Month: November 2022

Malware Analysis – amadey – b26c34994de77a1188bcb110985f7056

November 22, 2022

Score: 10 MALWARE FAMILY: amadeyTAGS:family:amadey, family:djvu, family:redline, family:smokeloader, family:vidar, botnet:517, botnet:kript, botnet:novr, backdoor, collection, discovery, infostealer, persistence, ransomware, spyware, stealer,...

Two Estonian citizens arrested in $575M cryptocurrency fraud scheme

November 22, 2022

Two Estonian citizens were arrested in Tallinn for allegedly running a $575 million cryptocurrency fraud scheme. Two Estonian nationals were...

Emotet is back and delivers payloads like IcedID and Bumblebee

November 22, 2022

The Emotet malware is back and experts warn of a high-volume malspam campaign delivering payloads like IcedID and Bumblebee. Proofpoint...

Daily Vulnerability Trends: Tue Nov 22 2022

November 22, 2022

Daily Vulnerability Trends (sourced from VulnMon) CVE NAMECVE DescriptionCVE-2021-44228Apache Log4j2 2.0-beta9 through 2.15.0 (excluding security releases 2.12.2, 2.12.3, and 2.3.1)...

LockBit 3.0 Ransomware Victim: ryokikogyo[.]co[.]jp

November 22, 2022

LockBit 3.0 Ransomware NOTE: No files or stolen information are by RedPacket Security. Any legal issues relating to the content...

LockBit 3.0 Ransomware Victim: westmount[.]org

November 22, 2022

LockBit 3.0 Ransomware NOTE: No files or stolen information are by RedPacket Security. Any legal issues relating to the content...

Bug Bounty

BugCrowd Bug Bounty Disclosure: – Panel access at https://news-push-88.op-mobile.opera.com/. – By rahul0x01

November 22, 2022

The below information is fully automated and the information is captured from the BugCrowd Disclosure website. The information was correct...

Bug Bounty

BugCrowd Bug Bounty Disclosure: – Impersonation via Broken Link Hijacking on https://sv.hellosign.com – By CoffeeAddict_exe

November 22, 2022

The below information is fully automated and the information is captured from the BugCrowd Disclosure website. The information was correct...

Malware Analysis – evasion – 35697283bc104abe8ed16dff49872499

November 22, 2022

Score: 9 MALWARE FAMILY: evasionTAGS:evasion, persistence, ransomwareMD5: 35697283bc104abe8ed16dff49872499SHA1: 7e56c1f57bbc5a4945e420c91d1d10eaa9018077ANALYSIS DATE: 2022-11-22T05:26:04ZTTPS: T1490, T1018, T1060, T1112, T1012, T1120, T1082, T1107 ScoreMeaningExample10Known...

Malware Analysis – djvu – ef6418c5bd481f4bd21178d59c435c59

November 22, 2022

Score: 10 MALWARE FAMILY: djvuTAGS:family:djvu, family:vidar, botnet:517, discovery, persistence, ransomware, spyware, stealerMD5: ef6418c5bd481f4bd21178d59c435c59SHA1: 764a8ca4dd4376ef3f01f3163bad4ab125b86380ANALYSIS DATE: 2022-11-22T03:45:06ZTTPS: T1012, T1082, T1005, T1081,...

Malware Analysis – ransomware – bb90548c9c0dd6e411c236b55004a392

November 22, 2022

Score: 10 MALWARE FAMILY: ransomwareTAGS:ransomwareMD5: bb90548c9c0dd6e411c236b55004a392SHA1: 1e1db20778c735c26ac2411fa565a1ff43405327ANALYSIS DATE: 2022-11-22T03:11:47ZTTPS: T1082, T1107, T1490 ScoreMeaningExample10Known badA malware family was detected.8-9Likely maliciousOne or...

Malware Analysis – djvu – 078f25c957093eb4ed171180c617abd6

November 22, 2022

Score: 10 MALWARE FAMILY: djvuTAGS:family:djvu, discovery, persistence, ransomwareMD5: 078f25c957093eb4ed171180c617abd6SHA1: 4f527b0890380b4b645d4d19d4e8bb5823725cdeANALYSIS DATE: 2022-11-22T05:53:49ZTTPS: T1082, T1012, T1060, T1112, T1222 ScoreMeaningExample10Known badA malware...

Cobalt Stike Beacon Detected – 2[.]56[.]173[.]252:8091

November 22, 2022

The Information provided at the time of posting was detected as "Cobalt Strike". Depending on when you are viewing this...

Cobalt Stike Beacon Detected – 108[.]61[.]147[.]158:443

November 22, 2022

The Information provided at the time of posting was detected as "Cobalt Strike". Depending on when you are viewing this...

Cobalt Stike Beacon Detected – 8[.]219[.]53[.]166:80

November 22, 2022

The Information provided at the time of posting was detected as "Cobalt Strike". Depending on when you are viewing this...

Cobalt Stike Beacon Detected – 23[.]234[.]200[.]96:2086

November 22, 2022

The Information provided at the time of posting was detected as "Cobalt Strike". Depending on when you are viewing this...

Cobalt Stike Beacon Detected – 47[.]100[.]131[.]229:8084

November 22, 2022

The Information provided at the time of posting was detected as "Cobalt Strike". Depending on when you are viewing this...

Cobalt Stike Beacon Detected – 45[.]139[.]105[.]143:8086

November 22, 2022

The Information provided at the time of posting was detected as "Cobalt Strike". Depending on when you are viewing this...

Cobalt Stike Beacon Detected – 43[.]142[.]149[.]110:80

November 22, 2022

The Information provided at the time of posting was detected as "Cobalt Strike". Depending on when you are viewing this...

Cobalt Stike Beacon Detected – 185[.]130[.]45[.]148:443

November 22, 2022

The Information provided at the time of posting was detected as "Cobalt Strike". Depending on when you are viewing this...

Malware Analysis – amadey – 7ec9b72df5a6f82f7e75aafdddf1bbd0

November 22, 2022

Score: 10 MALWARE FAMILY: amadeyTAGS:family:amadey, family:djvu, family:modiloader, family:smokeloader, family:vidar, botnet:517, backdoor, collection, discovery, persistence, ransomware, spyware, stealer, trojanMD5: 7ec9b72df5a6f82f7e75aafdddf1bbd0SHA1: faeb74ba6cca607299cccd8130585209f1784004ANALYSIS...

Malware Analysis – djvu – f14c38186de4c6eba0b7ff447dbdd249

November 22, 2022

Score: 10 MALWARE FAMILY: djvuTAGS:family:djvu, family:smokeloader, family:vidar, botnet:517, backdoor, collection, discovery, persistence, ransomware, spyware, stealer, trojanMD5: f14c38186de4c6eba0b7ff447dbdd249SHA1: a782fee561f437b3845633d5b8ddbcd7de7500eeANALYSIS DATE: 2022-11-21T21:00:26ZTTPS:...

Malware Analysis – evasion – f5adb1c319ceb270314088b86edb26e5

November 22, 2022

Score: 7 MALWARE FAMILY: evasionTAGS:evasion, ransomwareMD5: f5adb1c319ceb270314088b86edb26e5SHA1: d09463d16a534402f148f71397e1ca5522a7ed28ANALYSIS DATE: 2022-11-21T22:31:20ZTTPS: ScoreMeaningExample10Known badA malware family was detected.8-9Likely maliciousOne or more known...

Cobalt Stike Beacon Detected – 49[.]233[.]103[.]218:443

November 22, 2022

The Information provided at the time of posting was detected as "Cobalt Strike". Depending on when you are viewing this...

Month: November 2022

Malware Analysis – amadey – b26c34994de77a1188bcb110985f7056

Two Estonian citizens arrested in $575M cryptocurrency fraud scheme

Emotet is back and delivers payloads like IcedID and Bumblebee

Daily Vulnerability Trends: Tue Nov 22 2022

LockBit 3.0 Ransomware Victim: ryokikogyo[.]co[.]jp

LockBit 3.0 Ransomware Victim: westmount[.]org

BugCrowd Bug Bounty Disclosure: – Panel access at https://news-push-88.op-mobile.opera.com/. – By rahul0x01

BugCrowd Bug Bounty Disclosure: – Impersonation via Broken Link Hijacking on https://sv.hellosign.com – By CoffeeAddict_exe

Malware Analysis – evasion – 35697283bc104abe8ed16dff49872499

Malware Analysis – djvu – ef6418c5bd481f4bd21178d59c435c59

Malware Analysis – ransomware – bb90548c9c0dd6e411c236b55004a392

Malware Analysis – djvu – 078f25c957093eb4ed171180c617abd6

Cobalt Stike Beacon Detected – 2[.]56[.]173[.]252:8091

Cobalt Stike Beacon Detected – 108[.]61[.]147[.]158:443

Cobalt Stike Beacon Detected – 8[.]219[.]53[.]166:80

Cobalt Stike Beacon Detected – 23[.]234[.]200[.]96:2086

Cobalt Stike Beacon Detected – 47[.]100[.]131[.]229:8084

Cobalt Stike Beacon Detected – 45[.]139[.]105[.]143:8086

Cobalt Stike Beacon Detected – 43[.]142[.]149[.]110:80

Cobalt Stike Beacon Detected – 185[.]130[.]45[.]148:443

Malware Analysis – amadey – 7ec9b72df5a6f82f7e75aafdddf1bbd0

Malware Analysis – djvu – f14c38186de4c6eba0b7ff447dbdd249

Malware Analysis – evasion – f5adb1c319ceb270314088b86edb26e5

Cobalt Stike Beacon Detected – 49[.]233[.]103[.]218:443

[KILLSEC] – Ransomware Victim: Sumitomo

Cobalt Strike Beacon Detected – 47[.]108[.]112[.]243:8443

Cobalt Strike Beacon Detected – 39[.]100[.]108[.]3:80

Cobalt Strike Beacon Detected – 47[.]93[.]43[.]246:443

[QILIN] – Ransomware Victim: DieTech North America

You may have missed