Updated 2024-02-21-IOCs-from-SocGholish-AsyncRAT-infection.txt

PaloAltoNetworks · Feb 21, 2024 · 367e4b0 · 367e4b0
1 parent 3eb0c71
commit 367e4b0
Showing 1 changed file with 6 additions and 1 deletion.
diff --git a/2024-02-21-IOCs-from-SocGholish-AsyncRAT-infection.txt b/2024-02-21-IOCs-from-SocGholish-AsyncRAT-infection.txt
@@ -1,5 +1,10 @@
 2024-02-21 (WEDNESDAY): PARROT TDS --> SOCGHOLISH --> ASYNC RAT
 
+REFERENCES:
+
+- https://www.linkedin.com/posts/unit42_parrottds-socgholish-asyncrat-activity-7166192124441415681-rnLv
+- https://twitter.com/Unit42_Intel/status/1760426508558950518
+
 INFECTION CHAIN:
 
 - legitimate but compromised site --> ParrotTDS script --> SocGholish URL --> 
@@ -65,4 +70,4 @@ CONNECTIVITY AND LOCATION CHECKS BY ASYNC RAT-INFECTED HOST (NOT MALICIOUS):
 - port 80 - ipinfo[.]io - GET /[public IP address of infected host]/city
 - port 80 - ipinfo[.]io - GET /[public IP address of infected host]/region
 - port 80 - ipinfo[.]io - GET /[public IP address of infected host]/country
-- port 80 - www.google[.]com - GET /robots.txt
+- port 80 - www.google[.]com - GET /robots.txt