IndicatorPublished 11 Apr 2022Updated 12 Apr 2022

type osint · ThreatFox IOCs for 2022-04-11

Affects type osintSource ThreatFox MISP Feed

TLP:WHITE, disclosure is not limited

Indicators of compromise

Domains 2

ertimadifa.comIcedID Downloader botnet C2 domain (confidence level: 75%)
pop11.linkpc.netAsyncRAT botnet C2 domain (confidence level: 100%)

URLs 49

http://185.29.8.14/rothchild/panel/index.phpAzorult botnet C2 (confidence level: 100%)
http://sempersim.su/gf1/fre.phpLoki Password Stealer (PWS) botnet C2 (confidence level: 75%)
http://81.69.18.49:9000/visit.jsCobalt Strike botnet C2 (confidence level: 100%)
http://159.75.121.138/cmCobalt Strike botnet C2 (confidence level: 100%)
https://194.40.243.5/dequeue/devices/3o07zd6cgw5fCobalt Strike botnet C2 (confidence level: 100%)
http://101.42.99.243:5443/cmCobalt Strike botnet C2 (confidence level: 100%)
https://27.124.47.19/pushCobalt Strike botnet C2 (confidence level: 100%)
https://cstest20220319.accesscam.org:446/matchCobalt Strike botnet C2 (confidence level: 100%)
http://46.183.223.116/dublin/panel/index.phpAzorult botnet C2 (confidence level: 100%)
http://45.133.1.45/me/five/fre.phpLoki Password Stealer (PWS) botnet C2 (confidence level: 100%)

IP addresses 162

183.236.2.18Ghost RAT botnet C2 server (confidence level: 100%)
64.225.71.35Mirai botnet C2 server (confidence level: 75%)
91.243.59.6RedLine Stealer botnet C2 server (confidence level: 100%)
139.99.32.83RedLine Stealer botnet C2 server (confidence level: 100%)
128.199.95.124Mirai botnet C2 server (confidence level: 75%)
159.223.127.116Mirai botnet C2 server (confidence level: 75%)
181.235.9.150NjRAT botnet C2 server (confidence level: 100%)
185.81.157.7AsyncRAT botnet C2 server (confidence level: 75%)
45.153.231.64Mirai botnet C2 server (confidence level: 75%)
45.145.64.197RedLine Stealer botnet C2 server (confidence level: 100%)

Hashes 35

a60e301af2bf9c738d59bfa4182d37f9Gozi payload (confidence level: 50%)
f8d00a8981cf4f18025e2746717e2578ISFB payload (confidence level: 50%)
8c2d71ba522dcbf8e1c1c83a14f823bf2534b8262642c690a0ba62ac7a81e494QakBot payload (confidence level: 100%)
4469e008a3b28bf451b6db245f5e803c8be621fec05949025a23ed14fe95168bQakBot payload (confidence level: 100%)
115cb06e438f15d59ee8fb5f5bc0ca704d169ea07a35897fd04b5a17e704c519QakBot payload (confidence level: 100%)
c9f1a424853b18c57bb25265b6a4a8eecf193c6bd176c0a15ad5281370b5070dQakBot payload (confidence level: 100%)
99cadc26bbd45db664ef8b0df978363d145ccb781adbe836a7e543385448b129QakBot payload (confidence level: 100%)
175a7dd2fd6df13fc7d0dffd20400f9189f23bfcfb89ab2c9269be8239f9d9a4QakBot payload (confidence level: 100%)
03db1216b8607613b70bdf56c8d32f6c713f0a19472d4a696a6d086302c2c9a7QakBot payload (confidence level: 100%)
2af51fb294123d8c6865a4cd7d08595425b28642551fa6fa1f2d52a2f4b134d6QakBot payload (confidence level: 100%)

Description

ThreatFox IOCs for 2022-04-11

Impact

For European organizations, the impact of this threat primarily lies in the potential for network-based malware infections facilitated through payload delivery mechanisms. Given the medium severity and absence of known active exploits, the immediate risk of widespread compromise is moderate. However, organizations that rely heavily on networked infrastructure and have exposure to external threat actors may face risks including data exfiltration, unauthorized access, or disruption of services if these IOCs correspond to active malware campaigns. The lack of detailed exploit information means that the threat is more relevant for detection and monitoring rather than immediate incident response. European entities involved in critical infrastructure, finance, or government sectors should be particularly vigilant, as these sectors are common targets for malware campaigns leveraging network activity. The threat’s OSINT nature suggests that attackers may be using publicly available information to tailor payload delivery, increasing the sophistication of attacks and potentially bypassing traditional defenses if not properly monitored.

Defensive guidance

Given the nature of this threat as an OSINT-based IOC report without specific exploit details, mitigation should focus on enhancing detection and monitoring capabilities. European organizations should: 1) Integrate the provided IOCs into existing Security Information and Event Management (SIEM) and Intrusion Detection/Prevention Systems (IDS/IPS) to improve network traffic analysis and anomaly detection. 2) Conduct regular network traffic analysis to identify suspicious payload delivery attempts, especially those matching the IOC patterns. 3) Employ threat intelligence sharing platforms to stay updated on evolving IOCs and related malware activity. 4) Harden network perimeter defenses, including segmentation and strict access controls, to limit malware propagation. 5) Train security teams to recognize OSINT-derived threat indicators and incorporate them into incident response playbooks. 6) Implement advanced endpoint detection and response (EDR) solutions capable of detecting payload execution and lateral movement. 7) Regularly review and update firewall and proxy rules to block known malicious domains or IP addresses associated with the IOCs. These steps go beyond generic advice by emphasizing the operational integration of threat intelligence and proactive network defense tailored to the nature of the reported threat.

Community reviews

Loading reviews…