Month: November 2022

Malware Analysis – evasion – 14e5a91d1292a99bb872f4b31acd9646

November 21, 2022

Score: 9 MALWARE FAMILY: evasionTAGS:evasion, persistence, ransomware, upxMD5: 14e5a91d1292a99bb872f4b31acd9646SHA1: d2b91d461ab3e9bd0c70b49860d455f841673eccANALYSIS DATE: 2022-11-21T05:25:42ZTTPS: T1091, T1082, T1158, T1112, T1060, T1491 ScoreMeaningExample10Known badA...

Malware Analysis – djvu – e31c38e9f1ab45320a0053dd649ec8f9

November 21, 2022

Score: 10 MALWARE FAMILY: djvuTAGS:family:djvu, discovery, persistence, ransomwareMD5: e31c38e9f1ab45320a0053dd649ec8f9SHA1: 3047d3bf2654a5fb51a4438bb44dacab296e1d70ANALYSIS DATE: 2022-11-21T05:40:10ZTTPS: T1060, T1112, T1222, T1082, T1012, T1053 ScoreMeaningExample10Known badA...

Malware Analysis – djvu – c1ba21c6be66db5f18e143f95df50241

November 21, 2022

Score: 10 MALWARE FAMILY: djvuTAGS:family:djvu, family:redline, family:smokeloader, family:vidar, botnet:517, botnet:mario23_10, backdoor, collection, discovery, infostealer, persistence, ransomware, spyware, stealer, trojanMD5: c1ba21c6be66db5f18e143f95df50241SHA1:...

Cobalt Stike Beacon Detected – 49[.]232[.]17[.]51:80

November 21, 2022

The Information provided at the time of posting was detected as "Cobalt Strike". Depending on when you are viewing this...

Malware Analysis – dcrat – d609d7888ebd66e4cb502ae75ca86885

November 21, 2022

Score: 10 MALWARE FAMILY: dcratTAGS:family:dcrat, family:djvu, family:redline, family:smokeloader, family:vidar, botnet:517, botnet:mario23_10, backdoor, collection, discovery, infostealer, persistence, ransomware, rat, spyware, stealer,...

Malware Analysis – ransomware – 6ba66ac7b56c6f31417db0c1ca9fe6b1

November 21, 2022

Score: 5 MALWARE FAMILY: ransomwareTAGS:ransomwareMD5: 6ba66ac7b56c6f31417db0c1ca9fe6b1SHA1: 8ccc065e083d78b3a6b8996a687235234c2cd07dANALYSIS DATE: 2022-11-20T20:54:35ZTTPS: ScoreMeaningExample10Known badA malware family was detected.8-9Likely maliciousOne or more known damaging...

Cobalt Stike Beacon Detected – 143[.]198[.]42[.]84:80

November 21, 2022

The Information provided at the time of posting was detected as "Cobalt Strike". Depending on when you are viewing this...

Cobalt Stike Beacon Detected – 192[.]144[.]220[.]86:444

November 21, 2022

The Information provided at the time of posting was detected as "Cobalt Strike". Depending on when you are viewing this...

Cobalt Stike Beacon Detected – 43[.]129[.]214[.]143:443

November 21, 2022

The Information provided at the time of posting was detected as "Cobalt Strike". Depending on when you are viewing this...

Cobalt Stike Beacon Detected – 82[.]156[.]14[.]220:80

November 21, 2022

The Information provided at the time of posting was detected as "Cobalt Strike". Depending on when you are viewing this...

Malware Analysis – djvu – c87b0936f8df9e15a4f1b80ec67b1e7c

November 21, 2022

Score: 10 MALWARE FAMILY: djvuTAGS:family:djvu, family:vidar, botnet:517, discovery, persistence, ransomware, spyware, stealerMD5: c87b0936f8df9e15a4f1b80ec67b1e7cSHA1: b8079093e721cc3bec75aefdea51eb89aca07797ANALYSIS DATE: 2022-11-20T21:52:57ZTTPS: T1222, T1082, T1012, T1005,...

Malware Analysis – djvu – e9ad549423799c0b5c2cafa201b58064

November 21, 2022

Score: 10 MALWARE FAMILY: djvuTAGS:family:djvu, family:vidar, botnet:517, discovery, persistence, ransomware, spyware, stealerMD5: e9ad549423799c0b5c2cafa201b58064SHA1: c52a88d026937faef2066b108a4b4ba3aee1412eANALYSIS DATE: 2022-11-20T21:45:06ZTTPS: T1082, T1005, T1081, T1222,...

Malware Analysis – dcrat – f789ab6aeccc2819d9c8a1c16ee74ac0

November 21, 2022

Malware Analysis – dcrat – d9ed38e3ba39acbfa4ed8d69e233c67e

November 21, 2022

Cobalt Stike Beacon Detected – 42[.]193[.]145[.]27:80

November 21, 2022

The Information provided at the time of posting was detected as "Cobalt Strike". Depending on when you are viewing this...

Cobalt Stike Beacon Detected – 120[.]76[.]205[.]155:8080

November 21, 2022

The Information provided at the time of posting was detected as "Cobalt Strike". Depending on when you are viewing this...

Cobalt Stike Beacon Detected – 42[.]194[.]213[.]51:443

November 21, 2022

The Information provided at the time of posting was detected as "Cobalt Strike". Depending on when you are viewing this...

Cobalt Stike Beacon Detected – 192[.]252[.]182[.]56:80

November 21, 2022

The Information provided at the time of posting was detected as "Cobalt Strike". Depending on when you are viewing this...

Security Affairs newsletter Round 394

November 20, 2022

A new round of the weekly SecurityAffairs newsletter arrived! Every week the best security articles from Security Affairs free for...

PoC exploit code for ProxyNotShell Microsoft Exchange bugs released online

November 20, 2022

Proof-of-concept exploit code for two actively exploited Microsoft Exchange ProxyNotShell flaws released online. Proof-of-concept exploit code has been released online...

Malware Analysis – dcrat – e617ddfbd2fd3407103b9ed8371cdc72

November 20, 2022

Score: 10 MALWARE FAMILY: dcratTAGS:family:dcrat, family:djvu, family:redline, family:smokeloader, botnet:mario23_10, backdoor, collection, discovery, infostealer, persistence, ransomware, rat, spyware, stealer, trojanMD5: e617ddfbd2fd3407103b9ed8371cdc72SHA1:...

HackerOne Bug Bounty Disclosure: no-rate-limiting-for-remove-account-lead-to-huge-mass-mailingsbytanvir_0x

November 20, 2022

Programme HackerOne Weblate Weblate Submitted by tanvir_0x tanvir_0x Report No rate limiting for Remove Account lead to huge Mass mailings...

Malware Analysis – djvu – 13e7b7d335bf434f51253a09b682c881

November 20, 2022

Score: 10 MALWARE FAMILY: djvuTAGS:family:djvu, family:vidar, botnet:517, discovery, persistence, ransomware, spyware, stealerMD5: 13e7b7d335bf434f51253a09b682c881SHA1: b372ae40a0102bc385823b18abc80ecaf83db4dbANALYSIS DATE: 2022-11-20T15:06:54ZTTPS: T1005, T1081, T1082, T1053,...

Malware Analysis – djvu – a12cdf363ffc22dda705083793aad3dc

November 20, 2022

Score: 10 MALWARE FAMILY: djvuTAGS:family:djvu, family:vidar, botnet:517, discovery, persistence, ransomware, spyware, stealerMD5: a12cdf363ffc22dda705083793aad3dcSHA1: 77004309fadecdbfc95e0815eb18b01697d692c2ANALYSIS DATE: 2022-11-20T16:57:45ZTTPS: T1082, T1005, T1081, T1012,...

Month: November 2022

Malware Analysis – evasion – 14e5a91d1292a99bb872f4b31acd9646

Malware Analysis – djvu – e31c38e9f1ab45320a0053dd649ec8f9

Malware Analysis – djvu – c1ba21c6be66db5f18e143f95df50241

Cobalt Stike Beacon Detected – 49[.]232[.]17[.]51:80

Malware Analysis – dcrat – d609d7888ebd66e4cb502ae75ca86885

Malware Analysis – ransomware – 6ba66ac7b56c6f31417db0c1ca9fe6b1

Cobalt Stike Beacon Detected – 143[.]198[.]42[.]84:80

Cobalt Stike Beacon Detected – 192[.]144[.]220[.]86:444

Cobalt Stike Beacon Detected – 43[.]129[.]214[.]143:443

Cobalt Stike Beacon Detected – 82[.]156[.]14[.]220:80

Malware Analysis – djvu – c87b0936f8df9e15a4f1b80ec67b1e7c

Malware Analysis – djvu – e9ad549423799c0b5c2cafa201b58064

Malware Analysis – dcrat – f789ab6aeccc2819d9c8a1c16ee74ac0

Malware Analysis – dcrat – d9ed38e3ba39acbfa4ed8d69e233c67e

Cobalt Stike Beacon Detected – 42[.]193[.]145[.]27:80

Cobalt Stike Beacon Detected – 120[.]76[.]205[.]155:8080

Cobalt Stike Beacon Detected – 42[.]194[.]213[.]51:443

Cobalt Stike Beacon Detected – 192[.]252[.]182[.]56:80

Security Affairs newsletter Round 394

PoC exploit code for ProxyNotShell Microsoft Exchange bugs released online

Malware Analysis – dcrat – e617ddfbd2fd3407103b9ed8371cdc72

HackerOne Bug Bounty Disclosure: no-rate-limiting-for-remove-account-lead-to-huge-mass-mailingsbytanvir_0x

Malware Analysis – djvu – 13e7b7d335bf434f51253a09b682c881

Malware Analysis – djvu – a12cdf363ffc22dda705083793aad3dc

[BLACKSUIT] – Ransomware Victim: SVP Worldwide

[QILIN] – Ransomware Victim: Imprimerie Peau

[KILLSEC] – Ransomware Victim: Sumitomo

Cobalt Strike Beacon Detected – 47[.]108[.]112[.]243:8443

Cobalt Strike Beacon Detected – 39[.]100[.]108[.]3:80

You may have missed