Month: October 2022

Malware Analysis – evasion – ac7a356c77073104d0971b6945815bae

October 22, 2022

Score: 7 MALWARE FAMILY: evasionTAGS:evasion, ransomwareMD5: ac7a356c77073104d0971b6945815baeSHA1: 64c9290a69f2b7e9b74eeb53642659def971d9d3ANALYSIS DATE: 2022-10-22T16:05:04ZTTPS: ScoreMeaningExample10Known badA malware family was detected.8-9Likely maliciousOne or more known...

Malware Analysis – – e3a8a1f4f9bf5c7cc0e7da7e575cb842

October 22, 2022

Score: 1 MALWARE FAMILY: TAGS:MD5: e3a8a1f4f9bf5c7cc0e7da7e575cb842SHA1: 2edfd6857178311b4858405613039f116cd59072ANALYSIS DATE: 2022-10-22T15:55:44ZTTPS: ScoreMeaningExample10Known badA malware family was detected.8-9Likely maliciousOne or more known damaging...

Malware Analysis – dcrat – 022bc47a7232fed736eb97c1399d0d71

October 22, 2022

Score: 10 MALWARE FAMILY: dcratTAGS:family:dcrat, family:djvu, family:redline, family:smokeloader, family:vidar, botnet:517, botnet:google2, botnet:nam7, botnet:slovarikinstalls, backdoor, collection, discovery, infostealer, persistence, ransomware, rat,...

Malware Analysis – djvu – 90a0d198ea42fd35ddc35f8622febb15

October 22, 2022

Score: 10 MALWARE FAMILY: djvuTAGS:family:djvu, family:vidar, botnet:517, discovery, persistence, ransomware, spyware, stealerMD5: 90a0d198ea42fd35ddc35f8622febb15SHA1: 935c10f36cb85dee7607ab5e3fb8306609544c91ANALYSIS DATE: 2022-10-22T16:21:57ZTTPS: T1222, T1053, T1012, T1060,...

Malware Analysis – djvu – 80128ee42236ecc94d0a477e9a26f6b0

October 22, 2022

Score: 10 MALWARE FAMILY: djvuTAGS:family:djvu, family:vidar, botnet:517, discovery, persistence, ransomware, spyware, stealerMD5: 80128ee42236ecc94d0a477e9a26f6b0SHA1: 31cc39fd0dc6b973c2129fd882330dcf1ef010f6ANALYSIS DATE: 2022-10-22T16:27:11ZTTPS: T1053, T1005, T1081, T1012,...

Malware Analysis – djvu – b492f211c6e0e7dd13d9019219223510

October 22, 2022

Score: 10 MALWARE FAMILY: djvuTAGS:family:djvu, family:redline, family:smokeloader, family:vidar, botnet:517, botnet:google2, botnet:nam7, botnet:slovarikinstalls, backdoor, collection, discovery, infostealer, persistence, ransomware, spyware, stealer,...

Threat actors exploit critical flaw in VMware Workspace ONE Access to drop ransomware, miners

October 22, 2022

Threat actors are exploiting a now-patched vulnerability, tracked as CVE-2022-22954, in VMware Workspace ONE Access in attacks in the wild....

Usbsas – Tool And Framework For Securely Reading Untrusted USB Mass Storage Devices

October 22, 2022

usbsas is a free and open source (GPLv3) tool and framework for securely reading untrusted USB mass storage devices. Description...

Malware Analysis – – 5199b690874c0baa375855e37789569e

October 22, 2022

Score: 1 MALWARE FAMILY: TAGS:MD5: 5199b690874c0baa375855e37789569eSHA1: ce65f46da270330e66da4fa879932f091f01fcc9ANALYSIS DATE: 2022-10-22T07:59:33ZTTPS: ScoreMeaningExample10Known badA malware family was detected.8-9Likely maliciousOne or more known damaging...

Cobalt Stike Beacon Detected – 206[.]2[.]200[.]132:443

October 22, 2022

The Information provided at the time of posting was detected as "Cobalt Strike". Depending on when you are viewing this...

Malware Analysis – play – 5dcfb98d5adf722424420d02377cee54

October 22, 2022

Score: 10 MALWARE FAMILY: playTAGS:family:play, ransomwareMD5: 5dcfb98d5adf722424420d02377cee54SHA1: d999c810fa88dcedebd45e0a83d08ec6cd49e871ANALYSIS DATE: 2022-10-22T08:06:05ZTTPS: T1012, T1120, T1082 ScoreMeaningExample10Known badA malware family was detected.8-9Likely maliciousOne...

Malware Analysis – djvu – 49b36093a491b1b625066d3f2bcb9964

October 22, 2022

Score: 10 MALWARE FAMILY: djvuTAGS:family:djvu, family:vidar, botnet:517, discovery, persistence, ransomware, spyware, stealerMD5: 49b36093a491b1b625066d3f2bcb9964SHA1: fafe05e1978dedac0d3f781101acde8bf33ea1dfANALYSIS DATE: 2022-10-22T08:20:36ZTTPS: T1082, T1053, T1005, T1081,...

Malware Analysis – djvu – d4ce2b268bde19084d1b359d3a4829b3

October 22, 2022

Score: 10 MALWARE FAMILY: djvuTAGS:family:djvu, family:vidar, botnet:517, discovery, persistence, ransomware, spyware, stealerMD5: d4ce2b268bde19084d1b359d3a4829b3SHA1: 2a4db50d36a2832f5da23ec258b8eec7cbda626aANALYSIS DATE: 2022-10-22T08:06:58ZTTPS: T1060, T1112, T1082, T1005,...

Malware Analysis – danabot – 7fbe91ac75b84e34eef686ccf1322f25

October 22, 2022

Score: 10 MALWARE FAMILY: danabotTAGS:family:danabot, family:djvu, family:smokeloader, family:vidar, botnet:517, backdoor, banker, collection, discovery, persistence, ransomware, spyware, stealer, trojanMD5: 7fbe91ac75b84e34eef686ccf1322f25SHA1: d57422b77bee807b3e5df377abb7fcb187bfa5bcANALYSIS...

Cobalt Stike Beacon Detected – 1[.]13[.]176[.]232:80

October 22, 2022

The Information provided at the time of posting was detected as "Cobalt Strike". Depending on when you are viewing this...

Cobalt Stike Beacon Detected – 47[.]100[.]47[.]35:80

October 22, 2022

The Information provided at the time of posting was detected as "Cobalt Strike". Depending on when you are viewing this...

Cobalt Stike Beacon Detected – 106[.]13[.]54[.]144:8010

October 22, 2022

The Information provided at the time of posting was detected as "Cobalt Strike". Depending on when you are viewing this...

Cobalt Stike Beacon Detected – 47[.]243[.]236[.]221:4443

October 22, 2022

The Information provided at the time of posting was detected as "Cobalt Strike". Depending on when you are viewing this...

Malware Analysis – danabot – 794f5c531271e70c1af3a23fa6e74509

October 22, 2022

Score: 10 MALWARE FAMILY: danabotTAGS:family:danabot, family:djvu, family:smokeloader, family:vidar, botnet:517, backdoor, banker, collection, discovery, persistence, ransomware, spyware, stealer, trojanMD5: 794f5c531271e70c1af3a23fa6e74509SHA1: d70c740b27c0dc476986fdf0d9ae6ecda5a71ed1ANALYSIS...

Malware Analysis – djvu – b0a1a617d49859b95228bc5f4edbc783

October 22, 2022

Score: 10 MALWARE FAMILY: djvuTAGS:family:djvu, family:vidar, botnet:517, discovery, persistence, ransomware, spyware, stealerMD5: b0a1a617d49859b95228bc5f4edbc783SHA1: 4147ac09ca79aaa488e3816a57bea7ef6d0e446fANALYSIS DATE: 2022-10-22T08:28:10ZTTPS: T1053, T1005, T1081, T1012,...

Malware Analysis – djvu – f7358f89f421c996767e193d4457cd33

October 22, 2022

Score: 10 MALWARE FAMILY: djvuTAGS:family:djvu, family:vidar, botnet:517, discovery, persistence, ransomware, spyware, stealerMD5: f7358f89f421c996767e193d4457cd33SHA1: 49d1e745872ee4f14ee54c5036a077c1b6beaef3ANALYSIS DATE: 2022-10-22T09:00:54ZTTPS: T1012, T1060, T1112, T1222,...

Malware Analysis – djvu – e537a3ab6b4e48a6d9121aa780761c01

October 22, 2022

Score: 10 MALWARE FAMILY: djvuTAGS:family:djvu, family:vidar, botnet:517, discovery, persistence, ransomware, spyware, stealerMD5: e537a3ab6b4e48a6d9121aa780761c01SHA1: 2e0a71d24fcfcd151c11b1f50539669c2d6a266fANALYSIS DATE: 2022-10-22T08:44:50ZTTPS: T1012, T1082, T1060, T1112,...

Cobalt Stike Beacon Detected – 193[.]233[.]202[.]121:80

October 22, 2022

The Information provided at the time of posting was detected as "Cobalt Strike". Depending on when you are viewing this...

Cobalt Stike Beacon Detected – 124[.]156[.]87[.]117:443

October 22, 2022

The Information provided at the time of posting was detected as "Cobalt Strike". Depending on when you are viewing this...

Month: October 2022

Malware Analysis – evasion – ac7a356c77073104d0971b6945815bae

Malware Analysis – – e3a8a1f4f9bf5c7cc0e7da7e575cb842

Malware Analysis – dcrat – 022bc47a7232fed736eb97c1399d0d71

Malware Analysis – djvu – 90a0d198ea42fd35ddc35f8622febb15

Malware Analysis – djvu – 80128ee42236ecc94d0a477e9a26f6b0

Malware Analysis – djvu – b492f211c6e0e7dd13d9019219223510

Threat actors exploit critical flaw in VMware Workspace ONE Access to drop ransomware, miners

Usbsas – Tool And Framework For Securely Reading Untrusted USB Mass Storage Devices

Malware Analysis – – 5199b690874c0baa375855e37789569e

Cobalt Stike Beacon Detected – 206[.]2[.]200[.]132:443

Malware Analysis – play – 5dcfb98d5adf722424420d02377cee54

Malware Analysis – djvu – 49b36093a491b1b625066d3f2bcb9964

Malware Analysis – djvu – d4ce2b268bde19084d1b359d3a4829b3

Malware Analysis – danabot – 7fbe91ac75b84e34eef686ccf1322f25

Cobalt Stike Beacon Detected – 1[.]13[.]176[.]232:80

Cobalt Stike Beacon Detected – 47[.]100[.]47[.]35:80

Cobalt Stike Beacon Detected – 106[.]13[.]54[.]144:8010

Cobalt Stike Beacon Detected – 47[.]243[.]236[.]221:4443

Malware Analysis – danabot – 794f5c531271e70c1af3a23fa6e74509

Malware Analysis – djvu – b0a1a617d49859b95228bc5f4edbc783

Malware Analysis – djvu – f7358f89f421c996767e193d4457cd33

Malware Analysis – djvu – e537a3ab6b4e48a6d9121aa780761c01

Cobalt Stike Beacon Detected – 193[.]233[.]202[.]121:80

Cobalt Stike Beacon Detected – 124[.]156[.]87[.]117:443

CISA: Fortinet Updates Guidance and Indicators of Compromise following FortiManager Vulnerability Exploitation

CISA: CISA Releases Four Industrial Control Systems Advisories

CISA: JCDC’s Industry-Government Collaboration Speeds Mitigation of CrowdStrike IT Outage

CISA: CISA Releases Three Industrial Control Systems Advisories

CISA: Foreign Threat Actor Conducting Large-Scale Spearphishing Campaign with RDP Attachments

You may have missed