IndicatorPublished 16 Sep 2024Updated 17 Sep 2024

type osint · ThreatFox IOCs for 2024-09-16

Affects type osintSource ThreatFox MISP Feed

TLP:WHITE, disclosure is not limited

Indicators of compromise

Domains 48

www.hdobussl.ethergases.appHook botnet C2 domain (confidence level: 100%)
wwwwwwstaging.ethergases.appHook botnet C2 domain (confidence level: 100%)
www.backend.ethergases.appHook botnet C2 domain (confidence level: 100%)
www.m.ethergases.appHook botnet C2 domain (confidence level: 100%)
klkizwp.ethergases.appHook botnet C2 domain (confidence level: 100%)
www.analytic.ethergases.appHook botnet C2 domain (confidence level: 100%)
www1.ethergases.appHook botnet C2 domain (confidence level: 100%)
xn--premit-0eb.xyzHook botnet C2 domain (confidence level: 100%)
tasuju.xyzXehookStealer botnet C2 domain (confidence level: 100%)
cdnhou.bbbdfsdfsfffdddd.topERMAC botnet C2 domain (confidence level: 100%)

URLs 22

http://a1017742.xsph.ru/65bfc527.phpDCRat botnet C2 (confidence level: 100%)
http://20789cm.darkproducts.ru/l1nc0in.phpDCRat botnet C2 (confidence level: 100%)
https://159.69.100.83/Vidar botnet C2 (confidence level: 100%)
https://murderryewowp.shop/apiLumma Stealer botnet C2 (confidence level: 75%)
https://whizability.com/cdn-vs/original.jsFAKEUPDATES payload delivery URL (confidence level: 100%)
https://whizability.com/cdn-vs/index.phpFAKEUPDATES payload delivery URL (confidence level: 100%)
https://whizability.com/cdn-vs/update.phpFAKEUPDATES payload delivery URL (confidence level: 100%)
https://whizability.com/cdn-vs/data.phpFAKEUPDATES payload delivery URL (confidence level: 100%)
https://biribizidurdursun310.xyz/ntqzzmi0ytdmmjnl/Coper botnet C2 (confidence level: 80%)
https://biribizidurdursun36.xyz/ntqzzmi0ytdmmjnl/Coper botnet C2 (confidence level: 80%)

IP addresses 54

198.44.173.90Cobalt Strike botnet C2 server (confidence level: 100%)
175.178.13.109Cobalt Strike botnet C2 server (confidence level: 100%)
103.142.146.11Cobalt Strike botnet C2 server (confidence level: 100%)
192.129.178.60Remcos botnet C2 server (confidence level: 100%)
141.95.84.40Remcos botnet C2 server (confidence level: 100%)
121.199.28.252Cobalt Strike botnet C2 server (confidence level: 100%)
5.161.231.57Venom RAT botnet C2 server (confidence level: 100%)
109.199.108.1Crimson RAT botnet C2 server (confidence level: 100%)
185.229.9.27BianLian botnet C2 server (confidence level: 100%)
147.185.221.18NjRAT botnet C2 server (confidence level: 100%)

Hashes 165

07d889db87532544414f9fc089ac19f2921bfb18RedLine Stealer payload (confidence level: 95%)
1a088af9cd8038f62470f2a8a3436db8b384a1b27d29acee352faf5efcc191b9RedLine Stealer payload (confidence level: 95%)
7b941f7d216075afc69f94af5f9564edRedLine Stealer payload (confidence level: 95%)
6a2e81c26a76a4397fcbb2444428d61fe6f6c6e4Vidar payload (confidence level: 95%)
5ddb5598f1156d0ea44502cfbe89fdb6805c6b4be08cd33fd1a963b94544918eVidar payload (confidence level: 95%)
65ac3fe80ceced1ad72a4ab03dfd14f2Vidar payload (confidence level: 95%)
a6dd703797a20166df01471163f77cd92aaa0613Mars Stealer payload (confidence level: 95%)
c7c2fda0027361d7d5544a311da9e36058b845bb4e78c988d533be42edf02138Mars Stealer payload (confidence level: 95%)
6b3a661f028fcc8fdc9b04f4916b4324Mars Stealer payload (confidence level: 95%)
39d5988591cc576efe40b96b043e0377432154c1Socks5 Systemz payload (confidence level: 95%)

Description

ThreatFox IOCs for 2024-09-16

Impact

For European organizations, the impact of this threat primarily lies in the potential for undetected malware infections facilitated through network activity and payload delivery mechanisms. Since no specific vulnerabilities or exploits are detailed, the risk is associated with the presence of malicious payloads or network traffic that could lead to data exfiltration, system compromise, or lateral movement within corporate networks. The medium severity suggests a moderate risk level, where successful exploitation could affect confidentiality and integrity of data, and potentially availability if payloads include ransomware or disruptive malware. European entities with extensive network infrastructures, especially those in critical sectors such as finance, healthcare, and government, could face operational disruptions or data breaches if these IOCs correspond to active threats targeting their environments. However, the lack of known exploits in the wild and absence of patches indicates that this threat is currently more of a monitoring and detection concern rather than an immediate crisis. Organizations relying on OSINT feeds and threat intelligence platforms would benefit from integrating these IOCs into their security monitoring to enhance detection capabilities and reduce dwell time of potential intrusions.

Defensive guidance

Given the nature of this threat as an OSINT-based IOC update without specific vulnerabilities or exploits, mitigation should focus on enhancing detection and response capabilities. European organizations should: 1) Integrate the provided IOCs into existing Security Information and Event Management (SIEM) systems and Endpoint Detection and Response (EDR) tools to improve identification of suspicious network activity and payload delivery attempts. 2) Conduct regular network traffic analysis and anomaly detection to identify unusual patterns that may indicate malware delivery or command and control communications. 3) Maintain up-to-date threat intelligence feeds and ensure security teams are trained to interpret and act on OSINT data effectively. 4) Implement strict network segmentation and least privilege access controls to limit the impact of any successful payload delivery. 5) Perform regular security awareness training to reduce the risk of social engineering or phishing attacks that could facilitate payload delivery. 6) Continuously monitor for updates from trusted sources regarding patches or exploit developments related to these IOCs, adjusting defenses accordingly. These steps go beyond generic advice by emphasizing proactive intelligence integration and network behavior monitoring tailored to the nature of the threat.

Community reviews

Loading reviews…