Month: January 2023

abstract malware 990x400 1

Malware Analysis – djvu – db8272dd1f6d8267907e498639d11e07

January 19, 2023

Score: 10 MALWARE FAMILY: djvuTAGS:family:djvu, family:vidar, botnet:19, discovery, persistence, ransomware, spyware, stealerMD5: db8272dd1f6d8267907e498639d11e07SHA1: a464e52d9e24e822d945d7e2415e4fce5e1019ffANALYSIS DATE: 2023-01-18T22:40:36ZTTPS: T1053, T1012, T1060, T1112,...

abstract malware 990x400 1

Malware Analysis – – 9b583f2aa0dc81105ba238af0e12ff72

January 19, 2023

Score: 7 MALWARE FAMILY: TAGS:MD5: 9b583f2aa0dc81105ba238af0e12ff72SHA1: d58f64e37295f03a9aaa6f69261a8b5695115d99ANALYSIS DATE: 2023-01-18T22:58:55ZTTPS: T1082 ScoreMeaningExample10Known badA malware family was detected.8-9Likely maliciousOne or more known...

PoshC2Logo

Posh C2 Detected – 185[.]193[.]126[.]28:443

January 19, 2023

The Information provided at the time of posting was detected as "Posh C2". Depending on when you are viewing this...

2e3fd173845601935c80aa12cf56550f068bed9901beae6e6c628e4bb581dff0

Kscan – Simple Asset Mapping Tool

January 18, 2023

0 Disclaimer (The author did not participate in the XX action, don't trace it) This tool is only for legally...

LockBit 3.0 Ransomware Victim: duomed[.]com

January 18, 2023

LockBit 3.0 Ransomware NOTE: No files or stolen information are by RedPacket Security. Any legal issues relating to the content...

Cobalt Strike

Cobalt Stike Beacon Detected – 43[.]138[.]13[.]139:7777

January 18, 2023

The Information provided at the time of posting was detected as "Cobalt Strike". Depending on when you are viewing this...

Cobalt Strike

Cobalt Stike Beacon Detected – 213[.]252[.]244[.]69:80

January 18, 2023

The Information provided at the time of posting was detected as "Cobalt Strike". Depending on when you are viewing this...

Cobalt Strike

Cobalt Stike Beacon Detected – 213[.]32[.]75[.]32:443

January 18, 2023

The Information provided at the time of posting was detected as "Cobalt Strike". Depending on when you are viewing this...

Cobalt Strike

Cobalt Stike Beacon Detected – 20[.]9[.]56[.]158:443

January 18, 2023

The Information provided at the time of posting was detected as "Cobalt Strike". Depending on when you are viewing this...

Cobalt Strike

Cobalt Stike Beacon Detected – 77[.]73[.]134[.]51:443

January 18, 2023

The Information provided at the time of posting was detected as "Cobalt Strike". Depending on when you are viewing this...

Cobalt Strike

Cobalt Stike Beacon Detected – 84[.]32[.]190[.]10:443

January 18, 2023

The Information provided at the time of posting was detected as "Cobalt Strike". Depending on when you are viewing this...

abstract malware 990x400 1

Malware Analysis – djvu – 7a84a1a41a766c91cf8a3df085f960b6

January 18, 2023

Score: 10 MALWARE FAMILY: djvuTAGS:family:djvu, family:vidar, botnet:19, discovery, persistence, ransomware, spyware, stealerMD5: 7a84a1a41a766c91cf8a3df085f960b6SHA1: c44ee2b0d827561c5d53ae05399b1140530dcaeeANALYSIS DATE: 2023-01-18T09:44:29ZTTPS: T1005, T1081, T1060, T1112,...

abstract malware 990x400 1

Malware Analysis – djvu – 831ea71d4e3cc3e27250500e14d4ac25

January 18, 2023

Score: 10 MALWARE FAMILY: djvuTAGS:family:djvu, family:vidar, botnet:19, discovery, persistence, ransomware, spyware, stealerMD5: 831ea71d4e3cc3e27250500e14d4ac25SHA1: 8976eebf1416eb1bf968c346b08e7a32f5325908ANALYSIS DATE: 2023-01-18T10:45:15ZTTPS: T1082, T1012, T1222, T1005,...

CVE prog

GE Digital Proficy Historian command execution | CVE-2022-46732

January 18, 2023

NAME__________GE Digital Proficy Historian command executionPlatforms Affected:GE Digital Proficy Historian 7.0Risk Level:9.8Exploitability:UnprovenConsequences:Gain Access DESCRIPTION__________GE Digital Proficy Historian could allow a...

CVE prog

phpMyFAQ cross-site scripting | CVE-2023-0310

January 18, 2023

NAME__________phpMyFAQ cross-site scriptingPlatforms Affected:Risk Level:9.8Exploitability:UnprovenConsequences:Cross-Site Scripting DESCRIPTION__________phpMyFAQ is vulnerable to cross-site scripting, caused by improper validation of user-supplied input. A...

CVE prog

phpMyFAQ cross-site scripting | CVE-2023-0312

January 18, 2023

NAME__________phpMyFAQ cross-site scriptingPlatforms Affected:Risk Level:8.6Exploitability:UnprovenConsequences:Cross-Site Scripting DESCRIPTION__________phpMyFAQ is vulnerable to cross-site scripting, caused by improper validation of user-supplied input. A...

CVE prog

phpMyFAQ cross-site scripting | CVE-2023-0306

January 18, 2023

NAME__________phpMyFAQ cross-site scriptingPlatforms Affected:Risk Level:9.1Exploitability:UnprovenConsequences:Cross-Site Scripting DESCRIPTION__________phpMyFAQ is vulnerable to cross-site scripting, caused by improper validation of user-supplied input. A...

CVE prog

Online Tours and Travels Management System SQL injection | CVE-2023-0324

January 18, 2023

NAME__________Online Tours and Travels Management System SQL injectionPlatforms Affected:Risk Level:7.3Exploitability:HighConsequences:Data Manipulation DESCRIPTION__________Online Tours & Travels Management System is vulnerable to...

CVE prog

Mozilla Firefox safety bugs code execution | CVE-2023-23605

January 18, 2023

NAME__________Mozilla Firefox safety bugs code executionPlatforms Affected:Mozilla Firefox 108 Mozilla Firefox ESR 102.6Risk Level:8.8Exploitability:UnprovenConsequences:Gain Access DESCRIPTION__________Mozilla Firefox could allow a...

CVE prog

IBM Security QRadar SIEM information disclosure | CVE-2023-22875

January 18, 2023

NAME__________IBM Security QRadar SIEM information disclosurePlatforms Affected:IBM Security QRadar SIEM 7.5 IBM Security QRadar SIEM 7.4Risk Level:8.4Exploitability:UnprovenConsequences:Obtain Information DESCRIPTION__________IBM QRadar...

CVE prog

Git integer overflow | CVE-2022-41903

January 18, 2023

NAME__________Git integer overflowPlatforms Affected:Git Git 2.30.0 Git Git 2.36 Git Git 2.37 Git Git 2.38.0 GIt Git 2.39Risk Level:9.8Exploitability:UnprovenConsequences:Gain Access...

CVE prog

Cisco Small Business RV016, RV042, RV042G, and RV082 Routers security bypass | CVE-2023-20025

January 18, 2023

NAME__________Cisco Small Business RV016, RV042, RV042G, and RV082 Routers security bypassPlatforms Affected:Risk Level:9Exploitability:UnprovenConsequences:Bypass Security DESCRIPTION__________Cisco Small Business RV016, RV042, RV042G,...

CVE prog

Mediamatic plugin for WordPress cross-site request forgery | CVE-2023-0294

January 18, 2023

NAME__________Mediamatic plugin for WordPress cross-site request forgeryPlatforms Affected:Risk Level:8.8Exploitability:UnprovenConsequences:Gain Access DESCRIPTION__________Mediamatic plugin for WordPress is vulnerable to cross-site request forgery,...

CVE prog

Mozilla Firefox safety bugs code execution | CVE-2023-23606

January 18, 2023

NAME__________Mozilla Firefox safety bugs code executionPlatforms Affected:Mozilla Firefox 108Risk Level:8.8Exploitability:UnprovenConsequences:Gain Access DESCRIPTION__________Mozilla Firefox could allow a remote attacker to execute...

Cobalt Strike

Cobalt Strike Beacon Detected – 52[.]231[.]10[.]139:8080

November 23, 2024

Cobalt Strike

Cobalt Strike Beacon Detected – 54[.]224[.]145[.]120:443

November 23, 2024

Cobalt Strike

Cobalt Strike Beacon Detected – 118[.]193[.]37[.]157:8889

November 23, 2024

Cobalt Strike

Cobalt Strike Beacon Detected – 103[.]225[.]196[.]197:80

November 23, 2024

Cobalt Strike

Cobalt Strike Beacon Detected – 101[.]201[.]247[.]232:4433

November 23, 2024