Month: January 2023

Malware Analysis – ransomware – 91ad108862744c05daa83bfe37a7c8b1

January 1, 2023

Score: 9 MALWARE FAMILY: ransomwareTAGS:ransomware, upxMD5: 91ad108862744c05daa83bfe37a7c8b1SHA1: b5b3475be40bda4f75d3d24b547d44d60c03c61bANALYSIS DATE: 2023-01-01T08:58:57ZTTPS: T1082, T1012, T1120, T1107, T1490, T1491, T1112 ScoreMeaningExample10Known badA malware...

Malware Analysis – discovery – 5755c57c7d3b7304b42015c5dd34e5be

January 1, 2023

Score: 10 MALWARE FAMILY: discoveryTAGS:discovery, evasion, persistence, ransomwareMD5: 5755c57c7d3b7304b42015c5dd34e5beSHA1: 923d617a8a76195879a0eebc8a9794e00378450fANALYSIS DATE: 2023-01-01T09:38:40ZTTPS: T1060, T1112, T1012, T1082, T1031, T1053, T1158, T1042,...

Malware Analysis – djvu – 66e2b7371289dd956427b58b8dc7eb14

January 1, 2023

Score: 10 MALWARE FAMILY: djvuTAGS:family:djvu, family:vidar, botnet:19, discovery, persistence, ransomware, spyware, stealerMD5: 66e2b7371289dd956427b58b8dc7eb14SHA1: 9d6fb6efbad6863d21643c7f665c3aa2521aa54dANALYSIS DATE: 2023-01-01T09:34:48ZTTPS: T1082, T1053, T1222, T1012,...

Malware Analysis – amadey – 1b43fc5f83167e3ed72de7461fb2eb30

January 1, 2023

Score: 10 MALWARE FAMILY: amadeyTAGS:family:amadey, family:djvu, family:lgoogloader, family:smokeloader, family:vidar, botnet:19, backdoor, collection, discovery, downloader, persistence, ransomware, spyware, stealer, trojan, vmprotectMD5:...

Cobalt Stike Beacon Detected – 1[.]15[.]141[.]252:5555

January 1, 2023

The Information provided at the time of posting was detected as "Cobalt Strike". Depending on when you are viewing this...

Cobalt Stike Beacon Detected – 85[.]209[.]135[.]49:443

January 1, 2023

The Information provided at the time of posting was detected as "Cobalt Strike". Depending on when you are viewing this...

Cobalt Stike Beacon Detected – 110[.]41[.]131[.]105:6666

January 1, 2023

The Information provided at the time of posting was detected as "Cobalt Strike". Depending on when you are viewing this...

Cobalt Stike Beacon Detected – 1[.]15[.]141[.]252:443

January 1, 2023

The Information provided at the time of posting was detected as "Cobalt Strike". Depending on when you are viewing this...

Malware Analysis – smokeloader – 4040afcf9849e20e9305eb95cdd68ccc

January 1, 2023

Score: 10 MALWARE FAMILY: smokeloaderTAGS:family:smokeloader, backdoor, trojanMD5: 4040afcf9849e20e9305eb95cdd68cccSHA1: 79b900321e613d55e919516e6db4e7d8d153ad1cANALYSIS DATE: 2023-01-01T11:12:17ZTTPS: T1012, T1120, T1082, T1112 ScoreMeaningExample10Known badA malware family was...

Malware Analysis – – a0affa0816e523701464051054026e1c

January 1, 2023

Score: 3 MALWARE FAMILY: TAGS:MD5: a0affa0816e523701464051054026e1cSHA1: 470172daf36ce355162213e898616b8a775b846cANALYSIS DATE: 2023-01-01T09:44:16ZTTPS: T1082 ScoreMeaningExample10Known badA malware family was detected.8-9Likely maliciousOne or more known...

Malware Analysis – djvu – 89c3af6bef44ab50d7be35828dc5f1e3

January 1, 2023

Score: 10 MALWARE FAMILY: djvuTAGS:family:djvu, family:vidar, botnet:19, discovery, persistence, ransomware, spyware, stealerMD5: 89c3af6bef44ab50d7be35828dc5f1e3SHA1: b2ba0715cfbe5321bbc3e265fd5ec6998ad90c8cANALYSIS DATE: 2023-01-01T11:35:04ZTTPS: T1060, T1112, T1053, T1005,...

Malware Analysis – amadey – e7f05ecc16b05f76c5a228a2b688c93e

January 1, 2023

Cobalt Stike Beacon Detected – 43[.]138[.]62[.]36:8080

January 1, 2023

The Information provided at the time of posting was detected as "Cobalt Strike". Depending on when you are viewing this...

Cobalt Stike Beacon Detected – 43[.]156[.]3[.]238:2087

January 1, 2023

The Information provided at the time of posting was detected as "Cobalt Strike". Depending on when you are viewing this...

Cobalt Stike Beacon Detected – 54[.]178[.]175[.]181:443

January 1, 2023

The Information provided at the time of posting was detected as "Cobalt Strike". Depending on when you are viewing this...

Cobalt Stike Beacon Detected – 82[.]156[.]55[.]208:7788

January 1, 2023

The Information provided at the time of posting was detected as "Cobalt Strike". Depending on when you are viewing this...

Multiple Nintendo games buffer overflow | CVE-2022-47949

January 1, 2023

NAME Multiple Nintendo games buffer overflow Platforms Affected:Nintendo Mario Kart 7 Nintendo Mario Kart 8 Nintendo Mario Kart 8 Deluxe...

memos security bypass | CVE-2022-4814

January 1, 2023

NAME memos security bypass Platforms Affected:Risk Level:8.6Exploitability:UnprovenConsequences:Bypass Security DESCRIPTION memos could allow a remote attacker to bypass security restrictions, caused...

TrueConf Server SQL Injection | CVE-2022-46763

January 1, 2023

NAME TrueConf Server SQL Injection Platforms Affected:TrueConf TrueConf Server 5.2.0.10225Risk Level:7.3Exploitability:HighConsequences:Cross-Site Scripting DESCRIPTION TrueConf Server is vulnerable to SQL injection....

LiuOS security bypass | CVE-2022-46179

January 1, 2023

NAME LiuOS security bypass Platforms Affected:LiuOS LiuOSRisk Level:8Exploitability:UnprovenConsequences:Bypass Security DESCRIPTION LiuOS could allow a local attacker to bypass security restrictions,...

memos security bypass | CVE-2022-4812

January 1, 2023

TrueConf Server SQL Injection | CVE-2022-46764

January 1, 2023

memos security bypass | CVE-2022-4813

January 1, 2023

Daily Vulnerability Trends: Sun Jan 01 2023

January 1, 2023

Daily Vulnerability Trends (sourced from VulnMon) CVE NAMECVE DescriptionCVE-2022-48196Certain NETGEAR devices are affected by a buffer overflow by an unauthenticated...

Month: January 2023

Malware Analysis – ransomware – 91ad108862744c05daa83bfe37a7c8b1

Malware Analysis – discovery – 5755c57c7d3b7304b42015c5dd34e5be

Malware Analysis – djvu – 66e2b7371289dd956427b58b8dc7eb14

Malware Analysis – amadey – 1b43fc5f83167e3ed72de7461fb2eb30

Cobalt Stike Beacon Detected – 1[.]15[.]141[.]252:5555

Cobalt Stike Beacon Detected – 85[.]209[.]135[.]49:443

Cobalt Stike Beacon Detected – 110[.]41[.]131[.]105:6666

Cobalt Stike Beacon Detected – 1[.]15[.]141[.]252:443

Malware Analysis – smokeloader – 4040afcf9849e20e9305eb95cdd68ccc

Malware Analysis – – a0affa0816e523701464051054026e1c

Malware Analysis – djvu – 89c3af6bef44ab50d7be35828dc5f1e3

Malware Analysis – amadey – e7f05ecc16b05f76c5a228a2b688c93e

Cobalt Stike Beacon Detected – 43[.]138[.]62[.]36:8080

Cobalt Stike Beacon Detected – 43[.]156[.]3[.]238:2087

Cobalt Stike Beacon Detected – 54[.]178[.]175[.]181:443

Cobalt Stike Beacon Detected – 82[.]156[.]55[.]208:7788

Multiple Nintendo games buffer overflow | CVE-2022-47949

memos security bypass | CVE-2022-4814

TrueConf Server SQL Injection | CVE-2022-46763

LiuOS security bypass | CVE-2022-46179

memos security bypass | CVE-2022-4812

TrueConf Server SQL Injection | CVE-2022-46764

memos security bypass | CVE-2022-4813

Daily Vulnerability Trends: Sun Jan 01 2023

CISA: Fortinet Updates Guidance and Indicators of Compromise following FortiManager Vulnerability Exploitation

CISA: JCDC’s Industry-Government Collaboration Speeds Mitigation of CrowdStrike IT Outage

CISA: CISA Releases Three Industrial Control Systems Advisories

CISA: CISA Releases Four Industrial Control Systems Advisories

CISA: Foreign Threat Actor Conducting Large-Scale Spear-Phishing Campaign with RDP Attachments

You may have missed