Month: February 2023

Malware Analysis – djvu – 242a5bd17728897955589eb0bc5849ab

February 25, 2023

Score: 10 MALWARE FAMILY: djvuTAGS:family:djvu, family:vidar, discovery, persistence, ransomware, spyware, stealerMD5: 242a5bd17728897955589eb0bc5849abSHA1: 5f6fd9f4eda88306690b2d052495990a58d58d20ANALYSIS DATE: 2023-02-25T17:46:58ZTTPS: T1012, T1082, T1005, T1081, T1060,...

Malware Analysis – djvu – d377a439774611dde5416a3662e84c9e

February 25, 2023

Score: 10 MALWARE FAMILY: djvuTAGS:family:djvu, family:pseudomanuscrypt, family:smokeloader, family:vidar, backdoor, discovery, evasion, loader, persistence, ransomware, stealer, trojan, vmprotectMD5: d377a439774611dde5416a3662e84c9eSHA1: 59368d88a4b9084997f8de8b6014a306fb46de86ANALYSIS DATE:...

Malware Analysis – djvu – 4aceacc0ff479cea25d311326bbce89d

February 25, 2023

Score: 10 MALWARE FAMILY: djvuTAGS:family:djvu, family:vidar, discovery, persistence, ransomware, spyware, stealerMD5: 4aceacc0ff479cea25d311326bbce89dSHA1: e3d8e39cdade49720cc365dc8f7cedc361ec8e3fANALYSIS DATE: 2023-02-25T17:44:30ZTTPS: T1222, T1060, T1112, T1082, T1005,...

LockBit 3.0 Ransomware Victim: ispace[.]com

February 25, 2023

LockBit 3.0 Ransomware NOTE: No files or stolen information are by RedPacket Security. Any legal issues relating to the content...

Malware Analysis – djvu – 6b5e1e3b7a369a9160c0248eb0250568

February 25, 2023

Score: 10 MALWARE FAMILY: djvuTAGS:family:djvu, family:smokeloader, family:vidar, backdoor, discovery, evasion, persistence, ransomware, stealer, trojan, vmprotectMD5: 6b5e1e3b7a369a9160c0248eb0250568SHA1: 391842386166bfa74b59106ffb9a6bfb15429b48ANALYSIS DATE: 2023-02-25T09:35:25ZTTPS: T1012,...

Malware Analysis – djvu – 08c55cefe844a3447f6cc89f4f6410f0

February 25, 2023

Score: 10 MALWARE FAMILY: djvuTAGS:family:djvu, family:pseudomanuscrypt, family:smokeloader, family:vidar, backdoor, discovery, evasion, loader, persistence, ransomware, stealer, trojan, vmprotectMD5: 08c55cefe844a3447f6cc89f4f6410f0SHA1: 9e9514ef94066df1398f5c2f92a10f322e015e80ANALYSIS DATE:...

Malware Analysis – djvu – fc1ead7c27d8c4af3ee4684a615689c4

February 25, 2023

Score: 10 MALWARE FAMILY: djvuTAGS:family:djvu, family:vidar, discovery, persistence, ransomware, spyware, stealerMD5: fc1ead7c27d8c4af3ee4684a615689c4SHA1: d821d2777cd30b10d87ed8315e4f643477170773ANALYSIS DATE: 2023-02-25T09:32:54ZTTPS: T1053, T1012, T1005, T1081, T1060,...

Malware Analysis – djvu – 73c4dff369657cbaba4b2f6e9a2397c7

February 25, 2023

Score: 10 MALWARE FAMILY: djvuTAGS:family:djvu, family:vidar, discovery, persistence, ransomware, spyware, stealerMD5: 73c4dff369657cbaba4b2f6e9a2397c7SHA1: e323c9ef5e8f7e90c539551e742807c7455a56fbANALYSIS DATE: 2023-02-25T09:42:50ZTTPS: T1005, T1081, T1012, T1082, T1222,...

Cobalt Stike Beacon Detected – 139[.]180[.]193[.]248:9000

February 25, 2023

The Information provided at the time of posting was detected as "Cobalt Strike". Depending on when you are viewing this...

Cobalt Stike Beacon Detected – 198[.]211[.]9[.]165:81

February 25, 2023

The Information provided at the time of posting was detected as "Cobalt Strike". Depending on when you are viewing this...

Cobalt Stike Beacon Detected – 43[.]156[.]34[.]251:443

February 25, 2023

The Information provided at the time of posting was detected as "Cobalt Strike". Depending on when you are viewing this...

Malware Analysis – djvu – 3ad617705eb60bea01b35ebfdec9387c

February 25, 2023

Score: 10 MALWARE FAMILY: djvuTAGS:family:djvu, family:vidar, discovery, persistence, ransomware, spyware, stealerMD5: 3ad617705eb60bea01b35ebfdec9387cSHA1: 37ba7d4428f89d2065d07e0dea412f507cdb7438ANALYSIS DATE: 2023-02-25T10:35:16ZTTPS: T1005, T1081, T1053, T1012, T1060,...

Malware Analysis – djvu – 92712260bd169a57dc97ca60777714fc

February 25, 2023

Score: 10 MALWARE FAMILY: djvuTAGS:family:djvu, family:pseudomanuscrypt, family:smokeloader, family:vidar, backdoor, discovery, evasion, loader, persistence, ransomware, stealer, trojan, vmprotectMD5: 92712260bd169a57dc97ca60777714fcSHA1: f681cba7d6305d9a2adce37bb358c8024a1c9bdbANALYSIS DATE:...

Malware Analysis – discovery – 12d36f901366740c1da210d62e05b98a

February 25, 2023

Score: 8 MALWARE FAMILY: discoveryTAGS:discovery, exploitMD5: 12d36f901366740c1da210d62e05b98aSHA1: 8d13b7aef049bdda83a390f2c7b022914defc15bANALYSIS DATE: 2023-02-25T09:58:50ZTTPS: T1222, T1012, T1082 ScoreMeaningExample10Known badA malware family was detected.8-9Likely maliciousOne...

Malware Analysis – djvu – 6a4db9167cb6ae1dbdb0516bc394d427

February 25, 2023

Score: 10 MALWARE FAMILY: djvuTAGS:family:djvu, discovery, persistence, ransomwareMD5: 6a4db9167cb6ae1dbdb0516bc394d427SHA1: c3a4997d48b4136086323501468b963a0ab7a2faANALYSIS DATE: 2023-02-25T11:31:59ZTTPS: T1060, T1112, T1222, T1082, T1012, T1053 ScoreMeaningExample10Known badA...

Cobalt Stike Beacon Detected – 209[.]133[.]211[.]242:80

February 25, 2023

The Information provided at the time of posting was detected as "Cobalt Strike". Depending on when you are viewing this...

Cobalt Stike Beacon Detected – 8[.]142[.]124[.]166:8090

February 25, 2023

The Information provided at the time of posting was detected as "Cobalt Strike". Depending on when you are viewing this...

Cobalt Stike Beacon Detected – 101[.]37[.]33[.]153:87

February 25, 2023

The Information provided at the time of posting was detected as "Cobalt Strike". Depending on when you are viewing this...

Cobalt Stike Beacon Detected – 198[.]211[.]9[.]165:443

February 25, 2023

The Information provided at the time of posting was detected as "Cobalt Strike". Depending on when you are viewing this...

Cisco Firepower 4100, 9300 Security Appliances, and UCS Fabric Interconnects command execution | CVE-2023-20015

February 25, 2023

NAME__________Cisco Firepower 4100, 9300 Security Appliances, and UCS Fabric Interconnects command executionPlatforms Affected:Cisco UCS 6200 Series Fabric Interconnects Cisco UCS...

Gradio default account | CVE-2023-25823

February 25, 2023

NAME__________Gradio default accountPlatforms Affected:Risk Level:5.4Exploitability:UnprovenConsequences:Gain Access DESCRIPTION__________Gradio contains default hardcoded credentials. A remote attacker could exploit this vulnerability to gain...

JetBrains TeamCity cross-site scripting | CVE-2022-48343

February 25, 2023

NAME__________JetBrains TeamCity cross-site scriptingPlatforms Affected:Risk Level:5.4Exploitability:UnprovenConsequences:Cross-Site Scripting DESCRIPTION__________JetBrains TeamCity is vulnerable to cross-site scripting, caused by improper validation of user-supplied...

MuYuCMS directory traversal | CVE-2023-1002

February 25, 2023

NAME__________MuYuCMS directory traversalPlatforms Affected:Risk Level:7.5Exploitability:UnprovenConsequences:Obtain Information DESCRIPTION__________MuYuCMS could allow a remote attacker to traverse directories on the system, caused by...

JetBrains TeamCity cross-site scripting | CVE-2022-48344

February 25, 2023

Month: February 2023

Malware Analysis – djvu – 242a5bd17728897955589eb0bc5849ab

Malware Analysis – djvu – d377a439774611dde5416a3662e84c9e

Malware Analysis – djvu – 4aceacc0ff479cea25d311326bbce89d

LockBit 3.0 Ransomware Victim: ispace[.]com

Malware Analysis – djvu – 6b5e1e3b7a369a9160c0248eb0250568

Malware Analysis – djvu – 08c55cefe844a3447f6cc89f4f6410f0

Malware Analysis – djvu – fc1ead7c27d8c4af3ee4684a615689c4

Malware Analysis – djvu – 73c4dff369657cbaba4b2f6e9a2397c7

Cobalt Stike Beacon Detected – 139[.]180[.]193[.]248:9000

Cobalt Stike Beacon Detected – 198[.]211[.]9[.]165:81

Cobalt Stike Beacon Detected – 43[.]156[.]34[.]251:443

Malware Analysis – djvu – 3ad617705eb60bea01b35ebfdec9387c

Malware Analysis – djvu – 92712260bd169a57dc97ca60777714fc

Malware Analysis – discovery – 12d36f901366740c1da210d62e05b98a

Malware Analysis – djvu – 6a4db9167cb6ae1dbdb0516bc394d427

Cobalt Stike Beacon Detected – 209[.]133[.]211[.]242:80

Cobalt Stike Beacon Detected – 8[.]142[.]124[.]166:8090

Cobalt Stike Beacon Detected – 101[.]37[.]33[.]153:87

Cobalt Stike Beacon Detected – 198[.]211[.]9[.]165:443

Cisco Firepower 4100, 9300 Security Appliances, and UCS Fabric Interconnects command execution | CVE-2023-20015

Gradio default account | CVE-2023-25823

JetBrains TeamCity cross-site scripting | CVE-2022-48343

MuYuCMS directory traversal | CVE-2023-1002

JetBrains TeamCity cross-site scripting | CVE-2022-48344

CVE Alert: CVE-2024-51480

CVE Alert: CVE-2024-11423

CVE Alert: CVE-2024-51737

CVE Alert: CVE-2024-55656

CVE Alert: CVE-2025-21102

You may have missed