threatintel

Malware Analysis – djvu – 8e8c43682825e340a0e4e86df9638d88

November 9, 2022

Score: 10 MALWARE FAMILY: djvuTAGS:family:djvu, family:redline, family:smokeloader, family:vidar, botnet:517, botnet:gg, backdoor, collection, discovery, infostealer, persistence, ransomware, spyware, stealer, trojanMD5: 8e8c43682825e340a0e4e86df9638d88SHA1:...

Malware Analysis – teslacrypt – 52ec44494fed2c9bebd5ce99903b7775

November 9, 2022

Score: 10 MALWARE FAMILY: teslacryptTAGS:family:teslacrypt, persistence, ransomware, spyware, stealerMD5: 52ec44494fed2c9bebd5ce99903b7775SHA1: 6191526cf35f080922830412c795df4fed5f8696ANALYSIS DATE: 2022-11-08T13:52:35ZTTPS: T1082, T1060, T1112, T1107, T1490, T1005, T1081,...

Malware Analysis – ransomware – d796f9491a1dbd0f0dbcf2e2dfc617e5

November 9, 2022

Score: 10 MALWARE FAMILY: ransomwareTAGS:ransomware, spyware, stealerMD5: d796f9491a1dbd0f0dbcf2e2dfc617e5SHA1: e0dc3073ec0263d3267ce014bdbb3f69666da426ANALYSIS DATE: 2022-11-09T17:06:00ZTTPS: T1082, T1012, T1005, T1081, T1102 ScoreMeaningExample10Known badA malware family...

Malware Analysis – djvu – 879da220b96bdee376de037c5bff5e31

November 9, 2022

Score: 10 MALWARE FAMILY: djvuTAGS:family:djvu, family:vidar, botnet:517, discovery, persistence, ransomware, spyware, stealerMD5: 879da220b96bdee376de037c5bff5e31SHA1: 00eb2f6949fe3a189063909ad401da0ed0eea66bANALYSIS DATE: 2022-11-09T16:24:55ZTTPS: T1005, T1081, T1012, T1082,...

Malware Analysis – surtr – 393e9f112cc999ebd9333877bcc7535e

November 9, 2022

Score: 10 MALWARE FAMILY: surtrTAGS:family:surtr, evasion, persistence, ransomware, spyware, stealer, trojan, upxMD5: 393e9f112cc999ebd9333877bcc7535eSHA1: ed65581b6c3980b3ddf623a4d2f61ce08ce59bdfANALYSIS DATE: 2022-11-09T16:00:21ZTTPS: T1490, T1107, T1088, T1089,...

Malware Analysis – dcrat – d68bd01a1c047679188bd4ba14268249

November 9, 2022

Score: 10 MALWARE FAMILY: dcratTAGS:family:dcrat, family:djvu, family:redline, family:smokeloader, family:vidar, botnet:517, botnet:gg, backdoor, collection, discovery, infostealer, persistence, ransomware, rat, spyware, stealer,...

CISA: Microsoft Releases November 2022 Security Updates

November 9, 2022

Microsoft Releases November 2022 Security Updates Microsoft has released updates to address multiple vulnerabilities in Microsoft software. An attacker can...

Experts observed Amadey malware deploying LockBit 3.0 Ransomware

November 9, 2022

Experts noticed that the Amadey malware is being used to deploy LockBit 3.0 ransomware on compromised systems. Researchers from AhnLab Security Emergency...

Microsoft Patch Tuesday updates fix 6 actively exploited zero-days

November 9, 2022

Microsoft Patch Tuesday updates for November 2022 addressed 64 vulnerabilities, including six actively exploited zero-days. Microsoft Patch Tuesday updates for...

RDPHijack-BOF – Cobalt Strike Beacon Object File (BOF) That Uses WinStationConnect API To Perform Local/Remote RDP Session Hijacking

November 9, 2022

Cobalt Strike Beacon Object File (BOF) that uses WinStationConnect API to perform local/remote RDP session hijacking. With a valid access...

Cobalt Stike Beacon Detected – 124[.]223[.]65[.]106:81

November 9, 2022

The Information provided at the time of posting was detected as "Cobalt Strike". Depending on when you are viewing this...

Cobalt Stike Beacon Detected – 137[.]184[.]177[.]241:8080

November 9, 2022

The Information provided at the time of posting was detected as "Cobalt Strike". Depending on when you are viewing this...

Cobalt Stike Beacon Detected – 20[.]106[.]173[.]114:443

November 9, 2022

The Information provided at the time of posting was detected as "Cobalt Strike". Depending on when you are viewing this...

Malware Analysis – persistence – 08e972ef95b7bc784b5597be7e391d5c

November 9, 2022

Score: 9 MALWARE FAMILY: persistenceTAGS:persistence, ransomwareMD5: 08e972ef95b7bc784b5597be7e391d5cSHA1: 61a6b9edbbe15a73a0b1566c8cd4907a9d89b8bdANALYSIS DATE: 2022-11-08T08:35:50ZTTPS: T1060, T1112, T1107, T1490 ScoreMeaningExample10Known badA malware family was detected.8-9Likely...

Cobalt Stike Beacon Detected – 109[.]206[.]241[.]183:443

November 9, 2022

The Information provided at the time of posting was detected as "Cobalt Strike". Depending on when you are viewing this...

Cobalt Stike Beacon Detected – 185[.]177[.]117[.]215:9999

November 9, 2022

The Information provided at the time of posting was detected as "Cobalt Strike". Depending on when you are viewing this...

Cobalt Stike Beacon Detected – 175[.]178[.]120[.]190:80

November 9, 2022

The Information provided at the time of posting was detected as "Cobalt Strike". Depending on when you are viewing this...

Cobalt Stike Beacon Detected – 72[.]14[.]178[.]145:80

November 9, 2022

The Information provided at the time of posting was detected as "Cobalt Strike". Depending on when you are viewing this...

Malware Analysis – discovery – 0fa9b4b0aba88cff8c3aab79e87dd570

November 9, 2022

Score: 8 MALWARE FAMILY: discoveryTAGS:discovery, exploitMD5: 0fa9b4b0aba88cff8c3aab79e87dd570SHA1: da27d04edd4f1fdf08872f817fbb9a5ca0ae31f6ANALYSIS DATE: 2022-11-08T09:08:03ZTTPS: T1222 ScoreMeaningExample10Known badA malware family was detected.8-9Likely maliciousOne or more...

Malware Analysis – evasion – a9cb0417f7043a209dc488a9a9571d30

November 9, 2022

Score: 10 MALWARE FAMILY: evasionTAGS:evasion, persistence, ransomware, spyware, stealer, trojanMD5: a9cb0417f7043a209dc488a9a9571d30SHA1: d39d3dcf0a50e41ddbab64e9ab0376f3522bdd00ANALYSIS DATE: 2022-11-08T08:51:24ZTTPS: T1060, T1112, T1158, T1082, T1088, T1089,...

Malware Analysis – discovery – 01d2a08c2976f6f7f3a6579d1d64aa26

November 9, 2022

Score: 8 MALWARE FAMILY: discoveryTAGS:discovery, exploitMD5: 01d2a08c2976f6f7f3a6579d1d64aa26SHA1: 0f4fae2be30446e39ce0e14a5763dd7c41ff4b0fANALYSIS DATE: 2022-11-08T08:41:48ZTTPS: T1222 ScoreMeaningExample10Known badA malware family was detected.8-9Likely maliciousOne or more...

Malware Analysis – discovery – 034a5d389fc637d08c53eb0b683f1e81

November 9, 2022

Score: 8 MALWARE FAMILY: discoveryTAGS:discovery, exploitMD5: 034a5d389fc637d08c53eb0b683f1e81SHA1: 86b0b3bd1a6cb3a4d4920206760874db099e4957ANALYSIS DATE: 2022-11-08T08:51:26ZTTPS: T1222 ScoreMeaningExample10Known badA malware family was detected.8-9Likely maliciousOne or more...

Cobalt Stike Beacon Detected – 194[.]26[.]29[.]239:80

November 9, 2022

The Information provided at the time of posting was detected as "Cobalt Strike". Depending on when you are viewing this...

Cobalt Stike Beacon Detected – 84[.]32[.]128[.]34:8080

November 9, 2022

The Information provided at the time of posting was detected as "Cobalt Strike". Depending on when you are viewing this...

threatintel

Malware Analysis – djvu – 8e8c43682825e340a0e4e86df9638d88

Malware Analysis – teslacrypt – 52ec44494fed2c9bebd5ce99903b7775

Malware Analysis – ransomware – d796f9491a1dbd0f0dbcf2e2dfc617e5

Malware Analysis – djvu – 879da220b96bdee376de037c5bff5e31

Malware Analysis – surtr – 393e9f112cc999ebd9333877bcc7535e

Malware Analysis – dcrat – d68bd01a1c047679188bd4ba14268249

CISA: Microsoft Releases November 2022 Security Updates

Experts observed Amadey malware deploying LockBit 3.0 Ransomware

Microsoft Patch Tuesday updates fix 6 actively exploited zero-days

RDPHijack-BOF – Cobalt Strike Beacon Object File (BOF) That Uses WinStationConnect API To Perform Local/Remote RDP Session Hijacking

Cobalt Stike Beacon Detected – 124[.]223[.]65[.]106:81

Cobalt Stike Beacon Detected – 137[.]184[.]177[.]241:8080

Cobalt Stike Beacon Detected – 20[.]106[.]173[.]114:443

Malware Analysis – persistence – 08e972ef95b7bc784b5597be7e391d5c

Cobalt Stike Beacon Detected – 109[.]206[.]241[.]183:443

Cobalt Stike Beacon Detected – 185[.]177[.]117[.]215:9999

Cobalt Stike Beacon Detected – 175[.]178[.]120[.]190:80

Cobalt Stike Beacon Detected – 72[.]14[.]178[.]145:80

Malware Analysis – discovery – 0fa9b4b0aba88cff8c3aab79e87dd570

Malware Analysis – evasion – a9cb0417f7043a209dc488a9a9571d30

Malware Analysis – discovery – 01d2a08c2976f6f7f3a6579d1d64aa26

Malware Analysis – discovery – 034a5d389fc637d08c53eb0b683f1e81

Cobalt Stike Beacon Detected – 194[.]26[.]29[.]239:80

Cobalt Stike Beacon Detected – 84[.]32[.]128[.]34:8080

Navigating the Maze of Cybersecurity Compliance and Regulations

[LYNX] – Ransomware Victim: Clutch Industries

CISA: CISA Releases Five Industrial Control Systems Advisories

CISA: CISA Adds Four Known Exploited Vulnerabilities to Catalog

CISA: CISA Issues BOD 25-01, Implementing Secure Practices for Cloud Services

You may have missed