topic Re: malware.azjf C2 traffic in Advanced Threat Prevention Discussions

malware.azjf C2 traffic

MichaelWrigh — Thu, 18 Nov 2021 13:13:17 GMT

Hi,

I am seeing a lot of traffic being identified as malware.azjf C2 traffic over the last couple of days since the last threat update. I have noticed a pattern that users are visiting Wordpress websites that use the owl carousel plugin and checking these sites on VT they come up clean so appears to be a false positive.

Is anyone else aware of this going on?

Re: malware.azjf C2 traffic

gkabacs — Thu, 18 Nov 2021 16:05:12 GMT

Hi,

I have came across one from 17 November 2021. Same here, it points to a WordPress site with a carousel plugin.

Here are the IOCs:

IP: 194.72.147.94 on port 443

urls:

brunepark[.]gfmat[.]org
brunepark[.]gfmat[.]org/wp-content/plugins/js_composer/assets/lib/owl-carousel2-dist/owl.carousel.min.js?ver=6.0.5
brunepark[.]gfmat[.]org/wp-content/themes/ed-school/assets/fonts/ed-icon.ttf?nj4a9z

Re: malware.azjf C2 traffic

MarshallC — Thu, 18 Nov 2021 16:21:03 GMT

Same here. I have hits for at least the following sites,(likely more though), however the commonality seems to be the carousel plugin.

As far as I can tell, this is not malicious traffic, rather a false positive match for C2 traffic.

URLs:
- www[.]toshibaaudio[.]com/wp-content/themes/porto/js/libs/owl.carousel.min.js?ver=2.3.4
- www[.]thepartnership[.]org/wp-content/plugins/gyan-elements/assets/js/owl.carousel.min.js?ver=2.3.4
- uvc[.]org/wp-content/themes/startit/assets/js/modules/plugins/owl.carousel.min.js?ver=5.8.2
- www[.]integralpartnersllc[.]com/wp-content/themes/integral-partners/js/owl_slider/owl.carousel.min.js?ver=1637146460

Re: malware.azjf C2 traffic

ymiyashita — Fri, 19 Nov 2021 01:32:58 GMT

Palo Alto Networks confirmed that it was a False Positive. The signature "malware.azjf C2 traffic(446823108)" will be disabled in Anti-Virus version 3905.

Re: malware.azjf C2 traffic

CyberSOC.Support — Fri, 19 Nov 2021 07:57:42 GMT

Hi ! can u let us know, where did you get this? the official quote pelase

Re: malware.azjf C2 traffic

ymiyashita — Fri, 19 Nov 2021 09:26:10 GMT

I'm a Palo Alto Networks employee, so I can check the signature status. (I just updated my profile with a job title.)