Year: 2022

Malware Analysis – smokeloader – 5d041a4006ed3f18eef822470c83ed9c

December 13, 2022

Score: 10 MALWARE FAMILY: smokeloaderTAGS:family:smokeloader, backdoor, trojanMD5: 5d041a4006ed3f18eef822470c83ed9cSHA1: 14d269a9c95ecd7a643fe7f5487ef468986f5d9dANALYSIS DATE: 2022-12-13T11:57:40ZTTPS: T1012, T1120, T1082 ScoreMeaningExample10Known badA malware family was detected.8-9Likely...

Malware Analysis – dcrat – b5edc62fc06a612dc1edfaa0e6fdaa35

December 13, 2022

Score: 10 MALWARE FAMILY: dcratTAGS:family:dcrat, family:djvu, family:smokeloader, family:vidar, botnet:1808, backdoor, bootkit, collection, discovery, infostealer, persistence, ransomware, rat, spyware, stealer, trojanMD5:...

Twitter says recently leaked user data are from 2021 breach

December 13, 2022

Twitter confirmed that the recent leak of members’ profile information resulted from the 2021 data breach disclosed in August 2022....

Daily Vulnerability Trends: Tue Dec 13 2022

December 13, 2022

Daily Vulnerability Trends (sourced from VulnMon) CVE NAMECVE DescriptionCVE-2022-3602A buffer overrun can be triggered in X.509 certificate verification, specifically in...

Cuba Ransomware Victim: 2networkit

December 13, 2022

Cuba Ransomware NOTE: No files or stolen information are by RedPacket Security. Any legal issues relating to the content of...

Malware Analysis – djvu – 27b2b0f56a96792e4a87799bc5983d45

December 13, 2022

Score: 10 MALWARE FAMILY: djvuTAGS:family:djvu, family:smokeloader, family:vidar, botnet:1808, backdoor, bootkit, collection, discovery, persistence, ransomware, spyware, stealer, trojanMD5: 27b2b0f56a96792e4a87799bc5983d45SHA1: 5f18ed76dd5cb6b6820e8384e63d324771227aa6ANALYSIS DATE:...

Malware Analysis – djvu – e4abac89f0c02ab08125acc019535b2e

December 13, 2022

Score: 10 MALWARE FAMILY: djvuTAGS:family:djvu, discovery, persistence, ransomwareMD5: e4abac89f0c02ab08125acc019535b2eSHA1: e9d43e1c239006b102e4c741523be38e80d082f3ANALYSIS DATE: 2022-12-13T05:25:03ZTTPS: T1053, T1130, T1112, T1060, T1222, T1082 ScoreMeaningExample10Known badA...

Malware Analysis – djvu – ad11601c8003994fea9cf502f77cefd8

December 13, 2022

Score: 10 MALWARE FAMILY: djvuTAGS:family:djvu, discovery, persistence, ransomware, spyware, stealerMD5: ad11601c8003994fea9cf502f77cefd8SHA1: 78764391ee3ebf81d09b5def7a4436a07bd4cd7bANALYSIS DATE: 2022-12-13T05:43:45ZTTPS: T1005, T1081, T1060, T1112, T1222, T1082,...

Malware Analysis – lockbit – 38a0313aaad67d4c34ef96225c5c4603

December 13, 2022

Score: 10 MALWARE FAMILY: lockbitTAGS:family:lockbit, discovery, evasion, persistence, ransomwareMD5: 38a0313aaad67d4c34ef96225c5c4603SHA1: 88bad08303135cfa65efc1b505e993b917071104ANALYSIS DATE: 2022-12-13T04:33:06ZTTPS: T1490, T1046, T1082, T1107, T1060, T1112 ScoreMeaningExample10Known...

Malware Analysis – djvu – 31ab55838ad60dcce8fc22ff24614d76

December 13, 2022

Score: 10 MALWARE FAMILY: djvuTAGS:family:djvu, family:smokeloader, family:vidar, botnet:1808, backdoor, bootkit, collection, discovery, persistence, ransomware, spyware, stealer, trojanMD5: 31ab55838ad60dcce8fc22ff24614d76SHA1: 1e33acddb01d65ddd1dfd0a7c96de5537e84b82bANALYSIS DATE:...

Cobalt Stike Beacon Detected – 43[.]142[.]31[.]225:80

December 13, 2022

The Information provided at the time of posting was detected as "Cobalt Strike". Depending on when you are viewing this...

Cobalt Stike Beacon Detected – 62[.]204[.]41[.]171:443

December 13, 2022

The Information provided at the time of posting was detected as "Cobalt Strike". Depending on when you are viewing this...

Cobalt Stike Beacon Detected – 124[.]223[.]216[.]146:8082

December 13, 2022

The Information provided at the time of posting was detected as "Cobalt Strike". Depending on when you are viewing this...

Cobalt Stike Beacon Detected – 79[.]137[.]207[.]137:443

December 13, 2022

The Information provided at the time of posting was detected as "Cobalt Strike". Depending on when you are viewing this...

Cobalt Stike Beacon Detected – 117[.]50[.]184[.]22:9999

December 13, 2022

The Information provided at the time of posting was detected as "Cobalt Strike". Depending on when you are viewing this...

Cobalt Stike Beacon Detected – 114[.]116[.]101[.]84:89

December 13, 2022

The Information provided at the time of posting was detected as "Cobalt Strike". Depending on when you are viewing this...

Cobalt Stike Beacon Detected – 81[.]68[.]142[.]187:444

December 13, 2022

The Information provided at the time of posting was detected as "Cobalt Strike". Depending on when you are viewing this...

Cobalt Stike Beacon Detected – 8[.]212[.]49[.]116:443

December 13, 2022

The Information provided at the time of posting was detected as "Cobalt Strike". Depending on when you are viewing this...

Cobalt Stike Beacon Detected – 194[.]135[.]24[.]240:80

December 13, 2022

The Information provided at the time of posting was detected as "Cobalt Strike". Depending on when you are viewing this...

Malware Analysis – persistence – e5a2fb54732cc555141fa1d04de2cc92

December 13, 2022

Score: 8 MALWARE FAMILY: persistenceTAGS:persistence, ransomwareMD5: e5a2fb54732cc555141fa1d04de2cc92SHA1: a92095b913449b178aaad39acbfbf0607bcc3fbdANALYSIS DATE: 2022-12-12T21:44:15ZTTPS: T1060, T1112 ScoreMeaningExample10Known badA malware family was detected.8-9Likely maliciousOne or...

Malware Analysis – djvu – 3ce3405d342902d9ec619ecebb88e7c0

December 13, 2022

Score: 10 MALWARE FAMILY: djvuTAGS:family:djvu, discovery, persistence, ransomware, spyware, stealerMD5: 3ce3405d342902d9ec619ecebb88e7c0SHA1: ea7a862234245da1b809129099f6ad95de10485eANALYSIS DATE: 2022-12-12T21:04:08ZTTPS: T1012, T1082, T1053, T1005, T1081, T1060,...

Malware Analysis – djvu – fb7d729a0265065108852a71721728ab

December 13, 2022

Score: 10 MALWARE FAMILY: djvuTAGS:family:djvu, family:smokeloader, backdoor, bootkit, collection, discovery, persistence, ransomware, spyware, stealer, trojanMD5: fb7d729a0265065108852a71721728abSHA1: 60f45ef61a1971ef56c598e4e7c9ea50a8d3f0e6ANALYSIS DATE: 2022-12-12T21:24:46ZTTPS: T1012,...

Malware Analysis – djvu – 950340733bcaea1a64f5b6a0bdaf39d0

December 13, 2022

Score: 10 MALWARE FAMILY: djvuTAGS:family:djvu, family:smokeloader, backdoor, bootkit, collection, discovery, persistence, ransomware, spyware, stealer, trojanMD5: 950340733bcaea1a64f5b6a0bdaf39d0SHA1: 6b6ffba189c8e5bc6014405ab7ebea253704931fANALYSIS DATE: 2022-12-12T22:04:17ZTTPS: T1067,...

Cobalt Stike Beacon Detected – 204[.]44[.]125[.]106:443

December 13, 2022

The Information provided at the time of posting was detected as "Cobalt Strike". Depending on when you are viewing this...

Year: 2022

Malware Analysis – smokeloader – 5d041a4006ed3f18eef822470c83ed9c

Malware Analysis – dcrat – b5edc62fc06a612dc1edfaa0e6fdaa35

Twitter says recently leaked user data are from 2021 breach

Daily Vulnerability Trends: Tue Dec 13 2022

Cuba Ransomware Victim: 2networkit

Malware Analysis – djvu – 27b2b0f56a96792e4a87799bc5983d45

Malware Analysis – djvu – e4abac89f0c02ab08125acc019535b2e

Malware Analysis – djvu – ad11601c8003994fea9cf502f77cefd8

Malware Analysis – lockbit – 38a0313aaad67d4c34ef96225c5c4603

Malware Analysis – djvu – 31ab55838ad60dcce8fc22ff24614d76

Cobalt Stike Beacon Detected – 43[.]142[.]31[.]225:80

Cobalt Stike Beacon Detected – 62[.]204[.]41[.]171:443

Cobalt Stike Beacon Detected – 124[.]223[.]216[.]146:8082

Cobalt Stike Beacon Detected – 79[.]137[.]207[.]137:443

Cobalt Stike Beacon Detected – 117[.]50[.]184[.]22:9999

Cobalt Stike Beacon Detected – 114[.]116[.]101[.]84:89

Cobalt Stike Beacon Detected – 81[.]68[.]142[.]187:444

Cobalt Stike Beacon Detected – 8[.]212[.]49[.]116:443

Cobalt Stike Beacon Detected – 194[.]135[.]24[.]240:80

Malware Analysis – persistence – e5a2fb54732cc555141fa1d04de2cc92

Malware Analysis – djvu – 3ce3405d342902d9ec619ecebb88e7c0

Malware Analysis – djvu – fb7d729a0265065108852a71721728ab

Malware Analysis – djvu – 950340733bcaea1a64f5b6a0bdaf39d0

Cobalt Stike Beacon Detected – 204[.]44[.]125[.]106:443

[HUNTERS] – Ransomware Victim: Unisource Information Services

[HUNTERS] – Ransomware Victim: COROB

[HUNTERS] – Ransomware Victim: Patriarche Office of Architecture

[FUNKSEC] – Ransomware Victim: seocommarrakech[.]com

[HUNTERS] – Ransomware Victim: RocSearch

You may have missed