OSINT

Malware Analysis – smokeloader – b4346008df789fb0b428f3088c3290f5

January 12, 2023

Score: 10 MALWARE FAMILY: smokeloaderTAGS:family:smokeloader, backdoor, trojanMD5: b4346008df789fb0b428f3088c3290f5SHA1: 186b35c2d08c9250b3a0124dcd43c178a44cc3a5ANALYSIS DATE: 2023-01-12T11:11:03ZTTPS: T1012, T1120, T1082 ScoreMeaningExample10Known badA malware family was detected.8-9Likely...

Malware Analysis – revengerat – ddfdcc11a3e4a5dd265442a5bcea9fcf

January 12, 2023

Score: 10 MALWARE FAMILY: revengeratTAGS:family:revengerat, family:xmrig, discovery, evasion, miner, persistence, ransomware, spyware, stealer, trojanMD5: ddfdcc11a3e4a5dd265442a5bcea9fcfSHA1: a98cf41fb793d5c23bef6baac5c5848233c6ff41ANALYSIS DATE: 2023-01-12T11:05:34ZTTPS: T1031, T1064,...

Daily Vulnerability Trends: Thu Jan 12 2023

January 12, 2023

Daily Vulnerability Trends (sourced from VulnMon) CVE NAMECVE DescriptionCVE-2022-20452In initializeFromParcelLocked of BaseBundle.java, there is a possible method arbitrary code execution...

Malware Analysis – ransomware – 1f70c57bb5dc1b1a543d1cc25f670116

January 12, 2023

Score: 5 MALWARE FAMILY: ransomwareTAGS:ransomwareMD5: 1f70c57bb5dc1b1a543d1cc25f670116SHA1: ec2abab65434280be81e47a72913406702b3477cANALYSIS DATE: 2023-01-12T03:54:18ZTTPS: T1012, T1082, T1491, T1112 ScoreMeaningExample10Known badA malware family was detected.8-9Likely maliciousOne...

Malware Analysis – wannacry – 87234dff69f6c8edfaf828a5d491c886

January 12, 2023

Score: 10 MALWARE FAMILY: wannacryTAGS:family:wannacry, discovery, persistence, ransomware, spyware, stealer, wormMD5: 87234dff69f6c8edfaf828a5d491c886SHA1: 69902f3c575191db8114aa34f99b27ceae3a9f72ANALYSIS DATE: 2023-01-12T03:28:31ZTTPS: T1158, T1082, T1060, T1112, T1222,...

Malware Analysis – discovery – 1562d7504b9669b96cbeeba59b3fb6b4

January 12, 2023

Score: 10 MALWARE FAMILY: discoveryTAGS:discovery, evasion, persistence, ransomwareMD5: 1562d7504b9669b96cbeeba59b3fb6b4SHA1: 2ad24300cbd690f939cf62d949734f24daf1a8d3ANALYSIS DATE: 2023-01-12T03:00:34ZTTPS: T1012, T1120, T1082, T1060, T1112, T1497, T1042 ScoreMeaningExample10Known...

Malware Analysis – amadey – 24450d22a44831b8d4e20e3eb99d9fb9

January 12, 2023

Score: 10 MALWARE FAMILY: amadeyTAGS:family:amadey, family:aurora, family:dcrat, family:djvu, family:smokeloader, family:vidar, botnet:19, backdoor, discovery, infostealer, persistence, ransomware, rat, spyware, stealer, trojanMD5:...

Malware Analysis – djvu – 7f89e30634f529406e25c94728138ac2

January 12, 2023

Score: 10 MALWARE FAMILY: djvuTAGS:family:djvu, family:vidar, botnet:19, discovery, persistence, ransomware, spyware, stealerMD5: 7f89e30634f529406e25c94728138ac2SHA1: 107e604b48c37e9c01768ed0a79b6204a12d496fANALYSIS DATE: 2023-01-12T04:00:36ZTTPS: T1012, T1082, T1005, T1081,...

Malware Analysis – djvu – 947fe80a2c26a998c18cafe4ac2c6fa9

January 12, 2023

Score: 10 MALWARE FAMILY: djvuTAGS:family:djvu, family:vidar, botnet:19, discovery, persistence, ransomware, spyware, stealerMD5: 947fe80a2c26a998c18cafe4ac2c6fa9SHA1: 7337ef39800091ea808fa9c1c074e37feb4b95ccANALYSIS DATE: 2023-01-12T05:54:51ZTTPS: T1060, T1112, T1053, T1005,...

Malware Analysis – aurora – dfc9518f5e0b145f1fa786628670863d

January 12, 2023

Score: 10 MALWARE FAMILY: auroraTAGS:family:aurora, family:blacknet, family:darkcomet, family:dcrat, family:djvu, family:redline, family:smokeloader, family:vidar, family:wannacry, botnet:19, backdoor, collection, discovery, infostealer, persistence, ransomware,...

Cobalt Stike Beacon Detected – 43[.]139[.]146[.]60:2222

January 12, 2023

The Information provided at the time of posting was detected as "Cobalt Strike". Depending on when you are viewing this...

Cobalt Stike Beacon Detected – 103[.]149[.]90[.]238:2000

January 12, 2023

The Information provided at the time of posting was detected as "Cobalt Strike". Depending on when you are viewing this...

Malware Analysis – discovery – a7798f8706cb8c4c347da090eb320de9

January 12, 2023

Score: 10 MALWARE FAMILY: discoveryTAGS:discovery, persistence, ransomwareMD5: a7798f8706cb8c4c347da090eb320de9SHA1: 66a8b77a2ab4a5b4598f84895559edb0e44873daANALYSIS DATE: 2023-01-11T20:49:11ZTTPS: T1112, T1042, T1012, T1082, T1060 ScoreMeaningExample10Known badA malware family...

Malware Analysis – discovery – 1e262e85af7822f199da3f27c7f5d406

January 12, 2023

Score: 10 MALWARE FAMILY: discoveryTAGS:discovery, persistence, ransomwareMD5: 1e262e85af7822f199da3f27c7f5d406SHA1: 3b934e6d859308cc9af07a1b184ea90021ff7a36ANALYSIS DATE: 2023-01-11T23:05:24ZTTPS: T1112, T1012, T1082, T1060, T1042 ScoreMeaningExample10Known badA malware family...

Malware Analysis – amadey – b4be08f67e4b5fed600bf5558b119168

January 12, 2023

Score: 10 MALWARE FAMILY: amadeyTAGS:family:amadey, family:aurora, family:dcrat, family:djvu, family:icedid, family:smokeloader, family:vidar, botnet:19, campaign:3131022508, backdoor, banker, discovery, infostealer, loader, persistence, ransomware,...

Malware Analysis – evasion – 26b5b59d0c9ff7a575eced46612d8e25

January 12, 2023

Score: 5 MALWARE FAMILY: evasionTAGS:evasion, ransomwareMD5: 26b5b59d0c9ff7a575eced46612d8e25SHA1: f28ecc9dda6c7c3848c2e20913b3bd39155004bdANALYSIS DATE: 2023-01-11T22:43:03ZTTPS: ScoreMeaningExample10Known badA malware family was detected.8-9Likely maliciousOne or more known...

Malware Analysis – djvu – 793032b03418e42783b294836132e84e

January 12, 2023

Score: 10 MALWARE FAMILY: djvuTAGS:family:djvu, family:vidar, botnet:19, discovery, persistence, ransomware, spyware, stealerMD5: 793032b03418e42783b294836132e84eSHA1: a395aca39b0a1ce4b5af893f4014f1a96687f2bcANALYSIS DATE: 2023-01-11T22:44:58ZTTPS: T1053, T1005, T1081, T1060,...

CISA: NCSC-UK Releases Guidance on Using MSP for Administering Cloud Services

January 11, 2023

NCSC-UK Releases Guidance on Using MSP for Administering Cloud Services The United Kingdom’s National Cyber Security Centre (NCSC-UK) has released...

Bug Bounty

BugCrowd Bug Bounty Disclosure: – I found a text injection – By Orange_hacker

January 11, 2023

The below information is fully automated and the information is captured from the BugCrowd Disclosure website. The information was correct...

c2f941e109d3f913b12d82efdcf116fea5d147fff783caba368c7d51f68e8e56

PowerHuntShares – Audit Script Designed In Inventory, Analyze, And Report Excessive Privileges Configured On Active Directory Domains

January 11, 2023

PowerHuntShares is design to automatically inventory, analyze, and report excessive privilege assigned to SMB shares on Active Directory domain joined...

OSINT

Malware Analysis – smokeloader – b4346008df789fb0b428f3088c3290f5

Malware Analysis – revengerat – ddfdcc11a3e4a5dd265442a5bcea9fcf

Daily Vulnerability Trends: Thu Jan 12 2023

Malware Analysis – ransomware – 1f70c57bb5dc1b1a543d1cc25f670116

Malware Analysis – wannacry – 87234dff69f6c8edfaf828a5d491c886

Malware Analysis – discovery – 1562d7504b9669b96cbeeba59b3fb6b4

Malware Analysis – amadey – 24450d22a44831b8d4e20e3eb99d9fb9

Malware Analysis – djvu – 7f89e30634f529406e25c94728138ac2

Malware Analysis – djvu – 947fe80a2c26a998c18cafe4ac2c6fa9

Malware Analysis – aurora – dfc9518f5e0b145f1fa786628670863d

Cobalt Stike Beacon Detected – 43[.]139[.]146[.]60:2222

Cobalt Stike Beacon Detected – 103[.]149[.]90[.]238:2000

Malware Analysis – discovery – a7798f8706cb8c4c347da090eb320de9

Malware Analysis – discovery – 1e262e85af7822f199da3f27c7f5d406

Malware Analysis – amadey – b4be08f67e4b5fed600bf5558b119168

Malware Analysis – evasion – 26b5b59d0c9ff7a575eced46612d8e25

Malware Analysis – djvu – 793032b03418e42783b294836132e84e

CISA: NCSC-UK Releases Guidance on Using MSP for Administering Cloud Services

BugCrowd Bug Bounty Disclosure: – I found a text injection – By Orange_hacker

PowerHuntShares – Audit Script Designed In Inventory, Analyze, And Report Excessive Privileges Configured On Active Directory Domains

LockBit 3.0 Ransomware Victim: circlevillecourt[.]com

LockBit 3.0 Ransomware Victim: datair[.]com

Cobalt Stike Beacon Detected – 87[.]251[.]67[.]166:80

Cobalt Stike Beacon Detected – 43[.]132[.]122[.]84:80

Cobalt Strike Beacon Detected – 121[.]43[.]37[.]134:4434

Cobalt Strike Beacon Detected – 119[.]29[.]231[.]118:443

Cobalt Strike Beacon Detected – 39[.]101[.]74[.]162:443

Cobalt Strike Beacon Detected – 8[.]218[.]112[.]112:8880

Cobalt Strike Beacon Detected – 47[.]109[.]48[.]57:443

You may have missed