← Back to Pulse Feed
PULSE DETAIL
PULSE NAME
IcedID (Bokbot) with Dark VNC and Cobalt Strike
WHITE AlienVault 2022-07-27 Modified: 2022-08-26
26
IOCs
MEDIUM VOLUME
As early as April 2022, a long-running threat actor known as TA551 (designated by Proofpoint), Monster Libra (designated by Palo Alto Networks), or Shathak started distributing SVCReady malware. Since then, SANS have sometimes seen this same threat actor also push IcedID (Bokbot) malware.
cobalt strikeicediddarkvnciso imageicedid malwarejs filebokbot
MITRE ATT&CK & Malware Families
ATT&CK TECHNIQUES
MALWARE FAMILIES
Cobalt Strike DarkVNC IcedID
Indicators of Compromise (26)
All FileHash-SHA256 URL domain
TYPEINDICATORDESCRIPTIONCREATED
FileHash-SHA256 1de8b101cf9f0fabc9f086bddb662c89d92c903c5db107910b3898537d4aa8e7 — 2022-07-27
FileHash-SHA256 4661a789c199544197a7d3ccfedb51ec95393641fb44875c92cf6c2c4a40fc1d — 2022-07-27
FileHash-SHA256 4b86c52424564e720a809dca94f5540fcddac10cb57618b44d693e49fd38c0a5 — 2022-07-27
FileHash-SHA256 a15ae5482b31140220bb75ce2e6c53aaafe3dc702784a0d235a77668e3b0a69a — 2022-07-27
FileHash-SHA256 a7a0025d77b576bcdaf8b05df362e53a748b64b51dd5ec5d20cf289a38e38d56 — 2022-07-27
FileHash-SHA256 d9a7ce532ee39918815f9dd03d0b4961ef85dddfd2498759b868e9ed8858a532 — 2022-07-27
FileHash-SHA256 df66d308065919c5d45f6c9b718b1a7c58f9e461488bbef850c924728f053b14 — 2022-07-27
FileHash-SHA256 e512027d42d829fad95d14aa4c48f3ce30089e5c200681a2bded67068b8973f4 — 2022-07-27
FileHash-SHA256 ee0379ef06a74b3c810b4f757097cd0534ec5c4ebf0d92875b07421fe1a5dd55 — 2022-07-27
FileHash-SHA256 eef2684a47bbadf954f3bc06b3611989447f1b5cfd47cdeacb38321987b3565c — 2022-07-27
FileHash-SHA256 f53321d9a70050759f1d3d21e4748f6e9432bf2bc476f294e6345f67e6c56c3e — 2022-07-27
URL http://108.177.235.8:80 — 2022-07-27
URL http://108.62.118.133:443 — 2022-07-27
URL http://135.181.175.108:8080 — 2022-07-27
URL http://159.203.45.144:80 — 2022-07-27
URL http://178.33.187.139:443 — 2022-07-27
URL http://46.21.153.211:443 — 2022-07-27
URL http://lufuyadehi.com/svchost.dll — 2022-07-27
URL http://tritehairs.com/ cab538fd1647961eb35348c1bd84e1fde389ad89672587d2fe3c007a0bc9e67f 2022-07-27
domain alohasockstaina.com — 2022-07-27
domain gruvihabralo.nl — 2022-07-27
domain lufuyadehi.com — 2022-07-27
domain peranistaer.top — 2022-07-27
domain tritehairs.com — 2022-07-27
domain wiandukachelly.com — 2022-07-27
domain zuyonijobo.com — 2022-07-27
References (1)
↗ https://isc.sans.edu/diary/rss/28884