IndicatorPublished 11 Jan 2023Updated 12 Jan 2023

type osint · ThreatFox IOCs for 2023-01-11

Affects type osintSource ThreatFox MISP Feed

TLP:WHITE, disclosure is not limited

Indicators of compromise

Domains 34

pleasetake.picturesAmadey botnet C2 domain (confidence level: 50%)
doyiduzu.comCobalt Strike botnet C2 domain (confidence level: 100%)
allowedcloud.comCobalt Strike botnet C2 domain (confidence level: 100%)
redirect.frontlinepay.usCobalt Strike botnet C2 domain (confidence level: 100%)
svchost20230103.ddnsfree.comCobalt Strike botnet C2 domain (confidence level: 100%)
cs.newbird.cfCobalt Strike botnet C2 domain (confidence level: 100%)
acordadeumavez.momAstaroth botnet C2 domain (confidence level: 100%)
aesulluzetecnologia.hairAstaroth botnet C2 domain (confidence level: 100%)
anonovovidanova.momAstaroth botnet C2 domain (confidence level: 100%)
nemtusabeoqquer.skinAstaroth botnet C2 domain (confidence level: 100%)

URLs 74

http://871356.clmonth.nyashteam.top/nyashsupport.phpDCRat botnet C2 (confidence level: 100%)
http://82.146.34.244/pipe_bigloadgeneratorlocal.phpDCRat botnet C2 (confidence level: 100%)
http://193.47.61.99/cmCobalt Strike botnet C2 (confidence level: 100%)
http://54.151.146.41/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=booksCobalt Strike botnet C2 (confidence level: 100%)
http://101.33.125.241:4444/en_us/all.jsCobalt Strike botnet C2 (confidence level: 100%)
http://windowsign.theworkpc.com/pollbigloaddefaultdbbase.phpDCRat botnet C2 (confidence level: 100%)
http://158447.clmonth.nyashteam.top/nyashsupport.phpDCRat botnet C2 (confidence level: 100%)
http://42.224.213.130:35049/mozi.mMozi payload delivery URL (confidence level: 50%)
http://185.246.90.205/libsystem.soKinsing payload delivery URL (confidence level: 100%)
http://185.246.90.205/curl-amd64Kinsing payload delivery URL (confidence level: 100%)

IP addresses 100

3.122.103.39Cobalt Strike botnet C2 server (confidence level: 75%)
23.227.202.66Cobalt Strike botnet C2 server (confidence level: 75%)
185.48.86.75Cobalt Strike botnet C2 server (confidence level: 75%)
185.48.86.75Cobalt Strike botnet C2 server (confidence level: 75%)
185.48.86.75Cobalt Strike botnet C2 server (confidence level: 75%)
185.48.86.75Cobalt Strike botnet C2 server (confidence level: 75%)
49.234.152.199Cobalt Strike botnet C2 server (confidence level: 75%)
106.55.2.194Cobalt Strike botnet C2 server (confidence level: 75%)
37.38.244.230NjRAT botnet C2 server (confidence level: 100%)
193.47.61.99Cobalt Strike botnet C2 server (confidence level: 100%)

Hashes 6

381134ea0f0be535b9d2ce8a94093576CryCryptor payload (confidence level: 50%)
5c7fb0927db37372da25f270708103a2WannaCryptor payload (confidence level: 50%)
69c8f26359a2f91a60c66023180491f7Xloader payload (confidence level: 50%)
1dba6023c933a8d7a9a6623c158bc4b7Gozi payload (confidence level: 50%)
cb3b67a980ba921625ecdf082d518c73a9f80ce1b2d4f428b6e950b20a9688bbGozi payload (confidence level: 50%)
2c6f8842494083e7ff70f648a116c74a22a470e7fab297cded5927f555a7fc6eDCRat payload (confidence level: 50%)

Description

ThreatFox IOCs for 2023-01-11

Impact

For European organizations, the impact of this threat intelligence lies in its utility for improving detection and response rather than indicating an active or imminent attack vector. Since the IOCs relate to malware and network activity, organizations that do not incorporate these indicators into their security monitoring may face increased risk of undetected compromise or delayed incident response. The absence of known exploits and patches suggests that the threat is not currently causing widespread damage but could be leveraged by threat actors if combined with other vulnerabilities or social engineering tactics. European entities with extensive network infrastructure, especially those in critical sectors such as finance, energy, and government, could benefit from integrating these IOCs into their security information and event management (SIEM) systems and threat intelligence platforms to enhance their defensive posture. However, the direct operational impact is likely limited unless these IOCs correspond to active campaigns targeting specific organizations.

Defensive guidance

To mitigate risks associated with the threat intelligence provided, European organizations should: 1) Integrate the ThreatFox IOCs into their existing threat intelligence platforms and SIEM tools to enable automated detection of related malicious activity. 2) Conduct network traffic analysis focusing on indicators related to payload delivery and unusual network communications that match the IOCs. 3) Enhance endpoint detection and response (EDR) capabilities to identify and contain malware behaviors associated with the indicators. 4) Share relevant findings with industry Information Sharing and Analysis Centers (ISACs) to improve collective defense. 5) Maintain robust network segmentation and least privilege access controls to limit potential lateral movement if a compromise occurs. 6) Regularly update and test incident response plans to ensure readiness in case these indicators correspond to active threats. Since no patches are available, emphasis should be on detection, containment, and response rather than remediation of a software vulnerability.

Community reviews

Loading reviews…