IndicatorPublished 11 Aug 2023Updated 12 Aug 2023

type osint · ThreatFox IOCs for 2023-08-11

Affects type osintSource ThreatFox MISP Feed

TLP:WHITE, disclosure is not limited

Indicators of compromise

Domains 32

JanelaRAT botnet C2 domain (confidence level: 100%)

439mdxmex.damnserver.com
897midasgold.ddns.me
9mdxmex.damnserver.com
aigodmoney009.access.ly
askmrpc747bm.mymediapc.net
brockmex57.golffan.us
cinfintymex.geekgalaxy.com
cnt-blackrock.geekgalaxy.com
disrupmoney979.ditchyourip.com
dmrpc77bm.myactivedirectory.com

URLs 24

http://116.203.166.240:27015/Vidar botnet C2 (confidence level: 100%)
http://gcl-page.biz/stats/save.phpCCleaner Backdoor botnet C2 (confidence level: 100%)
http://gcl-page.biz/check.phpCCleaner Backdoor botnet C2 (confidence level: 100%)
http://beerword.xyz/Lumma Stealer botnet C2 (confidence level: 100%)
http://45.9.74.70/2bfwen6kgtm/index.phpAmadey botnet C2 (confidence level: 100%)
http://185.161.251.195/7basedbpoll/1/test/provider/processordefault.phpDCRat botnet C2 (confidence level: 100%)
http://94.156.253.25/en_us/all.jsCobalt Strike botnet C2 (confidence level: 100%)
http://91.103.252.140/RecordBreaker botnet C2 (confidence level: 100%)
http://216.128.145.196/~wellseconds/?p=060773029Loki Password Stealer (PWS) botnet C2 (confidence level: 100%)
http://77.91.68.18/nice/index.phpAmadey botnet C2 (confidence level: 100%)

IP addresses 80

80.85.157.78RedLine Stealer botnet C2 server (confidence level: 100%)
168.100.10.122RisePro botnet C2 server (confidence level: 50%)
77.126.0.168QakBot botnet C2 server (confidence level: 50%)
185.147.34.178RedLine Stealer botnet C2 server (confidence level: 100%)
94.156.253.26Cobalt Strike botnet C2 server (confidence level: 100%)
94.156.253.25Cobalt Strike botnet C2 server (confidence level: 100%)
39.49.48.18QakBot botnet C2 server (confidence level: 50%)
45.65.49.230QakBot botnet C2 server (confidence level: 50%)
86.96.75.225QakBot botnet C2 server (confidence level: 50%)
100.4.182.242QakBot botnet C2 server (confidence level: 50%)

Description

ThreatFox IOCs for 2023-08-11

Impact

For European organizations, the impact of this threat is currently assessed as medium but largely theoretical due to the lack of detailed exploitation data or known active campaigns. If the malware or payload delivery mechanisms referenced were to be leveraged in targeted attacks, potential impacts could include unauthorized network access, data exfiltration, or disruption of services. However, without known exploits or specific vulnerabilities, the immediate risk remains limited. European entities involved in critical infrastructure, government, or sectors with high exposure to network-based attacks should remain vigilant, as the presence of IOCs suggests some level of reconnaissance or preparatory activity that could precede more targeted attacks. The medium severity reflects the potential for escalation if further details emerge or if threat actors develop exploit capabilities based on these IOCs.

Defensive guidance

Given the limited technical details, mitigation should focus on enhancing network monitoring and threat intelligence integration. Organizations should: 1) Incorporate the provided IOCs into their security information and event management (SIEM) systems and intrusion detection/prevention systems (IDS/IPS) to detect any related network activity. 2) Conduct regular network traffic analysis to identify anomalous payload delivery attempts or reconnaissance behavior. 3) Maintain up-to-date threat intelligence feeds and collaborate with information sharing groups to receive timely updates on any evolution of this threat. 4) Implement strict network segmentation and least privilege principles to limit lateral movement if an infection occurs. 5) Educate security teams on recognizing early indicators of malware campaigns and payload delivery tactics. 6) Since no patches are available, focus on hardening network defenses and endpoint detection capabilities rather than relying on software updates. These steps go beyond generic advice by emphasizing proactive detection and intelligence-driven defense tailored to the nature of the threat.

Community reviews

Loading reviews…