OTX-62e90351180fc0835571e0c4
high
📛 Threat Title
Deimos C2 - C2 IP/Domain Tracker
Description
This pulse contains IOCs related to Deimos Infrastructure. Additions are automatically added based on several sources like: OTX sandboxes samples, internal tools, through the use of Shodan or Censys queries, shared intel from LevelBlue partners or external feeds.
Indicators of Compromise (2)
Each indicator is enriched from the IOC database, threat-intel feed corroboration (Threat Hunt) and VirusTotal. Click one to expand.
ipv4
140.150.21.27
IOC database
- Type
- ipv4
- Value
140.150.21.27- First seen
- Last seen
- Attached to this threat
- Appears in
- 1 threat
Threat Hunt — feed corroboration
Not present in any configured threat-intel feed.
Details From VirusTotal
No VirusTotal details cached for this IOC. Open the IOC page to query VirusTotal.
ipv4
172.245.126.141
VT: VT base fetch failed: HTTPError: 429 Client Error: Too Many Requests for url: https://www.virustotal.com/api/v3/ip_addresses/172.245.126.141
IOC database
- Type
- ipv4
- Value
172.245.126.141- First seen
- Last seen
- Attached to this threat
- Appears in
- 2 threats
- Description
- ip:port combination that is used for botnet Command&control (C&C) attributed to Deimos
Threat Hunt — feed corroboration
Not present in any configured threat-intel feed.
Details From VirusTotal
VirusTotal: VT base fetch failed: HTTPError: 429 Client Error: Too Many Requests for url: https://www.virustotal.com/api/v3/ip_addresses/172.245.126.141
References (2)
- reference AlienVaulkt OTX
-
OTX pulse
AlienVaulkt OTX
This pulse contains IOCs related to Deimos Infrastructure. Additions are automatically added based on several sources like: OTX sandboxes samples, internal tools, through the use of Shodan or Censys queries, shared intel from LevelBlue partners or external feeds.
Remediations (8)
-
web:dft.wiki
C2 Frameworks are post-exploitation tools popular among pentesters and threat actors for managing affected hosts from a centralised location. In this post I will walk through the following popular open-source C2 frameworks than I will compare them. Posh C2 Deimos C2 Covenant Mythic Minimum requirements for the C2 server: 1 vCPU 1 GB of RAM 15 ...
-
web:ethicalhacksacademy.com
C2 Tracker is a free, community-driven Indicator of Compromise (IOC) feed designed to track IP addresses associated with known malware, botnets, and Command-and-Control ( C2 ) infrastructure.
-
web:github.com
C2 Tracker C2 Tracker is a free-to-use-community-driven IOC feed that uses Shodan and Censys searches to collect IP addresses of known malware/botnet/ C2 infrastructure.
-
web:howto.thec2matrix.com
Add a new listener and set the host variable. Optionally, you can configure the AgentOptions which includes the URI paths.
-
web:hunt.io
DeimosC2 is an open-source command and control ( C2 ) framework written in Go, designed for managing compromised systems during post-exploitation phases. It operates seamlessly across platforms like Windows, macOS, and Linux, offering versatility for both legitimate security testing and malicious use.
-
web:jeffreyappel.nl
How works C2 detection and remediation in MDE? Microsoft Defender for Endpoint uses inspection of network packets and detects the C2 network patterns (known IP/ detected IP/behavior) Of course; when there is a brand new IP used it is not already detected as a "known C2 " IP, in this place the behavior helps and tries to detect the C2 activity.
-
web:meterpreter.org
C2 Tracker Free to use IOC feed for various tools/malware. It started for just C2 tools but has morphed into tracking infostealers and botnets as well. It uses Shodan searches to collect the IPs. The most recent collection is always stored in data; the IPs are broken down by tool and there is an all.txt.
-
web:www.trendmicro.com
This report provides defenders and security operations center teams with the technical details they need to know should they encounter the DeimosC2 C&C framework.
AI Forensic Analysis
Only Available for Registered Users. Sign in to view.