IndicatorPublished 25 Nov 2022Updated 26 Nov 2022

type osint · ThreatFox IOCs for 2022-11-25

Affects type osintSource ThreatFox MISP Feed

TLP:WHITE, disclosure is not limited

Indicators of compromise

Domains 21

Cobalt Strike botnet C2 domain (confidence level: 100%)

br.claughs.ga
svchost221125.ddns.net
cstest20221123.ddnsfree.com
www.pldtserver.org
www.usts.site
testwscdn.m.37.com
generalimaps.com
www.generalimaps.com
mail.generalimaps.com
secure.generalimaps.com

URLs 110

https://br.claughs.ga:2083/api/3Cobalt Strike botnet C2 (confidence level: 100%)
http://45.139.105.143:8085/fwlinkCobalt Strike botnet C2 (confidence level: 100%)
http://45.139.105.143:8086/updates.rssCobalt Strike botnet C2 (confidence level: 100%)
https://167.71.204.199:8443/www/handle/docCobalt Strike botnet C2 (confidence level: 100%)
http://49.235.125.53:20001/wp08/wp-includes/dtcla.phpCobalt Strike botnet C2 (confidence level: 100%)
http://amazon3.serveuser.com/6.jpgOski Stealer botnet C2 (confidence level: 100%)
http://amazon3.serveuser.com/1.jpgOski Stealer botnet C2 (confidence level: 100%)
http://amazon3.serveuser.com/2.jpgOski Stealer botnet C2 (confidence level: 100%)
http://amazon3.serveuser.com/3.jpgOski Stealer botnet C2 (confidence level: 100%)
http://amazon3.serveuser.com/4.jpgOski Stealer botnet C2 (confidence level: 100%)

IP addresses 54

101.34.117.22Cobalt Strike botnet C2 server (confidence level: 100%)
192.169.69.25Nanocore RAT botnet C2 server (confidence level: 100%)
172.86.120.88AsyncRAT botnet C2 server (confidence level: 75%)
94.103.183.33RedLine Stealer botnet C2 server (confidence level: 100%)
109.206.243.197Vjw0rm botnet C2 server (confidence level: 100%)
185.158.251.35NetSupportManager RAT botnet C2 server (confidence level: 100%)
185.212.47.160SharkBot botnet C2 server (confidence level: 75%)
49.235.125.53Cobalt Strike botnet C2 server (confidence level: 100%)
191.242.29.94NjRAT botnet C2 server (confidence level: 100%)
109.248.18.177Cobalt Strike botnet C2 server (confidence level: 100%)

Hashes 7

3b73a7836ad74f3935bbf484f0e52ad6Amadey payload (confidence level: 50%)
1233a723ebdece80cb592aa584510066BumbleBee payload (confidence level: 50%)
9d19404ce023281cfb5c0ebe8560be35bifrose payload (confidence level: 50%)
bdcb6fd328b0c7e776bf5ed4dd3c0b6eAmadey payload (confidence level: 50%)
12295d5a38c339ffb5333989765b54fc6f23cf45a3715a8c9871ab3a76ff7d82LokiBot payload (confidence level: 50%)
2fce09a64c49609a4b60d0659c9602c991a057ed8673e4dfd1b884bee662b493NjRAT payload (confidence level: 50%)
1a71685e9d69c3e7619c5f20dbc3bbd693efb1db2370f5127d7f5c81df2baf3bCobalt Strike payload (confidence level: 50%)

Description

ThreatFox IOCs for 2022-11-25

Impact

For European organizations, the impact of these IOCs depends largely on their integration into security monitoring and incident response processes. Since the data relates to malware payload delivery and network activity, failure to incorporate these IOCs into detection systems could result in missed early warnings of intrusion attempts or malware infections. However, given the lack of known exploits in the wild and no specific affected products, the immediate risk is limited. Organizations that rely heavily on OSINT for threat detection may find value in these IOCs to improve situational awareness. The medium severity suggests that while there is a potential for malicious activity, it is not currently widespread or highly destructive. European entities with critical infrastructure or high-value targets should remain vigilant, as threat actors often use such intelligence feeds to refine their attack methods. Overall, the impact is moderate and primarily preventative, emphasizing the importance of proactive threat intelligence consumption.

Defensive guidance

To mitigate risks associated with these IOCs, European organizations should: 1) Integrate the ThreatFox IOCs into their Security Information and Event Management (SIEM) and Intrusion Detection/Prevention Systems (IDS/IPS) to enhance detection of related malware payloads and network activities. 2) Regularly update threat intelligence feeds and ensure automated ingestion of OSINT data to maintain up-to-date situational awareness. 3) Conduct network traffic analysis focusing on anomalies that match the provided IOCs, even if no direct exploit is currently known. 4) Train security operations teams to recognize patterns of payload delivery and network activity associated with these IOCs. 5) Collaborate with local Computer Security Incident Response Teams (CSIRTs) and share intelligence to improve collective defense. 6) Maintain robust endpoint protection and network segmentation to limit potential malware spread if an infection occurs. These steps go beyond generic advice by emphasizing integration and operationalization of the specific IOCs from ThreatFox.

Community reviews

Loading reviews…