OSINT

Malware Analysis – adware – 11ff322997d98d02afe198c20b613ff3

February 10, 2023

Score: 8 MALWARE FAMILY: adwareTAGS:adware, discovery, exploit, persistence, ransomware, stealer, upxMD5: 11ff322997d98d02afe198c20b613ff3SHA1: 48e70395f187454bddc01484a6cbcf1c5f1753fcANALYSIS DATE: 2023-02-10T17:50:24ZTTPS: T1060, T1012, T1120, T1082, T1222,...

LockBit 3.0 Ransomware Victim: merlinpcbgroup[.]com

February 10, 2023

LockBit 3.0 Ransomware NOTE: No files or stolen information are by RedPacket Security. Any legal issues relating to the content...

Cobalt Stike Beacon Detected – 112[.]74[.]177[.]62:443

February 10, 2023

The Information provided at the time of posting was detected as "Cobalt Strike". Depending on when you are viewing this...

Cobalt Stike Beacon Detected – 5[.]181[.]86[.]249:4433

February 10, 2023

The Information provided at the time of posting was detected as "Cobalt Strike". Depending on when you are viewing this...

Cobalt Stike Beacon Detected – 37[.]220[.]87[.]31:80

February 10, 2023

The Information provided at the time of posting was detected as "Cobalt Strike". Depending on when you are viewing this...

Cobalt Stike Beacon Detected – 20[.]190[.]109[.]205:443

February 10, 2023

The Information provided at the time of posting was detected as "Cobalt Strike". Depending on when you are viewing this...

Empire C2 Detected – 149[.]28[.]146[.]251:80

February 10, 2023

The Information provided at the time of posting was detected as "Empire C2". Depending on when you are viewing this...

Daily Vulnerability Trends: Fri Feb 10 2023

February 10, 2023

Daily Vulnerability Trends (sourced from VulnMon) CVE NAMECVE DescriptionCVE-2023-24813Dompdf is an HTML to PDF converter written in php. Due to...

Malware Analysis – chaos – 4cc6ec4d961a14c4fc4b45dfe939ca00

February 10, 2023

Score: 10 MALWARE FAMILY: chaosTAGS:family:chaos, evasion, ransomware, spyware, stealerMD5: 4cc6ec4d961a14c4fc4b45dfe939ca00SHA1: 7a115dcc3ca91877b70de091b122259503d7109fANALYSIS DATE: 2023-02-10T05:37:03ZTTPS: T1490, T1059, T1107, T1005, T1081, T1082 ScoreMeaningExample10Known...

Malware Analysis – djvu – 20d5e3daaa4f8ce2e83c91861f2a8ade

February 10, 2023

Score: 10 MALWARE FAMILY: djvuTAGS:family:djvu, family:vidar, botnet:19, discovery, persistence, ransomware, spyware, stealerMD5: 20d5e3daaa4f8ce2e83c91861f2a8adeSHA1: 4a555a39d41a0d10d35cbe5f78682a00210be6a0ANALYSIS DATE: 2023-02-10T05:55:27ZTTPS: T1012, T1082, T1005, T1081,...

Malware Analysis – discovery – e5f2fcd6f0327a18366243c8c657eb8d

February 10, 2023

Score: 8 MALWARE FAMILY: discoveryTAGS:discovery, exploit, upxMD5: e5f2fcd6f0327a18366243c8c657eb8dSHA1: 0d195362be5e95e4c6efc264c8027c0720d344f5ANALYSIS DATE: 2023-02-10T03:24:24ZTTPS: T1222 ScoreMeaningExample10Known badA malware family was detected.8-9Likely maliciousOne or...

Malware Analysis – ransomware – 50f4469ad4b9bf352c5c9604ef913ccf

February 10, 2023

Score: 9 MALWARE FAMILY: ransomwareTAGS:ransomware, spyware, stealerMD5: 50f4469ad4b9bf352c5c9604ef913ccfSHA1: 5c82d5155c9151115346efd94e1b1da34cced32cANALYSIS DATE: 2023-02-10T05:42:47ZTTPS: T1005, T1081, T1107, T1490, T1082 ScoreMeaningExample10Known badA malware family...

Weee – 1,117,405 breached accounts

February 10, 2023

HIBP In February 2023, data belonging to the Asian and Hispanic food delivery service Weee appeared on a popular hacking...

Cobalt Stike Beacon Detected – 84[.]32[.]131[.]91:443

February 10, 2023

The Information provided at the time of posting was detected as "Cobalt Strike". Depending on when you are viewing this...

Cobalt Stike Beacon Detected – 194[.]165[.]16[.]56:443

February 10, 2023

The Information provided at the time of posting was detected as "Cobalt Strike". Depending on when you are viewing this...

Cobalt Stike Beacon Detected – 47[.]243[.]185[.]202:8099

February 10, 2023

The Information provided at the time of posting was detected as "Cobalt Strike". Depending on when you are viewing this...

Cobalt Stike Beacon Detected – 43[.]137[.]8[.]159:443

February 10, 2023

The Information provided at the time of posting was detected as "Cobalt Strike". Depending on when you are viewing this...

Cobalt Stike Beacon Detected – 216[.]83[.]46[.]88:8080

February 10, 2023

The Information provided at the time of posting was detected as "Cobalt Strike". Depending on when you are viewing this...

Cobalt Stike Beacon Detected – 192[.]3[.]127[.]76:443

February 10, 2023

The Information provided at the time of posting was detected as "Cobalt Strike". Depending on when you are viewing this...

Cobalt Stike Beacon Detected – 91[.]245[.]254[.]108:80

February 10, 2023

The Information provided at the time of posting was detected as "Cobalt Strike". Depending on when you are viewing this...

Malware Analysis – persistence – 046fbae3ebc4d201d4e8eafcc67743b4

February 10, 2023

Score: 10 MALWARE FAMILY: persistenceTAGS:persistence, ransomwareMD5: 046fbae3ebc4d201d4e8eafcc67743b4SHA1: 3a77dabee37c375b2bbcca77c222c98fba423010ANALYSIS DATE: 2023-02-09T23:25:22ZTTPS: T1060, T1082, T1012, T1120 ScoreMeaningExample10Known badA malware family was detected.8-9Likely...

Malware Analysis – persistence – bf6105e0bc1d98f773c139c95e071311

February 10, 2023

Score: 10 MALWARE FAMILY: persistenceTAGS:persistence, ransomwareMD5: bf6105e0bc1d98f773c139c95e071311SHA1: 38b12ff1618d1d7499d9b0a37d15a0d42d247895ANALYSIS DATE: 2023-02-09T22:39:19ZTTPS: T1082, T1060 ScoreMeaningExample10Known badA malware family was detected.8-9Likely maliciousOne or...

Malware Analysis – evasion – 43194e64a0e20b8a582d56aa5bd36b86

February 10, 2023

Score: 7 MALWARE FAMILY: evasionTAGS:evasion, ransomwareMD5: 43194e64a0e20b8a582d56aa5bd36b86SHA1: 2e7ac74639dee36c0f1c15bcdea45c8b89271c4eANALYSIS DATE: 2023-02-09T21:45:20ZTTPS: ScoreMeaningExample10Known badA malware family was detected.8-9Likely maliciousOne or more known...

CISA: #StopRansomware – Ransomware Attacks on Critical Infrastructure Fund DPRK Espionage Activities

February 9, 2023

#StopRansomware - Ransomware Attacks on Critical Infrastructure Fund DPRK Espionage Activities CISA, the National Security Agency (NSA), the Federal Bureau...

OSINT

Malware Analysis – adware – 11ff322997d98d02afe198c20b613ff3

LockBit 3.0 Ransomware Victim: merlinpcbgroup[.]com

Cobalt Stike Beacon Detected – 112[.]74[.]177[.]62:443

Cobalt Stike Beacon Detected – 5[.]181[.]86[.]249:4433

Cobalt Stike Beacon Detected – 37[.]220[.]87[.]31:80

Cobalt Stike Beacon Detected – 20[.]190[.]109[.]205:443

Empire C2 Detected – 149[.]28[.]146[.]251:80

Daily Vulnerability Trends: Fri Feb 10 2023

Malware Analysis – chaos – 4cc6ec4d961a14c4fc4b45dfe939ca00

Malware Analysis – djvu – 20d5e3daaa4f8ce2e83c91861f2a8ade

Malware Analysis – discovery – e5f2fcd6f0327a18366243c8c657eb8d

Malware Analysis – ransomware – 50f4469ad4b9bf352c5c9604ef913ccf

Weee – 1,117,405 breached accounts

Cobalt Stike Beacon Detected – 84[.]32[.]131[.]91:443

Cobalt Stike Beacon Detected – 194[.]165[.]16[.]56:443

Cobalt Stike Beacon Detected – 47[.]243[.]185[.]202:8099

Cobalt Stike Beacon Detected – 43[.]137[.]8[.]159:443

Cobalt Stike Beacon Detected – 216[.]83[.]46[.]88:8080

Cobalt Stike Beacon Detected – 192[.]3[.]127[.]76:443

Cobalt Stike Beacon Detected – 91[.]245[.]254[.]108:80

Malware Analysis – persistence – 046fbae3ebc4d201d4e8eafcc67743b4

Malware Analysis – persistence – bf6105e0bc1d98f773c139c95e071311

Malware Analysis – evasion – 43194e64a0e20b8a582d56aa5bd36b86

CISA: #StopRansomware – Ransomware Attacks on Critical Infrastructure Fund DPRK Espionage Activities

Cobalt Strike Beacon Detected – 121[.]43[.]37[.]134:4434

Cobalt Strike Beacon Detected – 119[.]29[.]231[.]118:443

Cobalt Strike Beacon Detected – 39[.]101[.]74[.]162:443

Cobalt Strike Beacon Detected – 8[.]218[.]112[.]112:8880

Cobalt Strike Beacon Detected – 47[.]109[.]48[.]57:443

You may have missed