LockBit 3.0 Ransomware Victim: mrkpc[.]com
LockBit 3.0 Ransomware NOTE: No files or stolen information are by RedPacket Security. Any legal issues relating to the content...
Month: February 2023
LockBit 3.0 Ransomware Victim: covermeinsurance[.]com
LockBit 3.0 Ransomware NOTE: No files or stolen information are by RedPacket Security. Any legal issues relating to the content...
LockBit 3.0 Ransomware Victim: qsi-q3[.]de
LockBit 3.0 Ransomware NOTE: No files or stolen information are by RedPacket Security. Any legal issues relating to the content...
Cobalt Stike Beacon Detected – 120[.]76[.]205[.]155:8090
The Information provided at the time of posting was detected as "Cobalt Strike". Depending on when you are viewing this...
Cobalt Stike Beacon Detected – 43[.]136[.]168[.]94:8443
The Information provided at the time of posting was detected as "Cobalt Strike". Depending on when you are viewing this...
Cobalt Stike Beacon Detected – 104[.]237[.]149[.]115:8084
The Information provided at the time of posting was detected as "Cobalt Strike". Depending on when you are viewing this...
Malware Analysis – djvu – a7c1891fa46875989205d76567a8975f
Score: 10 MALWARE FAMILY: djvuTAGS:family:djvu, family:rhadamanthys, family:smokeloader, backdoor, discovery, persistence, ransomware, stealer, trojan, vmprotectMD5: a7c1891fa46875989205d76567a8975fSHA1: 3ccbba1b2ec99f9d6e4eca2332f0d20cb22829dfANALYSIS DATE: 2023-02-12T09:11:04ZTTPS: T1082, T1012,...
Malware Analysis – banker – 757ecb313fa062bd376df95e00b64627
Score: 8 MALWARE FAMILY: bankerTAGS:banker, ransomwareMD5: 757ecb313fa062bd376df95e00b64627SHA1: 336fc4bf6a46e78c41b98cdace7348ff70e800f0ANALYSIS DATE: 2023-01-30T09:06:35ZTTPS: ScoreMeaningExample10Known badA malware family was detected.8-9Likely maliciousOne or more known...
Cobalt Stike Beacon Detected – 107[.]172[.]208[.]88:443
The Information provided at the time of posting was detected as "Cobalt Strike". Depending on when you are viewing this...
Cobalt Stike Beacon Detected – 107[.]148[.]149[.]21:80
The Information provided at the time of posting was detected as "Cobalt Strike". Depending on when you are viewing this...
Cobalt Stike Beacon Detected – 108[.]165[.]178[.]42:443
The Information provided at the time of posting was detected as "Cobalt Strike". Depending on when you are viewing this...
Cobalt Stike Beacon Detected – 43[.]142[.]73[.]5:443
The Information provided at the time of posting was detected as "Cobalt Strike". Depending on when you are viewing this...
Malware Analysis – smokeloader – 3b22e5432ed609b29d6f2620161debcd
Score: 10 MALWARE FAMILY: smokeloaderTAGS:family:smokeloader, backdoor, trojanMD5: 3b22e5432ed609b29d6f2620161debcdSHA1: 3b40352996f3a9db62a39e82c7f92eefa4e73bd3ANALYSIS DATE: 2023-02-12T09:31:05ZTTPS: T1012, T1120, T1082 ScoreMeaningExample10Known badA malware family was detected.8-9Likely...
Malware Analysis – smokeloader – 4252a5583234f80329ef453dfd253be4
Score: 10 MALWARE FAMILY: smokeloaderTAGS:family:smokeloader, backdoor, trojanMD5: 4252a5583234f80329ef453dfd253be4SHA1: 87a8a128ce59ff461724eedde72fec288bcbba11ANALYSIS DATE: 2023-02-12T09:17:09ZTTPS: T1012, T1120, T1082 ScoreMeaningExample10Known badA malware family was detected.8-9Likely...
Malware Analysis – djvu – fcad46ff6a14f8bab7b7b22a93f3557a
Score: 10 MALWARE FAMILY: djvuTAGS:family:djvu, discovery, persistence, ransomwareMD5: fcad46ff6a14f8bab7b7b22a93f3557aSHA1: 91829e367a65b5d3cedac193235bf1871de922eaANALYSIS DATE: 2023-02-12T09:26:54ZTTPS: T1060, T1112, T1222, T1082, T1053 ScoreMeaningExample10Known badA malware...
Malware Analysis – djvu – 630717681fcc3eea95825d3fd0c489f1
Score: 10 MALWARE FAMILY: djvuTAGS:family:djvu, family:vidar, botnet:19, discovery, persistence, ransomware, spyware, stealerMD5: 630717681fcc3eea95825d3fd0c489f1SHA1: ba5a2c63e7c4a2ef7587da8c0dfbb5aefb6cef1dANALYSIS DATE: 2023-02-12T09:47:18ZTTPS: T1053, T1005, T1081, T1012,...
Malware Analysis – djvu – a291f52688753bfec2f04434a6275823
Score: 10 MALWARE FAMILY: djvuTAGS:family:djvu, family:rhadamanthys, family:smokeloader, backdoor, discovery, persistence, ransomware, stealer, trojan, vmprotectMD5: a291f52688753bfec2f04434a6275823SHA1: 56f088a229ca6e97b6f9bf97953d22eb0317d7caANALYSIS DATE: 2023-02-12T10:41:53ZTTPS: T1012, T1082,...
Malware Analysis – – d5671758956b39e048680b6a8275e96a
Score: 1 MALWARE FAMILY: TAGS:MD5: d5671758956b39e048680b6a8275e96aSHA1: 33c341130bf9c93311001a6284692c86fec200efANALYSIS DATE: 2023-02-12T10:29:50ZTTPS: ScoreMeaningExample10Known badA malware family was detected.8-9Likely maliciousOne or more known damaging...
Malware Analysis – djvu – e8f4df71d5b432592e1773af5894a497
Score: 10 MALWARE FAMILY: djvuTAGS:family:djvu, family:vidar, botnet:19, discovery, persistence, ransomware, spyware, stealerMD5: e8f4df71d5b432592e1773af5894a497SHA1: c1fbe81d2d02d340c85929b4b9b0e26c4deb2927ANALYSIS DATE: 2023-02-12T11:50:41ZTTPS: T1053, T1005, T1081, T1012,...
Malware Analysis – smokeloader – bf216a294f44d0e6ab8cf375867d0ccc
Score: 10 MALWARE FAMILY: smokeloaderTAGS:family:smokeloader, backdoor, trojanMD5: bf216a294f44d0e6ab8cf375867d0cccSHA1: 0f2c939a394bed4166500e37dfaf89c18211296aANALYSIS DATE: 2023-02-12T11:35:07ZTTPS: T1012, T1120, T1082 ScoreMeaningExample10Known badA malware family was detected.8-9Likely...
Qualcomm Chipsets denial of service | CVE-2022-40513
NAME__________Qualcomm Chipsets denial of servicePlatforms Affected:Risk Level:7.5Exploitability:UnprovenConsequences:Denial of Service DESCRIPTION__________Qualcomm Chipsets are vulnerable to a denial of service, caused by...
Qualcomm Chipsets denial of service | CVE-2022-40502
NAME__________Qualcomm Chipsets denial of servicePlatforms Affected:Risk Level:7.5Exploitability:UnprovenConsequences:Denial of Service DESCRIPTION__________Qualcomm Chipsets are vulnerable to a denial of service, caused by...
MediaTek Android privilege escalation | CVE-2022-32654
NAME__________MediaTek Android privilege escalationPlatforms Affected:Risk Level:6.7Exploitability:UnprovenConsequences:Gain Privilege DESCRIPTION__________MediaTek Android could allow a local authenticated attacker to gain elevated privileges on...
Anchore Syft information disclosure | CVE-2023-24827
NAME__________Anchore Syft information disclosurePlatforms Affected:Anchore Syft 0.69.0Risk Level:6.5Exploitability:UnprovenConsequences:Obtain Information DESCRIPTION__________Anchore Syft could allow a remote attacker to obtain sensitive information,...
