Month: March 2023

DOS SS1 and Rakuraku PC Cloud information disclosure | CVE-2023-22336

March 2, 2023

NAME__________DOS SS1 and Rakuraku PC Cloud information disclosurePlatforms Affected:DOS SS1 13.0.0.40 DOS Rakuraku PC Cloud Agent 2.1.8Risk Level:5.3Exploitability:UnprovenConsequences:Data Manipulation DESCRIPTION__________DOS...

DOS SS1 and Rakuraku PC Cloud default account | CVE-2023-22344

March 2, 2023

NAME__________DOS SS1 and Rakuraku PC Cloud default accountPlatforms Affected:DOS SS1 13.0.0.40 DOS Rakuraku PC Cloud Agent 2.1.8Risk Level:5.3Exploitability:UnprovenConsequences:Obtain Information DESCRIPTION__________DOS...

Arubanetworks ArubaOS command execution | CVE-2023-22762

March 2, 2023

NAME__________Arubanetworks ArubaOS command executionPlatforms Affected:Aruba Networks ArubaOS 10.3.1.0 Aruba Networks ArubaOS 8.6.0.19 Aruba Networks ArubaOS 8.10.0.4 Aruba Networks SD-WAN 8.7.0.0-2.3.0.8Risk...

Aruba Networks ArubaOS security bypass | CVE-2023-22771

March 2, 2023

NAME__________Aruba Networks ArubaOS security bypassPlatforms Affected:Aruba Networks ArubaOS 10.3.1.0 Aruba Networks ArubaOS 10.3.0.0 Aruba Networks ArubaOS 8.6.0 Aruba Networks ArubaOS...

Dell PowerScale nodes denial of service | CVE-2023-23689

March 2, 2023

NAME__________Dell PowerScale nodes denial of servicePlatforms Affected:Risk Level:5.3Exploitability:UnprovenConsequences:Denial of Service DESCRIPTION__________Dell PowerScale nodes is vulnerable to a denial of service,...

Cisco IP Phone 6800, 7800, and 8800 Series denial of service | CVE-2023-20079

March 2, 2023

NAME__________Cisco IP Phone 6800, 7800, and 8800 Series denial of servicePlatforms Affected:Cisco IP Phone 6800 Series Cisco IP Phone 7800...

Linux Kernel denial of service | CVE-2023-1076

March 2, 2023

NAME__________Linux Kernel denial of servicePlatforms Affected:Linux KernelRisk Level:6.2Exploitability:UnprovenConsequences:Denial of Service DESCRIPTION__________Linux Kernel is vulnerable to a denial of service, caused...

SysUpdate Malware Strikes Again with Linux Version and New Evasion Tactics

March 2, 2023

The threat actor known as Lucky Mouse has developed a Linux version of a malware toolkit called SysUpdate, expanding on...

Daily Vulnerability Trends: Thu Mar 02 2023

March 2, 2023

Daily Vulnerability Trends (sourced from VulnMon) CVE NAMECVE DescriptionCVE-2022-40684An authentication bypass using an alternate path or channel in Fortinet FortiOS...

LockBit 3.0 Ransomware Victim: ascentengrs[.]com

March 2, 2023

LockBit 3.0 Ransomware NOTE: No files or stolen information are by RedPacket Security. Any legal issues relating to the content...

Malware Analysis – djvu – 6734fa8c61596e7943f5f21a7826ea50

March 2, 2023

Score: 10 MALWARE FAMILY: djvuTAGS:family:djvu, family:smokeloader, family:vidar, backdoor, discovery, persistence, ransomware, stealer, trojanMD5: 6734fa8c61596e7943f5f21a7826ea50SHA1: f01d350779e9a8259bb0d615002307fcbfe618e1ANALYSIS DATE: 2023-03-02T04:08:19ZTTPS: T1012, T1082, T1120,...

Malware Analysis – ransomware – 3385773c615affb24f66c5894f257bbc

March 2, 2023

Score: 7 MALWARE FAMILY: ransomwareTAGS:ransomwareMD5: 3385773c615affb24f66c5894f257bbcSHA1: a6a57fa162e552f011970a5a01c2a1450a5ae4f3ANALYSIS DATE: 2023-03-02T04:43:50ZTTPS: ScoreMeaningExample10Known badA malware family was detected.8-9Likely maliciousOne or more known damaging...

Malware Analysis – djvu – f448b1e332b316521904e002e3947774

March 2, 2023

Score: 10 MALWARE FAMILY: djvuTAGS:family:djvu, family:vidar, discovery, persistence, ransomware, spyware, stealerMD5: f448b1e332b316521904e002e3947774SHA1: ecb650c25c40e5cd76198f469d08f3b6a82b61f0ANALYSIS DATE: 2023-03-02T04:46:36ZTTPS: T1005, T1081, T1060, T1112, T1222,...

Malware Analysis – asyncrat – fb14b42cf21c9a8d2e0780747d20b64a

March 2, 2023

Score: 10 MALWARE FAMILY: asyncratTAGS:family:asyncrat, evasion, rat, themida, trojanMD5: fb14b42cf21c9a8d2e0780747d20b64aSHA1: 462bdf4847340a4da583a0321bc8efc5819de8f6ANALYSIS DATE: 2023-03-02T04:22:17ZTTPS: T1082, T1012, T1497 ScoreMeaningExample10Known badA malware family...

Malware Analysis – ransomware – 7d1cf6af55e3579725f16724463201c3

March 2, 2023

Score: 5 MALWARE FAMILY: ransomwareTAGS:ransomwareMD5: 7d1cf6af55e3579725f16724463201c3SHA1: 53788e49d16137b86c90ed906969c52c8a18b26dANALYSIS DATE: 2023-03-02T05:43:13ZTTPS: ScoreMeaningExample10Known badA malware family was detected.8-9Likely maliciousOne or more known damaging...

Malware Analysis – djvu – 28beebe57db41c975b328a487beba33a

March 2, 2023

Score: 10 MALWARE FAMILY: djvuTAGS:family:djvu, family:smokeloader, family:vidar, backdoor, discovery, persistence, ransomware, stealer, trojanMD5: 28beebe57db41c975b328a487beba33aSHA1: 1827147c4ef25a00bdf81b4184bc491ba6fb2bdaANALYSIS DATE: 2023-03-02T05:32:16ZTTPS: T1222, T1053, T1060,...

Malware Analysis – djvu – d6afa8fdf867890a84baf35b18cc1c1c

March 2, 2023

Score: 10 MALWARE FAMILY: djvuTAGS:family:djvu, family:vidar, discovery, persistence, ransomware, spyware, stealerMD5: d6afa8fdf867890a84baf35b18cc1c1cSHA1: 1a7da78728b9e47309a84bed604a0eb4974c34ceANALYSIS DATE: 2023-03-02T05:00:11ZTTPS: T1222, T1082, T1012, T1005, T1081,...

Malware Analysis – ransomware – 8e85fe825200719b9eb15275b12fd368

March 2, 2023

Score: 10 MALWARE FAMILY: ransomwareTAGS:ransomwareMD5: 8e85fe825200719b9eb15275b12fd368SHA1: 4425666e39ff70513640d8f0b3a320fdc5100cf5ANALYSIS DATE: 2023-03-02T05:23:33ZTTPS: ScoreMeaningExample10Known badA malware family was detected.8-9Likely maliciousOne or more known damaging...

Month: March 2023

DOS SS1 and Rakuraku PC Cloud information disclosure | CVE-2023-22336

DOS SS1 and Rakuraku PC Cloud default account | CVE-2023-22344

Arubanetworks ArubaOS command execution | CVE-2023-22762

Aruba Networks ArubaOS security bypass | CVE-2023-22771

Dell PowerScale nodes denial of service | CVE-2023-23689

Cisco IP Phone 6800, 7800, and 8800 Series denial of service | CVE-2023-20079

Linux Kernel denial of service | CVE-2023-1076

SysUpdate Malware Strikes Again with Linux Version and New Evasion Tactics

Daily Vulnerability Trends: Thu Mar 02 2023

LockBit 3.0 Ransomware Victim: ascentengrs[.]com

Malware Analysis – djvu – 6734fa8c61596e7943f5f21a7826ea50

Malware Analysis – ransomware – 3385773c615affb24f66c5894f257bbc

Malware Analysis – djvu – f448b1e332b316521904e002e3947774

Malware Analysis – asyncrat – fb14b42cf21c9a8d2e0780747d20b64a

Malware Analysis – ransomware – 7d1cf6af55e3579725f16724463201c3

Malware Analysis – djvu – 28beebe57db41c975b328a487beba33a

Malware Analysis – djvu – d6afa8fdf867890a84baf35b18cc1c1c

Malware Analysis – ransomware – 8e85fe825200719b9eb15275b12fd368

Critical Flaw in Cisco IP Phone Series Exposes Users to Command Injection Attack

Cobalt Stike Beacon Detected – 89[.]117[.]113[.]193:8765

Cobalt Stike Beacon Detected – 47[.]88[.]88[.]59:8090

Cobalt Stike Beacon Detected – 218[.]11[.]133[.]33:8805

Cobalt Stike Beacon Detected – 47[.]242[.]72[.]118:80

Cobalt Stike Beacon Detected – 54[.]238[.]255[.]15:443

Cobalt Strike Beacon Detected – 198[.]181[.]32[.]32:80

Cobalt Strike Beacon Detected – 101[.]126[.]18[.]76:7979

Cobalt Strike Beacon Detected – 1[.]117[.]72[.]208:8080

Cobalt Strike Beacon Detected – 103[.]231[.]74[.]38:8443

Cobalt Strike Beacon Detected – 147[.]182[.]192[.]11:443

You may have missed