Month: January 2023

Malware Analysis – djvu – 8a8c49b680a83c2393bffa1f436c1123

January 18, 2023

Score: 10 MALWARE FAMILY: djvuTAGS:family:djvu, family:vidar, botnet:19, discovery, persistence, ransomware, stealerMD5: 8a8c49b680a83c2393bffa1f436c1123SHA1: 314c05651c18a4485744f17244c2d175e7883198ANALYSIS DATE: 2023-01-17T21:59:52ZTTPS: T1082, T1012, T1053, T1060, T1112,...

Malware Analysis – discovery – 1bf2e99364940f8a814104325b4ee679

January 18, 2023

Score: 10 MALWARE FAMILY: discoveryTAGS:discovery, persistence, ransomwareMD5: 1bf2e99364940f8a814104325b4ee679SHA1: 6e68aa272b02059cab325334ace34fe505e994caANALYSIS DATE: 2023-01-17T22:19:03ZTTPS: T1057, T1012, T1060, T1082 ScoreMeaningExample10Known badA malware family was...

Malware Analysis – djvu – 1dbe2a7afbed81c1d517f0d29c08cd03

January 18, 2023

Score: 10 MALWARE FAMILY: djvuTAGS:family:djvu, family:vidar, botnet:19, discovery, persistence, ransomware, spyware, stealerMD5: 1dbe2a7afbed81c1d517f0d29c08cd03SHA1: 06bb32dd20d2726d9d1fb859c70846d70e6988eaANALYSIS DATE: 2023-01-17T23:52:48ZTTPS: T1005, T1081, T1222, T1082,...

Cobalt Stike Beacon Detected – 77[.]73[.]134[.]51:80

January 18, 2023

The Information provided at the time of posting was detected as "Cobalt Strike". Depending on when you are viewing this...

Cobalt Stike Beacon Detected – 43[.]154[.]23[.]98:443

January 18, 2023

The Information provided at the time of posting was detected as "Cobalt Strike". Depending on when you are viewing this...

Cobalt Stike Beacon Detected – 23[.]227[.]203[.]14:443

January 18, 2023

The Information provided at the time of posting was detected as "Cobalt Strike". Depending on when you are viewing this...

Cobalt Stike Beacon Detected – 47[.]100[.]48[.]185:8007

January 18, 2023

The Information provided at the time of posting was detected as "Cobalt Strike". Depending on when you are viewing this...

Brute Ratel C4 Detected – 54[.]150[.]84[.]227:80

January 18, 2023

The Information provided at the time of posting was detected as "Brute Ratel C4". Depending on when you are viewing...

News

US-CERT Bulletin (SB23-016):Vulnerability Summary for the Week of January 9, 2023

January 17, 2023

The CISA Vulnerability Bulletin provides a summary of new vulnerabilities that have been recorded by the National Institute of Standards...

CISA

CISA: CISA Updates Best Practices for Mapping to MITRE ATT&CK®

January 17, 2023

CISA Updates Best Practices for Mapping to MITRE ATT&CK® Today, CISA updated Best Practices for MITRE ATT&CK® Mapping. The MITRE...

HIVE Ransomware Victim: R C Stevens Construction

January 17, 2023

HIVE Ransomware NOTE: No files or stolen information are by RedPacket Security. Any legal issues relating to the content of...

8d03c11b8a5459b2259cfb42bf7788483c35efbf6a37a1b2de38009134359fe6

APTRS – Automated Penetration Testing Reporting System

January 17, 2023

APTRS (Automated Penetration Testing Reporting System) is an automated reporting tool in Python and Django. The tool allows Penetration testers...

Royal Ransomware Victim: carinya

January 17, 2023

RoyalRansomware NOTE: No files or stolen information are by RedPacket Security. Any legal issues relating to the content of the...

Malware Analysis – ransomware – b4447fd459e4d3f8c74d0dd61b363f35

January 17, 2023

Score: 7 MALWARE FAMILY: ransomwareTAGS:ransomwareMD5: b4447fd459e4d3f8c74d0dd61b363f35SHA1: 2f531904e872f4cb4a481c6983b4e7bb68541744ANALYSIS DATE: 2023-01-17T16:36:34ZTTPS: ScoreMeaningExample10Known badA malware family was detected.8-9Likely maliciousOne or more known damaging...

Malware Analysis – djvu – e8b5ced1c7421ee80a25afe48e816a08

January 17, 2023

Score: 10 MALWARE FAMILY: djvuTAGS:family:djvu, family:vidar, botnet:19, discovery, persistence, ransomware, stealerMD5: e8b5ced1c7421ee80a25afe48e816a08SHA1: d4d88fe22b4c6fdc3222486d6de353c8fff8643aANALYSIS DATE: 2023-01-17T16:41:57ZTTPS: T1130, T1112, T1060, T1222, T1082...

Malware Analysis – djvu – a9bac1dee06b3257cab19cb09bef3d1c

January 17, 2023

Score: 10 MALWARE FAMILY: djvuTAGS:family:djvu, family:vidar, botnet:19, discovery, persistence, ransomware, spyware, stealerMD5: a9bac1dee06b3257cab19cb09bef3d1cSHA1: 2be37ca987a82592dde5e01293266a6a26e7892cANALYSIS DATE: 2023-01-17T16:47:09ZTTPS: T1082, T1005, T1081, T1012,...

Malware Analysis – discovery – fba93d8d029e85e0cde3759b7903cee2

January 17, 2023

Score: 8 MALWARE FAMILY: discoveryTAGS:discovery, exploit, persistenceMD5: fba93d8d029e85e0cde3759b7903cee2SHA1: 525b1aa549188f4565c75ab69e51f927204ca384ANALYSIS DATE: 2023-01-17T17:38:51ZTTPS: T1012, T1060, T1112, T1222 ScoreMeaningExample10Known badA malware family was...

Malware Analysis – ransomware – caffd0c766788c61986d86fd2e608d81

January 17, 2023

Score: 7 MALWARE FAMILY: ransomwareTAGS:ransomwareMD5: caffd0c766788c61986d86fd2e608d81SHA1: 3fe95f91eb2cf49e160b3dd3908997dbde9a9277ANALYSIS DATE: 2023-01-17T17:34:04ZTTPS: ScoreMeaningExample10Known badA malware family was detected.8-9Likely maliciousOne or more known damaging...

Malware Analysis – ransomware – ee055c9526a3f435cfa4e0bf9ee87266

January 17, 2023

Score: 5 MALWARE FAMILY: ransomwareTAGS:ransomwareMD5: ee055c9526a3f435cfa4e0bf9ee87266SHA1: b5e24b18ba07c2e28377c9f249a99a46bb415b93ANALYSIS DATE: 2023-01-17T16:45:28ZTTPS: ScoreMeaningExample10Known badA malware family was detected.8-9Likely maliciousOne or more known damaging...

Month: January 2023

Malware Analysis – djvu – 8a8c49b680a83c2393bffa1f436c1123

Malware Analysis – discovery – 1bf2e99364940f8a814104325b4ee679

Malware Analysis – djvu – 1dbe2a7afbed81c1d517f0d29c08cd03

Cobalt Stike Beacon Detected – 77[.]73[.]134[.]51:80

Cobalt Stike Beacon Detected – 43[.]154[.]23[.]98:443

Cobalt Stike Beacon Detected – 23[.]227[.]203[.]14:443

Cobalt Stike Beacon Detected – 47[.]100[.]48[.]185:8007

Brute Ratel C4 Detected – 54[.]150[.]84[.]227:80

US-CERT Bulletin (SB23-016):Vulnerability Summary for the Week of January 9, 2023

CISA: CISA Updates Best Practices for Mapping to MITRE ATT&CK®

HIVE Ransomware Victim: R C Stevens Construction

APTRS – Automated Penetration Testing Reporting System

Royal Ransomware Victim: carinya

Malware Analysis – ransomware – b4447fd459e4d3f8c74d0dd61b363f35

Malware Analysis – djvu – e8b5ced1c7421ee80a25afe48e816a08

Malware Analysis – djvu – a9bac1dee06b3257cab19cb09bef3d1c

Malware Analysis – discovery – fba93d8d029e85e0cde3759b7903cee2

Malware Analysis – ransomware – caffd0c766788c61986d86fd2e608d81

Malware Analysis – ransomware – ee055c9526a3f435cfa4e0bf9ee87266

Cobalt Stike Beacon Detected – 103[.]187[.]168[.]153:443

Cobalt Stike Beacon Detected – 179[.]43[.]156[.]146:443

Cobalt Stike Beacon Detected – 45[.]128[.]211[.]137:8080

Cobalt Stike Beacon Detected – 85[.]239[.]54[.]14:443

Cobalt Stike Beacon Detected – 84[.]32[.]131[.]35:80

[INCRANSOM] – Ransomware Victim: Alna-Bioscience

Cobalt Strike Beacon Detected – 52[.]231[.]10[.]139:8080

Cobalt Strike Beacon Detected – 54[.]224[.]145[.]120:443

Cobalt Strike Beacon Detected – 118[.]193[.]37[.]157:8889

Cobalt Strike Beacon Detected – 103[.]225[.]196[.]197:80

You may have missed