ThreatFox IOC Database
You are viewing the ThreatFox database entry for url https://d1yxgunqlbb2ab.cloudfront.net:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books.
Database Entry
This IOC expired
This IOC is an old IOC and hence has expired on 2026-09-11 01:15:01 UTC. We therefore refrain from exporting it into our datasets. As a result, this database entry is purely informational and has no impact.
| IOC ID: | 200552 |
|---|---|
| IOC: | https://d1yxgunqlbb2ab.cloudfront.net:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books |
| IOC Type : | url |
| Threat Type : | botnet_cc |
| Malware: | Cobalt Strike |
| Malware alias: | Agentemis, BEACON, CobaltStrike, cobeacon |
| Confidence Level : | Confidence level is high (100%) |
| Is compromised? : | False |
| ASN: | AS16509 AMAZON-02 |
| Country: |  US |
| First seen: | 2021-08-27 07:29:27 UTC |
| Last seen: | never |
| UUID: | 828038ca-0708-11ec-830d-42010aa4000a |
| Reporter |  NexusFuzzy |
| Reward |
10 credits from lazyactivist192 |
| Tags: | CobaltStrike |
NexusFuzzy
[ Download URL of Beacon ]https://54.174.145.85/
[ Extracted Beacon Config ]
BeaconType: ['HTTPS']
Port: 443
SleepTime: 5000
MaxGetSize: 1048576
Jitter: 0
MaxDNS: 255
PublicKey: b'0\x81\x9f0\r\x06\t*\x86H\x86\xf7\r\x01\x01\x01\x05\x00\x03\x81\x8d\x000\x81\x89\x02\x81\x81\x00\x89\xbe\x11\x15\x9016"\xc0\xe3\xd7\x11.i\xbb\x84 \x8bT\x06\xf5\xe3\xe0+Q\xcf\xf3\x9c\x8f\x0e\xd2 \xdc\xaf\xbb\x08h\xda\x1a\x15\xf0\xf6\xa6/\x1c\xb2v\n\x9e\xfe5\x1a\x02X\xbb\x94\x11\xa9o02S\x18\xef?\xa8u9xL\xe6`M\x96\xd9F\x00!z\x97\x02T=J]\x8d[\xc2=M\x8a\x00\xd7F$\xc4;\xce\x8d\x1fI\xcb\xfb\xc5\xdb\x1e\x0f\xc2\xb1\x9b\x1b\xa7\x12\x99\x90\x84\xc0c\x15\xf4\xbcd\xa0\x0f(\xb7\xfbe\x02\x03\x01\x00\x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00'
PublicKey_MD5: ce885bdd3435544d5745d027ac5b2062
C2Server: d1yxgunqlbb2ab.cloudfront.net,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
UserAgent: Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko
HttpPostUri: /N4215/adj/amzn.us.sr.aps
Malleable_C2_Instructions: []
HttpGet_Metadata: {'ConstHeaders': ['Accept: */*', 'Host: www.amazon.com'], 'ConstParams': [], 'Metadata': ['base64', 'prepend "session-token="', 'prepend "skin=noskin;"', 'append "csm-hit=s-24KU11BB82RZSYGJ3BDK|1419899012996"', 'header "Cookie"'], 'SessionId': [], 'Output': []}
HttpPost_Metadata: {'ConstHeaders': ['Accept: */*', 'Content-Type: text/xml', 'X-Requested-With: XMLHttpRequest', 'Host: www.amazon.com'], 'ConstParams': ['sz=160x600', 'oe=oe=ISO-8859-1;', 's=3717', 'dc_ref=http%3A%2F%2Fwww.amazon.com'], 'Metadata': [], 'SessionId': ['parameter "sn"'], 'Output': ['base64', 'print']}
SpawnTo: b'\xd1\xc5\x13\x94\xac%\x9b\x1b\xc1k\x88\x93\x1f\xbeYP'
PipeName:
DNS_Idle: 0.0.0.0
DNS_Sleep: 0
SSH_Host: Not Found
SSH_Port: Not Found
SSH_Username: Not Found
SSH_Password_Plaintext: Not Found
SSH_Password_Pubkey: Not Found
SSH_Banner:
HttpGet_Verb: GET
HttpPost_Verb: POST
HttpPostChunk: 0
Spawnto_x86: %windir%\syswow64\rundll32.exe
Spawnto_x64: %windir%\sysnative\rundll32.exe
CryptoScheme: 0
Proxy_Config: Not Found
Proxy_User: Not Found
Proxy_Password: Not Found
Proxy_Behavior: Use IE settings
Watermark: 207596070
bStageCleanup: False
bCFGCaution: False
KillDate: 0
bProcInject_StartRWX: True
bProcInject_UseRWX: True
bProcInject_MinAllocSize: 0
ProcInject_PrependAppend_x86: Empty
ProcInject_PrependAppend_x64: Empty
ProcInject_Execute: ['CreateThread', 'SetThreadContext', 'CreateRemoteThread', 'RtlCreateUserThread']
ProcInject_AllocationMethod: VirtualAllocEx
ProcInject_Stub: b'0:\xe5\xba<\x01nI\x86$PX\x80\xfa\xd3\x14'
bUsesCookies: True
HostHeader:
smbFrameHeader: Not Found
tcpFrameHeader: Not Found
headersToRemove: Not Found
DNS_Beaconing: Not Found
DNS_get_TypeA: Not Found
DNS_get_TypeAAAA: Not Found
DNS_get_TypeTXT: Not Found
DNS_put_metadata: Not Found
DNS_put_output: Not Found
DNS_resolver: Not Found
DNS_strategy: Not Found
DNS_strategy_rotate_seconds: Not Found
DNS_strategy_fail_x: Not Found
DNS_strategy_fail_seconds: Not Found