ThreatFox IOC Database
You are viewing the ThreatFox database entry for url http://d32jqjeqo1vb2n.cloudfront.net:80/jquery-3.3.1.min.js.
Database Entry
This IOC expired
This IOC is an old IOC and hence has expired on 2026-09-11 01:15:01 UTC. We therefore refrain from exporting it into our datasets. As a result, this database entry is purely informational and has no impact.
| IOC ID: | 200685 |
|---|---|
| IOC: | http://d32jqjeqo1vb2n.cloudfront.net:80/jquery-3.3.1.min.js |
| IOC Type : | url |
| Threat Type : | botnet_cc |
| Malware: | Cobalt Strike |
| Malware alias: | Agentemis, BEACON, CobaltStrike, cobeacon |
| Confidence Level : | Confidence level is high (100%) |
| Is compromised? : | False |
| First seen: | 2021-08-27 08:05:04 UTC |
| Last seen: | never |
| UUID: | 7ca92faf-070d-11ec-830d-42010aa4000a |
| Reporter |  NexusFuzzy |
| Reward |
10 credits from lazyactivist192 |
| Tags: | CobaltStrike |
NexusFuzzy
[ Download URL of Beacon ]http://47.242.158.228/
[ Extracted Beacon Config ]
BeaconType: ['HTTP']
Port: 80
SleepTime: 5000
MaxGetSize: 1403644
Jitter: 0
MaxDNS: 255
PublicKey: b'0\x81\x9f0\r\x06\t*\x86H\x86\xf7\r\x01\x01\x01\x05\x00\x03\x81\x8d\x000\x81\x89\x02\x81\x81\x00\x8e\x98\xd8N6gT\xc4\xf9\x15\x7f\xbd\xc3X\xb4E\xfa\x17\xa5\x9a\n\x1a\xa8\xc0\x90&\xbf\x9e\xc9\rr\x10"\x07\x91S\xa7*\xd3\x00\x93\x013\x02xK\xccw\x929\\\xb0\xbf\xae{7~{\x94bB\x13\xed\xdd5$m\x8bF\x965C\xa8P\xcdB\xed\xd1\x99\xd9\r\x9a\x951\xe2\xcb\t\x84\xed\x1fc7\xfa\xf7\xc8,D\xd6g\x99\x13\xe4/\xbd.\x07\x15\x10N:H\xbc\x02!\xb6o\x1dG\\C\xa4\n:QH\xe8xK\x02\x03\x01\x00\x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00'
PublicKey_MD5: 7c3b8af679b2adb881691bb7589356e3
C2Server: d32jqjeqo1vb2n.cloudfront.net,/jquery-3.3.1.min.js
UserAgent: Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko
HttpPostUri: /jquery-3.3.2.min.js
Malleable_C2_Instructions: ['Remove 1522 bytes from the end', 'Remove 84 bytes from the beginning', 'Remove 3931 bytes from the beginning', 'Base64 URL-safe decode', 'XOR mask w/ random key']
HttpGet_Metadata: {'ConstHeaders': ['Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8', 'Referer: http://code.jquery.com/', 'Accept-Encoding: gzip, deflate'], 'ConstParams': [], 'Metadata': ['base64url', 'prepend "__cfduid="', 'header "Cookie"'], 'SessionId': [], 'Output': []}
HttpPost_Metadata: {'ConstHeaders': ['Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8', 'Referer: http://code.jquery.com/', 'Accept-Encoding: gzip, deflate'], 'ConstParams': [], 'Metadata': [], 'SessionId': ['mask', 'base64url', 'parameter "__cfduid"'], 'Output': ['mask', 'base64url', 'print']}
SpawnTo: b'\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00'
PipeName:
DNS_Idle: 74.125.196.113
DNS_Sleep: 0
SSH_Host: Not Found
SSH_Port: Not Found
SSH_Username: Not Found
SSH_Password_Plaintext: Not Found
SSH_Password_Pubkey: Not Found
SSH_Banner:
HttpGet_Verb: GET
HttpPost_Verb: POST
HttpPostChunk: 0
Spawnto_x86: %windir%\syswow64\dllhost.exe
Spawnto_x64: %windir%\sysnative\dllhost.exe
CryptoScheme: 0
Proxy_Config: Not Found
Proxy_User: Not Found
Proxy_Password: Not Found
Proxy_Behavior: Use IE settings
Watermark: 335628295
bStageCleanup: True
bCFGCaution: False
KillDate: 0
bProcInject_StartRWX: False
bProcInject_UseRWX: False
bProcInject_MinAllocSize: 17500
ProcInject_PrependAppend_x86: [b'\x90\x90', 'Empty']
ProcInject_PrependAppend_x64: [b'\x90\x90', 'Empty']
ProcInject_Execute: ['ntdll:RtlUserThreadStart', 'CreateThread', 'NtQueueApcThread-s', 'CreateRemoteThread', 'RtlCreateUserThread']
ProcInject_AllocationMethod: NtMapViewOfSection
ProcInject_Stub: b'\xe1\x05`\xfe\xc2\xe0C.N\x96\xcf\x9d\xd2TR~'
bUsesCookies: True
HostHeader:
smbFrameHeader: Not Found
tcpFrameHeader: Not Found
headersToRemove: Not Found
DNS_Beaconing: Not Found
DNS_get_TypeA: Not Found
DNS_get_TypeAAAA: Not Found
DNS_get_TypeTXT: Not Found
DNS_put_metadata: Not Found
DNS_put_output: Not Found
DNS_resolver: Not Found
DNS_strategy: Not Found
DNS_strategy_rotate_seconds: Not Found
DNS_strategy_fail_x: Not Found
DNS_strategy_fail_seconds: Not Found