IndicatorPublished 14 Jan 2022Updated 15 Jan 2022

type osint · ThreatFox IOCs for 2022-01-14

Affects type osintSource ThreatFox MISP Feed

TLP:WHITE, disclosure is not limited

Indicators of compromise

Domains 14

2t2ev5giwktc5o9.questAstaroth botnet C2 domain (confidence level: 100%)
3f2ocy9clt90x74.oneAstaroth botnet C2 domain (confidence level: 100%)
6v2mofchw2eix98.questAstaroth botnet C2 domain (confidence level: 100%)
a575hh752dp9l6c.oneAstaroth botnet C2 domain (confidence level: 100%)
ki6hcax6c1ehe5j.oneAstaroth botnet C2 domain (confidence level: 100%)
lc83k0l0bdl6u41.oneAstaroth botnet C2 domain (confidence level: 100%)
mxaflbsa3chjk0i.questAstaroth botnet C2 domain (confidence level: 100%)
nm542iefjijgl2n.oneAstaroth botnet C2 domain (confidence level: 100%)
r4nrjfmlc3k7z00.questAstaroth botnet C2 domain (confidence level: 100%)
t5ctg9k9cpdmhjt.questAstaroth botnet C2 domain (confidence level: 100%)

URLs 119

http://robotically.xyz/wp-content/xtkkx/Emotet payload delivery URL (confidence level: 90%)
http://shopnhap.com/highbinder/uedvfthdf5em40/Emotet payload delivery URL (confidence level: 90%)
https://celhocortofilmfestival.stream/css/naq/Emotet payload delivery URL (confidence level: 90%)
http://insertcatherreview.xyz/wp-includes/uulqtc51sl8izbt/Emotet payload delivery URL (confidence level: 90%)
http://bbc-us.com/wp-admin/48r6tif1qtmqrao/Emotet payload delivery URL (confidence level: 90%)
http://slimpackage.com/slimfit/five/fre.phpLoki Password Stealer (PWS) botnet C2 (confidence level: 100%)
http://2.arthaloca.com/styles/ds5rnprosfcabltyewo/Emotet payload delivery URL (confidence level: 90%)
http://slimpackage.com/slimmain/five/fre.phpLoki Password Stealer (PWS) botnet C2 (confidence level: 100%)
https://45.156.24.200:443/g.pixelCobalt Strike botnet C2 (confidence level: 50%)
https://107.172.89.110:443/updates.rssCobalt Strike botnet C2 (confidence level: 50%)

IP addresses 73

142.11.244.223DanaBot botnet C2 server (confidence level: 100%)
192.236.194.72DanaBot botnet C2 server (confidence level: 100%)
192.119.110.4DanaBot botnet C2 server (confidence level: 100%)
185.140.53.132Nanocore RAT botnet C2 server (confidence level: 100%)
212.193.30.54AsyncRAT botnet C2 server (confidence level: 75%)
107.189.1.53Mirai botnet C2 server (confidence level: 75%)
124.223.17.79Cobalt Strike botnet C2 server (confidence level: 100%)
124.71.111.23Cobalt Strike botnet C2 server (confidence level: 100%)
121.5.175.66Cobalt Strike botnet C2 server (confidence level: 100%)
193.242.145.134Cobalt Strike botnet C2 server (confidence level: 100%)

Hashes 81

3bb970ec5ce98d3945badae0c544dc03400858bcaf3908285d1dda102f644a0bEmotet payload (confidence level: 50%)
3b87d2d1a31c2cc49f365fce8aa50e034d72c44a9ec9c29f5f253da7a424b8eaEmotet payload (confidence level: 50%)
5e31a1960b0ee0ce4e0d02d08adb7647d9d3aae75393fd718594a73fd12d6f46Emotet payload (confidence level: 50%)
1b7512dc2c7e944f29436876f8d1e942a70100fdf7fcc7ed8d34e23ae31c669eEmotet payload (confidence level: 50%)
b8bed0211974f32db2c385350fb62954f0b0f335bc592b51144027956524d674Amadey payload (confidence level: 50%)
22cb98a4832824adc290e8a9541b50228f4f75fb1a8e621fd80d4d2be7ed73f9Amadey payload (confidence level: 50%)
8c0272f6d0136bb8adeb659d8de19a4be68a81fc018587275e045103fc01b49dAmadey payload (confidence level: 50%)
012ce05f8263d161d4387749446cb3df3240fd33cf71dfb3f48dc4f4c9354298Amadey payload (confidence level: 50%)
4162cc11cc30f7db7c8a151252a7e63e78dd4c03c995e2ab6e225dc811b8fd48Amadey payload (confidence level: 50%)
e997341ab2422f5471f4c9f1df84f7a52e16fa38d64e6e0f4f94859cc234e2f8Amadey payload (confidence level: 50%)

Description

ThreatFox IOCs for 2022-01-14

Impact

For European organizations, the impact of this threat is currently limited due to the lack of detailed information on affected systems or active exploitation. However, as the threat involves malware delivery and network activity, there is a potential risk of infection leading to data compromise, disruption of services, or lateral movement within networks if the malware is successfully deployed. The medium severity rating suggests moderate risk, possibly indicating that the malware could be used in targeted attacks or campaigns but is not currently widespread or highly destructive. European entities with exposure to global threat intelligence feeds or those relying on OSINT for threat detection may benefit from incorporating these IOCs into their detection mechanisms to enhance early warning capabilities. Without specific affected products or vulnerabilities, the direct operational impact remains uncertain but warrants vigilance in monitoring network traffic and payload delivery mechanisms.

Defensive guidance

Given the nature of this threat as an OSINT-derived set of IOCs for malware-related activity, European organizations should focus on enhancing detection and response capabilities rather than patching specific vulnerabilities. Practical mitigation steps include: 1) Integrate the provided IOCs into existing Security Information and Event Management (SIEM) systems and Endpoint Detection and Response (EDR) tools to improve detection of related malware activity. 2) Conduct regular network traffic analysis to identify unusual payload delivery attempts or suspicious network activity consistent with the threat profile. 3) Maintain updated threat intelligence feeds and ensure security teams are trained to interpret and act on OSINT-derived indicators. 4) Implement strict network segmentation and least privilege access controls to limit potential lateral movement if infection occurs. 5) Employ robust email and web filtering solutions to reduce the risk of initial malware payload delivery. 6) Conduct regular user awareness training focused on recognizing phishing and social engineering tactics that often accompany payload delivery. These steps go beyond generic advice by emphasizing the operational integration of OSINT IOCs and proactive network monitoring tailored to the threat's characteristics.

Community reviews

Loading reviews…