Security

Malware Analysis – evasion – 39be65c8a26732e90364ad5c6f98986e

December 20, 2022

Score: 7 MALWARE FAMILY: evasionTAGS:evasion, ransomwareMD5: 39be65c8a26732e90364ad5c6f98986eSHA1: 1d66f11969008d4d4fde5e896b9764d9192fb158ANALYSIS DATE: 2022-12-20T09:10:04ZTTPS: ScoreMeaningExample10Known badA malware family was detected.8-9Likely maliciousOne or more known...

Cobalt Stike Beacon Detected – 47[.]96[.]156[.]250:4445

December 20, 2022

The Information provided at the time of posting was detected as "Cobalt Strike". Depending on when you are viewing this...

Cobalt Stike Beacon Detected – 202[.]95[.]19[.]215:443

December 20, 2022

The Information provided at the time of posting was detected as "Cobalt Strike". Depending on when you are viewing this...

Cobalt Stike Beacon Detected – 43[.]140[.]251[.]169:80

December 20, 2022

The Information provided at the time of posting was detected as "Cobalt Strike". Depending on when you are viewing this...

Cobalt Stike Beacon Detected – 43[.]130[.]228[.]116:443

December 20, 2022

The Information provided at the time of posting was detected as "Cobalt Strike". Depending on when you are viewing this...

Malware Analysis – djvu – 6c84cd55dc9d322cbac397f90f9a94d0

December 20, 2022

Score: 10 MALWARE FAMILY: djvuTAGS:family:djvu, discovery, persistence, ransomware, spyware, stealerMD5: 6c84cd55dc9d322cbac397f90f9a94d0SHA1: 7c39f89906feabc5d8218f5d627aa150052138b4ANALYSIS DATE: 2022-12-20T10:36:34ZTTPS: T1222, T1005, T1081, T1053, T1012, T1082,...

Malware Analysis – persistence – dc4ae2105938cb68c5b6988465e13da1

December 20, 2022

Score: 8 MALWARE FAMILY: persistenceTAGS:persistence, ransomwareMD5: dc4ae2105938cb68c5b6988465e13da1SHA1: 4bf9313e1b4f51df9b94cf73e36adb53f8c29ac0ANALYSIS DATE: 2022-12-20T10:31:05ZTTPS: T1060, T1112 ScoreMeaningExample10Known badA malware family was detected.8-9Likely maliciousOne or...

Malware Analysis – ryuk – f62bb82db62dd6b80908dcd79ea51fb2

December 20, 2022

Score: 10 MALWARE FAMILY: ryukTAGS:family:ryuk, discovery, evasion, persistence, ransomwareMD5: f62bb82db62dd6b80908dcd79ea51fb2SHA1: e635ba1b935adf31ffd055d71884098567b3dd4fANALYSIS DATE: 2022-12-20T10:41:33ZTTPS: T1490, T1112, T1082, T1222, T1107, T1060 ScoreMeaningExample10Known...

Malware Analysis – banker – 09edc47eee95bc8e6e70faf20da6c3fd

December 20, 2022

Score: 8 MALWARE FAMILY: bankerTAGS:banker, evasion, ransomwareMD5: 09edc47eee95bc8e6e70faf20da6c3fdSHA1: 5925a3b50d251718609a7bf8dbc8bcd8e6fe2fc5ANALYSIS DATE: 2022-12-20T11:33:04ZTTPS: ScoreMeaningExample10Known badA malware family was detected.8-9Likely maliciousOne or more...

CVE-2022-41040 and CVE-2022-41082 – zero-days in MS Exchange

December 20, 2022

Summary At the end of September, GTSC reported an attack on critical infrastructure that took place in August. During the...

Malicious PyPI package posed as SentinelOne SDK to serve info-stealing malware

December 20, 2022

Researchers spotted a malicious package in the Python Package Index (PyPI) repository that impersonates a software development kit (SDK) for...

Cobalt Stike Beacon Detected – 138[.]197[.]165[.]105:443

December 20, 2022

The Information provided at the time of posting was detected as "Cobalt Strike". Depending on when you are viewing this...

Cobalt Stike Beacon Detected – 39[.]98[.]50[.]48:80

December 20, 2022

The Information provided at the time of posting was detected as "Cobalt Strike". Depending on when you are viewing this...

Cobalt Stike Beacon Detected – 198[.]46[.]131[.]172:443

December 20, 2022

The Information provided at the time of posting was detected as "Cobalt Strike". Depending on when you are viewing this...

Cobalt Stike Beacon Detected – 79[.]137[.]202[.]62:80

December 20, 2022

The Information provided at the time of posting was detected as "Cobalt Strike". Depending on when you are viewing this...

Cobalt Stike Beacon Detected – 47[.]104[.]195[.]224:80

December 20, 2022

The Information provided at the time of posting was detected as "Cobalt Strike". Depending on when you are viewing this...

Cobalt Stike Beacon Detected – 15[.]164[.]155[.]60:8888

December 20, 2022

The Information provided at the time of posting was detected as "Cobalt Strike". Depending on when you are viewing this...

Cobalt Stike Beacon Detected – 194[.]165[.]16[.]58:443

December 20, 2022

The Information provided at the time of posting was detected as "Cobalt Strike". Depending on when you are viewing this...

Cobalt Stike Beacon Detected – 47[.]242[.]58[.]73:8899

December 20, 2022

The Information provided at the time of posting was detected as "Cobalt Strike". Depending on when you are viewing this...

Cobalt Stike Beacon Detected – 121[.]36[.]165[.]78:444

December 20, 2022

The Information provided at the time of posting was detected as "Cobalt Strike". Depending on when you are viewing this...

Cobalt Stike Beacon Detected – 81[.]70[.]203[.]138:443

December 20, 2022

The Information provided at the time of posting was detected as "Cobalt Strike". Depending on when you are viewing this...

Cobalt Stike Beacon Detected – 1[.]117[.]231[.]225:443

December 20, 2022

The Information provided at the time of posting was detected as "Cobalt Strike". Depending on when you are viewing this...

Cobalt Stike Beacon Detected – 103[.]67[.]191[.]89:8080

December 20, 2022

The Information provided at the time of posting was detected as "Cobalt Strike". Depending on when you are viewing this...

Cobalt Stike Beacon Detected – 119[.]91[.]214[.]230:5555

December 20, 2022

The Information provided at the time of posting was detected as "Cobalt Strike". Depending on when you are viewing this...

Security

Malware Analysis – evasion – 39be65c8a26732e90364ad5c6f98986e

Cobalt Stike Beacon Detected – 47[.]96[.]156[.]250:4445

Cobalt Stike Beacon Detected – 202[.]95[.]19[.]215:443

Cobalt Stike Beacon Detected – 43[.]140[.]251[.]169:80

Cobalt Stike Beacon Detected – 43[.]130[.]228[.]116:443

Malware Analysis – djvu – 6c84cd55dc9d322cbac397f90f9a94d0

Malware Analysis – persistence – dc4ae2105938cb68c5b6988465e13da1

Malware Analysis – ryuk – f62bb82db62dd6b80908dcd79ea51fb2

Malware Analysis – banker – 09edc47eee95bc8e6e70faf20da6c3fd

CVE-2022-41040 and CVE-2022-41082 – zero-days in MS Exchange

Malicious PyPI package posed as SentinelOne SDK to serve info-stealing malware

Cobalt Stike Beacon Detected – 138[.]197[.]165[.]105:443

Cobalt Stike Beacon Detected – 39[.]98[.]50[.]48:80

Cobalt Stike Beacon Detected – 198[.]46[.]131[.]172:443

Cobalt Stike Beacon Detected – 79[.]137[.]202[.]62:80

Cobalt Stike Beacon Detected – 47[.]104[.]195[.]224:80

Cobalt Stike Beacon Detected – 15[.]164[.]155[.]60:8888

Cobalt Stike Beacon Detected – 194[.]165[.]16[.]58:443

Cobalt Stike Beacon Detected – 47[.]242[.]58[.]73:8899

Cobalt Stike Beacon Detected – 121[.]36[.]165[.]78:444

Cobalt Stike Beacon Detected – 81[.]70[.]203[.]138:443

Cobalt Stike Beacon Detected – 1[.]117[.]231[.]225:443

Cobalt Stike Beacon Detected – 103[.]67[.]191[.]89:8080

Cobalt Stike Beacon Detected – 119[.]91[.]214[.]230:5555

Cobalt Strike Beacon Detected – 162[.]128[.]74[.]109:4433

Cobalt Strike Beacon Detected – 120[.]24[.]62[.]81:443

Cobalt Strike Beacon Detected – 162[.]128[.]74[.]109:443

Cobalt Strike Beacon Detected – 156[.]245[.]28[.]97:80

Cobalt Strike Beacon Detected – 23[.]27[.]48[.]179:443

You may have missed