OSINT

Malware Analysis – djvu – 50fee0fee96a3c681b9c47eada3fffdf

January 19, 2023

Score: 10 MALWARE FAMILY: djvuTAGS:family:djvu, family:vidar, botnet:19, discovery, persistence, ransomware, spyware, stealerMD5: 50fee0fee96a3c681b9c47eada3fffdfSHA1: db64c7d74705e4a3c08ca50c140fa84d3c4fce09ANALYSIS DATE: 2023-01-19T17:22:07ZTTPS: T1012, T1222, T1082, T1005,...

Malware Analysis – locky – fb6ca1cd232151d667f6cd2484fee8c8

January 19, 2023

Score: 10 MALWARE FAMILY: lockyTAGS:family:locky, ransomwareMD5: fb6ca1cd232151d667f6cd2484fee8c8SHA1: f7bb52767afd2cd32ede8b5f83012eb99ba1ce28ANALYSIS DATE: 2023-01-19T17:42:29ZTTPS: ScoreMeaningExample10Known badA malware family was detected.8-9Likely maliciousOne or more known...

Malware Analysis – discovery – 133af41cfec522b7f583fcf77be37b1a

January 19, 2023

Score: 8 MALWARE FAMILY: discoveryTAGS:discoveryMD5: 133af41cfec522b7f583fcf77be37b1aSHA1: 50fde70e193eeea8d15c13dfc62cdcb4cbc2bcd0ANALYSIS DATE: 2023-01-19T17:13:15ZTTPS: T1082, T1012 ScoreMeaningExample10Known badA malware family was detected.8-9Likely maliciousOne or more...

LockBit 3.0 Ransomware Victim: tvk[.]nl

January 19, 2023

LockBit 3.0 Ransomware NOTE: No files or stolen information are by RedPacket Security. Any legal issues relating to the content...

Hackers push malware via Google search ads for VLC, 7-Zip, CCleaner

January 19, 2023

Hackers are setting up fake websites for popular free and open-source software to promote malicious downloads through advertisements in Google...

New York man defrauded thousands using credit cards sold on dark web

January 19, 2023

A New York resident has pleaded guilty to charges of conspiracy to commit bank fraud using stolen credit cards purchased...

Bitzlato crypto exchange seized for ransomware, drugs money laundering

January 19, 2023

The U.S. Department of Justice arrested and charged Russian national Anatoly Legkodymov, the founder of the Hong Kong-registered cryptocurrency exchange...

Product Security Incident Response: Key Strategies and Best Practices

January 19, 2023

Written By: Samuel Cure, CISO, AMI In today's digital landscape, it is essential to implement proactive measures to ensure the...

Ukraine links data-wiping attack on news agency to Russian hackers

January 19, 2023

The Computer Emergency Response Team of Ukraine (CERT-UA) has linked a destructive malware attack targeting the country's national news agency...

Illegal Solaris darknet market hijacked by competitor Kraken

January 19, 2023

Solaris, a large darknet marketplace focused on drugs and illegal substances, has been taken over by a smaller competitor named...

MailChimp discloses new breach after employees got hacked

January 19, 2023

Email marketing firm MailChimp suffered another breach after hackers accessed an internal customer support and account administration tool, allowing the...

Malware Analysis – djvu – 1e12ef6d811ea006a932860cd74b0282

January 19, 2023

Score: 10 MALWARE FAMILY: djvuTAGS:family:djvu, family:vidar, botnet:19, discovery, persistence, ransomware, stealerMD5: 1e12ef6d811ea006a932860cd74b0282SHA1: fcbef26773b2ef3a41bf1a74f4ed59233283321dANALYSIS DATE: 2023-01-19T09:27:14ZTTPS: T1130, T1112, T1060, T1222, T1082,...

Cobalt Stike Beacon Detected – 47[.]242[.]164[.]33:9998

January 19, 2023

The Information provided at the time of posting was detected as "Cobalt Strike". Depending on when you are viewing this...

Cobalt Stike Beacon Detected – 1[.]117[.]117[.]162:8888

January 19, 2023

The Information provided at the time of posting was detected as "Cobalt Strike". Depending on when you are viewing this...

Cobalt Stike Beacon Detected – 202[.]182[.]117[.]134:8087

January 19, 2023

The Information provided at the time of posting was detected as "Cobalt Strike". Depending on when you are viewing this...

Cobalt Stike Beacon Detected – 103[.]105[.]49[.]52:80

January 19, 2023

The Information provided at the time of posting was detected as "Cobalt Strike". Depending on when you are viewing this...

Malware Analysis – vidar – 6fb6025c04ba6fa3d4820aea944e3667

January 19, 2023

Score: 10 MALWARE FAMILY: vidarTAGS:family:vidar, botnet:408, discovery, persistence, ransomware, spyware, stealerMD5: 6fb6025c04ba6fa3d4820aea944e3667SHA1: b5fa73ed8561665ddaa9b9baecb427dd166d034bANALYSIS DATE: 2023-01-19T09:28:45ZTTPS: T1005, T1081, T1130, T1112, T1082,...

Malware Analysis – djvu – 892865bd136926da1ef72498bb1fb355

January 19, 2023

Score: 10 MALWARE FAMILY: djvuTAGS:family:djvu, family:vidar, botnet:19, discovery, persistence, ransomware, spyware, stealerMD5: 892865bd136926da1ef72498bb1fb355SHA1: 53103a535dd72d6156b0a2ba739071b98ec549a8ANALYSIS DATE: 2023-01-19T11:02:44ZTTPS: T1012, T1082, T1005, T1081,...

Malware Analysis – djvu – 30f074e92a9351c582e31b3be1e4a6c3

January 19, 2023

Score: 10 MALWARE FAMILY: djvuTAGS:family:djvu, family:redline, family:rhadamanthys, family:smokeloader, family:vidar, botnet:19, botnet:test, backdoor, collection, discovery, infostealer, persistence, ransomware, spyware, stealer, trojanMD5:...

Malware Analysis – djvu – 1c7c18d59d23a9901b0e2b8e48dcde2c

January 19, 2023

Score: 10 MALWARE FAMILY: djvuTAGS:family:djvu, family:vidar, botnet:19, discovery, persistence, ransomware, stealerMD5: 1c7c18d59d23a9901b0e2b8e48dcde2cSHA1: 4579072148edd252a0a6eaa87eea1a0f73599258ANALYSIS DATE: 2023-01-19T11:39:45ZTTPS: T1222, T1082, T1130, T1112, T1060...

Daily Vulnerability Trends: Thu Jan 19 2023

January 19, 2023

Daily Vulnerability Trends (sourced from VulnMon) CVE NAMECVE DescriptionCVE-2021-31985Microsoft Defender Remote Code Execution VulnerabilityCVE-2023-21674Windows Advanced Local Procedure Call (ALPC) Elevation...

Malware Analysis – – bf9859562a838793808f162f59a451a6

January 19, 2023

Score: 3 MALWARE FAMILY: TAGS:MD5: bf9859562a838793808f162f59a451a6SHA1: 6edf259df3a9031428ca8a2e56c4da1caff643afANALYSIS DATE: 2023-01-19T03:46:06ZTTPS: T1082 ScoreMeaningExample10Known badA malware family was detected.8-9Likely maliciousOne or more known...

Malware Analysis – smokeloader – 0ed65c594991f0a57f7209966ce2c081

January 19, 2023

Score: 10 MALWARE FAMILY: smokeloaderTAGS:family:smokeloader, backdoor, trojanMD5: 0ed65c594991f0a57f7209966ce2c081SHA1: 101e646cddf7eb518ed185e1946b3a2715b21057ANALYSIS DATE: 2023-01-19T03:05:05ZTTPS: T1012, T1120, T1082 ScoreMeaningExample10Known badA malware family was detected.8-9Likely...

Malware Analysis – djvu – 1e61d2b0a41e30bb734ddbe53bb66880

January 19, 2023

Score: 10 MALWARE FAMILY: djvuTAGS:family:djvu, family:vidar, botnet:19, discovery, persistence, ransomware, spyware, stealerMD5: 1e61d2b0a41e30bb734ddbe53bb66880SHA1: 26dc0624b6d0286043cf55c3299bd14161f9e19fANALYSIS DATE: 2023-01-19T03:00:52ZTTPS: T1060, T1112, T1012, T1082,...

OSINT

Malware Analysis – djvu – 50fee0fee96a3c681b9c47eada3fffdf

Malware Analysis – locky – fb6ca1cd232151d667f6cd2484fee8c8

Malware Analysis – discovery – 133af41cfec522b7f583fcf77be37b1a

LockBit 3.0 Ransomware Victim: tvk[.]nl

Hackers push malware via Google search ads for VLC, 7-Zip, CCleaner

New York man defrauded thousands using credit cards sold on dark web

Bitzlato crypto exchange seized for ransomware, drugs money laundering

Product Security Incident Response: Key Strategies and Best Practices

Ukraine links data-wiping attack on news agency to Russian hackers

Illegal Solaris darknet market hijacked by competitor Kraken

MailChimp discloses new breach after employees got hacked

Malware Analysis – djvu – 1e12ef6d811ea006a932860cd74b0282

Cobalt Stike Beacon Detected – 47[.]242[.]164[.]33:9998

Cobalt Stike Beacon Detected – 1[.]117[.]117[.]162:8888

Cobalt Stike Beacon Detected – 202[.]182[.]117[.]134:8087

Cobalt Stike Beacon Detected – 103[.]105[.]49[.]52:80

Malware Analysis – vidar – 6fb6025c04ba6fa3d4820aea944e3667

Malware Analysis – djvu – 892865bd136926da1ef72498bb1fb355

Malware Analysis – djvu – 30f074e92a9351c582e31b3be1e4a6c3

Malware Analysis – djvu – 1c7c18d59d23a9901b0e2b8e48dcde2c

Daily Vulnerability Trends: Thu Jan 19 2023

Malware Analysis – – bf9859562a838793808f162f59a451a6

Malware Analysis – smokeloader – 0ed65c594991f0a57f7209966ce2c081

Malware Analysis – djvu – 1e61d2b0a41e30bb734ddbe53bb66880

[QILIN] – Ransomware Victim: villagecoin[.]com

[QILIN] – Ransomware Victim: parsons-peebles[.]com

[QILIN] – Ransomware Victim: capmark[.]org

HackerOne Bug Bounty Disclosure: curl-easy-header-runs-at-o-n-or-worse-and-can-be-abused-to-use-minute-s-of-cpu-time-wolfsage

HackerOne Bug Bounty Disclosure: curl-oj-allows-creating-custom-curlrc-file-which-allows-exfiltrating-private-data-among-other-things-wolfsage

You may have missed