IndicatorPublished 23 Aug 2022Updated 24 Aug 2022

type osint · ThreatFox IOCs for 2022-08-23

Affects type osintSource ThreatFox MISP Feed

TLP:WHITE, disclosure is not limited

Indicators of compromise

Domains 22

usenlghusk.mlSMSspy botnet C2 domain (confidence level: 100%)
usenlghusk.gaSMSspy botnet C2 domain (confidence level: 100%)
93044live.mlSMSspy botnet C2 domain (confidence level: 100%)
trionyball.comIcedID botnet C2 domain (confidence level: 100%)
clearhotbeafc.comIcedID botnet C2 domain (confidence level: 100%)
mauraxinus.comIcedID botnet C2 domain (confidence level: 100%)
zalontrackei.comIcedID botnet C2 domain (confidence level: 100%)
52226asdiobioboioie.comNetSupportManager RAT botnet C2 domain (confidence level: 100%)
jjdfu.funNetSupportManager RAT payload delivery domain (confidence level: 100%)
myjesusloves.meFAKEUPDATES botnet C2 domain (confidence level: 100%)

URLs 79

https://service-53gacimc-1252339763.gz.apigw.tencentcs.com/api/xCobalt Strike botnet C2 (confidence level: 100%)
http://mail.world1sfuck.tk:2086/c/msdownload/update/others/2022/01/29136388_Cobalt Strike botnet C2 (confidence level: 100%)
http://89.45.4.169/jquery-3.3.1.min.jsCobalt Strike botnet C2 (confidence level: 100%)
http://a.efrey.top:81/dot.gifCobalt Strike botnet C2 (confidence level: 100%)
http://121.5.167.101/cmCobalt Strike botnet C2 (confidence level: 100%)
https://45.192.178.200/ptjCobalt Strike botnet C2 (confidence level: 100%)
http://44.209.247.95:5555/pixelCobalt Strike botnet C2 (confidence level: 100%)
http://121.5.136.224:50011/caCobalt Strike botnet C2 (confidence level: 100%)
http://124.222.177.70:8011/dpixelCobalt Strike botnet C2 (confidence level: 100%)
http://162.213.249.190/?4214103Loki Password Stealer (PWS) botnet C2 (confidence level: 100%)

IP addresses 60

139.180.191.129Cobalt Strike botnet C2 server (confidence level: 100%)
47.116.25.84Cobalt Strike botnet C2 server (confidence level: 100%)
89.45.4.169Cobalt Strike botnet C2 server (confidence level: 100%)
121.4.104.62Cobalt Strike botnet C2 server (confidence level: 100%)
121.5.167.101Cobalt Strike botnet C2 server (confidence level: 100%)
45.192.178.200Cobalt Strike botnet C2 server (confidence level: 100%)
35.173.206.44Cobalt Strike botnet C2 server (confidence level: 100%)
198.20.177.159Nanocore RAT botnet C2 server (confidence level: 100%)
5.154.181.23RedLine Stealer botnet C2 server (confidence level: 100%)
67.205.186.66Mirai botnet C2 server (confidence level: 75%)

Hashes 58

0f1d9b29cd29f8a7f2c6e1a9ce68de3480f680177f08a61b1934c965ea65a55cSMSspy payload (confidence level: 100%)
13eaadda71609960c966873f36efa735SMSspy payload (confidence level: 100%)
d4d8e4c7acc8c55c78737944fa235054f2f2efffeded83f107be43a0c1a58ffbSMSspy payload (confidence level: 100%)
d37107a95531607505c9c306c96d843fSMSspy payload (confidence level: 100%)
2cf1525cdb58ec9e5d47e5c66619b9cf2966155ece68a66e9bf935369971ccdcRemcos payload (confidence level: 100%)
c67e95d7141cdb09c9fa41c4cf95c0ba90ae6510320f981d8940fe0a3b4b0e17Remcos payload (confidence level: 100%)
f1dd9d53bfced731b89ffcc99e0eba448db94c8f15f47d18736a93f2078ec2caRemcos payload (confidence level: 100%)
b6af3cfa64ee5f153853e4eecee3c758b01fd1413714c699e2d3e813d6df542eRemcos payload (confidence level: 100%)
dbf66c5f52a3f691f81bfba587a15be34bc23fdae75ec933c61a87c9f500e182Remcos payload (confidence level: 100%)
866c057e74fa4215baeb8bb03b48ae93bfb2ca0122131d20bff85d8cbf471798Remcos payload (confidence level: 100%)

Description

ThreatFox IOCs for 2022-08-23

Impact

For European organizations, the impact of this threat is primarily dependent on the ability to leverage the provided IOCs to detect and mitigate potential malware infections. Since no specific exploit or vulnerability is described, the direct risk is limited to exposure to malware campaigns that these IOCs might help identify. Organizations that fail to integrate such threat intelligence into their security monitoring may face increased risk of undetected malware infections, potentially leading to data compromise, service disruption, or unauthorized access. The medium severity suggests a moderate risk level, with potential impacts on confidentiality and availability if malware payloads are successfully delivered and executed. However, the absence of known exploits in the wild reduces the immediate threat level. European entities with mature security operations centers (SOCs) and threat intelligence capabilities can use these IOCs to enhance detection and response, thereby mitigating potential impacts. Conversely, organizations lacking such capabilities might be more vulnerable to malware campaigns that these IOCs relate to.

Defensive guidance

To effectively mitigate risks associated with this threat intelligence update, European organizations should: 1) Integrate the provided IOCs into their security information and event management (SIEM) systems and endpoint detection and response (EDR) tools to enable real-time detection of related malware activity. 2) Regularly update threat intelligence feeds and ensure automated ingestion of new IOCs to maintain up-to-date defenses. 3) Conduct network traffic analysis focusing on indicators related to payload delivery and suspicious network activity to identify potential compromises early. 4) Enhance employee awareness and training regarding malware delivery methods to reduce the likelihood of successful payload execution. 5) Implement network segmentation and strict access controls to limit malware propagation if an infection occurs. 6) Perform regular vulnerability assessments and patch management, even though no specific patches are indicated here, to reduce attack surface. 7) Collaborate with national and European cybersecurity information sharing organizations to stay informed about evolving threats and share relevant intelligence.

Community reviews

Loading reviews…