IndicatorPublished 23 Jan 2023Updated 24 Jan 2023

type osint · ThreatFox IOCs for 2023-01-23

Affects type osintSource ThreatFox MISP Feed

TLP:WHITE, disclosure is not limited

Indicators of compromise

Domains 46

gfduytsdf.shopUnknown malware botnet C2 domain (confidence level: 100%)
log.gfduytsdf.shopUnknown malware botnet C2 domain (confidence level: 100%)
tibloautonef.comIcedID botnet C2 domain (confidence level: 50%)
nomaeradiur.comIcedID botnet C2 domain (confidence level: 50%)
trotimera.comIcedID botnet C2 domain (confidence level: 50%)
swordnifhing.comIcedID botnet C2 domain (confidence level: 50%)
trustopaj.comIcedID botnet C2 domain (confidence level: 50%)
ulrtonemio.comIcedID botnet C2 domain (confidence level: 50%)
rolewzullo.comIcedID botnet C2 domain (confidence level: 50%)
trastbaki.comIcedID botnet C2 domain (confidence level: 50%)

URLs 59

http://3.92.113.197:8082/hubcap/mayo-clinic-radio-full-shows/Cobalt Strike botnet C2 (confidence level: 100%)
http://3.92.113.197:8084/discussion/mayo-clinic-radio-als/Cobalt Strike botnet C2 (confidence level: 100%)
https://8.214.108.207:14443/activityCobalt Strike botnet C2 (confidence level: 100%)
http://208.67.105.87:12338/matchCobalt Strike botnet C2 (confidence level: 100%)
https://44.201.225.29/cmCobalt Strike botnet C2 (confidence level: 100%)
https://45.12.253.139/favicon.jsCobalt Strike botnet C2 (confidence level: 100%)
http://62.233.51.173/jb9szzzbv7/login.phpAmadey botnet C2 (confidence level: 100%)
http://62.233.51.173/jb9szzzbv7/index.php?scr=1Amadey botnet C2 (confidence level: 100%)
http://62.233.51.173/jb9szzzbv7/index.phpAmadey botnet C2 (confidence level: 100%)
http://62.233.51.173/jb9szzzbv7/plugins/cred64.dllAmadey botnet C2 (confidence level: 100%)

IP addresses 167

119.29.82.40Cobalt Strike botnet C2 server (confidence level: 75%)
3.136.65.236NjRAT botnet C2 server (confidence level: 100%)
3.129.187.220NjRAT botnet C2 server (confidence level: 100%)
3.133.207.110NjRAT botnet C2 server (confidence level: 100%)
3.131.147.49NjRAT botnet C2 server (confidence level: 100%)
37.44.238.144Mirai botnet C2 server (confidence level: 75%)
62.204.41.242Amadey botnet C2 server (confidence level: 50%)
66.112.219.122Cobalt Strike botnet C2 server (confidence level: 100%)
44.201.225.29Cobalt Strike botnet C2 server (confidence level: 100%)
45.12.253.139Cobalt Strike botnet C2 server (confidence level: 100%)

Hashes 7

43723dfa8e7a99421cb5d50cf28c86a5Agent Tesla payload (confidence level: 50%)
8ee1e415d1d3db2d58b5929ef9068408a3041a870a6115c3f62794aec88d5687Unknown malware payload (confidence level: 100%)
9f30f4572aabbaf043659e43faa646619d525947b5ac7142106edf4e9a41136aEmotet payload (confidence level: 75%)
9fcc0a561c8f144be6a6988185befd05Unknown malware payload (confidence level: 50%)
1994fa4183b160cfb8931100f218b331Unknown malware payload (confidence level: 100%)
801b0800b59e45135865c2c96257399eUnknown malware payload (confidence level: 100%)
ebf7728724651e00053e83e4cadf4885Unknown malware payload (confidence level: 100%)

Description

ThreatFox IOCs for 2023-01-23

Impact

For European organizations, the impact of this threat is currently assessed as limited due to the lack of detailed exploit information and absence of known active exploitation. However, the presence of payload delivery and network activity components suggests potential risks related to malware infection, data exfiltration, or lateral movement within networks if the threat actors succeed in deploying malicious payloads. Organizations relying on OSINT tools or network services could be targeted for reconnaissance or initial compromise. The medium severity rating implies a moderate risk level, potentially affecting confidentiality and integrity if exploited, but without immediate evidence of availability impact or widespread disruption. European entities with critical infrastructure or sensitive data could face increased risk if this threat evolves or is leveraged in targeted campaigns. The lack of patches or mitigation details further complicates proactive defense, underscoring the need for vigilance and monitoring.

Defensive guidance

Given the limited technical details, European organizations should focus on enhancing network monitoring and threat intelligence integration to detect any indicators related to this threat as they emerge. Specific recommendations include: 1) Implement advanced network traffic analysis to identify unusual payload delivery attempts or reconnaissance activities; 2) Integrate ThreatFox and other MISP feeds into existing SIEM and SOAR platforms to automate IOC ingestion and alerting; 3) Conduct regular OSINT tool and network service audits to ensure minimal exposure and hardened configurations; 4) Employ endpoint detection and response (EDR) solutions capable of identifying suspicious payload execution; 5) Educate security teams on emerging OSINT-related threats and encourage information sharing within European cybersecurity communities; 6) Maintain updated incident response plans to rapidly address potential infections or breaches linked to this threat. These steps go beyond generic advice by emphasizing proactive intelligence-driven detection and operational readiness tailored to the threat's characteristics.

Community reviews

Loading reviews…