OSINT

Malware Analysis – dharma – 58402f0f41e3bfecbea9ca1bcc0f0c2b

January 24, 2023

Score: 10 MALWARE FAMILY: dharmaTAGS:family:dharma, persistence, ransomware, spyware, stealerMD5: 58402f0f41e3bfecbea9ca1bcc0f0c2bSHA1: 0a2b11df94790e1121c17e350eb846a236e0fbcfANALYSIS DATE: 2023-01-24T09:17:05ZTTPS: T1060, T1112, T1107, T1490, T1005, T1081, T1082...

Malware Analysis – persistence – b6cfdefd2ef6bb507cbac8634ec3f6a1

January 24, 2023

Score: 9 MALWARE FAMILY: persistenceTAGS:persistence, ransomware, spyware, stealerMD5: b6cfdefd2ef6bb507cbac8634ec3f6a1SHA1: 583bbf424a7114586dd48fe57be999cbd750ba56ANALYSIS DATE: 2023-01-24T09:17:07ZTTPS: T1107, T1490, T1060, T1112, T1005, T1081, T1491 ScoreMeaningExample10Known...

Cobalt Stike Beacon Detected – 44[.]201[.]225[.]29:443

January 24, 2023

The Information provided at the time of posting was detected as "Cobalt Strike". Depending on when you are viewing this...

Malware Analysis – djvu – 25ebd3e34fae530ba993ec9a609a2459

January 24, 2023

Score: 10 MALWARE FAMILY: djvuTAGS:family:djvu, family:vidar, botnet:19, discovery, persistence, ransomware, spyware, stealerMD5: 25ebd3e34fae530ba993ec9a609a2459SHA1: cee22c94beeeb1d50c110babe87d5a756be8cf05ANALYSIS DATE: 2023-01-24T10:27:58ZTTPS: T1222, T1053, T1005, T1081,...

Cobalt Stike Beacon Detected – 35[.]164[.]247[.]19:443

January 24, 2023

The Information provided at the time of posting was detected as "Cobalt Strike". Depending on when you are viewing this...

Cobalt Stike Beacon Detected – 107[.]189[.]5[.]117:80

January 24, 2023

The Information provided at the time of posting was detected as "Cobalt Strike". Depending on when you are viewing this...

Cobalt Stike Beacon Detected – 194[.]165[.]16[.]62:80

January 24, 2023

The Information provided at the time of posting was detected as "Cobalt Strike". Depending on when you are viewing this...

Cobalt Stike Beacon Detected – 162[.]14[.]97[.]126:80

January 24, 2023

The Information provided at the time of posting was detected as "Cobalt Strike". Depending on when you are viewing this...

Daily Vulnerability Trends: Tue Jan 24 2023

January 24, 2023

Daily Vulnerability Trends (sourced from VulnMon) CVE NAMECVE DescriptionCVE-2023-24068Signal Desktop before 6.2.0 on Windows, Linux, and macOS allows an attacker...

Malware Analysis – djvu – d3d65090cad621234a92329236fb75e6

January 24, 2023

Score: 10 MALWARE FAMILY: djvuTAGS:family:djvu, family:vidar, botnet:19, discovery, persistence, ransomware, spyware, stealerMD5: d3d65090cad621234a92329236fb75e6SHA1: 18d5e6b99a1bb323f2b3ad6c3e8a4c2cb46b650aANALYSIS DATE: 2023-01-24T03:20:48ZTTPS: T1053, T1005, T1081, T1060,...

Malware Analysis – djvu – 9072bbefe62a6289483a541fa22d8d64

January 24, 2023

Score: 10 MALWARE FAMILY: djvuTAGS:family:djvu, family:vidar, botnet:19, discovery, persistence, ransomware, spyware, stealerMD5: 9072bbefe62a6289483a541fa22d8d64SHA1: 2ebdf7f18cfcd9827768b6981197832c672e556fANALYSIS DATE: 2023-01-24T05:39:04ZTTPS: T1222, T1060, T1112, T1053,...

Malware Analysis – evasion – 4e775bc9cb9d1e9818208935fbdba509

January 24, 2023

Score: 10 MALWARE FAMILY: evasionTAGS:evasion, persistence, ransomware, trojanMD5: 4e775bc9cb9d1e9818208935fbdba509SHA1: 7f72d5601ff522fef0dbabebdc01fa4289e5d4bcANALYSIS DATE: 2023-01-24T04:44:45ZTTPS: T1490, T1059, T1107, T1082, T1112, T1053, T1485, T1031,...

Malware Analysis – discovery – 6f19490d77a2076e8779ca5ca82bd454

January 24, 2023

Score: 10 MALWARE FAMILY: discoveryTAGS:discovery, ransomwareMD5: 6f19490d77a2076e8779ca5ca82bd454SHA1: 9f54708bc313f5863ca8e5cca60f727cb6e29154ANALYSIS DATE: 2023-01-24T04:25:49ZTTPS: T1012, T1130, T1112, T1082 ScoreMeaningExample10Known badA malware family was detected.8-9Likely...

Malware Analysis – djvu – 70fd03a7711ed5316b20dbe3110bd301

January 24, 2023

Score: 10 MALWARE FAMILY: djvuTAGS:family:djvu, family:vidar, botnet:19, discovery, persistence, ransomware, spyware, stealerMD5: 70fd03a7711ed5316b20dbe3110bd301SHA1: 60c30f7fc1c491085c0958d51cb7f9cf7ff26fa6ANALYSIS DATE: 2023-01-24T05:40:05ZTTPS: T1060, T1112, T1012, T1082,...

Autotrader – 20,032 breached accounts

January 24, 2023

HIBP In January 2023, 1.4M records from the Autotrader online vehicle marketplace appeared on a popular hacking forum. Autotrader stated...

KomplettFritid – 139,401 breached accounts

January 24, 2023

HIBP In January 2023, the online Norwegian store KomplettFritid was reported as having had a data breach dating back to...

Cobalt Stike Beacon Detected – 167[.]235[.]157[.]186:443

January 24, 2023

The Information provided at the time of posting was detected as "Cobalt Strike". Depending on when you are viewing this...

Cobalt Stike Beacon Detected – 185[.]175[.]156[.]42:443

January 24, 2023

The Information provided at the time of posting was detected as "Cobalt Strike". Depending on when you are viewing this...

Cobalt Stike Beacon Detected – 216[.]146[.]25[.]20:443

January 24, 2023

The Information provided at the time of posting was detected as "Cobalt Strike". Depending on when you are viewing this...

Cobalt Stike Beacon Detected – 88[.]119[.]175[.]149:9999

January 24, 2023

The Information provided at the time of posting was detected as "Cobalt Strike". Depending on when you are viewing this...

Malware Analysis – persistence – 425cbeecc22af1cbd3683702bad47d2b

January 24, 2023

Score: 10 MALWARE FAMILY: persistenceTAGS:persistence, ransomwareMD5: 425cbeecc22af1cbd3683702bad47d2bSHA1: d9df389bf4f5699414ae265bab820d16c97153f4ANALYSIS DATE: 2023-01-23T21:20:34ZTTPS: T1060, T1130, T1112, T1012, T1082, T1120 ScoreMeaningExample10Known badA malware family...

Malware Analysis – djvu – c93dffef8975b746c23b3dfa89fab68d

January 24, 2023

Score: 10 MALWARE FAMILY: djvuTAGS:family:djvu, family:vidar, botnet:19, discovery, persistence, ransomware, spyware, stealerMD5: c93dffef8975b746c23b3dfa89fab68dSHA1: 526e90755a469488a6fdfc90158d7c23a3f8db94ANALYSIS DATE: 2023-01-23T21:23:26ZTTPS: T1222, T1005, T1081, T1082,...

Malware Analysis – djvu – cc426856236596a24223d23bcb84d8c8

January 24, 2023

Score: 10 MALWARE FAMILY: djvuTAGS:family:djvu, family:vidar, botnet:19, discovery, persistence, ransomware, spyware, stealerMD5: cc426856236596a24223d23bcb84d8c8SHA1: 03c225a58255b94fd7917f304af3a9bc172ee681ANALYSIS DATE: 2023-01-23T21:03:36ZTTPS: T1012, T1082, T1005, T1081,...

Malware Analysis – asyncrat – 8b14bf467df11d832cfbd95c3c2a8ee9

January 24, 2023

Score: 10 MALWARE FAMILY: asyncratTAGS:family:asyncrat, ransomware, ratMD5: 8b14bf467df11d832cfbd95c3c2a8ee9SHA1: 98372efcfe106531e8cd4e3acb5372865f49ee73ANALYSIS DATE: 2023-01-23T23:31:10ZTTPS: T1082, T1012 ScoreMeaningExample10Known badA malware family was detected.8-9Likely maliciousOne...

OSINT

Malware Analysis – dharma – 58402f0f41e3bfecbea9ca1bcc0f0c2b

Malware Analysis – persistence – b6cfdefd2ef6bb507cbac8634ec3f6a1

Cobalt Stike Beacon Detected – 44[.]201[.]225[.]29:443

Malware Analysis – djvu – 25ebd3e34fae530ba993ec9a609a2459

Cobalt Stike Beacon Detected – 35[.]164[.]247[.]19:443

Cobalt Stike Beacon Detected – 107[.]189[.]5[.]117:80

Cobalt Stike Beacon Detected – 194[.]165[.]16[.]62:80

Cobalt Stike Beacon Detected – 162[.]14[.]97[.]126:80

Daily Vulnerability Trends: Tue Jan 24 2023

Malware Analysis – djvu – d3d65090cad621234a92329236fb75e6

Malware Analysis – djvu – 9072bbefe62a6289483a541fa22d8d64

Malware Analysis – evasion – 4e775bc9cb9d1e9818208935fbdba509

Malware Analysis – discovery – 6f19490d77a2076e8779ca5ca82bd454

Malware Analysis – djvu – 70fd03a7711ed5316b20dbe3110bd301

Autotrader – 20,032 breached accounts

KomplettFritid – 139,401 breached accounts

Cobalt Stike Beacon Detected – 167[.]235[.]157[.]186:443

Cobalt Stike Beacon Detected – 185[.]175[.]156[.]42:443

Cobalt Stike Beacon Detected – 216[.]146[.]25[.]20:443

Cobalt Stike Beacon Detected – 88[.]119[.]175[.]149:9999

Malware Analysis – persistence – 425cbeecc22af1cbd3683702bad47d2b

Malware Analysis – djvu – c93dffef8975b746c23b3dfa89fab68d

Malware Analysis – djvu – cc426856236596a24223d23bcb84d8c8

Malware Analysis – asyncrat – 8b14bf467df11d832cfbd95c3c2a8ee9

CVE Alert: CVE-2025-10459 – PHPGurukul – Beauty Parlour Management System

CVE Alert: CVE-2025-10443 – Tenda – AC9

CVE Alert: CVE-2025-10444 – Campcodes – Online Job Finder System

CVE Alert: CVE-2025-10448 – Campcodes – Online Job Finder System

CVE Alert: CVE-2025-10446 – Campcodes – Computer Sales and Inventory System

You may have missed