IndicatorPublished 6 Mar 2023Updated 7 Mar 2023

type osint · ThreatFox IOCs for 2023-03-06

Affects type osintSource ThreatFox MISP Feed

TLP:WHITE, disclosure is not limited

Indicators of compromise

Domains 13

orduhanpi.ruUnknown malware botnet C2 domain (confidence level: 100%)
ogtaypi.ruUnknown malware botnet C2 domain (confidence level: 100%)
myuridgo.ruUnknown malware botnet C2 domain (confidence level: 100%)
muhtargo.ruUnknown malware botnet C2 domain (confidence level: 100%)
muhsingo.ruUnknown malware botnet C2 domain (confidence level: 100%)
osmanpo.ruUnknown malware botnet C2 domain (confidence level: 100%)
payampo.ruUnknown malware botnet C2 domain (confidence level: 100%)
download-discord.topStealc payload delivery domain (confidence level: 100%)
service-ftyn94bx-1308675124.cd.apigw.tencentcs.comCobalt Strike botnet C2 domain (confidence level: 100%)
api.360com.liveCobalt Strike botnet C2 domain (confidence level: 100%)

URLs 80

http://104.193.254.45/bot/regex?key=3682a4b856cc8db9e7c6f4deda4a6fdc2a8f662f4cc34c6d4365d36e3ed0ab52LaplasClipper botnet C2 (confidence level: 100%)
http://45.159.189.105/bot/regex?key=3682a4b856cc8db9e7c6f4deda4a6fdc2a8f662f4cc34c6d4365d36e3ed0ab52LaplasClipper botnet C2 (confidence level: 100%)
http://68.183.13.128/?page_id=1860Loki Password Stealer (PWS) botnet C2 (confidence level: 100%)
http://68.183.13.128/?page_id=4136377Loki Password Stealer (PWS) botnet C2 (confidence level: 100%)
https://195.189.96.146/pixel.gifCobalt Strike botnet C2 (confidence level: 100%)
http://84.54.50.28/authAurora Stealer botnet C2 (confidence level: 100%)
http://94.131.112.184/authAurora Stealer botnet C2 (confidence level: 100%)
http://94.142.138.132/authAurora Stealer botnet C2 (confidence level: 100%)
http://94.142.138.137/authAurora Stealer botnet C2 (confidence level: 100%)
http://94.142.138.147/authAurora Stealer botnet C2 (confidence level: 100%)

IP addresses 147

45.8.146.108RedLine Stealer botnet C2 server (confidence level: 100%)
8.142.124.166Cobalt Strike botnet C2 server (confidence level: 75%)
152.89.196.12Cobalt Strike botnet C2 server (confidence level: 75%)
1.13.82.101Cobalt Strike botnet C2 server (confidence level: 75%)
79.134.225.17STRRAT botnet C2 server (confidence level: 100%)
195.189.96.146Cobalt Strike botnet C2 server (confidence level: 100%)
37.0.14.205STRRAT botnet C2 server (confidence level: 100%)
18.231.93.153NjRAT botnet C2 server (confidence level: 100%)
54.94.248.37NjRAT botnet C2 server (confidence level: 100%)
18.229.248.167NjRAT botnet C2 server (confidence level: 100%)

Hashes 6

Unknown malware payload (confidence level: 100%)

c9e84fae8578d34ab6b65d5c44e54fb2
caedf21246e5920e1015959f9fc9029f
32031a03a5302c16d28028dbe3cc911e
ee71e50f5c24475a08456cc6486e12da
9f4186242fd9479571daf9ea59a81342
8635a69131f07f61225891a7d5ec8ace

Description

ThreatFox IOCs for 2023-03-06

Impact

Given the lack of specific technical details, affected systems, or known exploits, the direct impact of this threat on European organizations is difficult to quantify. The medium severity rating and the nature of the data as OSINT IOCs imply that these indicators could be used by security teams to detect or prevent malware infections or network intrusions. If these IOCs correspond to emerging malware campaigns or payload delivery mechanisms, European organizations could face risks such as data breaches, service disruptions, or unauthorized access if they fail to incorporate these indicators into their detection systems. However, without concrete evidence of active exploitation or targeted attacks, the immediate risk remains moderate. The impact is primarily on the ability of organizations to maintain situational awareness and enhance their threat detection capabilities.

Defensive guidance

To effectively mitigate risks associated with this threat intelligence update, European organizations should: 1) Integrate the provided IOCs from ThreatFox into their Security Information and Event Management (SIEM) systems and endpoint detection and response (EDR) tools to enhance detection of related malware or network activity. 2) Regularly update threat intelligence feeds and ensure automated ingestion of OSINT data to maintain up-to-date defenses. 3) Conduct proactive network monitoring focusing on unusual payload delivery patterns or suspicious network activity that aligns with the indicators. 4) Train security analysts to interpret and act on OSINT-derived IOCs, emphasizing correlation with internal logs and alerts. 5) Maintain robust incident response plans that can quickly leverage new threat intelligence to contain potential infections. Since no patches or specific vulnerabilities are identified, focus should be on detection and response rather than remediation of a software flaw.

Community reviews

Loading reviews…