OSINT

Malware Analysis – djvu – 90363754a46ff1f0261845d1ede47a3a

December 24, 2022

Score: 10 MALWARE FAMILY: djvuTAGS:family:djvu, discovery, persistence, ransomware, spyware, stealerMD5: 90363754a46ff1f0261845d1ede47a3aSHA1: 2a032c2e0d53897b258362bc98a271f7b8b4e51eANALYSIS DATE: 2022-12-23T23:42:32ZTTPS: T1005, T1081, T1053, T1082, T1012, T1060,...

Malware Analysis – djvu – 60d534b335e0bab1e6b44e3f39962663

December 24, 2022

Score: 10 MALWARE FAMILY: djvuTAGS:family:djvu, discovery, persistence, ransomware, spyware, stealerMD5: 60d534b335e0bab1e6b44e3f39962663SHA1: c8ec8c06bdef1e2fa36e126c21ac735e55249cc9ANALYSIS DATE: 2022-12-23T23:57:20ZTTPS: T1012, T1082, T1060, T1112, T1005, T1081,...

IcedID Botnet Distributors Abuse Google PPC to Distribute Malware

December 23, 2022

We analyze the latest changes in IcedID botnet from a campaign that abuses Google pay per click (PPC) ads to...

S3Crets_Scanner – Hunting For Secrets Uploaded To Public S3 Buckets

December 23, 2022

S3cret Scanner tool designed to provide a complementary layer for the Contributing Pull requests and forks are welcome. For major...

Cobalt Stike Beacon Detected – 91[.]240[.]118[.]218:8093

December 23, 2022

The Information provided at the time of posting was detected as "Cobalt Strike". Depending on when you are viewing this...

Cobalt Stike Beacon Detected – 43[.]138[.]33[.]133:8001

December 23, 2022

The Information provided at the time of posting was detected as "Cobalt Strike". Depending on when you are viewing this...

Cobalt Stike Beacon Detected – 199[.]195[.]248[.]79:443

December 23, 2022

The Information provided at the time of posting was detected as "Cobalt Strike". Depending on when you are viewing this...

Cobalt Stike Beacon Detected – 88[.]214[.]27[.]53:80

December 23, 2022

The Information provided at the time of posting was detected as "Cobalt Strike". Depending on when you are viewing this...

Cobalt Stike Beacon Detected – 106[.]75[.]218[.]220:80

December 23, 2022

The Information provided at the time of posting was detected as "Cobalt Strike". Depending on when you are viewing this...

Cobalt Stike Beacon Detected – 18[.]194[.]244[.]87:443

December 23, 2022

The Information provided at the time of posting was detected as "Cobalt Strike". Depending on when you are viewing this...

Royal Ransomware Victim: Aegea Group companies

December 23, 2022

RoyalRansomware NOTE: No files or stolen information are by RedPacket Security. Any legal issues relating to the content of the...

Royal Ransomware Victim: Rech Informatica Ltda

December 23, 2022

RoyalRansomware NOTE: No files or stolen information are by RedPacket Security. Any legal issues relating to the content of the...

Cobalt Stike Beacon Detected – 198[.]74[.]115[.]207:8080

December 23, 2022

The Information provided at the time of posting was detected as "Cobalt Strike". Depending on when you are viewing this...

Cobalt Stike Beacon Detected – 121[.]37[.]5[.]94:7777

December 23, 2022

The Information provided at the time of posting was detected as "Cobalt Strike". Depending on when you are viewing this...

Cobalt Stike Beacon Detected – 121[.]4[.]138[.]60:9999

December 23, 2022

The Information provided at the time of posting was detected as "Cobalt Strike". Depending on when you are viewing this...

Cobalt Stike Beacon Detected – 77[.]73[.]131[.]193:443

December 23, 2022

The Information provided at the time of posting was detected as "Cobalt Strike". Depending on when you are viewing this...

Cobalt Stike Beacon Detected – 119[.]29[.]162[.]38:8088

December 23, 2022

The Information provided at the time of posting was detected as "Cobalt Strike". Depending on when you are viewing this...

Cobalt Stike Beacon Detected – 106[.]75[.]247[.]178:80

December 23, 2022

The Information provided at the time of posting was detected as "Cobalt Strike". Depending on when you are viewing this...

Cobalt Stike Beacon Detected – 8[.]131[.]94[.]164:7443

December 23, 2022

The Information provided at the time of posting was detected as "Cobalt Strike". Depending on when you are viewing this...

Cobalt Stike Beacon Detected – 43[.]138[.]41[.]95:80

December 23, 2022

The Information provided at the time of posting was detected as "Cobalt Strike". Depending on when you are viewing this...

Malware Analysis – djvu – 31779136196425ada7f38369086e99cc

December 23, 2022

Score: 10 MALWARE FAMILY: djvuTAGS:family:djvu, discovery, persistence, ransomware, spyware, stealerMD5: 31779136196425ada7f38369086e99ccSHA1: 65121e085572620c45d16e6683663ead301e5b03ANALYSIS DATE: 2022-12-23T09:12:06ZTTPS: T1005, T1081, T1012, T1082, T1222, T1053,...

Malware Analysis – smokeloader – 2d5f1f172ee74e3ad998059669e9e39e

December 23, 2022

Score: 10 MALWARE FAMILY: smokeloaderTAGS:family:smokeloader, backdoor, trojanMD5: 2d5f1f172ee74e3ad998059669e9e39eSHA1: 0ea9cf83108b57219d3c784ac1589ee5551c90a4ANALYSIS DATE: 2022-12-23T10:31:04ZTTPS: T1012, T1120, T1082 ScoreMeaningExample10Known badA malware family was detected.8-9Likely...

Malware Analysis – djvu – f667cb81fe70b79d3651127cbf34c1f3

December 23, 2022

Score: 10 MALWARE FAMILY: djvuTAGS:family:djvu, discovery, persistence, ransomware, spyware, stealerMD5: f667cb81fe70b79d3651127cbf34c1f3SHA1: 2aba0f68896664c65ffc6e166b051af73881005bANALYSIS DATE: 2022-12-23T10:20:38ZTTPS: T1005, T1081, T1012, T1082, T1053, T1060,...

Malware Analysis – djvu – e8af5b0c9d7b8d7f7357ee0fd9ea0218

December 23, 2022

Score: 10 MALWARE FAMILY: djvuTAGS:family:djvu, discovery, persistence, ransomwareMD5: e8af5b0c9d7b8d7f7357ee0fd9ea0218SHA1: 58a6671307eda70e55ea15dbc46d32769e6b2823ANALYSIS DATE: 2022-12-23T10:15:15ZTTPS: T1082, T1130, T1112, T1060, T1222 ScoreMeaningExample10Known badA malware...

OSINT

Malware Analysis – djvu – 90363754a46ff1f0261845d1ede47a3a

Malware Analysis – djvu – 60d534b335e0bab1e6b44e3f39962663

IcedID Botnet Distributors Abuse Google PPC to Distribute Malware

S3Crets_Scanner – Hunting For Secrets Uploaded To Public S3 Buckets

Cobalt Stike Beacon Detected – 91[.]240[.]118[.]218:8093

Cobalt Stike Beacon Detected – 43[.]138[.]33[.]133:8001

Cobalt Stike Beacon Detected – 199[.]195[.]248[.]79:443

Cobalt Stike Beacon Detected – 88[.]214[.]27[.]53:80

Cobalt Stike Beacon Detected – 106[.]75[.]218[.]220:80

Cobalt Stike Beacon Detected – 18[.]194[.]244[.]87:443

Royal Ransomware Victim: Aegea Group companies

Royal Ransomware Victim: Rech Informatica Ltda

Cobalt Stike Beacon Detected – 198[.]74[.]115[.]207:8080

Cobalt Stike Beacon Detected – 121[.]37[.]5[.]94:7777

Cobalt Stike Beacon Detected – 121[.]4[.]138[.]60:9999

Cobalt Stike Beacon Detected – 77[.]73[.]131[.]193:443

Cobalt Stike Beacon Detected – 119[.]29[.]162[.]38:8088

Cobalt Stike Beacon Detected – 106[.]75[.]247[.]178:80

Cobalt Stike Beacon Detected – 8[.]131[.]94[.]164:7443

Cobalt Stike Beacon Detected – 43[.]138[.]41[.]95:80

Malware Analysis – djvu – 31779136196425ada7f38369086e99cc

Malware Analysis – smokeloader – 2d5f1f172ee74e3ad998059669e9e39e

Malware Analysis – djvu – f667cb81fe70b79d3651127cbf34c1f3

Malware Analysis – djvu – e8af5b0c9d7b8d7f7357ee0fd9ea0218

Google Chrome Multiple Vulnerabilities

Cobalt Strike Beacon Detected – 124[.]221[.]116[.]169:80

Cobalt Strike Beacon Detected – 196[.]251[.]87[.]191:4433

Cobalt Strike Beacon Detected – 179[.]43[.]186[.]243:80

Cobalt Strike Beacon Detected – 118[.]25[.]91[.]151:80

You may have missed