Month: January 2023

Malware Analysis – djvu – f6b293eed267661df94b3d0afd7a2f82

January 6, 2023

Score: 10 MALWARE FAMILY: djvuTAGS:family:djvu, family:vidar, botnet:19, discovery, persistence, ransomware, spyware, stealerMD5: f6b293eed267661df94b3d0afd7a2f82SHA1: 9ba3088a0efd9c42cb5f7e22742c43d7793589f9ANALYSIS DATE: 2023-01-05T21:55:47ZTTPS: T1005, T1081, T1053, T1060,...

Malware Analysis – amadey – 8342e41277305e462526d301aa1196ff

January 6, 2023

Score: 10 MALWARE FAMILY: amadeyTAGS:family:amadey, family:djvu, family:smokeloader, family:vidar, botnet:19, backdoor, discovery, persistence, ransomware, spyware, stealer, trojan, vmprotectMD5: 8342e41277305e462526d301aa1196ffSHA1: ad04bf12f10dbc4ae8f4b52d19995d29e3fd378cANALYSIS DATE:...

Malware Analysis – persistence – b5981ed3aff8746b058a72eadf6c00d4

January 6, 2023

Score: 10 MALWARE FAMILY: persistenceTAGS:persistence, ransomwareMD5: b5981ed3aff8746b058a72eadf6c00d4SHA1: 4404ec52008ba98f6c1c4f21f72a7e31765eaa7dANALYSIS DATE: 2023-01-05T21:22:35ZTTPS: T1060, T1112, T1082, T1012, T1120 ScoreMeaningExample10Known badA malware family was...

Malware Analysis – discovery – d2b48aa2bd4b6d6c16261cecda611770

January 6, 2023

Score: 10 MALWARE FAMILY: discoveryTAGS:discovery, ransomwareMD5: d2b48aa2bd4b6d6c16261cecda611770SHA1: e4cb81b8725ba0db1dd98d5f4d4d2c2350dd7d59ANALYSIS DATE: 2023-01-05T21:37:15ZTTPS: T1012, T1082, T1057 ScoreMeaningExample10Known badA malware family was detected.8-9Likely maliciousOne...

Malware Analysis – discovery – 6fb56107fdf1eb1fd5358d34a5ffd4c4

January 6, 2023

Score: 10 MALWARE FAMILY: discoveryTAGS:discovery, ransomwareMD5: 6fb56107fdf1eb1fd5358d34a5ffd4c4SHA1: 1b4ce4480b140bb0f4d26bb2bfae3a6db58562e4ANALYSIS DATE: 2023-01-05T22:12:50ZTTPS: T1012, T1082, T1057 ScoreMeaningExample10Known badA malware family was detected.8-9Likely maliciousOne...

Malware Analysis – evasion – ce5451bc9732cf76ae643f57a6e4540a

January 6, 2023

Score: 7 MALWARE FAMILY: evasionTAGS:evasion, ransomwareMD5: ce5451bc9732cf76ae643f57a6e4540aSHA1: 6c340c782d97bd4f678d13e547d1494c41141c5aANALYSIS DATE: 2023-01-05T22:54:21ZTTPS: ScoreMeaningExample10Known badA malware family was detected.8-9Likely maliciousOne or more known...

Malware Analysis – djvu – e1346d650519a0c9124f2decc2198f01

January 6, 2023

Score: 10 MALWARE FAMILY: djvuTAGS:family:djvu, family:vidar, botnet:19, discovery, persistence, ransomware, spyware, stealerMD5: e1346d650519a0c9124f2decc2198f01SHA1: 2ca0a7c3055e70be006d9e2b2a363a5380e9907dANALYSIS DATE: 2023-01-05T23:55:15ZTTPS: T1053, T1082, T1222, T1012,...

Malware Analysis – evasion – 3312d268deb49f402ebaa0bed040832a

January 6, 2023

Score: 7 MALWARE FAMILY: evasionTAGS:evasion, ransomwareMD5: 3312d268deb49f402ebaa0bed040832aSHA1: 3a78ea2fa3d623faf8b97e1bf3c3abf2bc762936ANALYSIS DATE: 2023-01-05T22:55:12ZTTPS: ScoreMeaningExample10Known badA malware family was detected.8-9Likely maliciousOne or more known...

HackerOne Bug Bounty Disclosure: cve-2022-40127:-rce-in-apache-airflow-<2-4-0-bash-examplebyleixiao

January 5, 2023

Programme HackerOne Internet Bug Bounty Internet Bug Bounty Submitted by leixiao leixiao Report CVE-2022-40127: RCE in Apache Airflow

Malware Analysis – djvu – 1a31a6e01c28f2308a8728981a0ba917

January 5, 2023

Score: 10 MALWARE FAMILY: djvuTAGS:family:djvu, family:vidar, botnet:19, discovery, persistence, ransomware, spyware, stealerMD5: 1a31a6e01c28f2308a8728981a0ba917SHA1: e573fac78ffb94a69d704e62a4bc48313d0036f8ANALYSIS DATE: 2023-01-05T15:54:05ZTTPS: T1060, T1112, T1005, T1081,...

Malware Analysis – evasion – b53e20cecff1c0884afea69e403b788a

January 5, 2023

Score: 7 MALWARE FAMILY: evasionTAGS:evasion, ransomwareMD5: b53e20cecff1c0884afea69e403b788aSHA1: db36d6788b823b2fc8c13b597633928150198effANALYSIS DATE: 2023-01-05T16:39:18ZTTPS: ScoreMeaningExample10Known badA malware family was detected.8-9Likely maliciousOne or more known...

Malware Analysis – djvu – 62424bb1fdd7926fcb49ef7c8f13e272

January 5, 2023

Score: 10 MALWARE FAMILY: djvuTAGS:family:djvu, family:vidar, botnet:19, discovery, persistence, ransomware, spyware, stealerMD5: 62424bb1fdd7926fcb49ef7c8f13e272SHA1: 13a3afed29a458e247f74375c00515a205dc87e1ANALYSIS DATE: 2023-01-05T16:11:06ZTTPS: T1005, T1081, T1060, T1112,...

Malware Analysis – djvu – b2fabf8e6cd2703ace9d85f6182b4b51

January 5, 2023

Score: 10 MALWARE FAMILY: djvuTAGS:family:djvu, family:vidar, botnet:19, discovery, persistence, ransomware, spyware, stealerMD5: b2fabf8e6cd2703ace9d85f6182b4b51SHA1: dc6371e4ebda8f90b6cf4421c18d46956ba8bd34ANALYSIS DATE: 2023-01-05T16:47:26ZTTPS: T1060, T1112, T1222, T1053,...

Malware Analysis – amadey – 1170fa844f90aded8f9c12493f54d543

January 5, 2023

Score: 10 MALWARE FAMILY: amadeyTAGS:family:amadey, family:dcrat, family:djvu, family:smokeloader, family:vidar, botnet:19, backdoor, collection, discovery, infostealer, persistence, ransomware, rat, spyware, stealer, trojan,...

Malware Analysis – discovery – 4d8a60c6e654bd38212cebf3d17e5d38

January 5, 2023

Score: 8 MALWARE FAMILY: discoveryTAGS:discovery, exploit, persistenceMD5: 4d8a60c6e654bd38212cebf3d17e5d38SHA1: 9911ab18310d400ba4698a97c591e3893a7e3400ANALYSIS DATE: 2023-01-05T17:28:00ZTTPS: T1012, T1060, T1222 ScoreMeaningExample10Known badA malware family was detected.8-9Likely...

Malware Analysis – – d32877932ed310382b30efdd3cf67b29

January 5, 2023

Score: 1 MALWARE FAMILY: TAGS:MD5: d32877932ed310382b30efdd3cf67b29SHA1: 7faaad8a8aea96bcf78fdbc4ea6f73d76d58143aANALYSIS DATE: 2023-01-05T17:18:42ZTTPS: ScoreMeaningExample10Known badA malware family was detected.8-9Likely maliciousOne or more known damaging...

Malware Analysis – smokeloader – 4a0e3b3995cdc315c4caf048c3211f89

January 5, 2023

Score: 10 MALWARE FAMILY: smokeloaderTAGS:family:smokeloader, backdoor, trojanMD5: 4a0e3b3995cdc315c4caf048c3211f89SHA1: 4a47887a6190b1a816c6db5cbf4b545e4a6bf92eANALYSIS DATE: 2023-01-05T17:17:03ZTTPS: T1012, T1120, T1082 ScoreMeaningExample10Known badA malware family was detected.8-9Likely...

Malware Analysis – djvu – 054df7f4d72eba9f66a3e8940b223609

January 5, 2023

Score: 10 MALWARE FAMILY: djvuTAGS:family:djvu, family:vidar, botnet:19, discovery, persistence, ransomware, stealerMD5: 054df7f4d72eba9f66a3e8940b223609SHA1: 91877bfb6ca6ff8314376d435beec6c8a139a755ANALYSIS DATE: 2023-01-05T17:15:25ZTTPS: T1222, T1082, T1053, T1130, T1112,...

CISA

Month: January 2023

Malware Analysis – djvu – f6b293eed267661df94b3d0afd7a2f82

Malware Analysis – amadey – 8342e41277305e462526d301aa1196ff

Malware Analysis – persistence – b5981ed3aff8746b058a72eadf6c00d4

Malware Analysis – discovery – d2b48aa2bd4b6d6c16261cecda611770

Malware Analysis – discovery – 6fb56107fdf1eb1fd5358d34a5ffd4c4

Malware Analysis – evasion – ce5451bc9732cf76ae643f57a6e4540a

Malware Analysis – djvu – e1346d650519a0c9124f2decc2198f01

Malware Analysis – evasion – 3312d268deb49f402ebaa0bed040832a

HackerOne Bug Bounty Disclosure: cve-2022-40127:-rce-in-apache-airflow-<2-4-0-bash-examplebyleixiao

Malware Analysis – djvu – 1a31a6e01c28f2308a8728981a0ba917

Malware Analysis – evasion – b53e20cecff1c0884afea69e403b788a

Malware Analysis – djvu – 62424bb1fdd7926fcb49ef7c8f13e272

Malware Analysis – djvu – b2fabf8e6cd2703ace9d85f6182b4b51

Malware Analysis – amadey – 1170fa844f90aded8f9c12493f54d543

Malware Analysis – discovery – 4d8a60c6e654bd38212cebf3d17e5d38

Malware Analysis – – d32877932ed310382b30efdd3cf67b29

Malware Analysis – smokeloader – 4a0e3b3995cdc315c4caf048c3211f89

Malware Analysis – djvu – 054df7f4d72eba9f66a3e8940b223609

CISA: CISA Releases Three Industrial Systems Control Advisories

Cobalt Stike Beacon Detected – 114[.]115[.]235[.]249:8082

Cobalt Stike Beacon Detected – 8[.]134[.]209[.]29:80

Cobalt Stike Beacon Detected – 107[.]148[.]1[.]251:443

Cobalt Stike Beacon Detected – 137[.]184[.]247[.]75:443

Fortinet FortiADC command execution | CVE-2022-39947

[LOCKBIT3] – Ransomware Victim: madison-home[.]com

[CHORT] – Ransomware Victim: sheboyganwi[.]gov

[QILIN] – Ransomware Victim: Zimmerman & Frachtman PA Law Firm

[QILIN] – Ransomware Victim: Calvert Home Mortgage Investment

[QILIN] – Ransomware Victim: LBCO Contracting LTD

You may have missed