OSINT

Malware Analysis – djvu – 947fe80a2c26a998c18cafe4ac2c6fa9

January 12, 2023

Score: 10 MALWARE FAMILY: djvuTAGS:family:djvu, family:vidar, botnet:19, discovery, persistence, ransomware, spyware, stealerMD5: 947fe80a2c26a998c18cafe4ac2c6fa9SHA1: 7337ef39800091ea808fa9c1c074e37feb4b95ccANALYSIS DATE: 2023-01-12T05:54:51ZTTPS: T1060, T1112, T1053, T1005,...

Malware Analysis – aurora – dfc9518f5e0b145f1fa786628670863d

January 12, 2023

Score: 10 MALWARE FAMILY: auroraTAGS:family:aurora, family:blacknet, family:darkcomet, family:dcrat, family:djvu, family:redline, family:smokeloader, family:vidar, family:wannacry, botnet:19, backdoor, collection, discovery, infostealer, persistence, ransomware,...

Cobalt Stike Beacon Detected – 43[.]139[.]146[.]60:2222

January 12, 2023

The Information provided at the time of posting was detected as "Cobalt Strike". Depending on when you are viewing this...

Cobalt Stike Beacon Detected – 103[.]149[.]90[.]238:2000

January 12, 2023

The Information provided at the time of posting was detected as "Cobalt Strike". Depending on when you are viewing this...

Malware Analysis – discovery – a7798f8706cb8c4c347da090eb320de9

January 12, 2023

Score: 10 MALWARE FAMILY: discoveryTAGS:discovery, persistence, ransomwareMD5: a7798f8706cb8c4c347da090eb320de9SHA1: 66a8b77a2ab4a5b4598f84895559edb0e44873daANALYSIS DATE: 2023-01-11T20:49:11ZTTPS: T1112, T1042, T1012, T1082, T1060 ScoreMeaningExample10Known badA malware family...

Malware Analysis – discovery – 1e262e85af7822f199da3f27c7f5d406

January 12, 2023

Score: 10 MALWARE FAMILY: discoveryTAGS:discovery, persistence, ransomwareMD5: 1e262e85af7822f199da3f27c7f5d406SHA1: 3b934e6d859308cc9af07a1b184ea90021ff7a36ANALYSIS DATE: 2023-01-11T23:05:24ZTTPS: T1112, T1012, T1082, T1060, T1042 ScoreMeaningExample10Known badA malware family...

Malware Analysis – amadey – b4be08f67e4b5fed600bf5558b119168

January 12, 2023

Score: 10 MALWARE FAMILY: amadeyTAGS:family:amadey, family:aurora, family:dcrat, family:djvu, family:icedid, family:smokeloader, family:vidar, botnet:19, campaign:3131022508, backdoor, banker, discovery, infostealer, loader, persistence, ransomware,...

Malware Analysis – evasion – 26b5b59d0c9ff7a575eced46612d8e25

January 12, 2023

Score: 5 MALWARE FAMILY: evasionTAGS:evasion, ransomwareMD5: 26b5b59d0c9ff7a575eced46612d8e25SHA1: f28ecc9dda6c7c3848c2e20913b3bd39155004bdANALYSIS DATE: 2023-01-11T22:43:03ZTTPS: ScoreMeaningExample10Known badA malware family was detected.8-9Likely maliciousOne or more known...

Malware Analysis – djvu – 793032b03418e42783b294836132e84e

January 12, 2023

Score: 10 MALWARE FAMILY: djvuTAGS:family:djvu, family:vidar, botnet:19, discovery, persistence, ransomware, spyware, stealerMD5: 793032b03418e42783b294836132e84eSHA1: a395aca39b0a1ce4b5af893f4014f1a96687f2bcANALYSIS DATE: 2023-01-11T22:44:58ZTTPS: T1053, T1005, T1081, T1060,...

CISA: NCSC-UK Releases Guidance on Using MSP for Administering Cloud Services

January 11, 2023

NCSC-UK Releases Guidance on Using MSP for Administering Cloud Services The United Kingdom’s National Cyber Security Centre (NCSC-UK) has released...

Bug Bounty

BugCrowd Bug Bounty Disclosure: – I found a text injection – By Orange_hacker

January 11, 2023

The below information is fully automated and the information is captured from the BugCrowd Disclosure website. The information was correct...

c2f941e109d3f913b12d82efdcf116fea5d147fff783caba368c7d51f68e8e56

PowerHuntShares – Audit Script Designed In Inventory, Analyze, And Report Excessive Privileges Configured On Active Directory Domains

January 11, 2023

PowerHuntShares is design to automatically inventory, analyze, and report excessive privilege assigned to SMB shares on Active Directory domain joined...

LockBit 3.0 Ransomware Victim: circlevillecourt[.]com

January 11, 2023

LockBit 3.0 Ransomware NOTE: No files or stolen information are by RedPacket Security. Any legal issues relating to the content...

LockBit 3.0 Ransomware Victim: datair[.]com

January 11, 2023

LockBit 3.0 Ransomware NOTE: No files or stolen information are by RedPacket Security. Any legal issues relating to the content...

Cobalt Stike Beacon Detected – 87[.]251[.]67[.]166:80

January 11, 2023

The Information provided at the time of posting was detected as "Cobalt Strike". Depending on when you are viewing this...

Cobalt Stike Beacon Detected – 43[.]132[.]122[.]84:80

January 11, 2023

The Information provided at the time of posting was detected as "Cobalt Strike". Depending on when you are viewing this...

Cobalt Stike Beacon Detected – 116[.]204[.]211[.]163:443

January 11, 2023

The Information provided at the time of posting was detected as "Cobalt Strike". Depending on when you are viewing this...

Malware Analysis – lockbit – a8e0d56f8c67f1f7b6e592c12d87acab

January 11, 2023

Score: 10 MALWARE FAMILY: lockbitTAGS:family:lockbit, ransomwareMD5: a8e0d56f8c67f1f7b6e592c12d87acabSHA1: ed555f0162ea6ec5b8b8bada743cfc628d376274ANALYSIS DATE: 2023-01-11T09:07:12ZTTPS: T1491, T1112 ScoreMeaningExample10Known badA malware family was detected.8-9Likely maliciousOne or...

Cobalt Stike Beacon Detected – 101[.]42[.]46[.]117:80

January 11, 2023

The Information provided at the time of posting was detected as "Cobalt Strike". Depending on when you are viewing this...

Cobalt Stike Beacon Detected – 157[.]245[.]102[.]164:443

January 11, 2023

The Information provided at the time of posting was detected as "Cobalt Strike". Depending on when you are viewing this...

Cobalt Stike Beacon Detected – 173[.]82[.]196[.]58:443

January 11, 2023

The Information provided at the time of posting was detected as "Cobalt Strike". Depending on when you are viewing this...

Cobalt Stike Beacon Detected – 129[.]152[.]2[.]128:443

January 11, 2023

The Information provided at the time of posting was detected as "Cobalt Strike". Depending on when you are viewing this...

Malware Analysis – aurora – a750f4f224ae7af1c886b39d1c5800d4

January 11, 2023

Score: 10 MALWARE FAMILY: auroraTAGS:family:aurora, family:dcrat, family:djvu, family:icedid, family:smokeloader, family:vidar, botnet:19, campaign:3131022508, backdoor, banker, discovery, infostealer, loader, persistence, ransomware, rat,...

Malware Analysis – wannacry – 5c7fb0927db37372da25f270708103a2

January 11, 2023

Score: 10 MALWARE FAMILY: wannacryTAGS:family:wannacry, persistence, ransomware, spyware, stealer, wormMD5: 5c7fb0927db37372da25f270708103a2SHA1: 120ed9279d85cbfa56e5b7779ffa7162074f7a29ANALYSIS DATE: 2023-01-11T09:07:49ZTTPS: T1107, T1490, T1082, T1005, T1081, T1060,...

OSINT

Malware Analysis – djvu – 947fe80a2c26a998c18cafe4ac2c6fa9

Malware Analysis – aurora – dfc9518f5e0b145f1fa786628670863d

Cobalt Stike Beacon Detected – 43[.]139[.]146[.]60:2222

Cobalt Stike Beacon Detected – 103[.]149[.]90[.]238:2000

Malware Analysis – discovery – a7798f8706cb8c4c347da090eb320de9

Malware Analysis – discovery – 1e262e85af7822f199da3f27c7f5d406

Malware Analysis – amadey – b4be08f67e4b5fed600bf5558b119168

Malware Analysis – evasion – 26b5b59d0c9ff7a575eced46612d8e25

Malware Analysis – djvu – 793032b03418e42783b294836132e84e

CISA: NCSC-UK Releases Guidance on Using MSP for Administering Cloud Services

BugCrowd Bug Bounty Disclosure: – I found a text injection – By Orange_hacker

PowerHuntShares – Audit Script Designed In Inventory, Analyze, And Report Excessive Privileges Configured On Active Directory Domains

LockBit 3.0 Ransomware Victim: circlevillecourt[.]com

LockBit 3.0 Ransomware Victim: datair[.]com

Cobalt Stike Beacon Detected – 87[.]251[.]67[.]166:80

Cobalt Stike Beacon Detected – 43[.]132[.]122[.]84:80

Cobalt Stike Beacon Detected – 116[.]204[.]211[.]163:443

Malware Analysis – lockbit – a8e0d56f8c67f1f7b6e592c12d87acab

Cobalt Stike Beacon Detected – 101[.]42[.]46[.]117:80

Cobalt Stike Beacon Detected – 157[.]245[.]102[.]164:443

Cobalt Stike Beacon Detected – 173[.]82[.]196[.]58:443

Cobalt Stike Beacon Detected – 129[.]152[.]2[.]128:443

Malware Analysis – aurora – a750f4f224ae7af1c886b39d1c5800d4

Malware Analysis – wannacry – 5c7fb0927db37372da25f270708103a2

[INTERLOCK] – Ransomware Victim: Positive Solutions

[QILIN] – Ransomware Victim: AEROBLOX

[INTERLOCK] – Ransomware Victim: Wilsonville Toyota-Scion

[AKIRA] – Ransomware Victim: Cutcliffe Archetto & Santilli

[QILIN] – Ransomware Victim: Tecore

You may have missed