IndicatorPublished 10 May 2022Updated 11 May 2022

type osint · ThreatFox IOCs for 2022-05-10

Affects type osintSource ThreatFox MISP Feed

TLP:WHITE, disclosure is not limited

Indicators of compromise

Domains 8

nishabii.liveGhost RAT botnet C2 domain (confidence level: 100%)
dota.zzzsleepisnicezzz.artMirai botnet C2 domain (confidence level: 100%)
dota.iwishiwashappy.euMirai botnet C2 domain (confidence level: 100%)
dota.uiasuibasdbui.artMirai botnet C2 domain (confidence level: 100%)
zzzsleepisnicezzz.artMirai botnet C2 domain (confidence level: 100%)
iwishiwashappy.euMirai botnet C2 domain (confidence level: 100%)
uiasuibasdbui.artMirai botnet C2 domain (confidence level: 100%)
managmentoria.comCutwail botnet C2 domain (confidence level: 75%)

URLs 37

http://194.87.216.73/defaultdledownloadstemporary.phpDCRat botnet C2 (confidence level: 100%)
http://185.81.157.210:3681/vreVjw0rm botnet C2 (confidence level: 100%)
http://sempersim.su/gf11/fre.phpLoki Password Stealer (PWS) botnet C2 (confidence level: 100%)
http://sempersim.su/gf19/fre.phpLoki Password Stealer (PWS) botnet C2 (confidence level: 100%)
http://85.202.169.159/romas/inc/02d1f9874469a3.phpAgent Tesla botnet C2 (confidence level: 100%)
https://www.ausvanlines.com.au/cloudflare/index.phpAzorult botnet C2 (confidence level: 75%)
http://198.187.30.47/p.php?id=21890394437660420Loki Password Stealer (PWS) botnet C2 (confidence level: 75%)
http://45.133.1.41/wsp/inc/6cba382c58c057.phpAgent Tesla botnet C2 (confidence level: 100%)
http://sempersim.su/gf20/fre.phpLoki Password Stealer (PWS) botnet C2 (confidence level: 100%)
http://103.167.92.57/365space/vbc.exeFormbook payload delivery URL (confidence level: 100%)

IP addresses 49

194.9.71.111RedLine Stealer botnet C2 server (confidence level: 100%)
198.44.237.131NetWire RC botnet C2 server (confidence level: 100%)
51.210.80.98Mirai botnet C2 server (confidence level: 75%)
23.227.196.162STRRAT botnet C2 server (confidence level: 100%)
37.0.11.6Nanocore RAT botnet C2 server (confidence level: 75%)
178.23.190.51Mirai botnet C2 server (confidence level: 75%)
5.182.210.145Bashlite botnet C2 server (confidence level: 75%)
202.103.212.140Ghost RAT botnet C2 server (confidence level: 75%)
154.23.191.157Ghost RAT payload delivery server (confidence level: 75%)
193.178.210.87Mirai botnet C2 server (confidence level: 100%)

Hashes 4

5aa98174bd302b5cd08f4932b9a41a9586726bb40571b90bd82325039a7a8b51Emotet payload (confidence level: 100%)
20c703846da825710e52f27da7af48cb172e032022b18bb77609547b94ca740fAsyncRAT payload (confidence level: 50%)
3f7fde411098899ab3e60d50455c7e7f633dac039124926052ab559beaf0de7eMagniber payload (confidence level: 50%)
05dec77dbc765b43d3b969146da92bb6Coinminer payload (confidence level: 50%)

Description

ThreatFox IOCs for 2022-05-10

Impact

For European organizations, the impact of this threat is likely to be moderate given the medium severity rating and the nature of the threat as OSINT-related malware indicators. The threat could facilitate early detection of malware campaigns or network intrusions if the IOCs are integrated into security monitoring tools. However, without specific exploit details or targeted vulnerabilities, the direct risk of compromise or operational disruption is limited. Organizations relying heavily on network security monitoring and threat intelligence platforms could benefit from incorporating such IOCs to enhance situational awareness. Conversely, organizations lacking mature threat intelligence capabilities may find limited immediate value. The potential impact includes increased exposure to malware payload delivery attempts that could lead to data exfiltration, system compromise, or lateral movement if not detected and mitigated. Given the absence of patches or known exploits, the threat is more about detection and response readiness than urgent remediation.

Defensive guidance

1. Integrate Threat Intelligence: European organizations should incorporate ThreatFox IOCs into their existing Security Information and Event Management (SIEM) and Intrusion Detection/Prevention Systems (IDS/IPS) to enhance detection capabilities against related malware activity. 2. Network Monitoring: Implement advanced network traffic analysis to identify anomalous payload delivery attempts and suspicious network activity consistent with the threat profile. 3. Incident Response Preparedness: Develop and regularly update incident response playbooks that include procedures for handling malware infections detected via OSINT indicators. 4. Employee Awareness: Conduct targeted training to raise awareness about malware delivery methods, especially those involving network vectors, to reduce the risk of successful payload execution. 5. Collaboration and Sharing: Engage with European cybersecurity information sharing organizations (e.g., CERT-EU, ENISA) to receive updated IOCs and threat intelligence feeds to stay current on evolving threats. 6. Endpoint Security: Ensure endpoint protection platforms are configured to detect and block malware payloads and maintain up-to-date signatures and heuristics. These steps go beyond generic advice by emphasizing the operational integration of OSINT-derived IOCs and proactive network defense tailored to the threat's characteristics.

Community reviews

Loading reviews…