Month: January 2023

Malware Analysis – persistence – 20ebc478a429ac5c954870668f453cb2

January 26, 2023

Score: 8 MALWARE FAMILY: persistenceTAGS:persistence, ransomwareMD5: 20ebc478a429ac5c954870668f453cb2SHA1: 91c5fa33d5848a4e5bce867cf06a760aafd9dbd0ANALYSIS DATE: 2023-01-26T05:33:55ZTTPS: T1060, T1112 ScoreMeaningExample10Known badA malware family was detected.8-9Likely maliciousOne or...

Malware Analysis – ransomware – f7b5b9fd8c7020dedb138ef75190dffc

January 26, 2023

Score: 9 MALWARE FAMILY: ransomwareTAGS:ransomwareMD5: f7b5b9fd8c7020dedb138ef75190dffcSHA1: adebd8a52b6dc9ad35dee583eae8d93e0040b837ANALYSIS DATE: 2023-01-26T05:34:00ZTTPS: T1012, T1120, T1082, T1107, T1490 ScoreMeaningExample10Known badA malware family was detected.8-9Likely...

Malware Analysis – djvu – 504863d5dc6d3062a34f399173b61ec7

January 26, 2023

Score: 10 MALWARE FAMILY: djvuTAGS:family:djvu, family:smokeloader, family:vidar, botnet:19, backdoor, discovery, persistence, ransomware, spyware, stealer, trojan, vmprotectMD5: 504863d5dc6d3062a34f399173b61ec7SHA1: c895012708971193f8462d28860bacfe3e36d510ANALYSIS DATE: 2023-01-26T05:42:07ZTTPS:...

Cobalt Stike Beacon Detected – 3[.]90[.]213[.]150:80

January 26, 2023

The Information provided at the time of posting was detected as "Cobalt Strike". Depending on when you are viewing this...

Cobalt Stike Beacon Detected – 118[.]31[.]8[.]234:9955

January 26, 2023

The Information provided at the time of posting was detected as "Cobalt Strike". Depending on when you are viewing this...

Cobalt Stike Beacon Detected – 154[.]204[.]43[.]31:443

January 26, 2023

The Information provided at the time of posting was detected as "Cobalt Strike". Depending on when you are viewing this...

Cobalt Stike Beacon Detected – 124[.]221[.]169[.]111:8080

January 26, 2023

The Information provided at the time of posting was detected as "Cobalt Strike". Depending on when you are viewing this...

Brute Ratel C4 Detected – 35[.]72[.]0[.]113:80

January 26, 2023

The Information provided at the time of posting was detected as "Brute Ratel C4". Depending on when you are viewing...

Brute Ratel C4 Detected – 149[.]28[.]251[.]203:80

January 26, 2023

The Information provided at the time of posting was detected as "Brute Ratel C4". Depending on when you are viewing...

CISA

CISA: CISA, NSA, and MS-ISAC Release Advisory on the Malicious Use of RMM Software

January 25, 2023

CISA, NSA, and MS-ISAC Release Advisory on the Malicious Use of RMM Software Today, the Cybersecurity and Infrastructure Security Agency...

CISA

CISA: VMware Releases Security Updates for VMware vRealize Log Insight

January 25, 2023

VMware Releases Security Updates for VMware vRealize Log Insight VMware released security updates to address multiple vulnerabilities in VMware vRealize...

3a7bcbbd60f416df9a81ccffd6671a24a5c9a049a5f024aeb48a0302aab22143

DC-Sonar – Analyzing AD Domains For Security Risks Related To User Accounts

January 25, 2023

DC Sonar Community Repositories The project consists of repositories: dc-sonar-frontend dc-sonar-user-layer dc-sonar-workers-layer ntlm-scrutinizer Disclaimer It's only for education purposes. Avoid...

Cobalt Stike Beacon Detected – 124[.]223[.]215[.]12:8091

January 25, 2023

The Information provided at the time of posting was detected as "Cobalt Strike". Depending on when you are viewing this...

Cobalt Stike Beacon Detected – 18[.]197[.]201[.]242:4433

January 25, 2023

The Information provided at the time of posting was detected as "Cobalt Strike". Depending on when you are viewing this...

Cobalt Stike Beacon Detected – 81[.]161[.]229[.]168:443

January 25, 2023

The Information provided at the time of posting was detected as "Cobalt Strike". Depending on when you are viewing this...

Cobalt Stike Beacon Detected – 39[.]101[.]1[.]65:8443

January 25, 2023

The Information provided at the time of posting was detected as "Cobalt Strike". Depending on when you are viewing this...

Google Chrome code execution | CVE-2023-0471

January 25, 2023

NAME__________Google Chrome code executionPlatforms Affected:Google Chrome 109.0Risk Level:8.8Exploitability:UnprovenConsequences:Gain Access DESCRIPTION__________Google Chrome could allow a remote attacker to execute arbitrary code...

VMware vRealize Log Insight code execution | CVE-2022-31704

January 25, 2023

NAME__________VMware vRealize Log Insight code executionPlatforms Affected:VMware vRealize Log Insight 8.0.0 VMware Cloud Foundation 3.0 VMware Cloud Foundation 4.0 VMware...

Google Chrome code execution | CVE-2023-0472

January 25, 2023

FreeSWITCH Sofia-SIP buffer overflow | CVE-2023-22741

January 25, 2023

NAME__________FreeSWITCH Sofia-SIP buffer overflowPlatforms Affected:FreeSWITCH Sofia-SIP 1.13.10Risk Level:9.8Exploitability:UnprovenConsequences:Gain Access DESCRIPTION__________FreeSWITCH Sofia-SIP is vulnerable to a heap-based buffer overflow, caused by...

Month: January 2023

Malware Analysis – persistence – 20ebc478a429ac5c954870668f453cb2

Malware Analysis – ransomware – f7b5b9fd8c7020dedb138ef75190dffc

Malware Analysis – djvu – 504863d5dc6d3062a34f399173b61ec7

Cobalt Stike Beacon Detected – 3[.]90[.]213[.]150:80

Cobalt Stike Beacon Detected – 118[.]31[.]8[.]234:9955

Cobalt Stike Beacon Detected – 154[.]204[.]43[.]31:443

Cobalt Stike Beacon Detected – 124[.]221[.]169[.]111:8080

Brute Ratel C4 Detected – 35[.]72[.]0[.]113:80

Brute Ratel C4 Detected – 149[.]28[.]251[.]203:80

CISA: CISA, NSA, and MS-ISAC Release Advisory on the Malicious Use of RMM Software

CISA: VMware Releases Security Updates for VMware vRealize Log Insight

DC-Sonar – Analyzing AD Domains For Security Risks Related To User Accounts

Cobalt Stike Beacon Detected – 124[.]223[.]215[.]12:8091

Cobalt Stike Beacon Detected – 18[.]197[.]201[.]242:4433

Cobalt Stike Beacon Detected – 81[.]161[.]229[.]168:443

Cobalt Stike Beacon Detected – 39[.]101[.]1[.]65:8443

Google Chrome code execution | CVE-2023-0471

VMware vRealize Log Insight code execution | CVE-2022-31704

Google Chrome code execution | CVE-2023-0472

FreeSWITCH Sofia-SIP buffer overflow | CVE-2023-22741

Google Chrome code execution | CVE-2023-0473

Google Chrome code execution | CVE-2023-0474

LockBit 3.0 Ransomware Victim: flatironssolutions[.]com

Daily Vulnerability Trends: Wed Jan 25 2023

CISA: Foreign Threat Actor Conducting Large-Scale Spearphishing Campaign with RDP Attachments

[RANSOMHUB] – Ransomware Victim: blr[.]com

HackerOne Bug Bounty Disclosure: std-process-command-batch-files-argument-escaping-could-be-bypassed-with-trailing-whitespace-or-periods–xpl-r-r

[LOCKBIT3] – Ransomware Victim: madison-home[.]com

[CHORT] – Ransomware Victim: sheboyganwi[.]gov

You may have missed