Month: March 2023

Malware Analysis – ransomware – bddc77465196a1fe9e1a2e32ac8bca76

March 5, 2023

Score: 6 MALWARE FAMILY: ransomwareTAGS:ransomwareMD5: bddc77465196a1fe9e1a2e32ac8bca76SHA1: d9804432571b6d22956a38a5bf3223c15fe31030ANALYSIS DATE: 2023-03-05T10:21:40ZTTPS: ScoreMeaningExample10Known badA malware family was detected.8-9Likely maliciousOne or more known damaging...

Malware Analysis – djvu – 2ea34c5254243b375ea168b693fbf1cf

March 5, 2023

Score: 10 MALWARE FAMILY: djvuTAGS:family:djvu, family:vidar, discovery, persistence, ransomware, spyware, stealerMD5: 2ea34c5254243b375ea168b693fbf1cfSHA1: 474d9c43ad567f3238fd168fe374f90550f435e5ANALYSIS DATE: 2023-03-05T10:30:44ZTTPS: T1082, T1005, T1081, T1012, T1222,...

Cobalt Stike Beacon Detected – 162[.]14[.]117[.]138:443

March 5, 2023

The Information provided at the time of posting was detected as "Cobalt Strike". Depending on when you are viewing this...

Cobalt Stike Beacon Detected – 124[.]222[.]16[.]73:80

March 5, 2023

The Information provided at the time of posting was detected as "Cobalt Strike". Depending on when you are viewing this...

Cobalt Stike Beacon Detected – 5[.]9[.]224[.]208:443

March 5, 2023

The Information provided at the time of posting was detected as "Cobalt Strike". Depending on when you are viewing this...

Cobalt Stike Beacon Detected – 124[.]222[.]3[.]42:4433

March 5, 2023

The Information provided at the time of posting was detected as "Cobalt Strike". Depending on when you are viewing this...

Malware Analysis – djvu – a476d9fa19205b2d559ca70738d020ae

March 5, 2023

Score: 10 MALWARE FAMILY: djvuTAGS:family:djvu, family:vidar, discovery, persistence, ransomware, spyware, stealerMD5: a476d9fa19205b2d559ca70738d020aeSHA1: d45c468823386ab696bbc48d79507e4ff0512041ANALYSIS DATE: 2023-03-05T11:44:02ZTTPS: T1060, T1112, T1005, T1081, T1012,...

Malware Analysis – – 5e8189df55ed00bb294db50ead7b6eba

March 5, 2023

Score: 1 MALWARE FAMILY: TAGS:MD5: 5e8189df55ed00bb294db50ead7b6ebaSHA1: faf7ec2afa6674318f87e664e61100bbc1886429ANALYSIS DATE: 2023-03-05T10:31:36ZTTPS: ScoreMeaningExample10Known badA malware family was detected.8-9Likely maliciousOne or more known damaging...

Malware Analysis – djvu – 5088dddbc956fb18c627fb9241416e4f

March 5, 2023

Score: 10 MALWARE FAMILY: djvuTAGS:family:djvu, family:vidar, discovery, persistence, ransomware, spyware, stealerMD5: 5088dddbc956fb18c627fb9241416e4fSHA1: 5dc26a81f7df1ea96f02548a63276c012c0d1faaANALYSIS DATE: 2023-03-05T11:33:00ZTTPS: T1222, T1005, T1081, T1060, T1112,...

Malware Analysis – bootkit – 7f074455c7fcc15b3a6d372695511245

March 5, 2023

Score: 8 MALWARE FAMILY: bootkitTAGS:bootkit, evasion, persistenceMD5: 7f074455c7fcc15b3a6d372695511245SHA1: c68221fe8c1d1359f28e3c8d51f9b011ade849f0ANALYSIS DATE: 2023-03-05T10:49:17ZTTPS: T1082, T1050, T1031, T1562, T1489, T1012, T1112, T1060, T1067,...

Cobalt Stike Beacon Detected – 20[.]10[.]45[.]194:443

March 5, 2023

The Information provided at the time of posting was detected as "Cobalt Strike". Depending on when you are viewing this...

Cobalt Stike Beacon Detected – 82[.]157[.]182[.]245:8088

March 5, 2023

The Information provided at the time of posting was detected as "Cobalt Strike". Depending on when you are viewing this...

Cobalt Stike Beacon Detected – 185[.]254[.]37[.]251:443

March 5, 2023

The Information provided at the time of posting was detected as "Cobalt Strike". Depending on when you are viewing this...

Cobalt Stike Beacon Detected – 218[.]28[.]63[.]34:8037

March 5, 2023

The Information provided at the time of posting was detected as "Cobalt Strike". Depending on when you are viewing this...

Ransomware gang leaks data stolen from City of Oakland

March 5, 2023

The Play ransomware gang has begun to leak data from the City of Oakland, California, that was stolen in a...

New TPM 2.0 flaws could let hackers steal cryptographic keys

March 5, 2023

The Trusted Platform Module (TPM) 2.0 specification is affected by two buffer overflow vulnerabilities that could allow attackers to access...

Malware Analysis – djvu – 4eb58b88d5eb2f3c3ee03ef07d4ec90e

March 5, 2023

Score: 10 MALWARE FAMILY: djvuTAGS:family:djvu, family:vidar, discovery, persistence, ransomware, spyware, stealerMD5: 4eb58b88d5eb2f3c3ee03ef07d4ec90eSHA1: a99e6c29bd428027701ead8e6f45856c4b1d782dANALYSIS DATE: 2023-03-04T21:32:44ZTTPS: T1005, T1081, T1012, T1082, T1222,...

Malware Analysis – asyncrat – ea78d1ea9761657c99bc813f66be5b1d

March 5, 2023

Score: 10 MALWARE FAMILY: asyncratTAGS:family:asyncrat, family:nanocore, family:njrat, family:xworm, botnet::), botnet:default, botnet:متخطي بروسيس خاص, evasion, keylogger, persistence, pyinstaller, ransomware, rat, spyware,...

Malware Analysis – djvu – cbbd980c667805837fb441b76514ec0e

March 5, 2023

Score: 10 MALWARE FAMILY: djvuTAGS:family:djvu, family:vidar, discovery, persistence, ransomware, spyware, stealerMD5: cbbd980c667805837fb441b76514ec0eSHA1: 3df9e7f60b8c12b94dedafe1403c67e775b39d83ANALYSIS DATE: 2023-03-04T21:40:48ZTTPS: T1053, T1005, T1081, T1012, T1082,...

Malware Analysis – djvu – 4a3282a67a824741e1d348ee66503787

March 5, 2023

Score: 10 MALWARE FAMILY: djvuTAGS:family:djvu, family:vidar, discovery, persistence, ransomware, spyware, stealerMD5: 4a3282a67a824741e1d348ee66503787SHA1: 5b1bfed820496cfbe8be51c9780e5328eea3e3b0ANALYSIS DATE: 2023-03-04T21:38:32ZTTPS: T1053, T1005, T1081, T1012, T1082,...

Malware Analysis – asyncrat – 27f8ef3eb1c6fdbe295174f4fa4ea19c

March 5, 2023

Score: 10 MALWARE FAMILY: asyncratTAGS:family:asyncrat, family:bitrat, family:neshta, family:njrat, family:redline, family:remcos, family:warzonerat, botnet:default, botnet:hacked, botnet:hackpack, botnet:nyan cat, botnet:remotehost, discovery, evasion, infostealer,...

Malware Analysis – djvu – 37a0cfb5bde13c19c06363e90c2d98ad

March 5, 2023

Score: 10 MALWARE FAMILY: djvuTAGS:family:djvu, family:vidar, discovery, persistence, ransomware, spyware, stealerMD5: 37a0cfb5bde13c19c06363e90c2d98adSHA1: 74a2edca446c6929ac68ebead896c1025acb4dbbANALYSIS DATE: 2023-03-04T21:46:49ZTTPS: T1082, T1053, T1012, T1005, T1081,...

Malware Analysis – redline – 481ca5811352fa9ef53a2f39a83bd1cf

March 5, 2023

Score: 10 MALWARE FAMILY: redlineTAGS:family:redline, discovery, infostealer, persistence, ransomware, spywareMD5: 481ca5811352fa9ef53a2f39a83bd1cfSHA1: af239d190a3c2bdc8531a8c34a7bcedc086ec88cANALYSIS DATE: 2023-03-04T23:11:17ZTTPS: T1082, T1060, T1012, T1005, T1081, T1112,...

Malware Analysis – djvu – 6c18dae7be8f90441b86851a7cc1d62a

March 5, 2023

Score: 10 MALWARE FAMILY: djvuTAGS:family:djvu, family:vidar, discovery, persistence, ransomware, spyware, stealerMD5: 6c18dae7be8f90441b86851a7cc1d62aSHA1: 9932f62742d803bafc0b8ceec0af99c5401467ddANALYSIS DATE: 2023-03-04T23:26:45ZTTPS: T1005, T1081, T1222, T1053, T1012,...

Month: March 2023

Malware Analysis – ransomware – bddc77465196a1fe9e1a2e32ac8bca76

Malware Analysis – djvu – 2ea34c5254243b375ea168b693fbf1cf

Cobalt Stike Beacon Detected – 162[.]14[.]117[.]138:443

Cobalt Stike Beacon Detected – 124[.]222[.]16[.]73:80

Cobalt Stike Beacon Detected – 5[.]9[.]224[.]208:443

Cobalt Stike Beacon Detected – 124[.]222[.]3[.]42:4433

Malware Analysis – djvu – a476d9fa19205b2d559ca70738d020ae

Malware Analysis – – 5e8189df55ed00bb294db50ead7b6eba

Malware Analysis – djvu – 5088dddbc956fb18c627fb9241416e4f

Malware Analysis – bootkit – 7f074455c7fcc15b3a6d372695511245

Cobalt Stike Beacon Detected – 20[.]10[.]45[.]194:443

Cobalt Stike Beacon Detected – 82[.]157[.]182[.]245:8088

Cobalt Stike Beacon Detected – 185[.]254[.]37[.]251:443

Cobalt Stike Beacon Detected – 218[.]28[.]63[.]34:8037

Ransomware gang leaks data stolen from City of Oakland

New TPM 2.0 flaws could let hackers steal cryptographic keys

Malware Analysis – djvu – 4eb58b88d5eb2f3c3ee03ef07d4ec90e

Malware Analysis – asyncrat – ea78d1ea9761657c99bc813f66be5b1d

Malware Analysis – djvu – cbbd980c667805837fb441b76514ec0e

Malware Analysis – djvu – 4a3282a67a824741e1d348ee66503787

Malware Analysis – asyncrat – 27f8ef3eb1c6fdbe295174f4fa4ea19c

Malware Analysis – djvu – 37a0cfb5bde13c19c06363e90c2d98ad

Malware Analysis – redline – 481ca5811352fa9ef53a2f39a83bd1cf

Malware Analysis – djvu – 6c18dae7be8f90441b86851a7cc1d62a

CovenantC2 Detected – 58[.]65[.]172[.]131:7443

[SAFEPAY] – Ransomware Victim: titlenine[.]com

CVE Alert: CVE-2024-11362

CVE Alert: CVE-2024-10874

CVE Alert: CVE-2024-10961

You may have missed