IndicatorPublished 19 Nov 2021Updated 20 Nov 2021

type osint · ThreatFox IOCs for 2021-11-19

Affects type osintSource ThreatFox MISP Feed

TLP:WHITE, disclosure is not limited

Indicators of compromise

Domains 2

Metamorfo botnet C2 domain (confidence level: 100%)

solidez.top
mod.solidez.top

URLs 109

http://russk19.icu/forum8/logout.phpBetaBot botnet C2 (confidence level: 100%)
http://66.29.151.252/~nextimageblog/picture.phpLoki Password Stealer (PWS) botnet C2 (confidence level: 100%)
http://doanlee.com/kiz/need/work/panel/five/fre.phpLoki Password Stealer (PWS) botnet C2 (confidence level: 100%)
http://66.29.151.252/~nextimageblog/picture.php?id=6273440Loki Password Stealer (PWS) botnet C2 (confidence level: 75%)
https://doanlee.com/kiz/need/work/panel/five/fre.phpLoki Password Stealer (PWS) botnet C2 (confidence level: 75%)
http://http://service-g5884zuv-1258425359.sh.apigw.tencentcs.com:80/api/getitCobalt Strike botnet C2 (confidence level: 100%)
http://service-5xkoioxx-1252325407.sh.apigw.tencentcs.com:80/jquery-3.1.min.jsCobalt Strike botnet C2 (confidence level: 100%)
https://www.python35.com/visit.jsCobalt Strike botnet C2 (confidence level: 100%)
http://47.98.221.192:8002/updates.rssCobalt Strike botnet C2 (confidence level: 100%)
https://api.matrixpartners.business:8443/jquery-3.3.1.min.jsCobalt Strike botnet C2 (confidence level: 100%)

IP addresses 138

185.183.32.161RedLine Stealer botnet C2 server (confidence level: 75%)
185.215.113.121RedLine Stealer botnet C2 server (confidence level: 75%)
144.76.245.112RedLine Stealer botnet C2 server (confidence level: 100%)
185.19.85.175Nanocore RAT botnet C2 server (confidence level: 75%)
91.193.75.148Nanocore RAT botnet C2 server (confidence level: 100%)
176.9.10.140RedLine Stealer botnet C2 server (confidence level: 100%)
184.75.221.59NetWire RC botnet C2 server (confidence level: 100%)
121.5.39.179Cobalt Strike botnet C2 server (confidence level: 100%)
23.105.39.4Cobalt Strike botnet C2 server (confidence level: 100%)
47.98.221.192Cobalt Strike botnet C2 server (confidence level: 100%)

Hashes 130

1d1dc50fac47825b545ae57f3197151aec53ca53f2b93e6fcc5682932fdaa5f1Agent Tesla payload (confidence level: 50%)
0c192374ba684e25b4e86887d8ed5168f0c01d606a666e24191f6416aca9123aFormbook payload (confidence level: 50%)
079f266abd20071a65ff0c461ff0669c2c8af662aa5876679484726dfc5a5a6dAgent Tesla payload (confidence level: 50%)
43094826b48abcbf961c54b62bae3d2c477aa8a02f5ac96f9d11b40e4a71c10eFormbook payload (confidence level: 50%)
4725979042161b21b7b9d133b848b2c36c46de4752fd38e6be2887134fdd1e5aAgent Tesla payload (confidence level: 50%)
2f07775ab256b6bd7dc726fdf62f96728f1b1c2f4b9696f633c81c3f4540f30dFormbook payload (confidence level: 50%)
4d39d64daa2308a6f1b975a74fdda42138accdba97d1c2f41a979745cd4ae412Agent Tesla payload (confidence level: 50%)
fd2a0d7069cb20517cf2fafcdc12a7d3bd253a3f15d3bd2a66794acdfa928ddfFormbook payload (confidence level: 50%)
fbc666d2ad6b0beae48c3af901ec5fe084bea48205a085aa0be87c5f058b7ad9Nanocore RAT payload (confidence level: 50%)
dacd4d93f0f8d8e0f3b197cabaa9c6486a5526d896d39a56a386c39cbd8c63dfNanocore RAT payload (confidence level: 50%)

Description

ThreatFox IOCs for 2021-11-19

Impact

For European organizations, the impact of this threat intelligence update is primarily informational rather than indicative of an immediate, active threat. Since no specific malware or exploit details are provided, the direct risk to confidentiality, integrity, or availability is unclear. However, the sharing of IOCs related to malware and network activity can aid European cybersecurity teams in enhancing their detection capabilities and preparing defenses against potential payload delivery attempts. Organizations that rely heavily on OSINT and network monitoring may benefit from integrating these IOCs into their security operations centers (SOCs) to improve threat hunting and incident response. The medium severity suggests a moderate level of concern, but without concrete exploitation data, the immediate operational impact is limited. European entities should remain vigilant, especially those in sectors frequently targeted by malware campaigns, such as finance, critical infrastructure, and government.

Defensive guidance

Given the nature of this threat intelligence update, mitigation should focus on proactive threat detection and response rather than patching or direct vulnerability remediation. European organizations should: 1) Integrate the provided IOCs into their SIEM (Security Information and Event Management) and IDS/IPS (Intrusion Detection/Prevention Systems) to enhance detection of related network activity and payload delivery attempts. 2) Conduct regular threat hunting exercises using updated OSINT feeds like ThreatFox to identify potential compromises early. 3) Ensure robust network segmentation and monitoring to limit the impact of any payload delivery or malware execution. 4) Maintain up-to-date endpoint protection and behavioral analytics to detect anomalous activities associated with malware. 5) Foster information sharing with industry peers and national cybersecurity centers to stay informed about evolving threats. 6) Train security teams to interpret and act on threat intelligence feeds effectively, emphasizing correlation with internal logs and alerts.

Community reviews

Loading reviews…