OSINT

Malware Analysis – evasion – 70c464221d3e4875317c9edbef04a035

January 28, 2023

Score: 10 MALWARE FAMILY: evasionTAGS:evasion, ransomwareMD5: 70c464221d3e4875317c9edbef04a035SHA1: 8a1d92c8e5b7a5b3a6a34137c9eee01f89cd5564ANALYSIS DATE: 2023-01-28T03:06:17ZTTPS: T1012, T1082, T1112, T1107, T1490, T1031, T1562, T1489, T1120 ScoreMeaningExample10Known...

Malware Analysis – discovery – 6bf6d625a9a4632e25dc1d0760493b46

January 28, 2023

Score: 10 MALWARE FAMILY: discoveryTAGS:discovery, persistence, ransomwareMD5: 6bf6d625a9a4632e25dc1d0760493b46SHA1: 0bf7b69a0d75f606eabb1a70a8008ae0dc827e2aANALYSIS DATE: 2023-01-28T02:59:50ZTTPS: T1012, T1082, T1112, T1042, T1060 ScoreMeaningExample10Known badA malware family...

Malware Analysis – – 29c151659c2460d90adaca01a53045c4

January 28, 2023

Score: 3 MALWARE FAMILY: TAGS:MD5: 29c151659c2460d90adaca01a53045c4SHA1: e1a02696511991705827352a1496861997f72e42ANALYSIS DATE: 2023-01-28T03:25:18ZTTPS: T1082 ScoreMeaningExample10Known badA malware family was detected.8-9Likely maliciousOne or more known...

Malware Analysis – smokeloader – f1919afe5a8c6e8c1ba3608a1cf743ca

January 28, 2023

Score: 10 MALWARE FAMILY: smokeloaderTAGS:family:smokeloader, backdoor, trojanMD5: f1919afe5a8c6e8c1ba3608a1cf743caSHA1: a06fda942b66a9d649735bad9def7d7809e0ff4eANALYSIS DATE: 2023-01-28T04:05:03ZTTPS: T1012, T1120, T1082 ScoreMeaningExample10Known badA malware family was detected.8-9Likely...

Malware Analysis – discovery – 609c6289583d787d4e3f54435d7f370f

January 28, 2023

Score: 10 MALWARE FAMILY: discoveryTAGS:discovery, evasion, persistence, ransomwareMD5: 609c6289583d787d4e3f54435d7f370fSHA1: b8f8878c46ab45ba1aff16456f6874d523c35894ANALYSIS DATE: 2023-01-28T03:26:49ZTTPS: T1112, T1042, T1012, T1120, T1082, T1060 ScoreMeaningExample10Known badA...

Malware Analysis – djvu – 2448d81e6d4e464f4072e3f9e4c1e034

January 28, 2023

Score: 10 MALWARE FAMILY: djvuTAGS:family:djvu, family:vidar, botnet:19, discovery, persistence, ransomware, spyware, stealerMD5: 2448d81e6d4e464f4072e3f9e4c1e034SHA1: 7d5755a8c9ff913e6c1652c705889f1584d5bf10ANALYSIS DATE: 2023-01-28T04:40:56ZTTPS: T1060, T1112, T1082, T1053,...

Malware Analysis – djvu – a537b1b2eba7191282754c2fb45318e0

January 28, 2023

Score: 10 MALWARE FAMILY: djvuTAGS:family:djvu, family:vidar, botnet:19, discovery, persistence, ransomware, spyware, stealerMD5: a537b1b2eba7191282754c2fb45318e0SHA1: 41cfb3b29f880f009b9b74072ab889554e981826ANALYSIS DATE: 2023-01-28T05:49:07ZTTPS: T1222, T1053, T1005, T1081,...

Malware Analysis – smokeloader – 047bb49f0ac28120a7c78a25a3893cbd

January 28, 2023

Score: 10 MALWARE FAMILY: smokeloaderTAGS:family:smokeloader, backdoor, trojanMD5: 047bb49f0ac28120a7c78a25a3893cbdSHA1: da137491057e90c4596cd9c7903f32d9bf30f0d0ANALYSIS DATE: 2023-01-28T05:35:04ZTTPS: T1012, T1120, T1082 ScoreMeaningExample10Known badA malware family was detected.8-9Likely...

Malware Analysis – smokeloader – 3cc4a7678457376b7d19b95d5a9b7f8f

January 28, 2023

Score: 10 MALWARE FAMILY: smokeloaderTAGS:family:smokeloader, backdoor, trojanMD5: 3cc4a7678457376b7d19b95d5a9b7f8fSHA1: 35b231b2da92507f7dd78c24e22cce907fbe6288ANALYSIS DATE: 2023-01-28T04:41:02ZTTPS: T1012, T1120, T1082 ScoreMeaningExample10Known badA malware family was detected.8-9Likely...

Malware Analysis – – 7af0628722e85ab6d927381896266fc4

January 28, 2023

Score: 1 MALWARE FAMILY: TAGS:MD5: 7af0628722e85ab6d927381896266fc4SHA1: 360b7dc28c801f22a71f024dac748b57ddcccd11ANALYSIS DATE: 2023-01-28T04:59:29ZTTPS: ScoreMeaningExample10Known badA malware family was detected.8-9Likely maliciousOne or more known damaging...

Vice Society Ransomware Victim: EGR

January 28, 2023

Vice Society Ransomware NOTE: No files or stolen information are by RedPacket Security. Any legal issues relating to the content...

Vice Society Ransomware Victim: Bristol Community College

January 28, 2023

Vice Society Ransomware NOTE: No files or stolen information are by RedPacket Security. Any legal issues relating to the content...

Cobalt Stike Beacon Detected – 129[.]150[.]60[.]95:808

January 28, 2023

The Information provided at the time of posting was detected as "Cobalt Strike". Depending on when you are viewing this...

Cobalt Stike Beacon Detected – 103[.]155[.]92[.]191:443

January 28, 2023

The Information provided at the time of posting was detected as "Cobalt Strike". Depending on when you are viewing this...

Cobalt Stike Beacon Detected – 212[.]193[.]30[.]15:10443

January 28, 2023

The Information provided at the time of posting was detected as "Cobalt Strike". Depending on when you are viewing this...

Cobalt Stike Beacon Detected – 182[.]92[.]174[.]55:8085

January 28, 2023

The Information provided at the time of posting was detected as "Cobalt Strike". Depending on when you are viewing this...

Malware Analysis – discovery – ce5f006f6df3724e9b5e29e50d6cba98

January 28, 2023

Score: 8 MALWARE FAMILY: discoveryTAGS:discoveryMD5: ce5f006f6df3724e9b5e29e50d6cba98SHA1: ae81d18c7e6df077cbd1abebd9d38ac0fe6968b1ANALYSIS DATE: 2023-01-27T20:48:17ZTTPS: T1112, T1082, T1057, T1012, T1130 ScoreMeaningExample10Known badA malware family was detected.8-9Likely...

Malware Analysis – djvu – 0bd679f733e559aab3823ed9a72a4088

January 28, 2023

Score: 10 MALWARE FAMILY: djvuTAGS:family:djvu, family:vidar, botnet:19, discovery, persistence, ransomware, spyware, stealerMD5: 0bd679f733e559aab3823ed9a72a4088SHA1: fccb26f507a0663100687edf17a3dcd2419849c2ANALYSIS DATE: 2023-01-27T22:02:07ZTTPS: T1222, T1082, T1053, T1005,...

Malware Analysis – smokeloader – 14d154a90ba40b64391188294b280c04

January 28, 2023

Score: 10 MALWARE FAMILY: smokeloaderTAGS:family:smokeloader, backdoor, trojanMD5: 14d154a90ba40b64391188294b280c04SHA1: b8c292e079b9bb39b59fb75d56fb0bc373be9408ANALYSIS DATE: 2023-01-27T21:55:04ZTTPS: T1012, T1120, T1082 ScoreMeaningExample10Known badA malware family was detected.8-9Likely...

Malware Analysis – djvu – a2984ad23ae9672b720b6897a6cc445c

January 28, 2023

Score: 10 MALWARE FAMILY: djvuTAGS:family:djvu, family:vidar, botnet:19, discovery, persistence, ransomware, spyware, stealerMD5: a2984ad23ae9672b720b6897a6cc445cSHA1: 992d7a9daea058935385b34a0b74098459c83911ANALYSIS DATE: 2023-01-27T23:43:52ZTTPS: T1012, T1082, T1053, T1005,...

Malware Analysis – smokeloader – fb26103bb900cbc3d9edab7230cff1d6

January 28, 2023

Score: 10 MALWARE FAMILY: smokeloaderTAGS:family:smokeloader, backdoor, trojanMD5: fb26103bb900cbc3d9edab7230cff1d6SHA1: fd32b81f4b4221c7637a2aa972816d04e8d5c0acANALYSIS DATE: 2023-01-27T23:14:23ZTTPS: T1012, T1120, T1082 ScoreMeaningExample10Known badA malware family was detected.8-9Likely...

Malware Analysis – smokeloader – 285d9ed55708458fcb4225128183fce4

January 28, 2023

Score: 10 MALWARE FAMILY: smokeloaderTAGS:family:smokeloader, backdoor, trojanMD5: 285d9ed55708458fcb4225128183fce4SHA1: f6ebe877bdb56ca432b827ec0357b7e578d0ac37ANALYSIS DATE: 2023-01-27T22:26:03ZTTPS: T1012, T1120, T1082 ScoreMeaningExample10Known badA malware family was detected.8-9Likely...

Malware Analysis – djvu – 489f5cec111d24f085f73c1be3c0957b

January 28, 2023

Score: 10 MALWARE FAMILY: djvuTAGS:family:djvu, family:vidar, botnet:19, discovery, persistence, ransomware, spyware, stealerMD5: 489f5cec111d24f085f73c1be3c0957bSHA1: 82afe1b4cae03103f8d0f5fc916d04d06a4eb0b2ANALYSIS DATE: 2023-01-27T23:02:28ZTTPS: T1053, T1005, T1081, T1060,...

Posh C2 Detected – 3[.]65[.]198[.]167:443

January 28, 2023

The Information provided at the time of posting was detected as "Posh C2". Depending on when you are viewing this...

OSINT

Malware Analysis – evasion – 70c464221d3e4875317c9edbef04a035

Malware Analysis – discovery – 6bf6d625a9a4632e25dc1d0760493b46

Malware Analysis – – 29c151659c2460d90adaca01a53045c4

Malware Analysis – smokeloader – f1919afe5a8c6e8c1ba3608a1cf743ca

Malware Analysis – discovery – 609c6289583d787d4e3f54435d7f370f

Malware Analysis – djvu – 2448d81e6d4e464f4072e3f9e4c1e034

Malware Analysis – djvu – a537b1b2eba7191282754c2fb45318e0

Malware Analysis – smokeloader – 047bb49f0ac28120a7c78a25a3893cbd

Malware Analysis – smokeloader – 3cc4a7678457376b7d19b95d5a9b7f8f

Malware Analysis – – 7af0628722e85ab6d927381896266fc4

Vice Society Ransomware Victim: EGR

Vice Society Ransomware Victim: Bristol Community College

Cobalt Stike Beacon Detected – 129[.]150[.]60[.]95:808

Cobalt Stike Beacon Detected – 103[.]155[.]92[.]191:443

Cobalt Stike Beacon Detected – 212[.]193[.]30[.]15:10443

Cobalt Stike Beacon Detected – 182[.]92[.]174[.]55:8085

Malware Analysis – discovery – ce5f006f6df3724e9b5e29e50d6cba98

Malware Analysis – djvu – 0bd679f733e559aab3823ed9a72a4088

Malware Analysis – smokeloader – 14d154a90ba40b64391188294b280c04

Malware Analysis – djvu – a2984ad23ae9672b720b6897a6cc445c

Malware Analysis – smokeloader – fb26103bb900cbc3d9edab7230cff1d6

Malware Analysis – smokeloader – 285d9ed55708458fcb4225128183fce4

Malware Analysis – djvu – 489f5cec111d24f085f73c1be3c0957b

Posh C2 Detected – 3[.]65[.]198[.]167:443

Miljödata – 870,108 breached accounts

Cobalt Strike Beacon Detected – 119[.]91[.]203[.]199:88

Cobalt Strike Beacon Detected – 106[.]54[.]239[.]134:80

Cobalt Strike Beacon Detected – 81[.]69[.]98[.]230:50010

Cobalt Strike Beacon Detected – 103[.]43[.]18[.]10:80

You may have missed