OSINT

Malware Analysis – persistence – 2f33b9393d38762bd981dbede2389ca6

December 21, 2022

Score: 8 MALWARE FAMILY: persistenceTAGS:persistence, ransomwareMD5: 2f33b9393d38762bd981dbede2389ca6SHA1: 9e398d63c5c1f6d42b08c60f7d29366b8d3df901ANALYSIS DATE: 2022-12-21T05:30:05ZTTPS: T1060, T1112 ScoreMeaningExample10Known badA malware family was detected.8-9Likely maliciousOne or...

Malware Analysis – djvu – 5a8830c77d5640038b4ac92972f508fb

December 21, 2022

Score: 10 MALWARE FAMILY: djvuTAGS:family:djvu, discovery, persistence, ransomware, spyware, stealerMD5: 5a8830c77d5640038b4ac92972f508fbSHA1: ff7bd39b06a87adb62d5e616758aa457cc324a28ANALYSIS DATE: 2022-12-21T05:39:33ZTTPS: T1222, T1053, T1005, T1081, T1060, T1112,...

Malware Analysis – persistence – 34b7f6870d28447885d2ff2781645dd5

December 21, 2022

Score: 8 MALWARE FAMILY: persistenceTAGS:persistence, ransomware, upxMD5: 34b7f6870d28447885d2ff2781645dd5SHA1: d587ed39901accd9c71fe1fab25fe25d4a1f674cANALYSIS DATE: 2022-12-21T05:34:28ZTTPS: T1060, T1112 ScoreMeaningExample10Known badA malware family was detected.8-9Likely maliciousOne...

Malware Analysis – persistence – e39422f1a4cb873d35500140cffdd061

December 21, 2022

Score: 8 MALWARE FAMILY: persistenceTAGS:persistence, ransomwareMD5: e39422f1a4cb873d35500140cffdd061SHA1: 85704350976e882af8ea439df6d237103e233f74ANALYSIS DATE: 2022-12-21T05:30:06ZTTPS: T1060, T1112 ScoreMeaningExample10Known badA malware family was detected.8-9Likely maliciousOne or...

Cobalt Stike Beacon Detected – 110[.]40[.]199[.]147:443

December 21, 2022

The Information provided at the time of posting was detected as "Cobalt Strike". Depending on when you are viewing this...

Cobalt Stike Beacon Detected – 45[.]76[.]97[.]48:80

December 21, 2022

The Information provided at the time of posting was detected as "Cobalt Strike". Depending on when you are viewing this...

Cobalt Stike Beacon Detected – 104[.]238[.]159[.]118:443

December 21, 2022

The Information provided at the time of posting was detected as "Cobalt Strike". Depending on when you are viewing this...

Cobalt Stike Beacon Detected – 124[.]71[.]84[.]65:8443

December 21, 2022

The Information provided at the time of posting was detected as "Cobalt Strike". Depending on when you are viewing this...

Cobalt Stike Beacon Detected – 191[.]101[.]78[.]79:8090

December 21, 2022

The Information provided at the time of posting was detected as "Cobalt Strike". Depending on when you are viewing this...

Royal Ransomware Victim: Zehnders of Frankenmuth

December 21, 2022

RoyalRansomware NOTE: No files or stolen information are by RedPacket Security. Any legal issues relating to the content of the...

Cobalt Stike Beacon Detected – 8[.]134[.]56[.]231:80

December 21, 2022

The Information provided at the time of posting was detected as "Cobalt Strike". Depending on when you are viewing this...

Cobalt Stike Beacon Detected – 120[.]26[.]240[.]21:55443

December 21, 2022

The Information provided at the time of posting was detected as "Cobalt Strike". Depending on when you are viewing this...

Cobalt Stike Beacon Detected – 123[.]57[.]131[.]96:80

December 21, 2022

The Information provided at the time of posting was detected as "Cobalt Strike". Depending on when you are viewing this...

Cobalt Stike Beacon Detected – 107[.]189[.]12[.]60:443

December 21, 2022

The Information provided at the time of posting was detected as "Cobalt Strike". Depending on when you are viewing this...

Cobalt Stike Beacon Detected – 139[.]196[.]234[.]164:8888

December 21, 2022

The Information provided at the time of posting was detected as "Cobalt Strike". Depending on when you are viewing this...

Cobalt Stike Beacon Detected – 119[.]3[.]194[.]221:8080

December 21, 2022

The Information provided at the time of posting was detected as "Cobalt Strike". Depending on when you are viewing this...

Cobalt Stike Beacon Detected – 198[.]98[.]55[.]58:80

December 21, 2022

The Information provided at the time of posting was detected as "Cobalt Strike". Depending on when you are viewing this...

Cobalt Stike Beacon Detected – 179[.]60[.]150[.]99:80

December 21, 2022

The Information provided at the time of posting was detected as "Cobalt Strike". Depending on when you are viewing this...

Diving into an Old Exploit Chain and Discovering 3 new SIP-Bypass Vulnerabilities

December 20, 2022

More than two years ago, a researcher, A2nkF demonstrated the exploit chain from root privilege escalation to SIP-Bypass up to...

Raspberry Robin Malware Targets Telecom, Governments

December 20, 2022

We found samples of the Raspberry Robin malware spreading in telecommunications and government office systems beginning September. The main payload...

Web3 IPFS Only Used for Phishing – So Far

December 20, 2022

We discuss the use of the InterPlanetary File System (IPFS) in phishing attacks. If you like the site, please consider...

Daily Vulnerability Trends: Tue Dec 20 2022

December 20, 2022

Daily Vulnerability Trends (sourced from VulnMon) CVE NAMECVE DescriptionCVE-2022-45141 No description provided CVE-2022-37966Windows Kerberos RC4-HMAC Elevation of Privilege Vulnerability.CVE-2022-46908SQLite through...

Microsoft announced that a botnet dubbed MCCrash is launching distributed denial-of-service (DDoS) attacks against private Minecraft servers.

December 20, 2022

Microsoft announced that a botnet dubbed MCCrash is launching distributed denial-of-service (DDoS) attacks against private Minecraft servers. Microsoft spotted a...

Malware Analysis – makop – 6a956731b3677dd9d4d18641d40532ab

December 20, 2022

Score: 10 MALWARE FAMILY: makopTAGS:family:makop, ransomware, spyware, stealerMD5: 6a956731b3677dd9d4d18641d40532abSHA1: 1994ee0b381c5528d5b5c01fb97a14b5ff81e5a5ANALYSIS DATE: 2022-12-20T17:44:04ZTTPS: T1059, T1107, T1490, T1005, T1081 ScoreMeaningExample10Known badA malware...

OSINT

Malware Analysis – persistence – 2f33b9393d38762bd981dbede2389ca6

Malware Analysis – djvu – 5a8830c77d5640038b4ac92972f508fb

Malware Analysis – persistence – 34b7f6870d28447885d2ff2781645dd5

Malware Analysis – persistence – e39422f1a4cb873d35500140cffdd061

Cobalt Stike Beacon Detected – 110[.]40[.]199[.]147:443

Cobalt Stike Beacon Detected – 45[.]76[.]97[.]48:80

Cobalt Stike Beacon Detected – 104[.]238[.]159[.]118:443

Cobalt Stike Beacon Detected – 124[.]71[.]84[.]65:8443

Cobalt Stike Beacon Detected – 191[.]101[.]78[.]79:8090

Royal Ransomware Victim: Zehnders of Frankenmuth

Cobalt Stike Beacon Detected – 8[.]134[.]56[.]231:80

Cobalt Stike Beacon Detected – 120[.]26[.]240[.]21:55443

Cobalt Stike Beacon Detected – 123[.]57[.]131[.]96:80

Cobalt Stike Beacon Detected – 107[.]189[.]12[.]60:443

Cobalt Stike Beacon Detected – 139[.]196[.]234[.]164:8888

Cobalt Stike Beacon Detected – 119[.]3[.]194[.]221:8080

Cobalt Stike Beacon Detected – 198[.]98[.]55[.]58:80

Cobalt Stike Beacon Detected – 179[.]60[.]150[.]99:80

Diving into an Old Exploit Chain and Discovering 3 new SIP-Bypass Vulnerabilities

Raspberry Robin Malware Targets Telecom, Governments

Web3 IPFS Only Used for Phishing – So Far

Daily Vulnerability Trends: Tue Dec 20 2022

Microsoft announced that a botnet dubbed MCCrash is launching distributed denial-of-service (DDoS) attacks against private Minecraft servers.

Malware Analysis – makop – 6a956731b3677dd9d4d18641d40532ab

CVE Alert: CVE-2025-6697

CVE Alert: CVE-2025-6696

CVE Alert: CVE-2025-51672

CVE Alert: CVE-2025-52900

CVE Alert: CVE-2025-52887

You may have missed