OSINT

Malware Analysis – venus – 99bc5e82135557b8e571b2deab9f297f

November 18, 2022

Score: 10 MALWARE FAMILY: venusTAGS:family:venus, persistence, ransomware, spyware, stealerMD5: 99bc5e82135557b8e571b2deab9f297fSHA1: ec11f6abf13044a438a7f363bda2c9d5709d2475ANALYSIS DATE: 2022-11-18T09:09:43ZTTPS: T1060, T1112, T1082, T1018, T1012, T1120, T1005,...

Malware Analysis – djvu – 045d54b0d3abb25388920575931dc808

November 18, 2022

Score: 10 MALWARE FAMILY: djvuTAGS:family:djvu, family:raccoon, family:redline, family:smokeloader, family:vidar, botnet:05ad9c5ec543eb32dfa8e77bcd579c06, botnet:517, botnet:mario23_10, backdoor, collection, discovery, evasion, infostealer, persistence, ransomware, spyware,...

Malware Analysis – venus – 1c45c33e9884cb10264c1a2a0255e72a

November 18, 2022

Score: 10 MALWARE FAMILY: venusTAGS:family:venus, evasion, persistence, ransomwareMD5: 1c45c33e9884cb10264c1a2a0255e72aSHA1: 1992336a5d752187c979e24a95a871d8932ade6dANALYSIS DATE: 2022-11-18T09:06:41ZTTPS: T1031, T1082, T1012, T1120, T1060, T1112, T1018 ScoreMeaningExample10Known...

Malware Analysis – djvu – 75a94380a8882221cfcd80d761db68b5

November 18, 2022

Score: 10 MALWARE FAMILY: djvuTAGS:family:djvu, family:vidar, botnet:517, discovery, persistence, ransomware, spyware, stealerMD5: 75a94380a8882221cfcd80d761db68b5SHA1: cd1beb5a0bfa1d448d04a68ff9dc2f1b6286bbadANALYSIS DATE: 2022-11-18T10:15:56ZTTPS: T1005, T1081, T1222, T1012,...

Malware Analysis – dcrat – 89c367f90c1cd21cf580807cf4d5cb19

November 18, 2022

Score: 10 MALWARE FAMILY: dcratTAGS:family:dcrat, family:djvu, family:raccoon, family:redline, family:smokeloader, family:vidar, botnet:05ad9c5ec543eb32dfa8e77bcd579c06, botnet:517, botnet:mario23_10, backdoor, collection, discovery, infostealer, persistence, ransomware, rat,...

Malware Analysis – chaos – f6e9a9c91ab4cb5dcc9e1c6e9aa2e3a5

November 18, 2022

Score: 10 MALWARE FAMILY: chaosTAGS:family:chaos, evasion, ransomware, spyware, stealerMD5: f6e9a9c91ab4cb5dcc9e1c6e9aa2e3a5SHA1: 76831eb24a45cf1b27464879e9fe8806fa856084ANALYSIS DATE: 2022-11-18T10:28:03ZTTPS: T1490, T1059, T1107, T1491, T1112, T1005, T1081,...

Malware Analysis – djvu – de4b9445fa8264a29eecd2dd00a39fa7

November 18, 2022

Score: 10 MALWARE FAMILY: djvuTAGS:family:djvu, family:vidar, botnet:517, discovery, persistence, ransomware, spyware, stealerMD5: de4b9445fa8264a29eecd2dd00a39fa7SHA1: 0174d80ae151becb119020489834849049d15c0bANALYSIS DATE: 2022-11-18T10:45:53ZTTPS: T1005, T1081, T1060, T1112,...

Ongoing supply chain attack targets Python developers with WASP Stealer

November 18, 2022

A threat actor tracked as WASP is behind an ongoing supply chain attack targeting Python developers with the WASP Stealer....

Daily Vulnerability Trends: Fri Nov 18 2022

November 18, 2022

Daily Vulnerability Trends (sourced from VulnMon) CVE NAMECVE DescriptionCVE-2019-5482Heap buffer overflow in the TFTP protocol handler in cURL 7.19.4 to...

China-based Fangxiao group behind a long-running phishing campaign

November 18, 2022

A China-based financially motivated group, tracked as Fangxiao, is behind a large-scale phishing campaign dating back as far as 2019. Researchers...

Bug Bounty

BugCrowd Bug Bounty Disclosure: – Impersonation via Broken Link Hijacking on https://sv.hellosign.com – By CoffeeAddict_exe

November 18, 2022

The below information is fully automated and the information is captured from the BugCrowd Disclosure website. The information was correct...

Bug Bounty

BugCrowd Bug Bounty Disclosure: – Panel access at https://news-push-88.op-mobile.opera.com/. – By rahul0x01

November 18, 2022

The below information is fully automated and the information is captured from the BugCrowd Disclosure website. The information was correct...

Malware Analysis – djvu – 744c37adef44d4e27b5ac46299194566

November 18, 2022

Score: 10 MALWARE FAMILY: djvuTAGS:family:djvu, family:raccoon, family:redline, family:smokeloader, family:vidar, botnet:05ad9c5ec543eb32dfa8e77bcd579c06, botnet:1827, botnet:517, botnet:5m, botnet:mario23_10, backdoor, collection, discovery, evasion, infostealer, persistence,...

Malware Analysis – djvu – 6f4d157d440bbb29905c20b50c428f83

November 18, 2022

Score: 10 MALWARE FAMILY: djvuTAGS:family:djvu, family:vidar, botnet:517, discovery, persistence, ransomware, spyware, stealerMD5: 6f4d157d440bbb29905c20b50c428f83SHA1: 8418cf4d252ee2ac8f9fa64fa1c362b9be4ffbc5ANALYSIS DATE: 2022-11-18T03:41:09ZTTPS: T1222, T1053, T1012, T1082,...

Malware Analysis – dcrat – 88cc6e185c2f9a2c8830e6dfd03f481d

November 18, 2022

Score: 10 MALWARE FAMILY: dcratTAGS:family:dcrat, family:djvu, family:raccoon, family:redline, family:smokeloader, family:vidar, botnet:05ad9c5ec543eb32dfa8e77bcd579c06, botnet:1827, botnet:517, botnet:5m, botnet:mario23_10, backdoor, collection, discovery, evasion, infostealer,...

Malware Analysis – evasion – 9f3522bc02122b36a3f56dd7f10d89a8

November 18, 2022

Score: 7 MALWARE FAMILY: evasionTAGS:evasion, ransomwareMD5: 9f3522bc02122b36a3f56dd7f10d89a8SHA1: d17952baa029eeb4553fa6f70e042e8f2c49a1ecANALYSIS DATE: 2022-11-18T04:28:27ZTTPS: ScoreMeaningExample10Known badA malware family was detected.8-9Likely maliciousOne or more known...

Malware Analysis – djvu – 3c3e6245a9f9f3c0dc1943d4821353e2

November 18, 2022

Score: 10 MALWARE FAMILY: djvuTAGS:family:djvu, family:vidar, botnet:517, discovery, persistence, ransomware, spyware, stealerMD5: 3c3e6245a9f9f3c0dc1943d4821353e2SHA1: 3413cc858da15a7aa8e3cc9124a69faa97cc0e74ANALYSIS DATE: 2022-11-18T05:32:31ZTTPS: T1060, T1112, T1082, T1005,...

OSINT

Malware Analysis – venus – 99bc5e82135557b8e571b2deab9f297f

Malware Analysis – djvu – 045d54b0d3abb25388920575931dc808

Malware Analysis – venus – 1c45c33e9884cb10264c1a2a0255e72a

Malware Analysis – djvu – 75a94380a8882221cfcd80d761db68b5

Malware Analysis – dcrat – 89c367f90c1cd21cf580807cf4d5cb19

Malware Analysis – chaos – f6e9a9c91ab4cb5dcc9e1c6e9aa2e3a5

Malware Analysis – djvu – de4b9445fa8264a29eecd2dd00a39fa7

Ongoing supply chain attack targets Python developers with WASP Stealer

Daily Vulnerability Trends: Fri Nov 18 2022

China-based Fangxiao group behind a long-running phishing campaign

BugCrowd Bug Bounty Disclosure: – Impersonation via Broken Link Hijacking on https://sv.hellosign.com – By CoffeeAddict_exe

BugCrowd Bug Bounty Disclosure: – Panel access at https://news-push-88.op-mobile.opera.com/. – By rahul0x01

Malware Analysis – djvu – 744c37adef44d4e27b5ac46299194566

Malware Analysis – djvu – 6f4d157d440bbb29905c20b50c428f83

Malware Analysis – dcrat – 88cc6e185c2f9a2c8830e6dfd03f481d

Malware Analysis – evasion – 9f3522bc02122b36a3f56dd7f10d89a8

Malware Analysis – djvu – 3c3e6245a9f9f3c0dc1943d4821353e2

Cobalt Stike Beacon Detected – 47[.]92[.]64[.]196:80

Cobalt Stike Beacon Detected – 5[.]199[.]169[.]193:443

Cobalt Stike Beacon Detected – 43[.]138[.]49[.]13:2086

Cobalt Stike Beacon Detected – 43[.]143[.]175[.]195:80

Cobalt Stike Beacon Detected – 157[.]230[.]218[.]237:443

Cobalt Stike Beacon Detected – 45[.]32[.]11[.]46:8080

Cobalt Stike Beacon Detected – 91[.]240[.]118[.]207:82

Cobalt Strike Beacon Detected – 47[.]76[.]30[.]15:80

Cobalt Strike Beacon Detected – 52[.]140[.]245[.]31:80

Cobalt Strike Beacon Detected – 120[.]27[.]235[.]78:80

Cobalt Strike Beacon Detected – 8[.]138[.]47[.]245:80

Cobalt Strike Beacon Detected – 158[.]41[.]106[.]139:443

You may have missed