Month: March 2023

Malware Analysis – djvu – 9691efea065f013a3c8fbbd087137738

March 3, 2023

Score: 10 MALWARE FAMILY: djvuTAGS:family:djvu, family:smokeloader, family:vidar, backdoor, discovery, evasion, persistence, ransomware, spyware, stealer, trojanMD5: 9691efea065f013a3c8fbbd087137738SHA1: 88bd29dd09dd17f4e68787b671f911d37a151724ANALYSIS DATE: 2023-03-03T10:10:37ZTTPS: T1012,...

Malware Analysis – djvu – 478015b7fdf4f18d6b6ecb272e6f4ad9

March 3, 2023

Score: 10 MALWARE FAMILY: djvuTAGS:family:djvu, family:vidar, discovery, persistence, ransomware, spyware, stealerMD5: 478015b7fdf4f18d6b6ecb272e6f4ad9SHA1: 4e2ee1c868ac93a4d58a7f3ae9b3cf6f163fd5ebANALYSIS DATE: 2023-03-03T09:51:03ZTTPS: T1012, T1082, T1053, T1005, T1081,...

Cobalt Stike Beacon Detected – 1[.]13[.]165[.]208:2087

March 3, 2023

The Information provided at the time of posting was detected as "Cobalt Strike". Depending on when you are viewing this...

Cobalt Stike Beacon Detected – 20[.]212[.]22[.]151:53

March 3, 2023

The Information provided at the time of posting was detected as "Cobalt Strike". Depending on when you are viewing this...

Cobalt Stike Beacon Detected – 116[.]62[.]138[.]140:801

March 3, 2023

The Information provided at the time of posting was detected as "Cobalt Strike". Depending on when you are viewing this...

Cobalt Stike Beacon Detected – 64[.]227[.]190[.]71:443

March 3, 2023

The Information provided at the time of posting was detected as "Cobalt Strike". Depending on when you are viewing this...

Malware Analysis – djvu – 4687fd6f88441d2715a0925d9e8a589b

March 3, 2023

Score: 10 MALWARE FAMILY: djvuTAGS:family:djvu, family:vidar, discovery, persistence, ransomware, spyware, stealerMD5: 4687fd6f88441d2715a0925d9e8a589bSHA1: 08c6716bd6480d3afe3b1ba7a03d4395ad1c5073ANALYSIS DATE: 2023-03-03T10:51:49ZTTPS: T1060, T1112, T1005, T1081, T1012,...

Malware Analysis – djvu – 8e3357a9edecffea8b0f5dc22d9aacc2

March 3, 2023

Score: 10 MALWARE FAMILY: djvuTAGS:family:djvu, family:vidar, discovery, persistence, ransomware, spyware, stealerMD5: 8e3357a9edecffea8b0f5dc22d9aacc2SHA1: bcd84b4c7acd2511324ea25287d65ec48f59a560ANALYSIS DATE: 2023-03-03T11:08:04ZTTPS: T1005, T1081, T1082, T1012, T1060,...

Malware Analysis – djvu – cc8fd902ee4904d7c29e96ceac1384b1

March 3, 2023

Score: 10 MALWARE FAMILY: djvuTAGS:family:djvu, family:vidar, discovery, persistence, ransomware, spyware, stealerMD5: cc8fd902ee4904d7c29e96ceac1384b1SHA1: 6ba45d26e61a336dec373d1de4a64f89f4fdc2c6ANALYSIS DATE: 2023-03-03T11:03:36ZTTPS: T1082, T1053, T1005, T1081, T1222,...

Malware Analysis – djvu – 975e10c1763042c45b9778af90d982f0

March 3, 2023

Score: 10 MALWARE FAMILY: djvuTAGS:family:djvu, family:smokeloader, family:vidar, backdoor, discovery, persistence, ransomware, stealer, trojanMD5: 975e10c1763042c45b9778af90d982f0SHA1: 884493d24b7a814107496b296110bff7e76fa26bANALYSIS DATE: 2023-03-03T11:25:19ZTTPS: T1012, T1120, T1082,...

Cobalt Stike Beacon Detected – 116[.]204[.]211[.]163:80

March 3, 2023

The Information provided at the time of posting was detected as "Cobalt Strike". Depending on when you are viewing this...

Cobalt Stike Beacon Detected – 77[.]91[.]124[.]187:8080

March 3, 2023

The Information provided at the time of posting was detected as "Cobalt Strike". Depending on when you are viewing this...

Cobalt Stike Beacon Detected – 1[.]15[.]120[.]10:7777

March 3, 2023

The Information provided at the time of posting was detected as "Cobalt Strike". Depending on when you are viewing this...

Cobalt Stike Beacon Detected – 193[.]134[.]209[.]111:83

March 3, 2023

The Information provided at the time of posting was detected as "Cobalt Strike". Depending on when you are viewing this...

OpenSearch information disclosure | CVE-2023-25806

March 3, 2023

NAME__________OpenSearch information disclosurePlatforms Affected:OpenSearch Project OpenSearch 1.3.8 OpenSearch Project OpenSearch 2.5.0Risk Level:5.3Exploitability:UnprovenConsequences:Obtain Information DESCRIPTION__________OpenSearch could allow a remote attacker to...

GN Publisher Plugin for WordPress cross-site scripting | CVE-2023-1080

March 3, 2023

NAME__________GN Publisher Plugin for WordPress cross-site scriptingPlatforms Affected:WordPress GN Publisher Plugin for WordPress 1.5.5Risk Level:6.1Exploitability:HighConsequences:Cross-Site Scripting DESCRIPTION__________GN Publisher Plugin for...

Aruba Networks ArubaOS command execution | CVE-2023-22765

March 3, 2023

NAME__________Aruba Networks ArubaOS command executionPlatforms Affected:Aruba Networks ArubaOS 10.3.1.0 Aruba Networks ArubaOS 8.6.0.19 Aruba Networks ArubaOS 8.10.0.4 Aruba Networks SD-WAN...

Trusted Computing Group Trusted Platform Module information disclosure | US-CERT VU#782720

March 3, 2023

NAME__________Trusted Computing Group Trusted Platform Module information disclosurePlatforms Affected:Trusted Computing Group (TCG) Trusted Platform Module (TPM) 2.0Risk Level:7.5Exploitability:UnprovenConsequences:Obtain Information DESCRIPTION__________Trusted...

Aruba Networks ArubaOS command execution | CVE-2023-22768

March 3, 2023

NAME__________Aruba Networks ArubaOS command executionPlatforms Affected:Aruba Networks ArubaOS 10.3.1.0 Aruba Networks ArubaOS 8.6.0.19 Aruba Networks ArubaOS 8.10.0.4 Aruba Networks SD-WAN...

Aruba Networks ArubaOS web-based management interface command execution | CVE-2023-22758

March 3, 2023

NAME__________Aruba Networks ArubaOS web-based management interface command executionPlatforms Affected:Aruba Networks ArubaOSRisk Level:7.2Exploitability:UnprovenConsequences:Gain Access DESCRIPTION__________Aruba Networks ArubaOS web-based management interface could...

Month: March 2023

Malware Analysis – djvu – 9691efea065f013a3c8fbbd087137738

Malware Analysis – djvu – 478015b7fdf4f18d6b6ecb272e6f4ad9

Cobalt Stike Beacon Detected – 1[.]13[.]165[.]208:2087

Cobalt Stike Beacon Detected – 20[.]212[.]22[.]151:53

Cobalt Stike Beacon Detected – 116[.]62[.]138[.]140:801

Cobalt Stike Beacon Detected – 64[.]227[.]190[.]71:443

Malware Analysis – djvu – 4687fd6f88441d2715a0925d9e8a589b

Malware Analysis – djvu – 8e3357a9edecffea8b0f5dc22d9aacc2

Malware Analysis – djvu – cc8fd902ee4904d7c29e96ceac1384b1

Malware Analysis – djvu – 975e10c1763042c45b9778af90d982f0

Cobalt Stike Beacon Detected – 116[.]204[.]211[.]163:80

Cobalt Stike Beacon Detected – 77[.]91[.]124[.]187:8080

Cobalt Stike Beacon Detected – 1[.]15[.]120[.]10:7777

Cobalt Stike Beacon Detected – 193[.]134[.]209[.]111:83

OpenSearch information disclosure | CVE-2023-25806

GN Publisher Plugin for WordPress cross-site scripting | CVE-2023-1080

Aruba Networks ArubaOS command execution | CVE-2023-22765

Trusted Computing Group Trusted Platform Module information disclosure | US-CERT VU#782720

Aruba Networks ArubaOS command execution | CVE-2023-22768

Aruba Networks ArubaOS web-based management interface command execution | CVE-2023-22758

Aruba Networks ArubaOS command execution | CVE-2023-22766

Tenda products command execution | CVE-2023-23080

Download Read More Excerpt Link Plugin for WordPress cross-site request forgery | CVE-2023-1068

Aruba Networks ArubaOS command execution | CVE-2023-22763

[SAFEPAY] – Ransomware Victim: titlenine[.]com

CVE Alert: CVE-2024-11362

CVE Alert: CVE-2024-10874

CVE Alert: CVE-2024-10961

CVE Alert: CVE-2024-10886

You may have missed