threatintel

Malware Analysis – djvu – a45bf5a897a017bfd0ba54be36b2be78

October 7, 2022

Score: 10 MALWARE FAMILY: djvuTAGS:family:djvu, family:vidar, botnet:517, discovery, persistence, ransomware, spyware, stealerMD5: a45bf5a897a017bfd0ba54be36b2be78SHA1: fa54653817ff04a1dc06970602eab8e626f6885eANALYSIS DATE: 2022-10-07T15:22:49ZTTPS: T1005, T1081, T1012, T1082,...

Malware Analysis – djvu – 83584c13cb7552c9457896335da9fcfd

October 7, 2022

Score: 10 MALWARE FAMILY: djvuTAGS:family:djvu, family:vidar, botnet:517, discovery, persistence, ransomware, spyware, stealerMD5: 83584c13cb7552c9457896335da9fcfdSHA1: 7df13451b370887175457d72b18354400450bd90ANALYSIS DATE: 2022-10-07T15:20:35ZTTPS: T1222, T1082, T1012, T1005,...

Malware Analysis – amadey – 850faeb8c88754da54234d67cc3d5752

October 7, 2022

Score: 10 MALWARE FAMILY: amadeyTAGS:family:amadey, family:djvu, family:smokeloader, family:vidar, botnet:517, backdoor, collection, discovery, persistence, ransomware, spyware, stealer, trojanMD5: 850faeb8c88754da54234d67cc3d5752SHA1: 8e3f8b5f9e1cc59eb216797180d53dc3bab33abaANALYSIS DATE:...

Malware Analysis – ransomware – 8984977b58651bf6d1ecf884561f20ce

October 7, 2022

Score: 9 MALWARE FAMILY: ransomwareTAGS:ransomware, spyware, stealerMD5: 8984977b58651bf6d1ecf884561f20ceSHA1: dd32b3522ed72225331901ca30c6d53be5ee35d9ANALYSIS DATE: 2022-10-07T16:10:23ZTTPS: T1005, T1081, T1082, T1107, T1490, T1091 ScoreMeaningExample10Known badA malware...

Malware Analysis – ransomware – 8984977b58651bf6d1ecf884561f20ce

October 7, 2022

Score: 9 MALWARE FAMILY: ransomwareTAGS:ransomware, spyware, stealerMD5: 8984977b58651bf6d1ecf884561f20ceSHA1: dd32b3522ed72225331901ca30c6d53be5ee35d9ANALYSIS DATE: 2022-10-07T16:11:04ZTTPS: T1005, T1081, T1082, T1107, T1490, T1091 ScoreMeaningExample10Known badA malware...

Malware Analysis – amadey – e750ebffa7143be9bb3aece8edea96ce

October 7, 2022

Score: 10 MALWARE FAMILY: amadeyTAGS:family:amadey, family:djvu, family:smokeloader, family:vidar, botnet:517, backdoor, collection, discovery, persistence, ransomware, spyware, stealer, trojanMD5: e750ebffa7143be9bb3aece8edea96ceSHA1: ef033c3b1dcf518dd460883e668be80c1ffb3a80ANALYSIS DATE:...

Malware Analysis – masslogger – c980c7e6f4087c91113528f72c824192

October 7, 2022

Score: 10 MALWARE FAMILY: massloggerTAGS:family:masslogger, collection, ransomware, spyware, stealerMD5: c980c7e6f4087c91113528f72c824192SHA1: 4e2bba5c5ced0a245e372fed825c829ba47ba5f2ANALYSIS DATE: 2022-10-07T16:12:23ZTTPS: T1005, T1081, T1082, T1012, T1114 ScoreMeaningExample10Known badA...

Malware Analysis – smokeloader – e750ebffa7143be9bb3aece8edea96ce

October 7, 2022

Score: 10 MALWARE FAMILY: smokeloaderTAGS:family:smokeloader, backdoor, trojanMD5: e750ebffa7143be9bb3aece8edea96ceSHA1: ef033c3b1dcf518dd460883e668be80c1ffb3a80ANALYSIS DATE: 2022-10-07T16:51:04ZTTPS: T1012, T1120, T1082 ScoreMeaningExample10Known badA malware family was detected.8-9Likely...

CISA: FBI and CISA Publish a PSA on Information Manipulation Tactics for 2022 Midterm Elections

October 7, 2022

FBI and CISA Publish a PSA on Information Manipulation Tactics for 2022 Midterm Elections Title: FBI and CISA Publish a PSA...

Fortinet urges customers to immediately fix a critical authentication bypass flaw in FortiGate and FortiProxy

October 7, 2022

Fortinet addressed a critical authentication bypass vulnerability that impacted FortiGate firewalls and FortiProxy web proxies. Fortinet addressed a critical authentication...

Digital Binary Code on Dark Red Background. Data Breach

Wakanim – 6,706,951 breached accounts

October 7, 2022

In August 2022, the European streaming service Wakanim suffered a data breach which was subsequently advertised and sold on a...

Bhinneka – 1,274,340 breached accounts

October 7, 2022

In early 2020, the Indonesian consumer electronics website Bhinneka suffered a data breach that exposed almost 1.3M customer records. The...

Cloudfox – Automating Situational Awareness For Cloud Penetration Tests

October 7, 2022

CloudFox helps you gain situational awareness in unfamiliar cloud environments. It’s an open source CloudFox is designed to be executed...

Cobalt Stike Beacon Detected – 121[.]5[.]72[.]218:80

October 7, 2022

The Information provided at the time of posting was detected as "Cobalt Strike". Depending on when you are viewing this...

Cobalt Stike Beacon Detected – 139[.]224[.]137[.]154:8084

October 7, 2022

The Information provided at the time of posting was detected as "Cobalt Strike". Depending on when you are viewing this...

Cobalt Stike Beacon Detected – 222[.]161[.]59[.]29:666

October 7, 2022

The Information provided at the time of posting was detected as "Cobalt Strike". Depending on when you are viewing this...

Black Basta Ransomware Victim: MERCOLA

October 7, 2022

Black Basta Ransomware NOTE: No files or stolen information are by RedPacket Security. Any legal issues relating to the content...

Malware Analysis – smokeloader – 9d9da4319e0fff70db698857b74a797e

October 7, 2022

Score: 10 MALWARE FAMILY: smokeloaderTAGS:family:smokeloader, backdoor, trojanMD5: 9d9da4319e0fff70db698857b74a797eSHA1: 908841de7d76f4931dd62da3ab1b208f1b5b9cefANALYSIS DATE: 2022-10-07T08:03:04ZTTPS: T1012, T1120, T1082 ScoreMeaningExample10Known badA malware family was detected.8-9Likely...

Malware Analysis – djvu – 9d9da4319e0fff70db698857b74a797e

October 7, 2022

Score: 10 MALWARE FAMILY: djvuTAGS:family:djvu, family:smokeloader, family:vidar, botnet:517, backdoor, collection, discovery, persistence, ransomware, spyware, stealer, trojanMD5: 9d9da4319e0fff70db698857b74a797eSHA1: 908841de7d76f4931dd62da3ab1b208f1b5b9cefANALYSIS DATE: 2022-10-07T08:09:25ZTTPS:...

Cobalt Stike Beacon Detected – 43[.]142[.]147[.]186:80

October 7, 2022

The Information provided at the time of posting was detected as "Cobalt Strike". Depending on when you are viewing this...

Cobalt Stike Beacon Detected – 84[.]32[.]128[.]13:443

October 7, 2022

The Information provided at the time of posting was detected as "Cobalt Strike". Depending on when you are viewing this...

Cobalt Stike Beacon Detected – 188[.]241[.]240[.]137:443

October 7, 2022

The Information provided at the time of posting was detected as "Cobalt Strike". Depending on when you are viewing this...

Cobalt Stike Beacon Detected – 81[.]68[.]112[.]185:11

October 7, 2022

The Information provided at the time of posting was detected as "Cobalt Strike". Depending on when you are viewing this...

Malware Analysis – djvu – ffa9434c90b194b32d5ec9ad565ac875

October 7, 2022

Score: 10 MALWARE FAMILY: djvuTAGS:family:djvu, family:vidar, botnet:517, discovery, persistence, ransomware, spyware, stealerMD5: ffa9434c90b194b32d5ec9ad565ac875SHA1: b53d13666b21224c4960688d15b80a30e2b27e6dANALYSIS DATE: 2022-10-07T08:12:50ZTTPS: T1060, T1112, T1222, T1005,...

threatintel

Malware Analysis – djvu – a45bf5a897a017bfd0ba54be36b2be78

Malware Analysis – djvu – 83584c13cb7552c9457896335da9fcfd

Malware Analysis – amadey – 850faeb8c88754da54234d67cc3d5752

Malware Analysis – ransomware – 8984977b58651bf6d1ecf884561f20ce

Malware Analysis – ransomware – 8984977b58651bf6d1ecf884561f20ce

Malware Analysis – amadey – e750ebffa7143be9bb3aece8edea96ce

Malware Analysis – masslogger – c980c7e6f4087c91113528f72c824192

Malware Analysis – smokeloader – e750ebffa7143be9bb3aece8edea96ce

CISA: FBI and CISA Publish a PSA on Information Manipulation Tactics for 2022 Midterm Elections

Fortinet urges customers to immediately fix a critical authentication bypass flaw in FortiGate and FortiProxy

Wakanim – 6,706,951 breached accounts

Bhinneka – 1,274,340 breached accounts

Cloudfox – Automating Situational Awareness For Cloud Penetration Tests

Cobalt Stike Beacon Detected – 121[.]5[.]72[.]218:80

Cobalt Stike Beacon Detected – 139[.]224[.]137[.]154:8084

Cobalt Stike Beacon Detected – 222[.]161[.]59[.]29:666

Black Basta Ransomware Victim: MERCOLA

Malware Analysis – smokeloader – 9d9da4319e0fff70db698857b74a797e

Malware Analysis – djvu – 9d9da4319e0fff70db698857b74a797e

Cobalt Stike Beacon Detected – 43[.]142[.]147[.]186:80

Cobalt Stike Beacon Detected – 84[.]32[.]128[.]13:443

Cobalt Stike Beacon Detected – 188[.]241[.]240[.]137:443

Cobalt Stike Beacon Detected – 81[.]68[.]112[.]185:11

Malware Analysis – djvu – ffa9434c90b194b32d5ec9ad565ac875

[CACTUS] – Ransomware Victim: thermoid[.]com

[CACTUS] – Ransomware Victim: baillie[.]com

[CACTUS] – Ransomware Victim: tempel[.]com

[FUNKSEC] – Ransomware Victim: extremeperformance[.]com

[BABUK2] – Ransomware Victim: hitekgroup[.]in india Finance

You may have missed