Month: July 2023

abstract malware 990x400 1

Malware Analysis – ransomware – 11cb54336f76db8ec3ce3e92e25cb981

July 1, 2023

Score: 9 MALWARE FAMILY: ransomwareTAGS:ransomwareMD5: 11cb54336f76db8ec3ce3e92e25cb981SHA1: 3b25852585996aec5d3f1048330a6a44e0854410ANALYSIS DATE: 2023-07-01T15:30:39ZTTPS: ScoreMeaningExample10Known badA malware family was detected.8-9Likely maliciousOne or more known damaging...

abstract malware 990x400 1

Malware Analysis – smokeloader – 7d3ba1be302c88b7127356c4c691c828

July 1, 2023

Score: 10 MALWARE FAMILY: smokeloaderTAGS:family:smokeloader, backdoor, trojanMD5: 7d3ba1be302c88b7127356c4c691c828SHA1: fd29a0f596b64e54db9c3805283aa23e4f31ef3bANALYSIS DATE: 2023-07-01T16:29:24ZTTPS: T1012, T1120, T1082 ScoreMeaningExample10Known badA malware family was detected.8-9Likely...

abstract malware 990x400 1

Malware Analysis – – e25e39744775a8a636866cc7bc446640

July 1, 2023

Score: 7 MALWARE FAMILY: TAGS:MD5: e25e39744775a8a636866cc7bc446640SHA1: 9258197f2960a19f6412861fcdee2eb65ea33704ANALYSIS DATE: 2023-07-01T16:46:59ZTTPS: ScoreMeaningExample10Known badA malware family was detected.8-9Likely maliciousOne or more known damaging...

abstract malware 990x400 1

Malware Analysis – discovery – f04f123ee8df947810d49dad53472919

July 1, 2023

Score: 10 MALWARE FAMILY: discoveryTAGS:discovery, evasion, ransomwareMD5: f04f123ee8df947810d49dad53472919SHA1: b6fca143a3997493fd02cb6a351722da78d9c830ANALYSIS DATE: 2023-07-01T17:16:02ZTTPS: T1031, T1562, T1489, T1107, T1490, T1222, T1012, T1120, T1082...

abstract malware 990x400 1

Malware Analysis – ransomware – 3c4f9c2e1f8493374e7d153b75bb70e8

July 1, 2023

Score: 9 MALWARE FAMILY: ransomwareTAGS:ransomwareMD5: 3c4f9c2e1f8493374e7d153b75bb70e8SHA1: e413150c124bb5e7504182dd1d0eed1f0c5bdbd4ANALYSIS DATE: 2023-07-01T15:42:21ZTTPS: ScoreMeaningExample10Known badA malware family was detected.8-9Likely maliciousOne or more known damaging...

Basta

Black Basta Ransomware Victim: Blount Fine Foods

July 1, 2023

Black Basta Ransomware NOTE: No files or stolen information are by RedPacket Security. Any legal issues relating to the content...

Akira Ransomware Victim: 4LEAF, Inc

July 1, 2023

NOTE: No files or stolen information are by RedPacket Security. Any legal issues relating to the content of the files...

Cobalt Strike

Cobalt Stike Beacon Detected – 79[.]124[.]40[.]70:80

July 1, 2023

The Information provided at the time of posting was detected as "Cobalt Strike". Depending on when you are viewing this...

Cobalt Strike

Cobalt Stike Beacon Detected – 23[.]226[.]55[.]69:2083

July 1, 2023

The Information provided at the time of posting was detected as "Cobalt Strike". Depending on when you are viewing this...

Cobalt Strike

Cobalt Stike Beacon Detected – 101[.]43[.]64[.]17:443

July 1, 2023

The Information provided at the time of posting was detected as "Cobalt Strike". Depending on when you are viewing this...

Cobalt Strike

Cobalt Stike Beacon Detected – 175[.]178[.]53[.]131:8111

July 1, 2023

The Information provided at the time of posting was detected as "Cobalt Strike". Depending on when you are viewing this...

Cobalt Strike

Cobalt Stike Beacon Detected – 119[.]91[.]144[.]175:443

July 1, 2023

The Information provided at the time of posting was detected as "Cobalt Strike". Depending on when you are viewing this...

Cobalt Strike

Cobalt Stike Beacon Detected – 150[.]158[.]31[.]222:22222

July 1, 2023

The Information provided at the time of posting was detected as "Cobalt Strike". Depending on when you are viewing this...

Cobalt Strike

Cobalt Stike Beacon Detected – 119[.]13[.]90[.]176:9000

July 1, 2023

The Information provided at the time of posting was detected as "Cobalt Strike". Depending on when you are viewing this...

Cobalt Strike

Cobalt Stike Beacon Detected – 124[.]220[.]160[.]23:9997

July 1, 2023

The Information provided at the time of posting was detected as "Cobalt Strike". Depending on when you are viewing this...

Cobalt Strike

Cobalt Stike Beacon Detected – 43[.]136[.]27[.]234:8443

July 1, 2023

The Information provided at the time of posting was detected as "Cobalt Strike". Depending on when you are viewing this...

Cobalt Strike

Cobalt Stike Beacon Detected – 152[.]136[.]44[.]210:8888

July 1, 2023

The Information provided at the time of posting was detected as "Cobalt Strike". Depending on when you are viewing this...

Cobalt Strike

Cobalt Stike Beacon Detected – 120[.]48[.]62[.]132:8443

July 1, 2023

The Information provided at the time of posting was detected as "Cobalt Strike". Depending on when you are viewing this...

CVE prog

Sourcecodester Shopping Website SQL injection | CVE-2023-3457

July 1, 2023

NAME__________Sourcecodester Shopping Website SQL injectionPlatforms Affected:Sourcecodester Shopping Website 1.0Risk Level:6.5Exploitability:HighConsequences:Data Manipulation DESCRIPTION__________Sourcecodester Shopping Website is vulnerable to SQL injection. A...

CVE prog

Subscribe2 Plugin for WordPress security bypass | CVE-2023-1844

July 1, 2023

NAME__________Subscribe2 Plugin for WordPress security bypassPlatforms Affected:WordPress Subscribe2 Plugin WordPress 10.40Risk Level:4.3Exploitability:UnprovenConsequences:Bypass Security DESCRIPTION__________Subscribe2 Plugin for WordPress could allow a...

CVE prog

Retro Cellphone Online Store SQL injection | CVE-2023-3473

July 1, 2023

NAME__________Retro Cellphone Online Store SQL injectionPlatforms Affected:CampCodes Retro Cellphone Online Store 1.0Risk Level:4.7Exploitability:UnprovenConsequences:Data Manipulation DESCRIPTION__________Retro Cellphone Online Store is vulnerable...

CVE prog

Short URL plugin for WordPress cross-site scripting | CVE-2023-1602

July 1, 2023

NAME__________Short URL plugin for WordPress cross-site scriptingPlatforms Affected:WordPress Short URL Plugin for WordPress 1.6.4Risk Level:4.4Exploitability:HighConsequences:Cross-Site Scripting DESCRIPTION__________Short URL plugin for...

CVE prog

jgraph/drawio denial of service | CVE-2023-3398

July 1, 2023

NAME__________jgraph/drawio denial of servicePlatforms Affected:jgraph drawio 18.1.3Risk Level:5.3Exploitability:UnprovenConsequences:Denial of Service DESCRIPTION__________jgraph/drawio is vulnerable to a denial of service, caused by...

CVE prog

GuestBook Script cross-site scripting | CVE-2023-3476

July 1, 2023

NAME__________GuestBook Script cross-site scriptingPlatforms Affected:SimplePHPscripts GuestBook Script 2.2Risk Level:3.5Exploitability:UnprovenConsequences:Cross-Site Scripting DESCRIPTION__________GuestBook Script is vulnerable to cross-site scripting, caused by improper...

[HUNTERS] – Ransomware Victim: Orshan, Spann & Fernandez-Mesa

November 25, 2024

[HUNTERS] – Ransomware Victim: JN attorney

November 25, 2024

[INCRANSOM] – Ransomware Victim: Hadwins Volkswagen

November 25, 2024

[LYNX] – Ransomware Victim: Hypertype

November 25, 2024

[INCRANSOM] – Ransomware Victim: Nicholsons Solicitors

November 25, 2024