Year: 2023

Malware Analysis – djvu – 93c4c47e97687f03ad471d4d0d2f0291

March 1, 2023

Score: 10 MALWARE FAMILY: djvuTAGS:family:djvu, family:vidar, discovery, persistence, ransomware, spyware, stealerMD5: 93c4c47e97687f03ad471d4d0d2f0291SHA1: ad5800536b4053b7c87a4678900ba37fefe22accANALYSIS DATE: 2023-03-01T10:09:18ZTTPS: T1012, T1082, T1005, T1081, T1222,...

Cobalt Stike Beacon Detected – 81[.]70[.]239[.]223:80

March 1, 2023

The Information provided at the time of posting was detected as "Cobalt Strike". Depending on when you are viewing this...

Cobalt Stike Beacon Detected – 108[.]165[.]178[.]42:9091

March 1, 2023

The Information provided at the time of posting was detected as "Cobalt Strike". Depending on when you are viewing this...

Cobalt Stike Beacon Detected – 47[.]95[.]149[.]125:8443

March 1, 2023

The Information provided at the time of posting was detected as "Cobalt Strike". Depending on when you are viewing this...

Cobalt Stike Beacon Detected – 47[.]122[.]22[.]26:80

March 1, 2023

The Information provided at the time of posting was detected as "Cobalt Strike". Depending on when you are viewing this...

Malware Analysis – djvu – 7ef1217630afde6b4dd32eabbfa571ad

March 1, 2023

Score: 10 MALWARE FAMILY: djvuTAGS:family:djvu, family:vidar, discovery, persistence, ransomware, spyware, stealerMD5: 7ef1217630afde6b4dd32eabbfa571adSHA1: 969f7af1fe55f54aac5c572a167f1df3623b76bfANALYSIS DATE: 2023-03-01T10:29:57ZTTPS: T1222, T1082, T1012, T1005, T1081,...

Malware Analysis – djvu – c84e72c07920476083196bcca616c4fa

March 1, 2023

Score: 10 MALWARE FAMILY: djvuTAGS:family:djvu, family:vidar, discovery, persistence, ransomware, spyware, stealerMD5: c84e72c07920476083196bcca616c4faSHA1: 2fb00ae12e8ae7569bee5285265aa465f4b6710fANALYSIS DATE: 2023-03-01T10:30:48ZTTPS: T1082, T1012, T1005, T1081, T1222,...

Malware Analysis – djvu – 6ac21b17bfbee755658feed1d8b2e0e2

March 1, 2023

Score: 10 MALWARE FAMILY: djvuTAGS:family:djvu, family:smokeloader, family:vidar, backdoor, discovery, persistence, ransomware, stealer, trojanMD5: 6ac21b17bfbee755658feed1d8b2e0e2SHA1: d882a45a35c9195328505bc8b19515a10f416d5dANALYSIS DATE: 2023-03-01T11:30:33ZTTPS: T1012, T1120, T1082,...

Malware Analysis – djvu – cb3729af6606d66259fb727b19f929d4

March 1, 2023

Score: 10 MALWARE FAMILY: djvuTAGS:family:djvu, family:vidar, discovery, persistence, ransomware, spyware, stealerMD5: cb3729af6606d66259fb727b19f929d4SHA1: e67dfef686231b24b924f796f4e11420ad0fcf0cANALYSIS DATE: 2023-03-01T10:32:09ZTTPS: T1012, T1005, T1081, T1222, T1082,...

GeoNode XML external entity injection | CVE-2023-26043

March 1, 2023

NAME__________GeoNode XML external entity injectionPlatforms Affected:Risk Level:6.5Exploitability:UnprovenConsequences:Gain Access DESCRIPTION__________GeoNode is vulnerable to an XML external entity injection (XXE) attack when...

Trusted Computing Group Trusted Platform Module information disclosure | US-CERT VU#782720

March 1, 2023

NAME__________Trusted Computing Group Trusted Platform Module information disclosurePlatforms Affected:Trusted Computing Group (TCG) Trusted Platform Module (TPM) 2.0Risk Level:7.5Exploitability:UnprovenConsequences:Obtain Information DESCRIPTION__________Trusted...

laravel-admin file upload | CVE-2023-24249

March 1, 2023

NAME__________laravel-admin file uploadPlatforms Affected:Risk Level:6.3Exploitability:UnprovenConsequences:Gain Access DESCRIPTION__________laravel-admin could allow a remote authenticated attacker to upload arbitrary files, caused by improper...

Node.js utilities module denial of service | CVE-2023-26105

March 1, 2023

NAME__________Node.js utilities module denial of servicePlatforms Affected:Risk Level:7.5Exploitability:UnprovenConsequences:Denial of Service DESCRIPTION__________Node.js utilities module is vulnerable to a denial of service,...

VMware Workspace ONE Content security bypass | CVE-2023-20857

March 1, 2023

NAME__________VMware Workspace ONE Content security bypassPlatforms Affected:VMware Workspace ONE ContentRisk Level:6.3Exploitability:UnprovenConsequences:Bypass Security DESCRIPTION__________VMware Workspace ONE Content could allow a local...

IBM HTTP Server denial of service | CVE-2023-26281

March 1, 2023

NAME__________IBM HTTP Server denial of servicePlatforms Affected:IBM HTTP Server 8.5Risk Level:5.9Exploitability:UnprovenConsequences:Denial of Service DESCRIPTION__________IBM HTTP Server 8.5 used by IBM...

LockBit 3.0 Ransomware Victim: egas[.]no

March 1, 2023

LockBit 3.0 Ransomware NOTE: No files or stolen information are by RedPacket Security. Any legal issues relating to the content...

Parallax RAT Targeting Cryptocurrency Firms with Sophisticated Injection Techniques

March 1, 2023

Cryptocurrency companies are being targeted as part of a new campaign that delivers a remote access trojan called Parallax RAT....

Daily Vulnerability Trends: Wed Mar 01 2023

March 1, 2023

Daily Vulnerability Trends (sourced from VulnMon) CVE NAMECVE DescriptionCVE-2023-25157GeoServer is an open source software server written in Java that allows...

Cobalt Stike Beacon Detected – 47[.]106[.]123[.]86:8080

March 1, 2023

The Information provided at the time of posting was detected as "Cobalt Strike". Depending on when you are viewing this...

Cobalt Stike Beacon Detected – 45[.]227[.]255[.]185:443

March 1, 2023

The Information provided at the time of posting was detected as "Cobalt Strike". Depending on when you are viewing this...

Cobalt Stike Beacon Detected – 49[.]234[.]38[.]74:80

March 1, 2023

The Information provided at the time of posting was detected as "Cobalt Strike". Depending on when you are viewing this...

Cobalt Stike Beacon Detected – 139[.]198[.]181[.]40:80

March 1, 2023

The Information provided at the time of posting was detected as "Cobalt Strike". Depending on when you are viewing this...

Cobalt Stike Beacon Detected – 45[.]227[.]255[.]217:80

March 1, 2023

The Information provided at the time of posting was detected as "Cobalt Strike". Depending on when you are viewing this...

Malware Analysis – djvu – e8fae037423a86c0a49f78dc872fd857

March 1, 2023

Score: 10 MALWARE FAMILY: djvuTAGS:family:djvu, family:vidar, discovery, persistence, ransomware, spyware, stealerMD5: e8fae037423a86c0a49f78dc872fd857SHA1: d586c2be61e766821e4ab297a7c44ee1d16d3407ANALYSIS DATE: 2023-02-28T21:05:10ZTTPS: T1053, T1222, T1082, T1005, T1081,...

Year: 2023

Malware Analysis – djvu – 93c4c47e97687f03ad471d4d0d2f0291

Cobalt Stike Beacon Detected – 81[.]70[.]239[.]223:80

Cobalt Stike Beacon Detected – 108[.]165[.]178[.]42:9091

Cobalt Stike Beacon Detected – 47[.]95[.]149[.]125:8443

Cobalt Stike Beacon Detected – 47[.]122[.]22[.]26:80

Malware Analysis – djvu – 7ef1217630afde6b4dd32eabbfa571ad

Malware Analysis – djvu – c84e72c07920476083196bcca616c4fa

Malware Analysis – djvu – 6ac21b17bfbee755658feed1d8b2e0e2

Malware Analysis – djvu – cb3729af6606d66259fb727b19f929d4

GeoNode XML external entity injection | CVE-2023-26043

Trusted Computing Group Trusted Platform Module information disclosure | US-CERT VU#782720

laravel-admin file upload | CVE-2023-24249

Node.js utilities module denial of service | CVE-2023-26105

VMware Workspace ONE Content security bypass | CVE-2023-20857

IBM HTTP Server denial of service | CVE-2023-26281

LockBit 3.0 Ransomware Victim: egas[.]no

Parallax RAT Targeting Cryptocurrency Firms with Sophisticated Injection Techniques

Daily Vulnerability Trends: Wed Mar 01 2023

Cobalt Stike Beacon Detected – 47[.]106[.]123[.]86:8080

Cobalt Stike Beacon Detected – 45[.]227[.]255[.]185:443

Cobalt Stike Beacon Detected – 49[.]234[.]38[.]74:80

Cobalt Stike Beacon Detected – 139[.]198[.]181[.]40:80

Cobalt Stike Beacon Detected – 45[.]227[.]255[.]217:80

Malware Analysis – djvu – e8fae037423a86c0a49f78dc872fd857

CISA: CISA and ONCD Release Playbook for Strengthening Cybersecurity in Federal Grant Programs for Critical Infrastructure

CISA: CISA Adds Four Known Exploited Vulnerabilities to Catalog

CISA: CISA Releases Five Industrial Control Systems Advisories

CISA: CISA Issues BOD 25-01, Implementing Secure Practices for Cloud Services

CISA: CISA Releases Best Practice Guidance for Mobile Communications

You may have missed