Year: 2023

Malware Analysis – octo – 71d5c5dc3b8c5ded7b005155b84e3b16

February 22, 2023

Score: 10 MALWARE FAMILY: octoTAGS:family:octo, banker, evasion, infostealer, ransomware, rat, trojanMD5: 71d5c5dc3b8c5ded7b005155b84e3b16SHA1: a5c267fd84f0594279a0cc4f1c609a61120a5fdbANALYSIS DATE: 2023-02-22T11:10:11ZTTPS: ScoreMeaningExample10Known badA malware family was...

Malware Analysis – smokeloader – 145466b3234adf3b9745ea36d0531ec0

February 22, 2023

Score: 10 MALWARE FAMILY: smokeloaderTAGS:family:smokeloader, backdoor, trojanMD5: 145466b3234adf3b9745ea36d0531ec0SHA1: 01a065a2cc04eb82f484e43f34cab6e921178559ANALYSIS DATE: 2023-02-22T11:11:03ZTTPS: T1012, T1120, T1082 ScoreMeaningExample10Known badA malware family was detected.8-9Likely...

Malware Analysis – harly – b40f641da0c05fe97e558341d59236e2

February 22, 2023

Score: 10 MALWARE FAMILY: harlyTAGS:family:harly, infostealer, ransomware, trojanMD5: b40f641da0c05fe97e558341d59236e2SHA1: 65632a662c5478555cede3301ac46f55d33d7ac5ANALYSIS DATE: 2023-02-22T11:34:48ZTTPS: ScoreMeaningExample10Known badA malware family was detected.8-9Likely maliciousOne or...

Dell Multifunction Printer E525w Driver and Software Suite privilege escalation | CVE-2023-24575

February 22, 2023

NAME__________Dell Multifunction Printer E525w Driver and Software Suite privilege escalationPlatforms Affected:Risk Level:7.8Exploitability:UnprovenConsequences:Gain Privilege DESCRIPTION__________Dell Multifunction Printer E525w Driver and Software...

TP-Link Archer C50 denial of service | CVE-2023-0936

February 22, 2023

NAME__________TP-Link Archer C50 denial of servicePlatforms Affected:Risk Level:4.3Exploitability:UnprovenConsequences:Denial of Service DESCRIPTION__________TP-Link Archer C50 is vulnerable to a denial of service,...

Sourcecodester Music Gallery Site SQL injection | CVE-2023-0938

February 22, 2023

NAME__________Sourcecodester Music Gallery Site SQL injectionPlatforms Affected:Risk Level:6.5Exploitability:HighConsequences:Data Manipulation DESCRIPTION__________Sourcecodester Music Gallery Site is vulnerable to SQL injection. A remote...

Visioglobe Visioweb cross-site scripting | CVE-2022-3901

February 22, 2023

NAME__________Visioglobe Visioweb cross-site scriptingPlatforms Affected:Visioglobe Visioweb 1.10.6Risk Level:7.2Exploitability:HighConsequences:Cross-Site Scripting DESCRIPTION__________Visioglobe Visioweb is vulnerable to cross-site scripting, caused by improper validation...

IBM InfoSphere Information Server cross-site scripting | CVE-2023-25928

February 22, 2023

NAME__________IBM InfoSphere Information Server cross-site scriptingPlatforms Affected:IBM InfoSphere Information Server 11.7Risk Level:4.6Exploitability:UnprovenConsequences:Cross-Site Scripting DESCRIPTION__________IBM InfoSphere Information Server 11.7 is vulnerable...

DolphinPHP command execution | CVE-2023-0935

February 22, 2023

NAME__________DolphinPHP command executionPlatforms Affected:Risk Level:7.2Exploitability:UnprovenConsequences:Gain Access DESCRIPTION__________DolphinPHP could allow a remote authenticated attacker to execute arbitrary commands on the system,...

Apollo security bypass | CVE-2023-25570

February 22, 2023

NAME__________Apollo security bypassPlatforms Affected:Risk Level:7.5Exploitability:UnprovenConsequences:Bypass Security DESCRIPTION__________Apollo could allow a remote attacker to bypass security restrictions, caused by improper authentication...

Apollo cross-site request forgery | CVE-2023-25569

February 22, 2023

NAME__________Apollo cross-site request forgeryPlatforms Affected:Risk Level:5.7Exploitability:UnprovenConsequences:Gain Access DESCRIPTION__________Apollo is vulnerable to cross-site request forgery, caused by improper validation of user-supplied...

Siemens SiPass integrated AC5102, ACC-G2 and ACC-AP devices privilege escalation | CVE-2022-31808

February 22, 2023

NAME__________Siemens SiPass integrated AC5102, ACC-G2 and ACC-AP devices privilege escalationPlatforms Affected:Siemens SiPass integrated AC5100 Siemens SiPass integrated AC5102 Siemens SiPass...

Notary Project notation-go denial of service | CVE-2023-25656

February 22, 2023

NAME__________Notary Project notation-go denial of servicePlatforms Affected:Notary Project notation-go 0.9.0-alpha.1Risk Level:6.5Exploitability:UnprovenConsequences:Denial of Service DESCRIPTION__________Notary Project notation-go is vulnerable to a...

ARRIS TG2482A, ARRIS TG2492, and ARRIS SBG10 code execution | CVE-2022-45701

February 22, 2023

NAME__________ARRIS TG2482A, ARRIS TG2492, and ARRIS SBG10 code executionPlatforms Affected:Risk Level:4.7Exploitability:Proof of ConceptConsequences:Gain Access DESCRIPTION__________ARRIS TG2482A, ARRIS TG2492, and ARRIS...

LockBit 3.0 Ransomware Victim: lyonhealy[.]com

February 22, 2023

LockBit 3.0 Ransomware NOTE: No files or stolen information are by RedPacket Security. Any legal issues relating to the content...

Daily Vulnerability Trends: Wed Feb 22 2023

February 22, 2023

Daily Vulnerability Trends (sourced from VulnMon) CVE NAMECVE DescriptionCVE-2022-0544An integer underflow in the DDS loader of Blender leads to an...

LockBit 3.0 Ransomware Victim: treves-group[.]com

February 22, 2023

LockBit 3.0 Ransomware NOTE: No files or stolen information are by RedPacket Security. Any legal issues relating to the...

Malware Analysis – quantum – 78f011f6196ab070e05e7e363a0c02f1

February 22, 2023

Score: 10 MALWARE FAMILY: quantumTAGS:family:quantum, ransomwareMD5: 78f011f6196ab070e05e7e363a0c02f1SHA1: 8d31d3e523d1e11631d05f01c410340cef780bfcANALYSIS DATE: 2023-02-22T03:33:29ZTTPS: T1158 ScoreMeaningExample10Known badA malware family was detected.8-9Likely maliciousOne or more...

Malware Analysis – ransomware – 5a9a8e900606307943a468a8868bcf7d

February 22, 2023

Score: 7 MALWARE FAMILY: ransomwareTAGS:ransomwareMD5: 5a9a8e900606307943a468a8868bcf7dSHA1: 2fe997248fbc19d2157de62b88ade74ac8768442ANALYSIS DATE: 2023-02-22T03:00:36ZTTPS: ScoreMeaningExample10Known badA malware family was detected.8-9Likely maliciousOne or more known damaging...

Malware Analysis – quantum – 1ac3f71feece118a03c9e23af063f6d1

February 22, 2023

Score: 10 MALWARE FAMILY: quantumTAGS:family:quantum, ransomwareMD5: 1ac3f71feece118a03c9e23af063f6d1SHA1: bbc3979075e0574e54a5ead497fcba95fcc78fc0ANALYSIS DATE: 2023-02-22T03:06:12ZTTPS: T1158 ScoreMeaningExample10Known badA malware family was detected.8-9Likely maliciousOne or more...

Malware Analysis – quantum – 87940b01f02d85d033dae35f8d01348f

February 22, 2023

Score: 10 MALWARE FAMILY: quantumTAGS:family:quantum, ransomwareMD5: 87940b01f02d85d033dae35f8d01348fSHA1: 152dd7098b2b7409669b1a5ba1e997ddeb622734ANALYSIS DATE: 2023-02-22T04:01:52ZTTPS: T1158, T1112 ScoreMeaningExample10Known badA malware family was detected.8-9Likely maliciousOne or...

Malware Analysis – quantum – ee9c6e60027c8ce65003de32d6125914

February 22, 2023

Score: 10 MALWARE FAMILY: quantumTAGS:family:quantum, ransomwareMD5: ee9c6e60027c8ce65003de32d6125914SHA1: 97872dbc8df6d6c4cc6419e81994336503c748f9ANALYSIS DATE: 2023-02-22T03:46:06ZTTPS: T1158 ScoreMeaningExample10Known badA malware family was detected.8-9Likely maliciousOne or more...

Malware Analysis – quantum – 47f3e71a1b1eb4a939d5f17639514334

February 22, 2023

Score: 10 MALWARE FAMILY: quantumTAGS:family:quantum, ransomwareMD5: 47f3e71a1b1eb4a939d5f17639514334SHA1: d0c6afe81342ee81389864791c67e9b29e2939f2ANALYSIS DATE: 2023-02-22T04:05:47ZTTPS: T1158, T1112 ScoreMeaningExample10Known badA malware family was detected.8-9Likely maliciousOne or...

Malware Analysis – quantum – c53e027bf91d7e8c8da245ccd28279e5

February 22, 2023

Score: 10 MALWARE FAMILY: quantumTAGS:family:quantum, ransomwareMD5: c53e027bf91d7e8c8da245ccd28279e5SHA1: 4d1fb9ab277f997a63cd42fd76467715b67579e4ANALYSIS DATE: 2023-02-22T04:07:31ZTTPS: T1158, T1112 ScoreMeaningExample10Known badA malware family was detected.8-9Likely maliciousOne or...

Year: 2023

Malware Analysis – octo – 71d5c5dc3b8c5ded7b005155b84e3b16

Malware Analysis – smokeloader – 145466b3234adf3b9745ea36d0531ec0

Malware Analysis – harly – b40f641da0c05fe97e558341d59236e2

Dell Multifunction Printer E525w Driver and Software Suite privilege escalation | CVE-2023-24575

TP-Link Archer C50 denial of service | CVE-2023-0936

Sourcecodester Music Gallery Site SQL injection | CVE-2023-0938

Visioglobe Visioweb cross-site scripting | CVE-2022-3901

IBM InfoSphere Information Server cross-site scripting | CVE-2023-25928

DolphinPHP command execution | CVE-2023-0935

Apollo security bypass | CVE-2023-25570

Apollo cross-site request forgery | CVE-2023-25569

Siemens SiPass integrated AC5102, ACC-G2 and ACC-AP devices privilege escalation | CVE-2022-31808

Notary Project notation-go denial of service | CVE-2023-25656

ARRIS TG2482A, ARRIS TG2492, and ARRIS SBG10 code execution | CVE-2022-45701

LockBit 3.0 Ransomware Victim: lyonhealy[.]com

Daily Vulnerability Trends: Wed Feb 22 2023

LockBit 3.0 Ransomware Victim: treves-group[.]com

Malware Analysis – quantum – 78f011f6196ab070e05e7e363a0c02f1

Malware Analysis – ransomware – 5a9a8e900606307943a468a8868bcf7d

Malware Analysis – quantum – 1ac3f71feece118a03c9e23af063f6d1

Malware Analysis – quantum – 87940b01f02d85d033dae35f8d01348f

Malware Analysis – quantum – ee9c6e60027c8ce65003de32d6125914

Malware Analysis – quantum – 47f3e71a1b1eb4a939d5f17639514334

Malware Analysis – quantum – c53e027bf91d7e8c8da245ccd28279e5

Cobalt Strike Beacon Detected – 106[.]75[.]247[.]91:80

Cobalt Strike Beacon Detected – 162[.]244[.]24[.]30:80

Cobalt Strike Beacon Detected – 8[.]153[.]97[.]202:88

Cobalt Strike Beacon Detected – 47[.]121[.]190[.]121:81

Cobalt Strike Beacon Detected – 18[.]183[.]60[.]128:80

You may have missed