IndicatorPublished 12 Sep 2021Updated 13 Sep 2021

type osint · ThreatFox IOCs for 2021-09-12

Affects type osintSource ThreatFox MISP Feed

TLP:WHITE, disclosure is not limited

Indicators of compromise

URLs 95

http://1.15.187.165:8099/__utm.gifCobalt Strike botnet C2 (confidence level: 100%)
http://tww24.ru/secureapiwindows.phpDCRat botnet C2 (confidence level: 100%)
http://106.13.178.189:81/mgCobalt Strike botnet C2 (confidence level: 100%)
http://222.93.38.215:6666/visit.jsCobalt Strike botnet C2 (confidence level: 100%)
http://120.79.67.51:50006/dpixelCobalt Strike botnet C2 (confidence level: 100%)
http://47.108.184.159:3333/api/getitCobalt Strike botnet C2 (confidence level: 100%)
http://106.55.56.224:6666/visit.jsCobalt Strike botnet C2 (confidence level: 100%)
http://49.235.98.228:6666/c/msdownload/update/others/2016/12/29136388_Cobalt Strike botnet C2 (confidence level: 100%)
http://192.168.1.104:4444/cmCobalt Strike botnet C2 (confidence level: 100%)
http://127.0.0.1:9999/wp06/wp-includes/po.phpCobalt Strike botnet C2 (confidence level: 100%)

IP addresses 107

1.15.187.165Cobalt Strike botnet C2 server (confidence level: 100%)
106.13.178.189Cobalt Strike botnet C2 server (confidence level: 100%)
222.93.38.215Cobalt Strike botnet C2 server (confidence level: 100%)
120.79.67.51Cobalt Strike botnet C2 server (confidence level: 100%)
47.108.184.159Cobalt Strike botnet C2 server (confidence level: 100%)
106.55.56.224Cobalt Strike botnet C2 server (confidence level: 100%)
49.235.98.228Cobalt Strike botnet C2 server (confidence level: 100%)
121.4.193.179Cobalt Strike botnet C2 server (confidence level: 100%)
1.116.125.251Cobalt Strike botnet C2 server (confidence level: 100%)
52.80.127.131Cobalt Strike botnet C2 server (confidence level: 100%)

Hashes 41

c1a14f1843802dca53f3deccb8598875ef68a6db5eb740a23bec6c2db1d99be9Dridex payload (confidence level: 100%)
adc8e05648c951dcb4415aa0dc6c04c6008b7c9c2902888bb2d0e8b0004b594dDridex payload (confidence level: 100%)
a57af9eef729f33f4137775c7d0f76fe43165015fa29fdb8bbc41a56f5f4c3ceDridex payload (confidence level: 100%)
17e5ea22e1d8a275b565147668dacc2964e274fb9329212df88832c8e042db99Dridex payload (confidence level: 100%)
a0efa5591ef26d7ceed128afd7eadad808e81544aa138f8b9ce8cd817fe210d1Dridex payload (confidence level: 100%)
dd367d40751ff266743b3ddd5b307636d62c602cd81d43b47aaff3a12babf968Dridex payload (confidence level: 100%)
eb01cd9dca82fbe466a2de552fd30704e836bac2ba842ecea316d24604650ca9Dridex payload (confidence level: 100%)
4a319b8f1d1ba41b28adf014f05d6b5ba5d80197e9695bf42244ad4f000ba460Dridex payload (confidence level: 100%)
6688153cb9fffebcd5b17ee46f45f8196c5db430529355be455d58adf8a594dcDridex payload (confidence level: 100%)
3ac594b126713f599139d5bdbae9d4b18dd7d3b0b79760b4f4a06c1ad7bbd3e3Dridex payload (confidence level: 100%)

Description

ThreatFox IOCs for 2021-09-12

Impact

Given the limited technical details and absence of known exploits, the immediate impact on European organizations is likely low to medium. However, the presence of payload delivery and network activity tags implies potential risks of malware infection through network-based vectors, which could lead to data exfiltration, system compromise, or disruption if exploited effectively. European organizations, particularly those with extensive network infrastructures or those that rely heavily on OSINT for threat intelligence, may find value in integrating these IOCs into their detection systems to enhance situational awareness. The lack of patch availability and no specific affected software versions reduces the likelihood of a direct vulnerability exploitation but underscores the importance of monitoring network traffic for suspicious payload delivery attempts. The medium severity rating suggests a moderate risk level, emphasizing the need for vigilance but not indicating an immediate widespread threat.

Defensive guidance

1. Integrate the provided IOCs into existing Security Information and Event Management (SIEM) and Intrusion Detection/Prevention Systems (IDS/IPS) to enhance detection capabilities for related network activity and payload delivery attempts. 2. Conduct regular network traffic analysis focusing on unusual or unauthorized payload delivery patterns, especially those matching the characteristics of the IOCs from ThreatFox. 3. Maintain updated threat intelligence feeds and ensure cross-correlation with internal logs to identify early signs of compromise. 4. Implement strict network segmentation and access controls to limit the lateral movement potential of any malware that might be delivered. 5. Educate security teams on the importance of OSINT-based threat intelligence and encourage proactive monitoring of public intelligence feeds such as ThreatFox. 6. Since no patches are available, emphasize hardening of network defenses and endpoint protection to mitigate potential payload execution. 7. Regularly update and test incident response plans to ensure readiness in case of detection of related malicious activity.

Community reviews

Loading reviews…