IndicatorPublished 20 May 2022Updated 21 May 2022

type osint · ThreatFox IOCs for 2022-05-20

Affects type osintSource ThreatFox MISP Feed

TLP:WHITE, disclosure is not limited

Indicators of compromise

Domains 1

IcedID Downloader botnet C2 domain (confidence level: 75%)

speratinda.com

URLs 104

http://104.238.222.132:8088/mlCobalt Strike botnet C2 (confidence level: 100%)
https://service-384gj0ef-1303747394.sh.apigw.tencentcs.com/releaseCobalt Strike botnet C2 (confidence level: 100%)
http://vimstarim.gq/image/Cobalt Strike botnet C2 (confidence level: 100%)
https://114.55.25.227/image/Cobalt Strike botnet C2 (confidence level: 100%)
http://164.92.212.94/training-beaconCobalt Strike botnet C2 (confidence level: 100%)
http://155.94.135.33/pixel.gifCobalt Strike botnet C2 (confidence level: 100%)
https://179.60.150.118/dpixelCobalt Strike botnet C2 (confidence level: 100%)
http://164.92.103.99/read/v6.42/n6sywdk8z0spCobalt Strike botnet C2 (confidence level: 100%)
http://52.201.235.129/pixel.gifCobalt Strike botnet C2 (confidence level: 100%)
https://d16it2c3mahpb5.cloudfront.net/safebrowsing/fp/mkiyhtgmkhxthvo0zcp16a0gjgj6trv3xirbc7sayCobalt Strike botnet C2 (confidence level: 100%)

IP addresses 98

104.238.222.132Cobalt Strike botnet C2 server (confidence level: 100%)
124.222.205.32Cobalt Strike botnet C2 server (confidence level: 100%)
1.116.124.178Cobalt Strike botnet C2 server (confidence level: 100%)
114.55.25.227Cobalt Strike botnet C2 server (confidence level: 100%)
161.35.95.7Cobalt Strike botnet C2 server (confidence level: 100%)
155.94.135.33Cobalt Strike botnet C2 server (confidence level: 100%)
179.60.150.118Cobalt Strike botnet C2 server (confidence level: 100%)
164.92.103.99Cobalt Strike botnet C2 server (confidence level: 100%)
52.201.235.129Cobalt Strike botnet C2 server (confidence level: 100%)
18.223.15.73Cobalt Strike botnet C2 server (confidence level: 100%)

Hashes 8,979

61b78ed5a52cf3fcd3ad37c2c6007138bf898957d316f9c8f92e53e16397d0b6Emotet payload (confidence level: 75%)
1998911210eff971433649fe881cb2e417706f32b921c2e03f7630d6c0c44608Emotet payload (confidence level: 75%)
6b678338c1c8a77959e9fcec793f4f3b8e644550413c24171c5b1b1ffd99c3a1Emotet payload (confidence level: 75%)
b4d5b93e9298366600c44207fc00eb88568f746c1ee5f6c6f22ce9089b193f23Emotet payload (confidence level: 75%)
5596f9f097b6f076ff03116f600e38982f9a953be555cbed41df2cc533574e79Emotet payload (confidence level: 75%)
ce1799d7b4303b8b559ba74e35dac42675294aa291a2dfbadf903f5e76dc19baEmotet payload (confidence level: 75%)
fe9dee6f54744a56847204c9072606f499a3f4915d6a4dc2104361cac7fc2750Emotet payload (confidence level: 75%)
3e904ed689b6eb5e95abe6a339f68d371adf151b3030d10490c2e92b7ed82286Emotet payload (confidence level: 75%)
936da35179666f4a133fe56c107defbb343f341ec9578569428de9701e8005b9Emotet payload (confidence level: 75%)
827c2e04dd033f1ba5e2408fb41c78b8db8fd0549ea5b8ef9bb9af686f27d9a4Emotet payload (confidence level: 75%)

Description

ThreatFox IOCs for 2022-05-20

Impact

For European organizations, the impact of this threat intelligence feed depends on the relevance and applicability of the IOCs to their specific network environments. Since the information does not specify targeted systems or active exploits, the immediate risk is low to medium. However, organizations that integrate ThreatFox IOCs into their security monitoring tools can enhance their detection capabilities against potential malware payload deliveries and network-based threats. Failure to incorporate such OSINT feeds might delay detection of emerging threats, potentially leading to increased risk of compromise. The lack of patch availability and known exploits suggests that this is more of a situational awareness tool rather than an active, exploitable vulnerability. Nonetheless, organizations in sectors with high exposure to malware campaigns or targeted attacks should consider this intelligence valuable for proactive defense.

Defensive guidance

To effectively leverage this threat intelligence, European organizations should: 1) Integrate ThreatFox IOCs into their Security Information and Event Management (SIEM) and Endpoint Detection and Response (EDR) systems to enable real-time correlation and alerting. 2) Regularly update threat intelligence feeds to maintain current awareness of emerging indicators. 3) Conduct network traffic analysis focusing on payload delivery mechanisms and unusual network activity patterns highlighted by the IOCs. 4) Train security analysts to interpret and act upon OSINT-derived indicators, ensuring timely investigation and response. 5) Employ threat hunting exercises using the provided IOCs to identify potential compromises early. 6) Maintain robust incident response plans that incorporate OSINT feeds as part of their detection and mitigation workflows. These steps go beyond generic advice by emphasizing operational integration and analyst preparedness specific to OSINT-based threat intelligence.

Community reviews

Loading reviews…