IndicatorPublished 4 Jul 2024Updated 5 Jul 2024

type osint · ThreatFox IOCs for 2024-07-04

Affects type osintSource ThreatFox MISP Feed

TLP:WHITE, disclosure is not limited

Indicators of compromise

Domains 16

api.yukklzwo.vipCobalt Strike botnet C2 domain (confidence level: 100%)
qq.yukklzwo.vipCobalt Strike botnet C2 domain (confidence level: 100%)
aa.yukklzwo.vipCobalt Strike botnet C2 domain (confidence level: 100%)
testgk.oss-cn-beijing.aliyuncs.comCobalt Strike botnet C2 domain (confidence level: 100%)
d2kw3fh12wz47k.cloudfront.netCobalt Strike botnet C2 domain (confidence level: 100%)
arbiankroos.comCobalt Strike botnet C2 domain (confidence level: 100%)
c1.redteam.clubCobalt Strike botnet C2 domain (confidence level: 100%)
c2.redteam.clubCobalt Strike botnet C2 domain (confidence level: 100%)
c3.redteam.clubCobalt Strike botnet C2 domain (confidence level: 100%)
pcapi-server.comUnknown malware botnet C2 domain (confidence level: 100%)

URLs 77

https://starjod.xyz/website.phpUnknown malware payload delivery URL (confidence level: 100%)
http://a0996099.xsph.ru/l1nc0in.phpDCRat botnet C2 (confidence level: 100%)
https://www.antonina.campi.spotkaniakultur.com/article.phpGootLoader payload delivery URL (confidence level: 100%)
http://47.237.84.207:9777/ptjCobalt Strike botnet C2 (confidence level: 100%)
http://47.236.69.44:8002/ie9compatviewlist.xmlCobalt Strike botnet C2 (confidence level: 100%)
http://144.22.38.242/4444.apkMeterpreter payload delivery URL (confidence level: 100%)
http://144.22.38.242/4444.elfMeterpreter payload delivery URL (confidence level: 100%)
http://144.22.38.242/4444.exeMeterpreter payload delivery URL (confidence level: 100%)
http://144.22.38.242/5555.exeMeterpreter payload delivery URL (confidence level: 100%)
http://144.22.38.242/6666.apkMeterpreter payload delivery URL (confidence level: 100%)

IP addresses 105

79.110.62.16RedLine Stealer botnet C2 server (confidence level: 100%)
178.78.19.238NjRAT botnet C2 server (confidence level: 75%)
91.222.173.204DarkGate botnet C2 server (confidence level: 100%)
94.156.71.43RedLine Stealer botnet C2 server (confidence level: 100%)
105.154.107.145NjRAT botnet C2 server (confidence level: 100%)
77.91.77.180RisePro botnet C2 server (confidence level: 100%)
47.237.84.207Cobalt Strike botnet C2 server (confidence level: 100%)
47.237.84.207Cobalt Strike botnet C2 server (confidence level: 100%)
144.22.38.242Meterpreter botnet C2 server (confidence level: 100%)
144.22.38.242Meterpreter botnet C2 server (confidence level: 100%)

Hashes 254

273332a7e82a1808f3f3f13de3882870692919b2XWorm payload (confidence level: 95%)
0f1032dd6e6e984bd0e31d1edb45e027b12d0ec1976505dd6a4d1dd2351931acXWorm payload (confidence level: 95%)
2bf102e6b31cd60a79a900979e7c04a2XWorm payload (confidence level: 95%)
549e7a8c8e998d3b7f85e61a7171685af231e780Formbook payload (confidence level: 95%)
76650fb8aeaf679cd204ca347026a67767ab8d9c27f65597b275d8d57327e096Formbook payload (confidence level: 95%)
a9c37f81cd9a181dab2262d2f8456a76Formbook payload (confidence level: 95%)
8d628dec0d699f1ae4006fc4902209fa9d30b0a2AsyncRAT payload (confidence level: 95%)
93aa308ad98dbf7a242ff3d06c2ba50ece83cbf909a17887bc441788a942e3a4AsyncRAT payload (confidence level: 95%)
67fc91937026fa8c1f0d96c42c50ec87AsyncRAT payload (confidence level: 95%)
b4e871ca1b111a12f09db58484e5a90255e6f104Loki Password Stealer (PWS) payload (confidence level: 95%)

Description

ThreatFox IOCs for 2024-07-04

Impact

For European organizations, the impact of these IOCs depends largely on their integration into security monitoring and incident response workflows. Since these are OSINT-based indicators related to network activity and payload delivery, organizations that fail to incorporate such threat intelligence feeds may be at increased risk of undetected malware infections or network intrusions. The medium severity suggests a moderate threat level, implying that while immediate critical damage is unlikely, persistent or targeted attacks leveraging these indicators could lead to data breaches, service disruptions, or reputational harm. The lack of known exploits in the wild reduces the immediacy of the threat but does not eliminate the risk of emerging or targeted campaigns using these indicators. European entities with high exposure to network-based threats, such as financial institutions, critical infrastructure, and large enterprises, should consider these IOCs as part of their broader threat detection strategy to mitigate potential impacts.

Defensive guidance

To effectively mitigate risks associated with these IOCs, European organizations should: 1) Integrate the ThreatFox MISP feed into their Security Information and Event Management (SIEM) and Intrusion Detection/Prevention Systems (IDS/IPS) to enable real-time detection of related network activity and payload delivery attempts. 2) Conduct regular threat hunting exercises using these indicators to identify any latent infections or suspicious network behavior. 3) Enhance network segmentation and apply strict egress filtering to limit the ability of malware to communicate externally if payload delivery occurs. 4) Maintain up-to-date endpoint protection and network monitoring tools capable of analyzing payloads and blocking known malicious signatures. 5) Train security teams on interpreting OSINT feeds and correlating them with internal telemetry to improve incident response times. 6) Collaborate with national Computer Security Incident Response Teams (CSIRTs) and European cybersecurity information sharing platforms to stay informed about evolving threats related to these indicators.

Community reviews

Loading reviews…