Month: October 2022

Malware Analysis – ransomware – d9709124efbd1d95435e4ca9e854d37d

October 24, 2022

Score: 9 MALWARE FAMILY: ransomwareTAGS:ransomware, spyware, stealerMD5: d9709124efbd1d95435e4ca9e854d37dSHA1: f43d1cdc57d38b92185ef3157bf174976edf07e1ANALYSIS DATE: 2022-10-24T04:20:16ZTTPS: T1082, T1107, T1490, T1091, T1005, T1081 ScoreMeaningExample10Known badA malware...

Malware Analysis – djvu – 53996bb886f888999df63dcebe90a3a1

October 24, 2022

Score: 10 MALWARE FAMILY: djvuTAGS:family:djvu, family:vidar, botnet:517, discovery, persistence, ransomware, spyware, stealerMD5: 53996bb886f888999df63dcebe90a3a1SHA1: 102361721dc1fae543ce13df826b8b123a39048fANALYSIS DATE: 2022-10-24T04:34:00ZTTPS: T1005, T1081, T1053, T1222,...

Malware Analysis – evasion – 7624ff12dbea26dbd75f638093f3f2db

October 24, 2022

Score: 8 MALWARE FAMILY: evasionTAGS:evasion, ransomwareMD5: 7624ff12dbea26dbd75f638093f3f2dbSHA1: 345adc3c451ba2a65179557113dbd4107208069bANALYSIS DATE: 2022-10-24T04:32:05ZTTPS: ScoreMeaningExample10Known badA malware family was detected.8-9Likely maliciousOne or more known...

Malware Analysis – djvu – 6550a62e79b1783a785f37bc0dc87007

October 24, 2022

Score: 10 MALWARE FAMILY: djvuTAGS:family:djvu, family:vidar, botnet:517, discovery, persistence, ransomware, spyware, stealerMD5: 6550a62e79b1783a785f37bc0dc87007SHA1: 6cd443018cfb7203da41bbc7c2cf35d0f928bfecANALYSIS DATE: 2022-10-24T04:33:26ZTTPS: T1082, T1012, T1053, T1005,...

Malware Analysis – ransomware – a3e5ea6ffe5935f03762ec7ebb6d5587

October 24, 2022

Score: 9 MALWARE FAMILY: ransomwareTAGS:ransomware, spyware, stealerMD5: a3e5ea6ffe5935f03762ec7ebb6d5587SHA1: 8f0cf626239e07362909901e67e99dfdff0d57d8ANALYSIS DATE: 2022-10-24T04:40:16ZTTPS: T1107, T1490, T1091, T1005, T1081, T1082 ScoreMeaningExample10Known badA malware...

Shomon – Shodan Monitoring Integration For TheHive

October 24, 2022

ShoMon is a Shodan alert feeder for TheHive written in GoLang. With version 2.0, it is more powerful than ever!...

Malware Analysis – djvu – ab6ec2d920861f0b7a3eacab49e8d488

October 24, 2022

Score: 10 MALWARE FAMILY: djvuTAGS:family:djvu, family:vidar, botnet:517, discovery, persistence, ransomware, spyware, stealerMD5: ab6ec2d920861f0b7a3eacab49e8d488SHA1: 3d7ce274a06bbfa09b376fe2d0912d1ae6b45e46ANALYSIS DATE: 2022-10-23T20:04:18ZTTPS: T1222, T1005, T1081, T1060,...

Malware Analysis – smokeloader – 138f6d817b90090fdb77cbec3dd51baa

October 24, 2022

Score: 10 MALWARE FAMILY: smokeloaderTAGS:family:smokeloader, backdoor, trojanMD5: 138f6d817b90090fdb77cbec3dd51baaSHA1: 9dddc78e11f062ead2a8ff272fd24317ce423d64ANALYSIS DATE: 2022-10-23T20:19:04ZTTPS: T1012, T1120, T1082 ScoreMeaningExample10Known badA malware family was detected.8-9Likely...

Cobalt Stike Beacon Detected – 34[.]80[.]244[.]46:8443

October 24, 2022

The Information provided at the time of posting was detected as "Cobalt Strike". Depending on when you are viewing this...

Cobalt Stike Beacon Detected – 123[.]57[.]194[.]64:80

October 24, 2022

The Information provided at the time of posting was detected as "Cobalt Strike". Depending on when you are viewing this...

Cobalt Stike Beacon Detected – 198[.]13[.]46[.]131:443

October 24, 2022

The Information provided at the time of posting was detected as "Cobalt Strike". Depending on when you are viewing this...

Malware Analysis – – cbb8de336e13d106119ac3bfa0dd508b

October 24, 2022

Score: 1 MALWARE FAMILY: TAGS:MD5: cbb8de336e13d106119ac3bfa0dd508bSHA1: 50366fcb11c12d0a461077fe2542d62dec87c406ANALYSIS DATE: 2022-10-23T20:15:59ZTTPS: ScoreMeaningExample10Known badA malware family was detected.8-9Likely maliciousOne or more known damaging...

Malware Analysis – evasion – 52cb3a715670c49337c27624ef136365

October 24, 2022

Score: 8 MALWARE FAMILY: evasionTAGS:evasion, ransomwareMD5: 52cb3a715670c49337c27624ef136365SHA1: 4bbdff72041661d55eb57331021da3eefc0305abANALYSIS DATE: 2022-10-23T20:18:03ZTTPS: ScoreMeaningExample10Known badA malware family was detected.8-9Likely maliciousOne or more known...

Malware Analysis – djvu – cce89d5985c0aabb9afc90ffaf5b16ea

October 24, 2022

Score: 10 MALWARE FAMILY: djvuTAGS:family:djvu, family:vidar, botnet:517, discovery, persistence, ransomware, spyware, stealerMD5: cce89d5985c0aabb9afc90ffaf5b16eaSHA1: 5b030a5006d691e060d04d31ae8439aa29f27406ANALYSIS DATE: 2022-10-23T20:11:05ZTTPS: T1082, T1005, T1081, T1012,...

Cobalt Stike Beacon Detected – 101[.]42[.]178[.]86:443

October 24, 2022

The Information provided at the time of posting was detected as "Cobalt Strike". Depending on when you are viewing this...

Cobalt Stike Beacon Detected – 43[.]139[.]78[.]242:80

October 24, 2022

The Information provided at the time of posting was detected as "Cobalt Strike". Depending on when you are viewing this...

Cobalt Stike Beacon Detected – 46[.]21[.]107[.]60:443

October 24, 2022

The Information provided at the time of posting was detected as "Cobalt Strike". Depending on when you are viewing this...

Malware Analysis – persistence – f676aba2d996eed2c194e9f5944446fa

October 24, 2022

Score: 9 MALWARE FAMILY: persistenceTAGS:persistence, ransomwareMD5: f676aba2d996eed2c194e9f5944446faSHA1: 9cbf67ee5a45c47bcadbd0d67642e690d9da9d92ANALYSIS DATE: 2022-10-23T20:19:05ZTTPS: T1060, T1112, T1107, T1490, T1012, T1120, T1082 ScoreMeaningExample10Known badA malware...

Cobalt Stike Beacon Detected – 81[.]19[.]140[.]9:443

October 24, 2022

The Information provided at the time of posting was detected as "Cobalt Strike". Depending on when you are viewing this...

Malware Analysis – danabot – b55340d42a86faf6ce8f664527e22f13

October 24, 2022

Score: 10 MALWARE FAMILY: danabotTAGS:family:danabot, family:djvu, family:smokeloader, family:vidar, botnet:517, backdoor, banker, collection, discovery, persistence, ransomware, spyware, stealer, trojanMD5: b55340d42a86faf6ce8f664527e22f13SHA1: 7f5875b0b38f6fd754d906d22c021834e70ed3e8ANALYSIS...

Malware Analysis – evasion – 729cd1068f8a097c2645f2dee30a62b9

October 24, 2022

Score: 8 MALWARE FAMILY: evasionTAGS:evasion, ransomwareMD5: 729cd1068f8a097c2645f2dee30a62b9SHA1: fa5314f171cf73d8a27124faffcc0dd6f7866046ANALYSIS DATE: 2022-10-23T20:20:04ZTTPS: ScoreMeaningExample10Known badA malware family was detected.8-9Likely maliciousOne or more known...

Malware Analysis – ransomware – 0f1a802a12fd40dbd5918c6e6edbbfe6

October 24, 2022

Score: 10 MALWARE FAMILY: ransomwareTAGS:ransomwareMD5: 0f1a802a12fd40dbd5918c6e6edbbfe6SHA1: a4ae06064164336421e71201365f1567ff015c75ANALYSIS DATE: 2022-10-23T21:05:39ZTTPS: T1082, T1491, T1112 ScoreMeaningExample10Known badA malware family was detected.8-9Likely maliciousOne or...

Malware Analysis – djvu – 11f5215a4122653acb8b87ef5926ebf2

October 24, 2022

Score: 10 MALWARE FAMILY: djvuTAGS:family:djvu, family:vidar, botnet:517, discovery, persistence, ransomware, spyware, stealerMD5: 11f5215a4122653acb8b87ef5926ebf2SHA1: d17bbc7a11d3eec7bf60d8d1cc058b831970ab41ANALYSIS DATE: 2022-10-23T21:18:15ZTTPS: T1222, T1060, T1112, T1082,...

Cobalt Stike Beacon Detected – 91[.]213[.]50[.]75:8010

October 24, 2022

The Information provided at the time of posting was detected as "Cobalt Strike". Depending on when you are viewing this...

Month: October 2022

Malware Analysis – ransomware – d9709124efbd1d95435e4ca9e854d37d

Malware Analysis – djvu – 53996bb886f888999df63dcebe90a3a1

Malware Analysis – evasion – 7624ff12dbea26dbd75f638093f3f2db

Malware Analysis – djvu – 6550a62e79b1783a785f37bc0dc87007

Malware Analysis – ransomware – a3e5ea6ffe5935f03762ec7ebb6d5587

Shomon – Shodan Monitoring Integration For TheHive

Malware Analysis – djvu – ab6ec2d920861f0b7a3eacab49e8d488

Malware Analysis – smokeloader – 138f6d817b90090fdb77cbec3dd51baa

Cobalt Stike Beacon Detected – 34[.]80[.]244[.]46:8443

Cobalt Stike Beacon Detected – 123[.]57[.]194[.]64:80

Cobalt Stike Beacon Detected – 198[.]13[.]46[.]131:443

Malware Analysis – – cbb8de336e13d106119ac3bfa0dd508b

Malware Analysis – evasion – 52cb3a715670c49337c27624ef136365

Malware Analysis – djvu – cce89d5985c0aabb9afc90ffaf5b16ea

Cobalt Stike Beacon Detected – 101[.]42[.]178[.]86:443

Cobalt Stike Beacon Detected – 43[.]139[.]78[.]242:80

Cobalt Stike Beacon Detected – 46[.]21[.]107[.]60:443

Malware Analysis – persistence – f676aba2d996eed2c194e9f5944446fa

Cobalt Stike Beacon Detected – 81[.]19[.]140[.]9:443

Malware Analysis – danabot – b55340d42a86faf6ce8f664527e22f13

Malware Analysis – evasion – 729cd1068f8a097c2645f2dee30a62b9

Malware Analysis – ransomware – 0f1a802a12fd40dbd5918c6e6edbbfe6

Malware Analysis – djvu – 11f5215a4122653acb8b87ef5926ebf2

Cobalt Stike Beacon Detected – 91[.]213[.]50[.]75:8010

[INCRANSOM] – Ransomware Victim: Alna-Bioscience

Cobalt Strike Beacon Detected – 52[.]231[.]10[.]139:8080

Cobalt Strike Beacon Detected – 54[.]224[.]145[.]120:443

Cobalt Strike Beacon Detected – 118[.]193[.]37[.]157:8889

Cobalt Strike Beacon Detected – 103[.]225[.]196[.]197:80

You may have missed