IcedID to Cobalt Strike In Under 20 Minutes
Tags
maec-delivery-vectors: Watering Hole
attack-pattern: Data Models Credentials - T1589.001 Exploits - T1587.004 Exploits - T1588.005 Javascript - T1059.007 Malware - T1587.001 Malware - T1588.001 Phishing - T1660 Phishing - T1566 Powershell - T1059.001 Regsvr32 - T1218.010 Visual Basic - T1059.005 Vulnerabilities - T1588.006 Brute Force - T1110 Powershell - T1086 Regsvr32 - T1117
Show in Graph
Common Information
Type Value
UUID 7e677a8b-cb35-4f63-9383-b5964422b5e1
Fingerprint 8061bbddbb9d5a0e
Analysis status DONE
Considered CTI value 2
Text language
Published May 18, 2022, midnight
Added to db Dec. 19, 2024, 9:51 p.m.
Last updated Dec. 19, 2024, 9:52 p.m.
Headline IcedID to Cobalt Strike In Under 20 Minutes
Title IcedID to Cobalt Strike In Under 20 Minutes
Detected Hints/Tags/Attributes 65/2/15
Source URLs
Redirection Url
Details Source https://www.esentire.com/blog/icedid-to-cobalt-strike-in-under-20-minutes
URL Provider
Details Provider Source level domain
Details esentire.com www.esentire.com
Attributes
Details Type #Events CTI Value
Details Domain 1 
cooldogblunts.com
Details Domain 1 
reseptors.com
Details Domain 2 
coolbearblunts.com
Details Domain 1 
jquerysearchengine.com
Details md5 1 
934a3c540bb7224f9e0f6229b7dbe00b
Details md5 1 
0ab07147f62d8daabb591c7b4ccb4187
Details md5 1 
a1702eceb019352298b88b2011bfe8af
Details IPv4 1 
51.89.73.150
Details IPv4 1 
194.15.112.23
Details IPv4 1 
149.3.170.104
Details IPv4 3 
88.119.161.88
Details IPv4 1 
162.33.179.178
Details IPv4 1 
162.33.178.218
Details Url 1 
http://162.33.179.178/pasdphaiusfoifds
Details Url 1 
http://162.33.179.178/asdhodihsa