

Rewterz Threat Alert – Multi-stage Fileless Banking Trojan – IoCs
April 8, 2019
Rewterz Threat Advisory – CVE-2019-9489 Trend Micro OfficeScan XG Data Manipulation Vulnerability
April 10, 2019
Rewterz Threat Alert – Multi-stage Fileless Banking Trojan – IoCs
April 8, 2019
Rewterz Threat Advisory – CVE-2019-9489 Trend Micro OfficeScan XG Data Manipulation Vulnerability
April 10, 2019Severity
Medium
Analysis Summary
This is a list of IP addresses associated with scanning and exploit activity. Threat indicators are provided.
Impact
- SSH Scan
- SSH Brute Force Attempt
- Oracle WebLogic Exploitation Attempt
- JBoss Exploitation Attempt
Indicators of Compromise
IP(s) / Hostname(s)
- 36[.]156[.]24[.]94
- 36[.]156[.]24[.]97
- 61[.]184[.]247[.]2
- 61[.]184[.]247[.]3
- 61[.]184[.]247[.]5
- 61[.]184[.]247[.]7
- 61[.]184[.]247[.]11
- 122[.]226[.]181[.]164
- 122[.]226[.]181[.]167
- 125[.]65[.]42[.]187
- 125[.]65[.]42[.]192
- 185[.]234[.]218[.]248
- 218[.]92[.]1[.]132
- 223[.]111[.]139[.]210
- 223[.]111[.]139[.]247
- 36[.]156[.]24[.]96
- 36[.]156[.]24[.]96
- 36[.]156[.]24[.]99
- 61[.]184[.]247[.]6
- 115[.]238[.]245[.]14
- 125[.]65[.]42[.]192
- 179[.]60[.]146[.]9
- 36[.]156[.]24[.]97
- 115[.]238[.]245[.]4
- 115[.]238[.]245[.]8
- 118[.]123[.]15[.]142
- 179[.]60[.]146[.]9
- 222[.]186[.]30[.]71
- 223[.]111[.]139[.]211
- 223[.]111[.]139[.]247
- 36[.]156[.]24[.]94
- 36[.]156[.]24[.]95
- 36[.]156[.]24[.]98
- 36[.]156[.]24[.]99
- 61[.]184[.]247[.]2
- 61[.]184[.]247[.]6
- 61[.]184[.]247[.]10
- 122[.]226[.]181[.]165
- 223[.]111[.]139[.]211
- 61[.]184[.]247[.]3
- 61[.]184[.]247[.]8
- 61[.]184[.]247[.]8
- 61[.]184[.]247[.]11
- 115[.]238[.]245[.]4
- 118[.]123[.]15[.]142
- 122[.]226[.]181[.]164
- 122[.]226[.]181[.]166
- 125[.]65[.]42[.]187
- 192[.]99[.]142[.]251
- 218[.]92[.]1[.]132
- 223[.]111[.]139[.]210
- 61[.]184[.]247[.]4
- 61[.]184[.]247[.]5
- 61[.]184[.]247[.]7
- 116[.]31[.]116[.]5
- 122[.]226[.]181[.]165
- 218[.]92[.]1[.]131
- 222[.]186[.]30[.]71
- 103[.]207[.]36[.]144
- 115[.]238[.]245[.]2
- 115[.]238[.]245[.]2
- 115[.]238[.]245[.]8
- 115[.]238[.]245[.]14
- 122[.]226[.]181[.]166
- 158[.]69[.]133[.]20
- 218[.]92[.]1[.]131
- 223[.]111[.]139[.]244
- 223[.]111[.]139[.]244
- 36[.]156[.]24[.]95
- 36[.]156[.]24[.]98
- 61[.]184[.]247[.]4
- 61[.]184[.]247[.]10
- 61[.]184[.]247[.]12
- 61[.]184[.]247[.]12
- 116[.]31[.]116[.]5
- 122[.]226[.]181[.]167
Remediation
- Consider blocking and alerting on these IP addresses as they have been logged attempting to exploit vulnerabilities or otherwise gain access or information about SLTT network resources.
- Investigate any logged activity from the noted IP addresses for signs of successful exploitation.