Skip to content

05-indicators-of-compromise.md

Latest commit

 

History

History
73 lines (58 loc) · 3.3 KB

05-indicators-of-compromise.md

File metadata and controls

73 lines (58 loc) · 3.3 KB
Raw

05 — Indicators of Compromise (IOCs)

All indicators observed during the investigation, consolidated for reference and detection. Machine-readable versions are available in ../iocs/indicators.csv and ../iocs/indicators.json.

⚠️ These indicators belong to the BOTS v1 training dataset and describe a simulated attack. Validate independently before using them operationally. See ../DISCLAIMER.md.

Network Indicators

Type Indicator Role Notes
IPv4 40.80.148.42 Attacker — operator Manual login (batman) & 3791.exe upload; MSIE/Trident UA
IPv4 23.22.63.114 Attacker — brute-force bot Python-urllib/2.7; also linked to the malware sample
IPv4 192.168.250.70 Victim Compromised Joomla web server (imreallynotbatman.com)
Port 1337/tcp C2 Outbound beacon port
Domain prankglassinebracket.jumpingcrab.com C2 Dynamic DNS (jumpingcrab.com via afraid.org)
Domain jumpingcrab.com C2 parent Free dynamic-DNS parent domain
Domain Po1s0n1Vy.com Attribution Threat-actor persona ("Poison Ivy")
IPv4 69.197.18.183 C2 resolution Resolved from the C2 domain (Robtex)
IPv4 70.39.97.227 C2 resolution Resolved from the C2 domain
IPv4 169.47.130.85 C2 resolution Resolved from the C2 domain

Host / Web Indicators

Type Indicator Role
URI /joomla/administrator/index.php Brute-force target (Joomla admin login)
URI /poisonivy-is-coming-for-you-batman.jpeg Defacement artifact
Filename 3791.exe Uploaded malware payload
Filename agent.php Uploaded web artifact
Filename MirandaTateScreensaver.scr.exe Malware sample (per ThreatMiner metadata)
Command line cmd.exe /c "3791.exe 2>&1" Malware execution (Sysmon EventCode 1)
Account admin (Joomla) Brute-forced account
Credential batman Compromised password
User-Agent Python-urllib/2.7 Automated brute-force tool

File Hashes — 3791.exe / MirandaTateScreensaver.scr.exe

Algorithm Value
MD5 c99131e0169171935c5ac32615ed6261
SHA1 bc927ff06263351f43db8dec88e4b08485e07996
SHA256 9709473ab351387aab9e816eff3910b9f28a7a70202e250ed46dba8f820f34a8

File metadata: PE32 executable (console) Intel 80386, MS Windows · 494,080 bytes

Malware Classification

Vendor Detection name
Fortinet W32/Korplug.HP!tr
ESET-NOD32 a variant of Win32/Korplug.HP
BitDefender / Ad-Aware / F-Secure / GData / Emsisoft Trojan.GenericKD.3470547
Antiy-AVL Trojan[Backdoor]/Win32.Redsip
Avira TR/AD.Zupdax.qmyx
Ikarus Trojan.Win32.Korplug
DrWeb Trojan.MulDrop6.51432

Korplug / PlugX is a well-documented remote-access trojan (RAT) family used in targeted intrusions — consistent with the APT framing of this scenario.

Threat Actor

Attribute Value
Persona Poison Ivy (Po1s0n1Vy)
Registrant (WHOIS) Registration Private / Domains By Proxy, LLC
Registrar GoDaddy.com, LLC
Campaign theme "Poison Ivy is coming for you, Batman" (defacement)