Year: 2022

Malware Analysis – djvu – 93e80cf200afb6eb3aef34afa206af0b

October 14, 2022

Score: 10 MALWARE FAMILY: djvuTAGS:family:djvu, family:vidar, botnet:517, discovery, persistence, ransomware, spyware, stealerMD5: 93e80cf200afb6eb3aef34afa206af0bSHA1: fc15242b02094520aa7698927242f38b92d35035ANALYSIS DATE: 2022-10-14T08:56:53ZTTPS: T1012, T1082, T1053, T1005,...

Cobalt Stike Beacon Detected – 31[.]7[.]62[.]194:80

October 14, 2022

The Information provided at the time of posting was detected as "Cobalt Strike". Depending on when you are viewing this...

Cobalt Stike Beacon Detected – 41[.]216[.]183[.]24:443

October 14, 2022

The Information provided at the time of posting was detected as "Cobalt Strike". Depending on when you are viewing this...

Cobalt Stike Beacon Detected – 121[.]5[.]102[.]72:801

October 14, 2022

The Information provided at the time of posting was detected as "Cobalt Strike". Depending on when you are viewing this...

Cobalt Stike Beacon Detected – 185[.]236[.]202[.]202:80

October 14, 2022

The Information provided at the time of posting was detected as "Cobalt Strike". Depending on when you are viewing this...

Malware Analysis – djvu – 4fc50e305f9719c90d875264755aa9f1

October 14, 2022

Score: 10 MALWARE FAMILY: djvuTAGS:family:djvu, family:vidar, botnet:517, discovery, persistence, ransomware, stealerMD5: 4fc50e305f9719c90d875264755aa9f1SHA1: 7017615409a08f6384fd00d6e26ada2a8b671767ANALYSIS DATE: 2022-10-14T09:52:18ZTTPS: T1130, T1112, T1222, T1082, T1012,...

Malware Analysis – ransomware – c39d02e577302bf8caa4e4d483300f60

October 14, 2022

Score: 9 MALWARE FAMILY: ransomwareTAGS:ransomware, spyware, stealerMD5: c39d02e577302bf8caa4e4d483300f60SHA1: 5260376d86035057f7df26df8c73c7927ada50a5ANALYSIS DATE: 2022-10-14T09:40:08ZTTPS: T1005, T1081, T1082, T1107, T1490, T1091 ScoreMeaningExample10Known badA malware...

Malware Analysis – ransomware – 9ab4626608328e493a9aa75cb82b0c3f

October 14, 2022

Score: 9 MALWARE FAMILY: ransomwareTAGS:ransomwareMD5: 9ab4626608328e493a9aa75cb82b0c3fSHA1: a22a3325f78a61226f78419dba5264fd701d7903ANALYSIS DATE: 2022-10-14T09:40:17ZTTPS: T1091, T1082, T1107, T1490 ScoreMeaningExample10Known badA malware family was detected.8-9Likely maliciousOne...

Malware Analysis – ransomware – 316d49bb419c374794ac38cb426576b9

October 14, 2022

Score: 9 MALWARE FAMILY: ransomwareTAGS:ransomwareMD5: 316d49bb419c374794ac38cb426576b9SHA1: 4003353dedc40548b27b703cc9e010de43a064dcANALYSIS DATE: 2022-10-14T09:40:26ZTTPS: T1107, T1490, T1091, T1082 ScoreMeaningExample10Known badA malware family was detected.8-9Likely maliciousOne...

Cobalt Stike Beacon Detected – 157[.]245[.]254[.]149:443

October 14, 2022

The Information provided at the time of posting was detected as "Cobalt Strike". Depending on when you are viewing this...

Cobalt Stike Beacon Detected – 5[.]44[.]42[.]16:80

October 14, 2022

The Information provided at the time of posting was detected as "Cobalt Strike". Depending on when you are viewing this...

Cobalt Stike Beacon Detected – 154[.]221[.]25[.]206:443

October 14, 2022

The Information provided at the time of posting was detected as "Cobalt Strike". Depending on when you are viewing this...

Cobalt Stike Beacon Detected – 174[.]139[.]150[.]250:4443

October 14, 2022

The Information provided at the time of posting was detected as "Cobalt Strike". Depending on when you are viewing this...

Malware Analysis – ransomware – 45ac7cd59d7f250217c69d5ec042632d

October 14, 2022

Score: 9 MALWARE FAMILY: ransomwareTAGS:ransomwareMD5: 45ac7cd59d7f250217c69d5ec042632dSHA1: cf41622eea189b592cc3f31d9eadceba56144310ANALYSIS DATE: 2022-10-14T10:34:50ZTTPS: T1107, T1490 ScoreMeaningExample10Known badA malware family was detected.8-9Likely maliciousOne or more...

Malware Analysis – djvu – 381c69c453ddd6ecebb0535db66d069a

October 14, 2022

Score: 10 MALWARE FAMILY: djvuTAGS:family:djvu, family:vidar, botnet:517, discovery, persistence, ransomware, spyware, stealerMD5: 381c69c453ddd6ecebb0535db66d069aSHA1: f023209a0bc9a96fe9cb9d17a5012ddc2ee28462ANALYSIS DATE: 2022-10-14T10:37:50ZTTPS: T1005, T1081, T1012, T1082,...

Malware Analysis – djvu – a1f3f1f4e250c96cbbee38b5d6babd7e

October 14, 2022

Score: 10 MALWARE FAMILY: djvuTAGS:family:djvu, family:vidar, botnet:517, discovery, persistence, ransomware, spyware, stealerMD5: a1f3f1f4e250c96cbbee38b5d6babd7eSHA1: 34f96b5e8d04ea15f2079d51383986a1cbc91123ANALYSIS DATE: 2022-10-14T10:24:10ZTTPS: T1222, T1082, T1053, T1005,...

Malware Analysis – danabot – 3572e56a91ed00b2a383c8efd1b64653

October 14, 2022

Score: 10 MALWARE FAMILY: danabotTAGS:family:danabot, family:djvu, family:smokeloader, family:vidar, botnet:517, backdoor, banker, collection, discovery, persistence, ransomware, spyware, stealer, trojan, vmprotectMD5: 3572e56a91ed00b2a383c8efd1b64653SHA1:...

Year: 2022

Malware Analysis – djvu – 93e80cf200afb6eb3aef34afa206af0b

Cobalt Stike Beacon Detected – 31[.]7[.]62[.]194:80

Cobalt Stike Beacon Detected – 41[.]216[.]183[.]24:443

Cobalt Stike Beacon Detected – 121[.]5[.]102[.]72:801

Cobalt Stike Beacon Detected – 185[.]236[.]202[.]202:80

Malware Analysis – djvu – 4fc50e305f9719c90d875264755aa9f1

Malware Analysis – ransomware – c39d02e577302bf8caa4e4d483300f60

Malware Analysis – ransomware – 9ab4626608328e493a9aa75cb82b0c3f

Malware Analysis – ransomware – 316d49bb419c374794ac38cb426576b9

Cobalt Stike Beacon Detected – 157[.]245[.]254[.]149:443

Cobalt Stike Beacon Detected – 5[.]44[.]42[.]16:80

Cobalt Stike Beacon Detected – 154[.]221[.]25[.]206:443

Cobalt Stike Beacon Detected – 174[.]139[.]150[.]250:4443

Malware Analysis – ransomware – 45ac7cd59d7f250217c69d5ec042632d

Malware Analysis – djvu – 381c69c453ddd6ecebb0535db66d069a

Malware Analysis – djvu – a1f3f1f4e250c96cbbee38b5d6babd7e

Malware Analysis – danabot – 3572e56a91ed00b2a383c8efd1b64653

Cobalt Stike Beacon Detected – 139[.]9[.]1[.]63:80

Cobalt Stike Beacon Detected – 82[.]157[.]245[.]205:4433

Cobalt Stike Beacon Detected – 66[.]42[.]48[.]182:6443

Cobalt Stike Beacon Detected – 104[.]168[.]117[.]95:80

Experts released PoC exploit code for critical bug CVE-2022-40684 in Fortinet products

DJI drone tracking data exposed in the US

Gogs cross-site scripting | CVE-2022-32174

[DRAGONFORCE] – Ransomware Victim: Mapping Solutions

[DRAGONFORCE] – Ransomware Victim: Aquasys

[AKIRA] – Ransomware Victim: Grand Fire Protection

[LYNX] – Ransomware Victim: Alo Center (hq[.]aloteknik[.]se)

[INCRANSOM] – Ransomware Victim: Prinston Pharmaceutical (huahaius[.]com)

You may have missed