IndicatorPublished 28 Jun 2021Updated 29 Jun 2021

type osint · ThreatFox IOCs for 2021-06-28

Affects type osintSource ThreatFox MISP Feed

TLP:WHITE, disclosure is not limited

Indicators of compromise

Domains 3

enroter1984.cnServHelper botnet C2 domain (confidence level: 100%)
neboley.cnServHelper botnet C2 domain (confidence level: 100%)
worktwork3.xyzNetSupportManager RAT botnet C2 domain (confidence level: 100%)

URLs 18

http://194.58.103.2/main/index.phpAmadey botnet C2 (confidence level: 100%)
http://50.116.43.143/pony/gate.phpPony botnet C2 (confidence level: 100%)
http://vihaiha.com/.ill/news/school/boy/choo/fre.phpLoki Password Stealer (PWS) botnet C2 (confidence level: 100%)
http://63.141.228.141/32.php/clsdqrhiilvb5Loki Password Stealer (PWS) botnet C2 (confidence level: 100%)
https://vihaiha.com/.ill/news/school/boy/choo/fre.phpLoki Password Stealer (PWS) botnet C2 (confidence level: 75%)
http://192.119.111.43/zubby/fre.phpLoki Password Stealer (PWS) botnet C2 (confidence level: 100%)
http://wuyoo.vip:2083/fwlinkCobalt Strike botnet C2 (confidence level: 75%)
http://www.wuyoo.vip:2083/ga.jsCobalt Strike botnet C2 (confidence level: 75%)
http://morbuw01.top/index.phpCryptBot botnet C2 (confidence level: 100%)
http://xeibzs12.top/index.phpCryptBot botnet C2 (confidence level: 100%)

IP addresses 57

103.219.152.238Mirai botnet C2 server (confidence level: 75%)
45.119.84.166AsyncRAT botnet C2 server (confidence level: 100%)
193.56.29.150Nanocore RAT botnet C2 server (confidence level: 100%)
136.144.41.3Mirai botnet C2 server (confidence level: 75%)
45.88.76.150RedLine Stealer botnet C2 server (confidence level: 100%)
195.154.169.33Mirai botnet C2 server (confidence level: 75%)
34.123.37.42RedLine Stealer botnet C2 server (confidence level: 100%)
185.163.45.87ServHelper botnet C2 server (confidence level: 75%)
103.42.57.18Dridex botnet C2 server (confidence level: 75%)
115.68.220.48Dridex botnet C2 server (confidence level: 75%)

Hashes 719

d6a96c347f2f90a73cee813980dd81b5275a0eba5885e39fbfcd52b303d7ed33Dridex payload (confidence level: 100%)
fb558a8ff72ffa0ff31ff976133b29aaa1fdc3e390620e391e5c44332cf62c37Dridex payload (confidence level: 100%)
a21f880704b9900a7803e0eb6c2cf840738f23735453e09371473e9687c65a12Dridex payload (confidence level: 100%)
0bf5f21b1c06d0f34b4785c0a9a24019a72e59d6c9c20ce6fa2a0605955ddefaDridex payload (confidence level: 100%)
79c23ecef8230811448bfbfd2970c86aaa032afb9487192afd428f837749bc8bDridex payload (confidence level: 100%)
4425c948351776755b2036d48b34acdfbef70fbf3815bfa2c697a279f0254b23Dridex payload (confidence level: 100%)
2484a33d32a87a62782b0ad0867f9441a3718b42a0b9e526691c88d27a5f7ef5Dridex payload (confidence level: 100%)
f2a10fd4580a169918a35fc6afbb7073a76970dab92d2d571aabe7df4449ca1dDridex payload (confidence level: 100%)
c63e1924519fa17e8be4232b4f60cc34cef1dd7f771d85d6c32f08b4e8d88d5eDridex payload (confidence level: 100%)
ddd07f1d09bcce89a6b1f2af0a8ff64f8856b00dc7165f8328bfa9105d61c258Dridex payload (confidence level: 100%)

Description

ThreatFox IOCs for 2021-06-28

Impact

For European organizations, the impact of these IOCs depends largely on their ability to integrate and utilize this threat intelligence effectively within their security monitoring and incident response processes. Since the threat is categorized as malware-related network activity and payload delivery, organizations that do not have robust network monitoring, endpoint detection, or threat intelligence capabilities may be at increased risk of undetected compromise or lateral movement within their networks. However, given the medium severity and lack of known active exploits, the immediate risk is moderate. The threat intelligence can help organizations identify malicious traffic or payloads early, potentially preventing data breaches, service disruptions, or unauthorized access. Industries with high exposure to external network traffic, such as finance, telecommunications, and critical infrastructure, may find this intelligence particularly relevant. The absence of patch information indicates that mitigation relies on detection and response rather than software updates.

Defensive guidance

European organizations should prioritize integrating these IOCs into their existing security information and event management (SIEM) systems, intrusion detection/prevention systems (IDS/IPS), and endpoint detection and response (EDR) tools to enhance detection capabilities. Regularly updating threat intelligence feeds and correlating alerts with these IOCs can improve early warning and incident response. Network segmentation and strict access controls can limit the impact of any successful payload delivery. Conducting regular threat hunting exercises using these IOCs can uncover latent infections or ongoing malicious activity. Additionally, organizations should ensure that their security teams are trained to interpret and act on OSINT-derived indicators effectively. Since no patches are available, emphasis should be placed on proactive monitoring, anomaly detection, and rapid containment strategies. Sharing relevant findings with national or sectoral Computer Security Incident Response Teams (CSIRTs) can also enhance collective defense.

Community reviews

Loading reviews…