IndicatorPublished 8 Sep 2023Updated 9 Sep 2023

type osint · ThreatFox IOCs for 2023-09-08

Affects type osintSource ThreatFox MISP Feed

TLP:WHITE, disclosure is not limited

Indicators of compromise

Domains 55

sept7ama.tuktuk.ugRedLine Stealer botnet C2 domain (confidence level: 100%)
kevinbrawiewu.comIcedID botnet C2 domain (confidence level: 100%)
clainsrimauto.comIcedID botnet C2 domain (confidence level: 100%)
kaheshanpa.comIcedID botnet C2 domain (confidence level: 100%)
04septgo.tuktuk.ugRedLine Stealer botnet C2 domain (confidence level: 100%)
ekb.tuktuk.ugRedLine Stealer botnet C2 domain (confidence level: 100%)
fk29.tuktuk.ugRedLine Stealer botnet C2 domain (confidence level: 100%)
msk.tuktuk.ugRedLine Stealer botnet C2 domain (confidence level: 100%)
sept4em.tuktuk.ugRedLine Stealer botnet C2 domain (confidence level: 100%)
sept5ama.tuktuk.ugRedLine Stealer botnet C2 domain (confidence level: 100%)

URLs 19

https://heartwoodproperties.com/blog.phpGootLoader payload delivery URL (confidence level: 100%)
https://heldenfutter.de/blog.phpGootLoader payload delivery URL (confidence level: 100%)
https://gutesherz.or/go.phpGootLoader payload delivery URL (confidence level: 100%)
https://38.47.238.225/jquery-3.3.1.min.jsCobalt Strike botnet C2 (confidence level: 100%)
https://paste.ee/d/jepak/0Remcos payload delivery URL (confidence level: 75%)
https://pastebin.com/raw/sfgsbg3vRemcos payload delivery URL (confidence level: 75%)
https://wtools.io/code/dl/bplbRemcos payload delivery URL (confidence level: 75%)
https://pasteio.com/download/xtnja1wvooamRemcos payload delivery URL (confidence level: 75%)
https://oiuytyfvq621mb.org/vvmd54/FAKEUPDATES payload delivery URL (confidence level: 100%)
https://oiuytyfvq621mb.org/zgbn19mxFAKEUPDATES payload delivery URL (confidence level: 100%)

IP addresses 39

20.0.54.48RedLine Stealer botnet C2 server (confidence level: 100%)
23.108.57.87RedLine Stealer botnet C2 server (confidence level: 100%)
179.60.147.4Meterpreter botnet C2 server (confidence level: 100%)
194.147.140.232Remcos botnet C2 server (confidence level: 100%)
3.214.57.4Unknown malware botnet C2 server (confidence level: 50%)
208.123.119.100BianLian botnet C2 server (confidence level: 50%)
66.135.16.39Havoc botnet C2 server (confidence level: 50%)
80.85.152.108Havoc botnet C2 server (confidence level: 50%)
159.223.205.33Havoc botnet C2 server (confidence level: 50%)
89.96.196.150Responder botnet C2 server (confidence level: 50%)

Hashes 3

Remcos payload (confidence level: 75%)

d27224eb9e5c34abfb22ba1941f3c4c4fbcfb5702899f8cf4fe280f4aa881d44
5a21b731fa6efbd890bcec79dc8ee32d38d78ff56ba4570b7edeef947b335484
77e02a67b7335161ae2abc3cd2a71540b75c78ab564cb3d993ae1e6dbcbeb615

Description

ThreatFox IOCs for 2023-09-08

Impact

For European organizations, the impact of this threat is currently limited due to the lack of detailed exploit information and absence of known active exploitation. However, the presence of malware-related IOCs and payload delivery mechanisms implies potential risks if these indicators are linked to targeted campaigns or if they evolve into active threats. Organizations relying on OSINT for threat detection may benefit from integrating these IOCs into their monitoring systems to enhance early warning capabilities. The medium severity suggests that while immediate disruption or data compromise is unlikely, there is a moderate risk of network intrusion or malware infection if these IOCs correspond to emerging threats. European entities with critical infrastructure or sensitive data should remain vigilant, as payload delivery mechanisms can lead to ransomware, data exfiltration, or system compromise if exploited.

Defensive guidance

Given the limited technical details, European organizations should focus on proactive threat intelligence integration and network hygiene. Specific recommendations include: 1) Incorporate the latest ThreatFox IOCs into SIEM and endpoint detection and response (EDR) platforms to improve detection of related malware activities. 2) Conduct regular network traffic analysis to identify anomalous payload delivery attempts, especially those matching known IOC patterns once available. 3) Enhance employee awareness training on phishing and social engineering, as payload delivery often leverages these vectors. 4) Maintain up-to-date backups and incident response plans to mitigate potential impacts of malware infections. 5) Collaborate with national cybersecurity centers and information sharing groups to receive timely updates on emerging threats linked to these IOCs. 6) Since no patches are available, focus on network segmentation and least privilege principles to limit lateral movement if compromise occurs.

Community reviews

Loading reviews…