Month: January 2023

abstract malware 990x400 1

Malware Analysis – amadey – 578be748607a89ea3df1c31c52a202c1

January 4, 2023

Score: 10 MALWARE FAMILY: amadeyTAGS:family:amadey, family:djvu, family:smokeloader, family:vidar, botnet:19, backdoor, collection, discovery, persistence, ransomware, spyware, stealer, trojan, vmprotectMD5: 578be748607a89ea3df1c31c52a202c1SHA1: f868c590736d08d9a74ae470e846950822effa51ANALYSIS...

CISA

CISA: Fortinet Releases Security Updates for FortiADC

January 4, 2023

Fortinet Releases Security Updates for FortiADC Fortinet has released a security advisory to address a vulnerability in multiple versions of...

Cobalt Strike

Cobalt Stike Beacon Detected – 149[.]127[.]232[.]17:80

January 4, 2023

The Information provided at the time of posting was detected as "Cobalt Strike". Depending on when you are viewing this...

Cobalt Strike

Cobalt Stike Beacon Detected – 47[.]94[.]172[.]106:9898

January 4, 2023

The Information provided at the time of posting was detected as "Cobalt Strike". Depending on when you are viewing this...

Cobalt Strike

Cobalt Stike Beacon Detected – 8[.]134[.]63[.]69:443

January 4, 2023

The Information provided at the time of posting was detected as "Cobalt Strike". Depending on when you are viewing this...

Cobalt Strike

Cobalt Stike Beacon Detected – 20[.]225[.]139[.]12:80

January 4, 2023

The Information provided at the time of posting was detected as "Cobalt Strike". Depending on when you are viewing this...

Cobalt Strike

Cobalt Stike Beacon Detected – 47[.]108[.]150[.]23:443

January 4, 2023

The Information provided at the time of posting was detected as "Cobalt Strike". Depending on when you are viewing this...

Cobalt Strike

Cobalt Stike Beacon Detected – 45[.]61[.]187[.]167:80

January 4, 2023

The Information provided at the time of posting was detected as "Cobalt Strike". Depending on when you are viewing this...

Cobalt Strike

Cobalt Stike Beacon Detected – 39[.]96[.]116[.]31:80

January 4, 2023

The Information provided at the time of posting was detected as "Cobalt Strike". Depending on when you are viewing this...

Cobalt Strike

Cobalt Stike Beacon Detected – 52[.]43[.]159[.]70:80

January 4, 2023

The Information provided at the time of posting was detected as "Cobalt Strike". Depending on when you are viewing this...

Cobalt Strike

Cobalt Stike Beacon Detected – 47[.]92[.]227[.]151:80

January 4, 2023

The Information provided at the time of posting was detected as "Cobalt Strike". Depending on when you are viewing this...

Cobalt Strike

Cobalt Stike Beacon Detected – 88[.]218[.]193[.]100:443

January 4, 2023

The Information provided at the time of posting was detected as "Cobalt Strike". Depending on when you are viewing this...

abstract malware 990x400 1

Malware Analysis – nitro – a0c0192c30c048044421d25c23501582

January 4, 2023

Score: 10 MALWARE FAMILY: nitroTAGS:family:nitro, persistence, ransomware, spyware, stealerMD5: a0c0192c30c048044421d25c23501582SHA1: d6080d25a6439238d0a8e90e6bbfc229680ecf3bANALYSIS DATE: 2023-01-04T10:05:23ZTTPS: T1005, T1081, T1491, T1112, T1102, T1060, T1012,...

abstract malware 990x400 1

Malware Analysis – amadey – 6c5d5e80bab3b17f1b6faa5273e0b224

January 4, 2023

Score: 10 MALWARE FAMILY: amadeyTAGS:family:amadey, family:djvu, family:smokeloader, family:vidar, botnet:19, backdoor, collection, discovery, persistence, ransomware, spyware, stealer, trojan, vmprotectMD5: 6c5d5e80bab3b17f1b6faa5273e0b224SHA1: e486b2da9876bd1205a6efd8098dd30b59a6454dANALYSIS...

abstract malware 990x400 1

Malware Analysis – smokeloader – 88fc55ed1a5295684fc77c36024060cf

January 4, 2023

Score: 10 MALWARE FAMILY: smokeloaderTAGS:family:smokeloader, backdoor, trojanMD5: 88fc55ed1a5295684fc77c36024060cfSHA1: 3c09ac4a25c92f1f3a4052ee1e97659b39672925ANALYSIS DATE: 2023-01-04T11:26:03ZTTPS: T1012, T1120, T1082 ScoreMeaningExample10Known badA malware family was detected.8-9Likely...

abstract malware 990x400 1

Malware Analysis – ransomware – 0e2f34900a7e0324b91ca191fd043e74

January 4, 2023

Score: 5 MALWARE FAMILY: ransomwareTAGS:ransomwareMD5: 0e2f34900a7e0324b91ca191fd043e74SHA1: 8d34aca2b2ca50d3816b161493ec7440f2cbdbc0ANALYSIS DATE: 2023-01-04T10:53:29ZTTPS: ScoreMeaningExample10Known badA malware family was detected.8-9Likely maliciousOne or more known damaging...

abstract malware 990x400 1

Malware Analysis – djvu – a4b4e507ef0dc6c624c17badb10d29c9

January 4, 2023

Score: 10 MALWARE FAMILY: djvuTAGS:family:djvu, family:vidar, botnet:19, discovery, persistence, ransomware, spyware, stealerMD5: a4b4e507ef0dc6c624c17badb10d29c9SHA1: d376a5af805dd6654af35f42f71a3303ff1905f6ANALYSIS DATE: 2023-01-04T10:20:49ZTTPS: T1082, T1012, T1053, T1222,...

CVE prog

Qualcomm BIOS buffer overflow | CVE-2022-40517

January 4, 2023

NAME Qualcomm BIOS buffer overflow Platforms Affected:Qualcomm BIOSRisk Level:8.4Exploitability:UnprovenConsequences:Gain Access DESCRIPTION Qualcomm BIOS is vulnerable to a stack-based buffer overflow,...

CVE prog

memos security bypass | CVE-2022-4863

January 4, 2023

NAME memos security bypass Platforms Affected:memos memos 0.9.0Risk Level:8.4Exploitability:UnprovenConsequences:Bypass Security DESCRIPTION memos could allow a local attacker to bypass security...

CVE prog

Synology VPN Plus Server command execution | CVE-2022-43931

January 4, 2023

NAME Synology VPN Plus Server command execution Platforms Affected:Synology VPN Plus Server for SRM 1.2 Synology VPN Plus Server for...

CVE prog

Esri Portal for ArcGIS directory traversal | CVE-2022-38205

January 4, 2023

NAME Esri Portal for ArcGIS directory traversal Platforms Affected:Esri Portal for ArcGIS 10.9.1Risk Level:8.6Exploitability:UnprovenConsequences:Obtain Information DESCRIPTION Esri Portal for ArcGIS...

CVE prog

Apache Kylin command execution | CVE-2022-43396

January 4, 2023

NAME Apache Kylin command execution Platforms Affected:Apache Kylin 3.0.0 Apache Kylin 2.0.0 Apache Kylin 4.0.0Risk Level:8.8Exploitability:UnprovenConsequences:Gain Access DESCRIPTION Apache Kylin...

CVE prog

memos cross-site request forgery | CVE-2022-4847

January 4, 2023

NAME memos cross-site request forgery Platforms Affected:Risk Level:8.3Exploitability:Proof of ConceptConsequences:Gain Access DESCRIPTION memos is vulnerable to cross-site request forgery, caused...

CVE prog

Apache Kylin command execution | CVE-2022-44621

January 4, 2023

NAME Apache Kylin command execution Platforms Affected:Apache Kylin 3.0.0 Apache Kylin 2.0.0 Apache Kylin 4.0.0Risk Level:8.8Exploitability:UnprovenConsequences:Gain Access DESCRIPTION Apache Kylin...

[QILIN] – Ransomware Victim: Zimmerman & Frachtman PA Law Firm

November 22, 2024

[QILIN] – Ransomware Victim: Calvert Home Mortgage Investment

November 22, 2024

[QILIN] – Ransomware Victim: LBCO Contracting LTD

November 22, 2024

unlock membership

Unveiling Blockchain Security: Safeguarding the Digital Ledger

November 22, 2024

news

A Fifth of UK Enterprises Uncertain About NIS2 Compliance Requirements

November 22, 2024