OSINT

Malware Analysis – smokeloader – f55db70dde213b489bed910191d180d2

December 31, 2022

Score: 10 MALWARE FAMILY: smokeloaderTAGS:family:smokeloader, backdoor, trojanMD5: f55db70dde213b489bed910191d180d2SHA1: faa9789e8bec8b7c03df02b12871231932b32fcdANALYSIS DATE: 2022-12-31T10:02:04ZTTPS: T1012, T1120, T1082 ScoreMeaningExample10Known badA malware family was detected.8-9Likely...

Brute Ratel C4 Detected – 2[.]34[.]225[.]206:9002

December 31, 2022

The Information provided at the time of posting was detected as "Brute Ratel C4". Depending on when you are viewing...

Cobalt Stike Beacon Detected – 3[.]74[.]102[.]137:443

December 31, 2022

The Information provided at the time of posting was detected as "Cobalt Strike". Depending on when you are viewing this...

Cobalt Stike Beacon Detected – 154[.]223[.]165[.]16:443

December 31, 2022

The Information provided at the time of posting was detected as "Cobalt Strike". Depending on when you are viewing this...

Cobalt Stike Beacon Detected – 82[.]157[.]102[.]120:8999

December 31, 2022

The Information provided at the time of posting was detected as "Cobalt Strike". Depending on when you are viewing this...

Cobalt Stike Beacon Detected – 34[.]92[.]28[.]142:443

December 31, 2022

The Information provided at the time of posting was detected as "Cobalt Strike". Depending on when you are viewing this...

Daily Vulnerability Trends: Sat Dec 31 2022

December 31, 2022

Daily Vulnerability Trends (sourced from VulnMon) CVE NAMECVE DescriptionCVE-2021-1961Possible buffer overflow due to lack of offset length check while updating...

Malware Analysis – djvu – e6c13b6e3d5d725d96c3d275be3c38d4

December 31, 2022

Score: 10 MALWARE FAMILY: djvuTAGS:family:djvu, family:vidar, botnet:19, discovery, persistence, ransomware, spyware, stealerMD5: e6c13b6e3d5d725d96c3d275be3c38d4SHA1: 7803f9f7fbb55696f08dd5f961c2826aeb12e752ANALYSIS DATE: 2022-12-31T03:22:02ZTTPS: T1012, T1082, T1005, T1081,...

Malware Analysis – smokeloader – e940a13c2509bd823153f8e0e764d0e8

December 31, 2022

Score: 10 MALWARE FAMILY: smokeloaderTAGS:family:smokeloader, backdoor, trojanMD5: e940a13c2509bd823153f8e0e764d0e8SHA1: 44ac7375cdb880267f9d13c804c218e28c53884dANALYSIS DATE: 2022-12-31T03:32:03ZTTPS: T1012, T1120, T1082 ScoreMeaningExample10Known badA malware family was detected.8-9Likely...

Malware Analysis – smokeloader – 8dad56f7c0cd6da28c485028d5bb79a8

December 31, 2022

Score: 10 MALWARE FAMILY: smokeloaderTAGS:family:smokeloader, backdoor, trojanMD5: 8dad56f7c0cd6da28c485028d5bb79a8SHA1: 4f683dda502920ee1c9dee80e35f9df6adef7ed3ANALYSIS DATE: 2022-12-31T04:02:03ZTTPS: T1012, T1120, T1082 ScoreMeaningExample10Known badA malware family was detected.8-9Likely...

Malware Analysis – ransomware – da64a453f7662e5425946c1d96903d86

December 31, 2022

Score: 8 MALWARE FAMILY: ransomwareTAGS:ransomware, spyware, stealerMD5: da64a453f7662e5425946c1d96903d86SHA1: 1b9f15da6e00b3cc73ea71f27db5d766fabbd62bANALYSIS DATE: 2022-12-31T04:09:02ZTTPS: T1082, T1012, T1120, T1005, T1081 ScoreMeaningExample10Known badA malware family...

Malware Analysis – ransomware – 2454d403b8fd8a0084d966ac136083bc

December 31, 2022

Score: 8 MALWARE FAMILY: ransomwareTAGS:ransomware, spyware, stealerMD5: 2454d403b8fd8a0084d966ac136083bcSHA1: 1bce66750426f1b9db1da2c56227d32ac4608727ANALYSIS DATE: 2022-12-31T04:43:04ZTTPS: T1082, T1005, T1081 ScoreMeaningExample10Known badA malware family was detected.8-9Likely...

Malware Analysis – smokeloader – b1d2c66939121ccd165b024d9451cb4d

December 31, 2022

Score: 10 MALWARE FAMILY: smokeloaderTAGS:family:smokeloader, backdoor, trojanMD5: b1d2c66939121ccd165b024d9451cb4dSHA1: e08bddb59f360a78f9c38bf30f1ad45d8e3ec060ANALYSIS DATE: 2022-12-31T05:31:10ZTTPS: T1012, T1120, T1082 ScoreMeaningExample10Known badA malware family was detected.8-9Likely...

Malware Analysis – djvu – b407a3f0e6290013e97b1c53fd935eff

December 31, 2022

Score: 10 MALWARE FAMILY: djvuTAGS:family:djvu, family:vidar, botnet:19, discovery, persistence, ransomware, spyware, stealerMD5: b407a3f0e6290013e97b1c53fd935effSHA1: 430978c3912c16c45fb4bdb38b7d8829cba198adANALYSIS DATE: 2022-12-31T05:31:29ZTTPS: T1222, T1005, T1081, T1012,...

Malware Analysis – amadey – d0f554a0c60d749227776e1c3a557c10

December 31, 2022

Score: 10 MALWARE FAMILY: amadeyTAGS:family:amadey, family:dcrat, family:djvu, family:lgoogloader, family:redline, family:smokeloader, botnet:8888888, botnet:letgo, botnet:sport, backdoor, collection, discovery, downloader, infostealer, persistence, ransomware,...

Malware Analysis – evasion – ccd8aeacd5792f628d48b660b36a364f

December 31, 2022

Score: 7 MALWARE FAMILY: evasionTAGS:evasion, ransomwareMD5: ccd8aeacd5792f628d48b660b36a364fSHA1: f73441d600669341b7d894a2d06fb695dc002ef4ANALYSIS DATE: 2022-12-31T04:52:43ZTTPS: ScoreMeaningExample10Known badA malware family was detected.8-9Likely maliciousOne or more known...

OSINT

Malware Analysis – smokeloader – f55db70dde213b489bed910191d180d2

Brute Ratel C4 Detected – 2[.]34[.]225[.]206:9002

Cobalt Stike Beacon Detected – 3[.]74[.]102[.]137:443

Cobalt Stike Beacon Detected – 154[.]223[.]165[.]16:443

Cobalt Stike Beacon Detected – 82[.]157[.]102[.]120:8999

Cobalt Stike Beacon Detected – 34[.]92[.]28[.]142:443

Daily Vulnerability Trends: Sat Dec 31 2022

Malware Analysis – djvu – e6c13b6e3d5d725d96c3d275be3c38d4

Malware Analysis – smokeloader – e940a13c2509bd823153f8e0e764d0e8

Malware Analysis – smokeloader – 8dad56f7c0cd6da28c485028d5bb79a8

Malware Analysis – ransomware – da64a453f7662e5425946c1d96903d86

Malware Analysis – ransomware – 2454d403b8fd8a0084d966ac136083bc

Malware Analysis – smokeloader – b1d2c66939121ccd165b024d9451cb4d

Malware Analysis – djvu – b407a3f0e6290013e97b1c53fd935eff

Malware Analysis – amadey – d0f554a0c60d749227776e1c3a557c10

Malware Analysis – evasion – ccd8aeacd5792f628d48b660b36a364f

Cobalt Stike Beacon Detected – 8[.]209[.]215[.]82:80

Cobalt Stike Beacon Detected – 101[.]42[.]27[.]149:443

Cobalt Stike Beacon Detected – 84[.]32[.]128[.]110:443

Cobalt Stike Beacon Detected – 51[.]91[.]99[.]2:80

Royal Ransomware Victim: AONTTAGL

Cobalt Stike Beacon Detected – 185[.]227[.]154[.]118:80

Cobalt Stike Beacon Detected – 118[.]31[.]76[.]225:4430

Cobalt Stike Beacon Detected – 121[.]5[.]234[.]90:888

Cobalt Strike Beacon Detected – 121[.]43[.]37[.]134:4434

Cobalt Strike Beacon Detected – 119[.]29[.]231[.]118:443

Cobalt Strike Beacon Detected – 39[.]101[.]74[.]162:443

Cobalt Strike Beacon Detected – 8[.]218[.]112[.]112:8880

Cobalt Strike Beacon Detected – 47[.]109[.]48[.]57:443

You may have missed