Month: March 2023

Malware Analysis – smokeloader – 45e9ebac4458e3e5bfd25e9ced12442d

March 8, 2023

Score: 10 MALWARE FAMILY: smokeloaderTAGS:family:smokeloader, backdoor, trojanMD5: 45e9ebac4458e3e5bfd25e9ced12442dSHA1: 581159e264a22f962795e53b058dcd8a47056042ANALYSIS DATE: 2023-03-08T11:25:05ZTTPS: T1012, T1120, T1082 ScoreMeaningExample10Known badA malware family was detected.8-9Likely...

Cobalt Stike Beacon Detected – 124[.]220[.]45[.]192:80

March 8, 2023

The Information provided at the time of posting was detected as "Cobalt Strike". Depending on when you are viewing this...

Cobalt Stike Beacon Detected – 43[.]140[.]193[.]29:80

March 8, 2023

The Information provided at the time of posting was detected as "Cobalt Strike". Depending on when you are viewing this...

Cobalt Stike Beacon Detected – 194[.]135[.]24[.]246:80

March 8, 2023

The Information provided at the time of posting was detected as "Cobalt Strike". Depending on when you are viewing this...

Cobalt Stike Beacon Detected – 216[.]83[.]45[.]175:8443

March 8, 2023

The Information provided at the time of posting was detected as "Cobalt Strike". Depending on when you are viewing this...

Posh C2 Detected – 95[.]248[.]117[.]142:443

March 8, 2023

The Information provided at the time of posting was detected as "Posh C2". Depending on when you are viewing this...

Cobalt Stike Beacon Detected – 116[.]62[.]218[.]6:2222

March 8, 2023

The Information provided at the time of posting was detected as "Cobalt Strike". Depending on when you are viewing this...

Cobalt Stike Beacon Detected – 77[.]91[.]78[.]185:80

March 8, 2023

The Information provided at the time of posting was detected as "Cobalt Strike". Depending on when you are viewing this...

Cobalt Stike Beacon Detected – 54[.]36[.]102[.]43:443

March 8, 2023

The Information provided at the time of posting was detected as "Cobalt Strike". Depending on when you are viewing this...

Cobalt Stike Beacon Detected – 45[.]227[.]255[.]185:80

March 8, 2023

The Information provided at the time of posting was detected as "Cobalt Strike". Depending on when you are viewing this...

Cobalt Stike Beacon Detected – 124[.]223[.]91[.]53:80

March 8, 2023

The Information provided at the time of posting was detected as "Cobalt Strike". Depending on when you are viewing this...

Cobalt Stike Beacon Detected – 192[.]211[.]55[.]118:82

March 8, 2023

The Information provided at the time of posting was detected as "Cobalt Strike". Depending on when you are viewing this...

Cobalt Stike Beacon Detected – 81[.]68[.]136[.]116:443

March 8, 2023

The Information provided at the time of posting was detected as "Cobalt Strike". Depending on when you are viewing this...

Cobalt Stike Beacon Detected – 47[.]95[.]149[.]125:9999

March 8, 2023

The Information provided at the time of posting was detected as "Cobalt Strike". Depending on when you are viewing this...

Cobalt Stike Beacon Detected – 39[.]98[.]182[.]254:80

March 8, 2023

The Information provided at the time of posting was detected as "Cobalt Strike". Depending on when you are viewing this...

Cobalt Stike Beacon Detected – 114[.]115[.]135[.]149:50050

March 8, 2023

The Information provided at the time of posting was detected as "Cobalt Strike". Depending on when you are viewing this...

Malware Analysis – djvu – b9cb1b0a55dcf4d065422a2b4ea694fe

March 7, 2023

Score: 10 MALWARE FAMILY: djvuTAGS:family:djvu, family:vidar, discovery, persistence, ransomware, spyware, stealerMD5: b9cb1b0a55dcf4d065422a2b4ea694feSHA1: b67e999f4cfe34e85d3ab9446668cd4d4f9ca865ANALYSIS DATE: 2023-03-07T15:20:47ZTTPS: T1060, T1112, T1012, T1082, T1053,...

Malware Analysis – – 8237549d0f3175eb29b0f4fe0b641364

March 7, 2023

Score: 1 MALWARE FAMILY: TAGS:MD5: 8237549d0f3175eb29b0f4fe0b641364SHA1: 9222774ac583f059bebe81a6bdebd0854f0ad131ANALYSIS DATE: 2023-03-07T15:39:56ZTTPS: T1130, T1112 ScoreMeaningExample10Known badA malware family was detected.8-9Likely maliciousOne or more...

Malware Analysis – ransomware – 5d2b525369fa3448cc680ecc2750c5d4

March 7, 2023

Score: 8 MALWARE FAMILY: ransomwareTAGS:ransomware, spyware, stealerMD5: 5d2b525369fa3448cc680ecc2750c5d4SHA1: 9b5105b043a56bbc89a265028346e43cbed5b436ANALYSIS DATE: 2023-03-07T16:07:51ZTTPS: T1005, T1081 ScoreMeaningExample10Known badA malware family was detected.8-9Likely maliciousOne...

Malware Analysis – djvu – 0024490531d32328a77476d4fe97fa8a

March 7, 2023

Score: 10 MALWARE FAMILY: djvuTAGS:family:djvu, family:vidar, discovery, persistence, ransomware, spyware, stealerMD5: 0024490531d32328a77476d4fe97fa8aSHA1: e2d482d70d1bb2fe14740b0cf4308b1989f8887cANALYSIS DATE: 2023-03-07T16:22:48ZTTPS: T1082, T1005, T1081, T1012, T1060,...

Malware Analysis – djvu – 30a433165615cb3a20df6f0f8b30ed42

March 7, 2023

Score: 10 MALWARE FAMILY: djvuTAGS:family:djvu, family:vidar, discovery, persistence, ransomware, spyware, stealerMD5: 30a433165615cb3a20df6f0f8b30ed42SHA1: dd709abaaf76c777a009706d7c1c0a1ce91d327cANALYSIS DATE: 2023-03-07T17:05:26ZTTPS: T1060, T1112, T1082, T1012, T1222,...

Malware Analysis – djvu – 839d93c22afa775900d65606fea333cf

March 7, 2023

Score: 10 MALWARE FAMILY: djvuTAGS:family:djvu, family:vidar, discovery, persistence, ransomware, spyware, stealerMD5: 839d93c22afa775900d65606fea333cfSHA1: 08a0dfaffb487977f2ad7538a3458b6532b1cf10ANALYSIS DATE: 2023-03-07T17:30:40ZTTPS: T1222, T1012, T1082, T1005, T1081,...

Malware Analysis – ransomware – 48fb1f1225e69e524340113503fcbc5d

March 7, 2023

Score: 6 MALWARE FAMILY: ransomwareTAGS:ransomwareMD5: 48fb1f1225e69e524340113503fcbc5dSHA1: 26a45db8fecf464aef9969e04bdf47c111278f47ANALYSIS DATE: 2023-03-07T17:17:27ZTTPS: ScoreMeaningExample10Known badA malware family was detected.8-9Likely maliciousOne or more known damaging...

Malware Analysis – djvu – 36e080712ebf97abfff61ae7cc1ea154

March 7, 2023

Score: 10 MALWARE FAMILY: djvuTAGS:family:djvu, family:vidar, discovery, persistence, ransomware, spyware, stealerMD5: 36e080712ebf97abfff61ae7cc1ea154SHA1: 363e7024e477b80f536fb7676dcf00a2ae0e4529ANALYSIS DATE: 2023-03-07T17:50:26ZTTPS: T1005, T1081, T1012, T1082, T1222,...

Month: March 2023

Malware Analysis – smokeloader – 45e9ebac4458e3e5bfd25e9ced12442d

Cobalt Stike Beacon Detected – 124[.]220[.]45[.]192:80

Cobalt Stike Beacon Detected – 43[.]140[.]193[.]29:80

Cobalt Stike Beacon Detected – 194[.]135[.]24[.]246:80

Cobalt Stike Beacon Detected – 216[.]83[.]45[.]175:8443

Posh C2 Detected – 95[.]248[.]117[.]142:443

Cobalt Stike Beacon Detected – 116[.]62[.]218[.]6:2222

Cobalt Stike Beacon Detected – 77[.]91[.]78[.]185:80

Cobalt Stike Beacon Detected – 54[.]36[.]102[.]43:443

Cobalt Stike Beacon Detected – 45[.]227[.]255[.]185:80

Cobalt Stike Beacon Detected – 124[.]223[.]91[.]53:80

Cobalt Stike Beacon Detected – 192[.]211[.]55[.]118:82

Cobalt Stike Beacon Detected – 81[.]68[.]136[.]116:443

Cobalt Stike Beacon Detected – 47[.]95[.]149[.]125:9999

Cobalt Stike Beacon Detected – 39[.]98[.]182[.]254:80

Cobalt Stike Beacon Detected – 114[.]115[.]135[.]149:50050

Malware Analysis – djvu – b9cb1b0a55dcf4d065422a2b4ea694fe

Malware Analysis – – 8237549d0f3175eb29b0f4fe0b641364

Malware Analysis – ransomware – 5d2b525369fa3448cc680ecc2750c5d4

Malware Analysis – djvu – 0024490531d32328a77476d4fe97fa8a

Malware Analysis – djvu – 30a433165615cb3a20df6f0f8b30ed42

Malware Analysis – djvu – 839d93c22afa775900d65606fea333cf

Malware Analysis – ransomware – 48fb1f1225e69e524340113503fcbc5d

Malware Analysis – djvu – 36e080712ebf97abfff61ae7cc1ea154

[RAWORLD] – Ransomware Victim: Co****nt

[KILLSEC] – Ransomware Victim: inv[[.][.][.]]nator

[KILLSEC] – Ransomware Victim: Ithbar

[KILLSEC] – Ransomware Victim: RiverRestHome

[KILLSEC] – Ransomware Victim: Dardoc

You may have missed