IndicatorPublished 6 Oct 2023Updated 7 Oct 2023

type osint · ThreatFox IOCs for 2023-10-06

Affects type osintSource ThreatFox MISP Feed

TLP:WHITE, disclosure is not limited

Indicators of compromise

Domains 17

nmbvcxzasedrt.comFAKEUPDATES payload delivery domain (confidence level: 100%)
sahame.symen.irIRATA botnet C2 domain (confidence level: 100%)
symen.irIRATA botnet C2 domain (confidence level: 100%)
adl-vq.vizvaz.comIRATA payload delivery domain (confidence level: 100%)
mynameisnull.siteIRATA botnet C2 domain (confidence level: 100%)
gta-fportal.comIRATA botnet C2 domain (confidence level: 100%)
plawers.comPikabot payload delivery domain (confidence level: 100%)
d2d756ulnohqjs.cloudfront.netCobalt Strike botnet C2 domain (confidence level: 100%)
upcls.onlineCobalt Strike botnet C2 domain (confidence level: 100%)
helloone.accountants.monsterCobalt Strike botnet C2 domain (confidence level: 100%)

URLs 115

https://nmbvcxzasedrt.com/vvmd54/FAKEUPDATES payload delivery URL (confidence level: 100%)
https://nmbvcxzasedrt.com/lander/chrome_1695206714/_index.phpFAKEUPDATES payload delivery URL (confidence level: 100%)
http://fgkdfkfddxzy.xyzAlien botnet C2 (confidence level: 80%)
https://nmbvcxzasedrt.com/zgbn19mxFAKEUPDATES payload delivery URL (confidence level: 100%)
https://fablane.com/cdn-js/minlen.phpFAKEUPDATES payload delivery URL (confidence level: 100%)
https://fablane.com/cdn/qzwewmrqqgqnaww.phpFAKEUPDATES payload delivery URL (confidence level: 100%)
https://residencialcasabrasileira.com/111.phpFAKEUPDATES payload delivery URL (confidence level: 100%)
https://legalny.com.pl/comments.phpGootLoader payload delivery URL (confidence level: 100%)
http://haroldmoscotelora09.con-ip.com:1995Remcos botnet C2 (confidence level: 100%)
http://terlevisor23.con-ip.com:1883Remcos botnet C2 (confidence level: 100%)

IP addresses 78

138.201.18.225AsyncRAT botnet C2 server (confidence level: 100%)
80.76.51.70Unknown malware botnet C2 server (confidence level: 50%)
45.86.163.188BianLian botnet C2 server (confidence level: 50%)
45.86.163.188BianLian botnet C2 server (confidence level: 50%)
46.148.139.144BianLian botnet C2 server (confidence level: 50%)
3.81.68.30BianLian botnet C2 server (confidence level: 50%)
34.227.89.96Havoc botnet C2 server (confidence level: 50%)
45.138.16.248Havoc botnet C2 server (confidence level: 50%)
142.171.158.253Unknown malware botnet C2 server (confidence level: 50%)
101.42.41.136Cobalt Strike botnet C2 server (confidence level: 100%)

Hashes 2

IRATA payload (confidence level: 100%)

4e1196b694ec1391ed1874e10f30b2f909a05b9c76828089d2c2aeed5527b687
5a736b914a1119389bd94142c013ff5c

Description

ThreatFox IOCs for 2023-10-06

Impact

For European organizations, the impact of this threat intelligence update is primarily in enhancing situational awareness and improving detection capabilities rather than mitigating an active or critical threat. Since no specific vulnerabilities or exploits are identified, the direct risk to confidentiality, integrity, or availability is low at this time. However, the presence of updated IOCs related to malware and payload delivery could help organizations identify early signs of intrusion or compromise attempts, potentially reducing the dwell time of attackers if these indicators are integrated into security monitoring tools. The medium severity rating suggests that while the threat is not urgent, it should not be ignored, especially for organizations with high-value assets or those in sectors frequently targeted by malware campaigns, such as finance, critical infrastructure, and government entities.

Defensive guidance

European organizations should incorporate the provided IOCs into their existing security information and event management (SIEM) systems, intrusion detection/prevention systems (IDS/IPS), and endpoint detection and response (EDR) tools to enhance detection of related malicious activity. Regularly updating threat intelligence feeds and correlating these indicators with internal logs can improve early warning capabilities. Additionally, organizations should conduct network traffic analysis focusing on unusual payload delivery patterns and suspicious network activity. Since no patches are available, emphasis should be placed on proactive monitoring, employee awareness training to recognize phishing or social engineering attempts that could deliver malware, and maintaining robust backup and recovery procedures to mitigate potential payload impacts. Collaboration with national cybersecurity centers and sharing intelligence within trusted communities can also enhance collective defense against evolving threats.

Community reviews

Loading reviews…