Month: January 2023

Malware Analysis – smokeloader – 72ce916457cd12dc4109d2c87e81328f

January 27, 2023

Score: 10 MALWARE FAMILY: smokeloaderTAGS:family:smokeloader, backdoor, trojanMD5: 72ce916457cd12dc4109d2c87e81328fSHA1: 1b8e70394824f2494481b84a1b355b5a29cf8ae2ANALYSIS DATE: 2023-01-27T10:43:08ZTTPS: T1012, T1120, T1082 ScoreMeaningExample10Known badA malware family was detected.8-9Likely...

Posh C2 Detected – 135[.]181[.]253[.]65:443

January 27, 2023

The Information provided at the time of posting was detected as "Posh C2". Depending on when you are viewing this...

Nodejs simple-git module code execution | CVE-2022-25860

January 27, 2023

NAME__________Nodejs simple-git module code executionPlatforms Affected:Node.js simple-git 3.15.1Risk Level:8.1Exploitability:Proof of ConceptConsequences:Gain Access DESCRIPTION__________Nodejs simple-git module could allow a remote attacker...

Tenable.sc cross-site scripting | CVE-2023-24494

January 27, 2023

NAME__________Tenable.sc cross-site scriptingPlatforms Affected:Tenable Tenable.sc 5.23.1Risk Level:8.3Exploitability:UnprovenConsequences:Cross-Site Scripting DESCRIPTION__________Tenable.sc is vulnerable to cross-site scripting, caused by improper validation of user-supplied...

Book Store Management System cross-site scripting | CVE-2023-23024

January 27, 2023

NAME__________Book Store Management System cross-site scriptingPlatforms Affected:Risk Level:7.2Exploitability:HighConsequences:Cross-Site Scripting DESCRIPTION__________Book Store Management System is vulnerable to cross-site scripting, caused by...

Broadcom Symantec Identity Manager response splitting | CVE-2023-23950

January 27, 2023

NAME__________Broadcom Symantec Identity Manager response splittingPlatforms Affected:Broadcom Symantec Identity Manager 14.3 Broadcom Symantec Identity Manager 14.4Risk Level:8.1Exploitability:UnprovenConsequences:Gain Access DESCRIPTION__________Broadcom Symantec...

Sengled Zigbee Smart Bulb denial of service | CVE-2022-47100

January 27, 2023

NAME__________Sengled Zigbee Smart Bulb denial of servicePlatforms Affected:Risk Level:8.1Exploitability:UnprovenConsequences:Denial of Service DESCRIPTION__________Sengled Zigbee Smart Bulb is vulnerable to a denial...

Jenkins Keycloak Authentication Plugin security bypass | CVE-2023-24456

January 27, 2023

NAME__________Jenkins Keycloak Authentication Plugin security bypassPlatforms Affected:Jenkins Keycloak Authentication Plugin 2.3.0Risk Level:8.8Exploitability:UnprovenConsequences:Bypass Security DESCRIPTION__________Jenkins Keycloak Authentication Plugin could allow a...

Sierra Wireless AirLink Router command execution | CVE-2022-46649

January 27, 2023

NAME__________Sierra Wireless AirLink Router command executionPlatforms Affected:Risk Level:8Exploitability:UnprovenConsequences:Gain Access DESCRIPTION__________Sierra Wireless AirLink Router could allow a remote authenticated attacker to...

Delta Electronics InfraSuite Device Master privilege escalation | CVE-2023-0444

January 27, 2023

NAME__________Delta Electronics InfraSuite Device Master privilege escalationPlatforms Affected:Delta Electronics InfraSuite Device Master 00.00.01aRisk Level:8.8Exploitability:UnprovenConsequences:Gain Privileges DESCRIPTION__________Delta Electronics InfraSuite Device Master...

Econolite EOS brute force | CVE-2023-0452

January 27, 2023

NAME__________Econolite EOS brute forcePlatforms Affected:Risk Level:9.8Exploitability:UnprovenConsequences:Bypass Security DESCRIPTION__________Econolite EOS is vulnerable to a brute force attack, caused by the use...

Broadcom Symantec Identity Manager cross-site scripting | CVE-2023-23949

January 27, 2023

NAME__________Broadcom Symantec Identity Manager cross-site scriptingPlatforms Affected:Broadcom Symantec Identity Manager 14.3 Broadcom Symantec Identity Manager 14.4Risk Level:8.1Exploitability:UnprovenConsequences:Cross-Site Scripting DESCRIPTION__________Broadcom Symantec...

Daily Vulnerability Trends: Fri Jan 27 2023

January 27, 2023

Daily Vulnerability Trends (sourced from VulnMon) CVE NAMECVE DescriptionCVE-2022-21225Improper neutralization in the Intel(R) Data Center Manager software before version 4.1...

Vice Society Ransomware Victim: Bristol Community College

January 27, 2023

Vice Society Ransomware NOTE: No files or stolen information are by RedPacket Security. Any legal issues relating to the content...

Malware Analysis – djvu – 7a16c7dc54ff82bafb8ff194789f2cf2

January 27, 2023

Score: 10 MALWARE FAMILY: djvuTAGS:family:djvu, family:vidar, botnet:19, discovery, persistence, ransomware, spyware, stealerMD5: 7a16c7dc54ff82bafb8ff194789f2cf2SHA1: 542345446ad059bbc82f554de67df8be1e6a070dANALYSIS DATE: 2023-01-27T04:22:36ZTTPS: T1060, T1112, T1082, T1005,...

Malware Analysis – smokeloader – 79f867b1b9a9b5b64b7fd471c63ccdd6

January 27, 2023

Score: 10 MALWARE FAMILY: smokeloaderTAGS:family:smokeloader, backdoor, trojanMD5: 79f867b1b9a9b5b64b7fd471c63ccdd6SHA1: 83c1c343245518432ba561f72d65d52e9f607fbfANALYSIS DATE: 2023-01-27T03:16:03ZTTPS: T1012, T1120, T1082 ScoreMeaningExample10Known badA malware family was detected.8-9Likely...

Malware Analysis – discovery – 03845022a6a113f6c4de407b644e8c5a

January 27, 2023

Score: 10 MALWARE FAMILY: discoveryTAGS:discovery, persistence, ransomwareMD5: 03845022a6a113f6c4de407b644e8c5aSHA1: 3497d9894fc9b629e53c57cd2310f9c619dfe007ANALYSIS DATE: 2023-01-27T04:50:32ZTTPS: T1012, T1082, T1112, T1042, T1060 ScoreMeaningExample10Known badA malware family...

Malware Analysis – smokeloader – cff2799137f6dbfa54d7e8d6c45ab395

January 27, 2023

Score: 10 MALWARE FAMILY: smokeloaderTAGS:family:smokeloader, backdoor, trojanMD5: cff2799137f6dbfa54d7e8d6c45ab395SHA1: ee58b60a36e5152de027bb5d00e85c5b8b613a8bANALYSIS DATE: 2023-01-27T04:29:03ZTTPS: T1012, T1120, T1082 ScoreMeaningExample10Known badA malware family was detected.8-9Likely...

Malware Analysis – lockbit – 0ee7386109b1f3596ae62735cf53f6b3

January 27, 2023

Score: 10 MALWARE FAMILY: lockbitTAGS:family:lockbit, discovery, evasion, persistence, ransomwareMD5: 0ee7386109b1f3596ae62735cf53f6b3SHA1: 0a67f0154a003fd06597a28dd2fd3e2f63b333b7ANALYSIS DATE: 2023-01-27T05:13:45ZTTPS: T1490, T1046, T1082, T1018, T1491, T1112, T1060,...

Malware Analysis – lockbit – ebd239b8b8fe486b2a13a5896a96d044

January 27, 2023

Score: 10 MALWARE FAMILY: lockbitTAGS:family:lockbit, discovery, evasion, persistence, ransomwareMD5: ebd239b8b8fe486b2a13a5896a96d044SHA1: 60821226d8d934d488d4f8e8081c32c6a73f8929ANALYSIS DATE: 2023-01-27T05:22:03ZTTPS: T1490, T1046, T1060, T1112, T1082, T1107 ScoreMeaningExample10Known...

Malware Analysis – djvu – ee739793bb58a7e07a7bdd0764599625

January 27, 2023

Score: 10 MALWARE FAMILY: djvuTAGS:family:djvu, family:smokeloader, family:vidar, botnet:19, backdoor, discovery, persistence, ransomware, spyware, stealer, trojan, vmprotectMD5: ee739793bb58a7e07a7bdd0764599625SHA1: 755f9a8ba645382117579761ce3a3714b35b862aANALYSIS DATE: 2023-01-27T05:46:43ZTTPS:...

Malware Analysis – lockbit – 01c9561a15dc451562ba536d8239fa41

January 27, 2023

Score: 10 MALWARE FAMILY: lockbitTAGS:family:lockbit, discovery, evasion, persistence, ransomwareMD5: 01c9561a15dc451562ba536d8239fa41SHA1: 9566de40d3435be6fac364e11d50d67d8a3c8dc4ANALYSIS DATE: 2023-01-27T05:24:24ZTTPS: T1490, T1046, T1082, T1060, T1112, T1107, T1491...

Malware Analysis – lockbit – b0916724ff4118bf213e31cd198c0afd

January 27, 2023

Score: 10 MALWARE FAMILY: lockbitTAGS:family:lockbit, discovery, evasion, persistence, ransomwareMD5: b0916724ff4118bf213e31cd198c0afdSHA1: 12ac32d012e818c78d6db790f6e11838ca75db88ANALYSIS DATE: 2023-01-27T05:25:49ZTTPS: T1490, T1046, T1060, T1112, T1107, T1082, T1491,...

Malware Analysis – djvu – 2cba3b77e08584bb8b4b823bca27bf0a

January 27, 2023

Score: 10 MALWARE FAMILY: djvuTAGS:family:djvu, family:vidar, botnet:19, discovery, persistence, ransomware, spyware, stealerMD5: 2cba3b77e08584bb8b4b823bca27bf0aSHA1: 15840c50da253e6d2b5654d30a165d32bff91db3ANALYSIS DATE: 2023-01-27T05:52:45ZTTPS: T1060, T1112, T1012, T1082,...

Month: January 2023

Malware Analysis – smokeloader – 72ce916457cd12dc4109d2c87e81328f

Posh C2 Detected – 135[.]181[.]253[.]65:443

Nodejs simple-git module code execution | CVE-2022-25860

Tenable.sc cross-site scripting | CVE-2023-24494

Book Store Management System cross-site scripting | CVE-2023-23024

Broadcom Symantec Identity Manager response splitting | CVE-2023-23950

Sengled Zigbee Smart Bulb denial of service | CVE-2022-47100

Jenkins Keycloak Authentication Plugin security bypass | CVE-2023-24456

Sierra Wireless AirLink Router command execution | CVE-2022-46649

Delta Electronics InfraSuite Device Master privilege escalation | CVE-2023-0444

Econolite EOS brute force | CVE-2023-0452

Broadcom Symantec Identity Manager cross-site scripting | CVE-2023-23949

Daily Vulnerability Trends: Fri Jan 27 2023

Vice Society Ransomware Victim: Bristol Community College

Malware Analysis – djvu – 7a16c7dc54ff82bafb8ff194789f2cf2

Malware Analysis – smokeloader – 79f867b1b9a9b5b64b7fd471c63ccdd6

Malware Analysis – discovery – 03845022a6a113f6c4de407b644e8c5a

Malware Analysis – smokeloader – cff2799137f6dbfa54d7e8d6c45ab395

Malware Analysis – lockbit – 0ee7386109b1f3596ae62735cf53f6b3

Malware Analysis – lockbit – ebd239b8b8fe486b2a13a5896a96d044

Malware Analysis – djvu – ee739793bb58a7e07a7bdd0764599625

Malware Analysis – lockbit – 01c9561a15dc451562ba536d8239fa41

Malware Analysis – lockbit – b0916724ff4118bf213e31cd198c0afd

Malware Analysis – djvu – 2cba3b77e08584bb8b4b823bca27bf0a

CISA: CISA Adds One Known Exploited Vulnerability to Catalog

CISA: CISA Releases Six Industrial Control Systems Advisories

CISA: CISA Releases Eight Industrial Control Systems Advisories

CISA: CISA and Partners Release Joint Guidance on PRC-Affiliated Threat Actor Compromising Networks of Global Telecommunications Providers

CISA: CISA Adds Three Known Exploited Vulnerabilities to Catalog

You may have missed