Security

Malware Analysis – ransomware – 183ad97d55d1170f21a8d10a8339fdab

December 12, 2022

Score: 5 MALWARE FAMILY: ransomwareTAGS:ransomwareMD5: 183ad97d55d1170f21a8d10a8339fdabSHA1: 427b302690b2418b5b414fee3ac6ce585e6fe375ANALYSIS DATE: 2022-12-12T10:56:45ZTTPS: ScoreMeaningExample10Known badA malware family was detected.8-9Likely maliciousOne or more known damaging...

Cobalt Stike Beacon Detected – 43[.]154[.]57[.]146:8002

December 12, 2022

The Information provided at the time of posting was detected as "Cobalt Strike". Depending on when you are viewing this...

Cobalt Stike Beacon Detected – 18[.]192[.]11[.]175:80

December 12, 2022

The Information provided at the time of posting was detected as "Cobalt Strike". Depending on when you are viewing this...

Cobalt Stike Beacon Detected – 103[.]155[.]92[.]229:80

December 12, 2022

The Information provided at the time of posting was detected as "Cobalt Strike". Depending on when you are viewing this...

Cobalt Stike Beacon Detected – 107[.]189[.]12[.]60:80

December 12, 2022

The Information provided at the time of posting was detected as "Cobalt Strike". Depending on when you are viewing this...

Malware Analysis – smokeloader – e2aa8611ff12300ed35713bd5b396b2e

December 12, 2022

Score: 10 MALWARE FAMILY: smokeloaderTAGS:family:smokeloader, backdoor, trojanMD5: e2aa8611ff12300ed35713bd5b396b2eSHA1: 21a61539cbd78c50ae43234657b0d7e6a6a81010ANALYSIS DATE: 2022-12-12T11:14:49ZTTPS: T1012, T1120, T1082 ScoreMeaningExample10Known badA malware family was detected.8-9Likely...

Malware Analysis – dcrat – e2a32071d75e13ad12354cde287a1469

December 12, 2022

Score: 10 MALWARE FAMILY: dcratTAGS:family:dcrat, family:djvu, family:raccoon, family:redline, family:smokeloader, family:vidar, botnet:517, botnet:ec7a54fb6492ff3a52d09504b8ecf082, botnet:mario23_10, backdoor, bootkit, collection, discovery, infostealer, persistence, ransomware,...

Malware Analysis – dcrat – ae28646e93a50694398096751b0e149f

December 12, 2022

Malware Analysis – djvu – 88c46c7fa052089249e07fc1425e07bd

December 12, 2022

Score: 10 MALWARE FAMILY: djvuTAGS:family:djvu, family:vidar, botnet:517, discovery, persistence, ransomware, spyware, stealerMD5: 88c46c7fa052089249e07fc1425e07bdSHA1: f0e3c48f0aa75999b5f790faf3930b87e892b664ANALYSIS DATE: 2022-12-12T11:01:50ZTTPS: T1012, T1082, T1005, T1081,...

TrueBot infections were observed in Clop ransomware attacks

December 12, 2022

Researchers reported an increase in TrueBot infections, attackers have shifted from using malicious emails as their primary delivery method to other techniques....

Malware Analysis – smokeloader – 9b680fe6c94c5c5efd8d1ee47e6bc9a3

December 12, 2022

Score: 10 MALWARE FAMILY: smokeloaderTAGS:family:smokeloader, backdoor, trojanMD5: 9b680fe6c94c5c5efd8d1ee47e6bc9a3SHA1: 07700e18220654e8334dd36db10c413543ab5f59ANALYSIS DATE: 2022-12-12T04:24:56ZTTPS: T1012, T1120, T1082 ScoreMeaningExample10Known badA malware family was detected.8-9Likely...

Malware Analysis – – 3a02deed11f7ff4dbc1188d201ad164a

December 12, 2022

Score: 8 MALWARE FAMILY: TAGS:MD5: 3a02deed11f7ff4dbc1188d201ad164aSHA1: 5c935f5c25c2975ef384878bb094567fb19519c9ANALYSIS DATE: 2022-12-12T04:09:21ZTTPS: ScoreMeaningExample10Known badA malware family was detected.8-9Likely maliciousOne or more known damaging...

Malware Analysis – djvu – 6ae2c7e69f7af191c459978a7ffbb2d6

December 12, 2022

Score: 10 MALWARE FAMILY: djvuTAGS:family:djvu, family:vidar, botnet:517, discovery, persistence, ransomware, spyware, stealerMD5: 6ae2c7e69f7af191c459978a7ffbb2d6SHA1: 64c504634fb86ae0cde436c50cefee73fb0f8e8fANALYSIS DATE: 2022-12-12T03:58:30ZTTPS: T1222, T1012, T1082, T1060,...

Malware Analysis – evasion – e9663f1b8ec8a5e2c130f4ff496a43d8

December 12, 2022

Score: 10 MALWARE FAMILY: evasionTAGS:evasion, persistence, ransomwareMD5: e9663f1b8ec8a5e2c130f4ff496a43d8SHA1: ed373bf96e834f4bf920220cc61a84f064e1275aANALYSIS DATE: 2022-12-07T09:27:09ZTTPS: T1012, T1120, T1082, T1158, T1112, T1060 ScoreMeaningExample10Known badA malware...

Malware Analysis – dcrat – b046fd352da5913664316180e0e22633

December 12, 2022

Score: 10 MALWARE FAMILY: dcratTAGS:family:dcrat, family:djvu, family:redline, family:smokeloader, family:vidar, botnet:517, botnet:mario23_10, backdoor, bootkit, collection, discovery, infostealer, persistence, ransomware, rat, spyware,...

Malware Analysis – djvu – 0bffab8de978679c204fe21331058575

December 12, 2022

Score: 10 MALWARE FAMILY: djvuTAGS:family:djvu, family:vidar, botnet:517, discovery, persistence, ransomware, spyware, stealerMD5: 0bffab8de978679c204fe21331058575SHA1: f3830a7b5b741df86cc52d7432a7d6a30a6772e6ANALYSIS DATE: 2022-12-12T05:02:15ZTTPS: T1082, T1053, T1005, T1081,...

Malware Analysis – dcrat – fbdde4446467cf7b6e2edc26f470ed98

December 12, 2022

Malware Analysis – djvu – 352a744e8b4258b7729581602709800a

December 12, 2022

Score: 10 MALWARE FAMILY: djvuTAGS:family:djvu, family:vidar, botnet:517, discovery, persistence, ransomware, spyware, stealerMD5: 352a744e8b4258b7729581602709800aSHA1: a06aa0539924ca45f63ce74783d593e97ba1502cANALYSIS DATE: 2022-12-12T05:32:53ZTTPS: T1053, T1005, T1081, T1130,...

Cobalt Stike Beacon Detected – 47[.]92[.]95[.]200:443

December 12, 2022

The Information provided at the time of posting was detected as "Cobalt Strike". Depending on when you are viewing this...

Cobalt Stike Beacon Detected – 20[.]12[.]210[.]245:443

December 12, 2022

The Information provided at the time of posting was detected as "Cobalt Strike". Depending on when you are viewing this...

Cobalt Stike Beacon Detected – 1[.]117[.]91[.]33:80

December 12, 2022

The Information provided at the time of posting was detected as "Cobalt Strike". Depending on when you are viewing this...

Cobalt Stike Beacon Detected – 83[.]97[.]20[.]148:80

December 12, 2022

The Information provided at the time of posting was detected as "Cobalt Strike". Depending on when you are viewing this...

Malware Analysis – djvu – 1607b60ccb7bc768acc7059b54a1d86a

December 12, 2022

Score: 10 MALWARE FAMILY: djvuTAGS:family:djvu, family:vidar, botnet:517, discovery, persistence, ransomware, spyware, stealerMD5: 1607b60ccb7bc768acc7059b54a1d86aSHA1: 94dd0783405cececd513b50f38d5c4cb3cf82f77ANALYSIS DATE: 2022-12-11T21:51:54ZTTPS: T1053, T1005, T1081, T1012,...

Cobalt Stike Beacon Detected – 1[.]14[.]198[.]89:8011

December 12, 2022

The Information provided at the time of posting was detected as "Cobalt Strike". Depending on when you are viewing this...

Security

Malware Analysis – ransomware – 183ad97d55d1170f21a8d10a8339fdab

Cobalt Stike Beacon Detected – 43[.]154[.]57[.]146:8002

Cobalt Stike Beacon Detected – 18[.]192[.]11[.]175:80

Cobalt Stike Beacon Detected – 103[.]155[.]92[.]229:80

Cobalt Stike Beacon Detected – 107[.]189[.]12[.]60:80

Malware Analysis – smokeloader – e2aa8611ff12300ed35713bd5b396b2e

Malware Analysis – dcrat – e2a32071d75e13ad12354cde287a1469

Malware Analysis – dcrat – ae28646e93a50694398096751b0e149f

Malware Analysis – djvu – 88c46c7fa052089249e07fc1425e07bd

TrueBot infections were observed in Clop ransomware attacks

Malware Analysis – smokeloader – 9b680fe6c94c5c5efd8d1ee47e6bc9a3

Malware Analysis – – 3a02deed11f7ff4dbc1188d201ad164a

Malware Analysis – djvu – 6ae2c7e69f7af191c459978a7ffbb2d6

Malware Analysis – evasion – e9663f1b8ec8a5e2c130f4ff496a43d8

Malware Analysis – dcrat – b046fd352da5913664316180e0e22633

Malware Analysis – djvu – 0bffab8de978679c204fe21331058575

Malware Analysis – dcrat – fbdde4446467cf7b6e2edc26f470ed98

Malware Analysis – djvu – 352a744e8b4258b7729581602709800a

Cobalt Stike Beacon Detected – 47[.]92[.]95[.]200:443

Cobalt Stike Beacon Detected – 20[.]12[.]210[.]245:443

Cobalt Stike Beacon Detected – 1[.]117[.]91[.]33:80

Cobalt Stike Beacon Detected – 83[.]97[.]20[.]148:80

Malware Analysis – djvu – 1607b60ccb7bc768acc7059b54a1d86a

Cobalt Stike Beacon Detected – 1[.]14[.]198[.]89:8011

CISA: CISA Releases Fact Sheet Detailing Embedded Backdoor Function of Contec CMS8000 Firmware

CISA: CISA Releases Nine Industrial Control Systems Advisories

CISA: CISA Adds Four Known Exploited Vulnerabilities to Catalog

CISA: CISA Partners with ASD’s ACSC, CCCS, NCSC-UK, and Other International and US Organizations to Release Guidance on Edge Devices

CISA: CISA Adds One Known Exploited Vulnerability to Catalog

You may have missed