromised or phishing-based delivery methods. SOC teams should proactively hunt for these URLs in Azure Sentinel to identify and mitigate potential malware infections before they spread.

IOC Summary

Threat: malware_download Total URLs: 34 Active URLs: 13

URLStatusThreatDate Added
hxxps://185.29.9.115/lSmsJveL68.binofflinemalware_download2026-05-19
hxxp://185.29.9.115/DHekiqXjOh156.binonlinemalware_download2026-05-19
hxxp://185.29.9.115/cipHP130.binonlinemalware_download2026-05-19
hxxp://185.29.9.115/nnZRHUcccKNMOu229.binonlinemalware_download2026-05-19
hxxp://185.29.9.115/lSmsJveL68.binonlinemalware_download2026-05-19
hxxp://185.29.9.115/uPBhPExQORmbMya151.binonlinemalware_download2026-05-19
hxxp://185.29.9.115/HIuwxijvTjCqqzXvxiYw186.binofflinemalware_download2026-05-19
hxxp://185.29.9.115/nkMgqv11.binofflinemalware_download2026-05-19
hxxp://185.29.9.115/NfTdhrhyxbvWEqPrZGBpNAFkY164.binofflinemalware_download2026-05-19
hxxps://raw.githubusercontent.com/grere856-dot/rammm/refs/heads/main/shellcode.binonlinemalware_download2026-05-19
hxxps://drive.google.com/uc?export=download&id=1DLAZBGZUQC7wa5iBjxj_MRl1RTp6l8vSonlinemalware_download2026-05-19
hxxps://raw.githubusercontent.com/grere856-dot/vigilant-waffle/refs/heads/main/shellcode.binonlinemalware_download2026-05-19
hxxps://github.com/grere856-dot/rammm/raw/refs/heads/main/shellcode.binonlinemalware_download2026-05-19
hxxps://github.com/grere856-dot/vigilant-waffle/raw/refs/heads/main/shellcode.binonlinemalware_download2026-05-19
hxxp://196.251.107.104/xvzpjyddlu/getdata.phpofflinemalware_download2026-05-19
hxxps://desentupidora.pro.br/hidrosys/api/rump18th.pngonlinemalware_download2026-05-19
hxxp://losslvs.surf:7802/offlinemalware_download2026-05-19
hxxps://github.com/grere856-dot/verbose-palm-tree/raw/refs/heads/main/file.vbprojofflinemalware_download2026-05-19
hxxp://id8796.cfd/uploads/oVnQ8PYJh2Xo.exeofflinemalware_download2026-05-19
hxxps://raw.githubusercontent.com/grere856-dot/verbose-palm-tree/refs/heads/main/file.vbprojonlinemalware_download2026-05-19
hxxp://62.60.226.159/uploads/fKTFmBE3kQP9.exeofflinemalware_download2026-05-19
hxxp://62.60.226.159/uploads/af2dee0f20b847ea_310.phpofflinemalware_download2026-05-19
hxxp://196.251.107.130/16b022998f754137b60a.phpofflinemalware_download2026-05-19
hxxp://62.60.226.159/uploads/f6ab9f4da4ed74e4_301.phpofflinemalware_download2026-05-19
hxxp://62.60.226.159/xvzpjyddlu/getdata.phpofflinemalware_download2026-05-19

KQL: Url Dns Hunt

// Hunt for DNS resolution of URLhaus malicious domains
// Threat: malware_download
let malicious_domains = dynamic(["185.29.9.115", "desentupidora.pro.br", "crescentegramas.com.br", "raw.githubusercontent.com", "github.com", "drive.google.com"]);
DnsEvents
| where Name has_any (malicious_domains)
| project TimeGenerated, Computer, Name, IPAddresses
| order by TimeGenerated desc

KQL: Url Proxy Hunt

// Hunt for web traffic to URLhaus malicious domains
let malicious_domains = dynamic(["185.29.9.115", "desentupidora.pro.br", "crescentegramas.com.br", "raw.githubusercontent.com", "github.com", "drive.google.com"]);
CommonSecurityLog
| where RequestURL has_any (malicious_domains) or DestinationHostName has_any (malicious_domains)
| project TimeGenerated, SourceIP, RequestURL, DestinationHostName, DeviceAction
| order by TimeGenerated desc

Required Data Sources

Sentinel TableNotes
CommonSecurityLogEnsure this data connector is enabled
DnsEventsEnsure this data connector is enabled

References

False Positive Guidance

Original source: https://urlhaus.abuse.ch/