Year: 2023

Malware Analysis – amadey – eea2a8fb45dd969242c2bcfb9f612e48

January 7, 2023

Score: 10 MALWARE FAMILY: amadeyTAGS:family:amadey, family:djvu, family:smokeloader, family:vidar, botnet:19, backdoor, discovery, persistence, ransomware, spyware, stealer, trojan, vmprotectMD5: eea2a8fb45dd969242c2bcfb9f612e48SHA1: 9059fda6374dd9cea212ef65fb510003a9d4f9daANALYSIS DATE:...

SlideTeam – 1,464,271 breached accounts

January 7, 2023

HIBP In April 2021, the "world’s largest collection of pre-designed presentation slides" SlideTeam had 1.4M records breached and later published...

Vice Society Ransomware Victim: LetMeRepair

January 7, 2023

Vice Society Ransomware NOTE: No files or stolen information are by RedPacket Security. Any legal issues relating to the content...

Vice Society Ransomware Victim: Bay Area Rapid Transit

January 7, 2023

Vice Society Ransomware NOTE: No files or stolen information are by RedPacket Security. Any legal issues relating to the content...

Vice Society Ransomware Victim: City Lit

January 7, 2023

Vice Society Ransomware NOTE: No files or stolen information are by RedPacket Security. Any legal issues relating to the content...

Vice Society Ransomware Victim: Park View

January 7, 2023

Vice Society Ransomware NOTE: No files or stolen information are by RedPacket Security. Any legal issues relating to the content...

Cobalt Stike Beacon Detected – 107[.]174[.]247[.]46:80

January 7, 2023

The Information provided at the time of posting was detected as "Cobalt Strike". Depending on when you are viewing this...

Cobalt Stike Beacon Detected – 38[.]242[.]241[.]231:443

January 7, 2023

The Information provided at the time of posting was detected as "Cobalt Strike". Depending on when you are viewing this...

Cobalt Stike Beacon Detected – 101[.]43[.]188[.]175:8443

January 7, 2023

The Information provided at the time of posting was detected as "Cobalt Strike". Depending on when you are viewing this...

Malware Analysis – djvu – 7873a6083d3990821cd66ad9a5aceebe

January 7, 2023

Score: 10 MALWARE FAMILY: djvuTAGS:family:djvu, family:smokeloader, family:vidar, botnet:19, backdoor, discovery, persistence, ransomware, spyware, stealer, trojan, vmprotectMD5: 7873a6083d3990821cd66ad9a5aceebeSHA1: e0d03bb5c7674dc492687e66975edb397ff0b3c9ANALYSIS DATE: 2023-01-06T21:16:22ZTTPS:...

Malware Analysis – djvu – b0f0b79c2b04c118ef4f6629e88cd2bc

January 7, 2023

Score: 10 MALWARE FAMILY: djvuTAGS:family:djvu, family:vidar, botnet:19, discovery, persistence, ransomware, spyware, stealerMD5: b0f0b79c2b04c118ef4f6629e88cd2bcSHA1: e88aec0e4d70cce8ae9ac6ed07191f24eb03afeaANALYSIS DATE: 2023-01-06T21:16:19ZTTPS: T1012, T1082, T1005, T1081,...

Malware Analysis – evasion – 4c0e7f72921c21ebb2d67d58d92e92fb

January 7, 2023

Score: 10 MALWARE FAMILY: evasionTAGS:evasion, persistence, ransomwareMD5: 4c0e7f72921c21ebb2d67d58d92e92fbSHA1: 9b8a9d56ae0961825e7e5e8e0363c72297954009ANALYSIS DATE: 2023-01-06T22:25:33ZTTPS: T1031, T1562, T1489, T1060, T1112, T1107, T1490, T1012, T1120,...

Malware Analysis – djvu – ee56af504d8d398200f6b80870499502

January 7, 2023

Score: 10 MALWARE FAMILY: djvuTAGS:family:djvu, family:vidar, botnet:19, discovery, persistence, ransomware, spyware, stealerMD5: ee56af504d8d398200f6b80870499502SHA1: 268e292df2627e4263cf9de0debb5d3136e8057aANALYSIS DATE: 2023-01-06T21:41:36ZTTPS: T1053, T1005, T1081, T1012,...

Malware Analysis – discovery – 4e72fd959c26c584f851553c854029cf

January 7, 2023

Score: 10 MALWARE FAMILY: discoveryTAGS:discovery, ransomwareMD5: 4e72fd959c26c584f851553c854029cfSHA1: d41f78eae4003a8713eccc9ce0250eb0455215e1ANALYSIS DATE: 2023-01-06T22:05:38ZTTPS: T1082, T1057, T1012, T1130, T1112 ScoreMeaningExample10Known badA malware family was...

Malware Analysis – amadey – 26fe4336a7d372adf5f211d7f412aecf

January 7, 2023

Score: 10 MALWARE FAMILY: amadeyTAGS:family:amadey, family:djvu, family:smokeloader, family:vidar, botnet:19, botnet:494, backdoor, discovery, persistence, ransomware, spyware, stealer, trojan, vmprotectMD5: 26fe4336a7d372adf5f211d7f412aecfSHA1: 4fc85afe503f085ef16f57fac073596f8eb10afdANALYSIS...

Malware Analysis – djvu – af5aa9bc773c7828ac30cdc423ccb974

January 7, 2023

Score: 10 MALWARE FAMILY: djvuTAGS:family:djvu, family:vidar, botnet:19, discovery, persistence, ransomware, spyware, stealerMD5: af5aa9bc773c7828ac30cdc423ccb974SHA1: 11deebd500cbe542d145bd3b5b188a9911f3eaabANALYSIS DATE: 2023-01-06T23:00:32ZTTPS: T1060, T1112, T1082, T1005,...

Malware Analysis – amadey – c381deebc66153d21111d53654b38270

January 7, 2023

Score: 10 MALWARE FAMILY: amadeyTAGS:family:amadey, family:djvu, family:smokeloader, family:vidar, botnet:19, botnet:494, backdoor, discovery, persistence, ransomware, spyware, stealer, trojan, vmprotectMD5: c381deebc66153d21111d53654b38270SHA1: 642f0cc887c5e3277878ee374fdf985b8c5d0687ANALYSIS...

Malware Analysis – discovery – 9b583f2aa0dc81105ba238af0e12ff72

January 7, 2023

Score: 10 MALWARE FAMILY: discoveryTAGS:discovery, ransomware, upxMD5: 9b583f2aa0dc81105ba238af0e12ff72SHA1: d58f64e37295f03a9aaa6f69261a8b5695115d99ANALYSIS DATE: 2023-01-06T23:49:14ZTTPS: T1082, T1012 ScoreMeaningExample10Known badA malware family was detected.8-9Likely maliciousOne...

Malware Analysis – evasion – ea5e82760186813f2c6a502f53378e62

January 7, 2023

Score: 10 MALWARE FAMILY: evasionTAGS:evasion, persistence, ransomwareMD5: ea5e82760186813f2c6a502f53378e62SHA1: 63ae0b9f29bd80f33d71791be5b5c3ea8a038987ANALYSIS DATE: 2023-01-06T22:48:40ZTTPS: T1012, T1120, T1082, T1112, T1070, T1060, T1018 ScoreMeaningExample10Known badA...

Posh C2 Detected – 44[.]192[.]81[.]16:443

January 7, 2023

The Information provided at the time of posting was detected as "Posh C2". Depending on when you are viewing this...

e9bec52b3962764f0e0e11d26fed5612da49aa0acb3f53d1c610117ffe6c10c3

Villain – Windows And Linux Backdoor Generator And Multi-Session Handler That Allows Users To Connect With Sibling Servers And Share Their Backdoor Sessions

January 6, 2023

Villain is a Windows & Linux backdoor generator and multi-session handler that allows users to connect with sibling servers (other...

1aec70e20361e2b6db44446c203f7629e037d004127edd410b5a9d3ed0f064dd

DotDumper – An Automatic Unpacker And Logger For DotNet Framework Targeting Files

January 6, 2023

An automatic unpacker and logger for DotNet Framework targeting files! This tool has been unveiled at Black Hat USA 2022....

5ee1cf00191149f5bf276ca1b291e9e9f709bc0f9496e69dd799d87e12e4fa8f

ExchangeFinder – Find Microsoft Exchange Instance For A Given Domain And Identify The Exact Version

January 6, 2023

ExchangeFinder is a simple and open-source tool that tries to find Micrsoft Exchange instance for a given domain based on...

Malware Analysis – djvu – 93c0547134939574209bab5e292eaeed

January 6, 2023

Score: 10 MALWARE FAMILY: djvuTAGS:family:djvu, family:vidar, botnet:19, discovery, persistence, ransomware, stealerMD5: 93c0547134939574209bab5e292eaeedSHA1: 8c0deaa8439563a4abae05fc5c00f1802aed55a5ANALYSIS DATE: 2023-01-06T15:26:03ZTTPS: T1053, T1130, T1112, T1060, T1222,...

Year: 2023

Malware Analysis – amadey – eea2a8fb45dd969242c2bcfb9f612e48

SlideTeam – 1,464,271 breached accounts

Vice Society Ransomware Victim: LetMeRepair

Vice Society Ransomware Victim: Bay Area Rapid Transit

Vice Society Ransomware Victim: City Lit

Vice Society Ransomware Victim: Park View

Cobalt Stike Beacon Detected – 107[.]174[.]247[.]46:80

Cobalt Stike Beacon Detected – 38[.]242[.]241[.]231:443

Cobalt Stike Beacon Detected – 101[.]43[.]188[.]175:8443

Malware Analysis – djvu – 7873a6083d3990821cd66ad9a5aceebe

Malware Analysis – djvu – b0f0b79c2b04c118ef4f6629e88cd2bc

Malware Analysis – evasion – 4c0e7f72921c21ebb2d67d58d92e92fb

Malware Analysis – djvu – ee56af504d8d398200f6b80870499502

Malware Analysis – discovery – 4e72fd959c26c584f851553c854029cf

Malware Analysis – amadey – 26fe4336a7d372adf5f211d7f412aecf

Malware Analysis – djvu – af5aa9bc773c7828ac30cdc423ccb974

Malware Analysis – amadey – c381deebc66153d21111d53654b38270

Malware Analysis – discovery – 9b583f2aa0dc81105ba238af0e12ff72

Malware Analysis – evasion – ea5e82760186813f2c6a502f53378e62

Posh C2 Detected – 44[.]192[.]81[.]16:443

Villain – Windows And Linux Backdoor Generator And Multi-Session Handler That Allows Users To Connect With Sibling Servers And Share Their Backdoor Sessions

DotDumper – An Automatic Unpacker And Logger For DotNet Framework Targeting Files

ExchangeFinder – Find Microsoft Exchange Instance For A Given Domain And Identify The Exact Version

Malware Analysis – djvu – 93c0547134939574209bab5e292eaeed

CVE Alert: CVE-2024-10215

CVE Alert: CVE-2024-13283

CVE Alert: CVE-2024-13262

CVE Alert: CVE-2025-21598

CVE Alert: CVE-2024-13273

You may have missed