IndicatorPublished 31 Jul 2024Updated 1 Aug 2024

type osint · ThreatFox IOCs for 2024-07-31

Affects type osintSource ThreatFox MISP Feed

TLP:WHITE, disclosure is not limited

Indicators of compromise

Domains 1

FAKEUPDATES payload delivery domain (confidence level: 100%)

myanswerpronto.com

URLs 21

http://a1010630.xsph.ru/74dd937b.phpDCRat botnet C2 (confidence level: 100%)
http://101.43.103.253:8080/emtwCobalt Strike botnet C2 (confidence level: 75%)
http://8.130.172.150:1787/hkcgCobalt Strike botnet C2 (confidence level: 100%)
http://cx76022.tw1.ru/669eb395.phpDCRat botnet C2 (confidence level: 100%)
https://myanswerpronto.com/cdn-vs/original.jsFAKEUPDATES payload delivery URL (confidence level: 100%)
https://myanswerpronto.com/cdn-vs/main.phpFAKEUPDATES payload delivery URL (confidence level: 100%)
http://myanswerpronto.com/cdn-vs/22per.phpFAKEUPDATES payload delivery URL (confidence level: 100%)
http://111.230.41.191:8443/uc/validate/check.doCobalt Strike botnet C2 (confidence level: 75%)
http://a1011643.xsph.ru/fa4cd07b.phpDCRat botnet C2 (confidence level: 100%)
http://47.103.87.12:443/ptjCobalt Strike botnet C2 (confidence level: 75%)

IP addresses 57

18.192.93.86NjRAT botnet C2 server (confidence level: 75%)
3.126.37.18NjRAT botnet C2 server (confidence level: 75%)
18.157.68.73NjRAT botnet C2 server (confidence level: 75%)
18.197.239.5NjRAT botnet C2 server (confidence level: 75%)
103.117.141.96Latrodectus botnet C2 server (confidence level: 75%)
41.140.55.35NjRAT botnet C2 server (confidence level: 75%)
162.212.158.246AsyncRAT botnet C2 server (confidence level: 75%)
194.87.210.134Rshell botnet C2 server (confidence level: 100%)
8.130.172.150Cobalt Strike botnet C2 server (confidence level: 100%)
147.185.221.21NjRAT botnet C2 server (confidence level: 100%)

Hashes 159

c440409a8093c7b8c3ef11881bb4be889a491127Socks5 Systemz payload (confidence level: 95%)
5f368a7a339e485c3795a21bea867e9ea0606c3c66f7ca3c3b4a644a70d05228Socks5 Systemz payload (confidence level: 95%)
38a4f01b629b6188b3dc1efa69200242Socks5 Systemz payload (confidence level: 95%)
590e60bd792ead11cbd507c4de8ca9f77a3757a9Socks5 Systemz payload (confidence level: 95%)
258ecd1cb153a2a450ad5404f7c55a7dea44edb54da650ffa1165d7158dee94bSocks5 Systemz payload (confidence level: 95%)
3a8c9f010a87038a151bcee14aed51d5Socks5 Systemz payload (confidence level: 95%)
5afee0c45f59cdd18b24375d3ac3051d9accde66Socks5 Systemz payload (confidence level: 95%)
a51b75ef6b4fb020c834b8d1b58c11de532ee6171ea94a645f5986630332de26Socks5 Systemz payload (confidence level: 95%)
ffc2b0891fc6c848aca2afba9894d9ceSocks5 Systemz payload (confidence level: 95%)
3bf745f5e576de3036d0e7ce01127495eafa24efSocks5 Systemz payload (confidence level: 95%)

Description

ThreatFox IOCs for 2024-07-31

Impact

For European organizations, the impact of this threat is currently assessed as moderate due to the lack of detailed exploit information or active campaigns. The malware-related network activity and payload delivery could potentially lead to data exfiltration, system compromise, or lateral movement if leveraged in targeted attacks. However, without specific affected products or vulnerabilities, the risk remains generalized. European entities with extensive network exposure or those in critical infrastructure sectors should remain vigilant, as such OSINT feeds often precede or accompany emerging threats. The medium severity suggests a need for monitoring rather than immediate emergency response. The absence of known exploits in the wild reduces the immediate risk but does not eliminate the possibility of future exploitation.

Defensive guidance

Given the nature of the threat as an OSINT-based IOC report without specific vulnerabilities or exploits, mitigation should focus on enhancing detection and response capabilities. Organizations should: 1) Integrate ThreatFox IOCs into existing Security Information and Event Management (SIEM) and Endpoint Detection and Response (EDR) systems to improve detection of related network activity and payload delivery attempts. 2) Conduct regular network traffic analysis to identify anomalous or suspicious payload delivery patterns consistent with the reported IOCs. 3) Maintain up-to-date threat intelligence feeds and ensure security teams are trained to interpret and act upon OSINT data. 4) Implement strict network segmentation and least privilege principles to limit potential lateral movement if a payload is delivered. 5) Regularly review and update incident response plans to incorporate emerging OSINT threat data. 6) Since no patches are available, focus on proactive monitoring and rapid containment rather than patch management for this specific threat.

Community reviews

Loading reviews…