Month: April 2023

Malware Analysis – persistence – e736d07744f89f05460b1f12daeb8172

April 25, 2023

Score: 10 MALWARE FAMILY: persistenceTAGS:persistence, ransomwareMD5: e736d07744f89f05460b1f12daeb8172SHA1: 19fb70308f0d47947eb6d2d5b572e96539d345bbANALYSIS DATE: 2023-04-25T17:27:21ZTTPS: T1012, T1120, T1082, T1107, T1490, T1112, T1060 ScoreMeaningExample10Known badA malware...

Malware Analysis – djvu – 4bc6e26f6bf9258473180f9805bbe508

April 25, 2023

Score: 10 MALWARE FAMILY: djvuTAGS:family:djvu, discovery, persistence, ransomwareMD5: 4bc6e26f6bf9258473180f9805bbe508SHA1: dacc8979f7e59e60be9cb842982ee0deca5b3248ANALYSIS DATE: 2023-04-25T17:41:03ZTTPS: T1130, T1112, T1060, T1222, T1082, T1053 ScoreMeaningExample10Known badA...

Malware Analysis – babuk – f9afb31bc17811e5ab4fa406f105b1fe

April 25, 2023

Score: 10 MALWARE FAMILY: babukTAGS:family:babuk, family:darkside, ransomwareMD5: f9afb31bc17811e5ab4fa406f105b1feSHA1: d1a9449dcc8a3aa0c887bce71f128866175f679aANALYSIS DATE: 2023-04-25T17:44:04ZTTPS: T1107, T1490, T1082, T1012, T1120 ScoreMeaningExample10Known badA malware family...

Malware Analysis – evasion – 2c2bd73dcba2e7eb7fa78105c84ca2b1

April 25, 2023

Score: 8 MALWARE FAMILY: evasionTAGS:evasion, ransomwareMD5: 2c2bd73dcba2e7eb7fa78105c84ca2b1SHA1: 24d7defc1e00739461dda0b275bd8304277aafd1ANALYSIS DATE: 2023-04-25T17:37:03ZTTPS: ScoreMeaningExample10Known badA malware family was detected.8-9Likely maliciousOne or more known...

Malware Analysis – quasar – 5ec1610f2529bf6c482f43e8d7cb6235

April 25, 2023

Score: 10 MALWARE FAMILY: quasarTAGS:family:quasar, evasion, persistence, ransomware, spyware, trojanMD5: 5ec1610f2529bf6c482f43e8d7cb6235SHA1: a356a2a69d0551967f133b4b18c43703027e2383ANALYSIS DATE: 2023-04-25T17:40:13ZTTPS: T1107, T1490, T1088, T1089, T1112, T1031,...

Daily Threat Intelligence – April 25 – 2023

April 25, 2023

The notorious Lazarus group has formulated a new malware family to threaten macOS users. The attackers have been discovered utilizing...

HackerOne Bug Bounty Disclosure: missing-brute-force-protection-for-passwords-of-password-protected-share-linksbyhackit_bharat

April 25, 2023

Programme HackerOne Nextcloud Nextcloud Submitted by hackit_bharat hackit_bharat Report Missing brute force protection for passwords of password protected share links...

HackerOne Bug Bounty Disclosure: delete-any-user’s-added-email,telephone,fax,address,skype-via-csrf-in-(https://academy-acronis-com/)byimranhudaa

April 25, 2023

Programme HackerOne Acronis Acronis Submitted by imranhudaa imranhudaa Report Delete any user's added Email,Telephone,Fax,Address,Skype via csrf in (https://academy.acronis.com/) Full Report...

HackerOne Bug Bounty Disclosure: the-`io-kubernetes-client-util-generic-dynamic-dynamics`-contains-a-code-execution-vulnerability-due-to-snakeyamlbyjlleitschuh

April 25, 2023

Programme HackerOne Kubernetes Kubernetes Submitted by jlleitschuh jlleitschuh Report The `io.kubernetes.client.util.generic.dynamic.Dynamics` contains a code execution vulnerability due to SnakeYAML Full...

HackerOne Bug Bounty Disclosure: file-read-vulnerability-allows-attackers-to-compromise-s3-buckets-using-prowbystealthy

April 25, 2023

Programme HackerOne Kubernetes Kubernetes Submitted by stealthy stealthy Report File Read Vulnerability allows Attackers to Compromise S3 buckets using Prow...

CISA

Month: April 2023

Malware Analysis – persistence – e736d07744f89f05460b1f12daeb8172

Malware Analysis – djvu – 4bc6e26f6bf9258473180f9805bbe508

Malware Analysis – babuk – f9afb31bc17811e5ab4fa406f105b1fe

Malware Analysis – evasion – 2c2bd73dcba2e7eb7fa78105c84ca2b1

Malware Analysis – quasar – 5ec1610f2529bf6c482f43e8d7cb6235

Daily Threat Intelligence – April 25 – 2023

HackerOne Bug Bounty Disclosure: missing-brute-force-protection-for-passwords-of-password-protected-share-linksbyhackit_bharat

HackerOne Bug Bounty Disclosure: delete-any-user’s-added-email,telephone,fax,address,skype-via-csrf-in-(https://academy-acronis-com/)byimranhudaa

HackerOne Bug Bounty Disclosure: the-`io-kubernetes-client-util-generic-dynamic-dynamics`-contains-a-code-execution-vulnerability-due-to-snakeyamlbyjlleitschuh

HackerOne Bug Bounty Disclosure: file-read-vulnerability-allows-attackers-to-compromise-s3-buckets-using-prowbystealthy

CISA: CISA Releases Two Industrial Control Systems Advisories

Iranian Hackers Launch Sophisticated Attacks Targeting Israel with PowerLess Backdoor

New SLP Vulnerability Could Let Attackers Launch 2200x Powerful DDoS Attacks

Posh C2 Detected – 159[.]69[.]180[.]8:443

Lazarus Subgroup Targeting Apple Devices with New RustBucket macOS Malware

Modernizing Vulnerability Management: The Move Toward Exposure Management

Google Cloud Introduces Security AI Workbench for Faster Threat Detection and Analysis

LockBit 3.0 Ransomware Victim: nagase[.]co[.]jp

LockBit 3.0 Ransomware Victim: ultimateimageprinting[.]com

LockBit 3.0 Ransomware Victim: abro[.]se

LockBit 3.0 Ransomware Victim: goforcloud[.]com

LockBit 3.0 Ransomware Victim: gruponutresa[.]com

Piwigo SQL injection | CVE-2023-26876

NVIDIA ConnectX-5 and ConnectX6-DX adapters denial of service | CVE-2023-0204

[INCRANSOM] – Ransomware Victim: Darlington EMS

[INCRANSOM] – Ransomware Victim: Schuck-Gruppe

[APT73] – Ransomware Victim: gureco[.]pl

[APT73] – Ransomware Victim: lgpunjab[.]gov[.]in

[INCRANSOM] – Ransomware Victim: IPE Engwicht

You may have missed