OSINT

Malware Analysis – discovery – 259146c9c627a0b7afd36df0065ee45d

February 6, 2023

Score: 10 MALWARE FAMILY: discoveryTAGS:discovery, ransomwareMD5: 259146c9c627a0b7afd36df0065ee45dSHA1: 93ba5783cdfb0cbf36cf1b74c986d18b92983eb7ANALYSIS DATE: 2023-02-06T17:08:53ZTTPS: T1082, T1057, T1012 ScoreMeaningExample10Known badA malware family was detected.8-9Likely maliciousOne...

Malware Analysis – smokeloader – dd89ebe4d3d6ee44a15591607cd374e2

February 6, 2023

Score: 10 MALWARE FAMILY: smokeloaderTAGS:family:smokeloader, backdoor, trojanMD5: dd89ebe4d3d6ee44a15591607cd374e2SHA1: 8e480704c0d6ce94e2c546654e438f8dab4caa8fANALYSIS DATE: 2023-02-06T08:59:07ZTTPS: T1012, T1120, T1082 ScoreMeaningExample10Known badA malware family was detected.8-9Likely...

Cobalt Stike Beacon Detected – 184[.]72[.]146[.]182:443

February 6, 2023

The Information provided at the time of posting was detected as "Cobalt Strike". Depending on when you are viewing this...

Malware Analysis – lockbit – 276cd95358453f33882de2253969280d

February 6, 2023

Score: 10 MALWARE FAMILY: lockbitTAGS:family:lockbit, ransomware, spyware, stealerMD5: 276cd95358453f33882de2253969280dSHA1: 92da23a61819755940b5376e7846400e286ec00cANALYSIS DATE: 2023-02-06T09:10:41ZTTPS: T1005, T1081 ScoreMeaningExample10Known badA malware family was detected.8-9Likely...

Malware Analysis – smokeloader – 379d835b0c9a62d7fe8a00ac59cf4e2f

February 6, 2023

Score: 10 MALWARE FAMILY: smokeloaderTAGS:family:smokeloader, backdoor, trojanMD5: 379d835b0c9a62d7fe8a00ac59cf4e2fSHA1: daaf15ee0824ec8c2811567f47c4ad1495dcf268ANALYSIS DATE: 2023-02-06T09:53:56ZTTPS: T1012, T1120, T1082 ScoreMeaningExample10Known badA malware family was detected.8-9Likely...

Malware Analysis – smokeloader – a974539f8a333563092df0526dad19e6

February 6, 2023

Score: 10 MALWARE FAMILY: smokeloaderTAGS:family:smokeloader, backdoor, trojanMD5: a974539f8a333563092df0526dad19e6SHA1: 0f575881e48bf3fed1fe5cd27748a20567c013c3ANALYSIS DATE: 2023-02-06T09:34:06ZTTPS: T1012, T1120, T1082 ScoreMeaningExample10Known badA malware family was detected.8-9Likely...

Malware Analysis – smokeloader – 0a1b22b3d185b189572a5a810d09080b

February 6, 2023

Score: 10 MALWARE FAMILY: smokeloaderTAGS:family:smokeloader, backdoor, trojanMD5: 0a1b22b3d185b189572a5a810d09080bSHA1: e49ef7f2308d7b2d9cdc0d96f16308119bb58d55ANALYSIS DATE: 2023-02-06T09:35:06ZTTPS: T1012, T1120, T1082 ScoreMeaningExample10Known badA malware family was detected.8-9Likely...

Cobalt Stike Beacon Detected – 124[.]223[.]215[.]12:80

February 6, 2023

The Information provided at the time of posting was detected as "Cobalt Strike". Depending on when you are viewing this...

Cobalt Stike Beacon Detected – 45[.]61[.]186[.]121:443

February 6, 2023

The Information provided at the time of posting was detected as "Cobalt Strike". Depending on when you are viewing this...

Cobalt Stike Beacon Detected – 107[.]189[.]13[.]130:443

February 6, 2023

The Information provided at the time of posting was detected as "Cobalt Strike". Depending on when you are viewing this...

Cobalt Stike Beacon Detected – 104[.]243[.]143[.]71:443

February 6, 2023

The Information provided at the time of posting was detected as "Cobalt Strike". Depending on when you are viewing this...

Malware Analysis – smokeloader – edfe3e765085055a28f27904219853de

February 6, 2023

Score: 10 MALWARE FAMILY: smokeloaderTAGS:family:smokeloader, backdoor, trojanMD5: edfe3e765085055a28f27904219853deSHA1: f76a53589eea6ceee8112072904ed79264674f9dANALYSIS DATE: 2023-02-06T10:55:18ZTTPS: T1012, T1120, T1082 ScoreMeaningExample10Known badA malware family was detected.8-9Likely...

Malware Analysis – amadey – cffb8a63b2c022bb8396a36c3c1d1cc1

February 6, 2023

Score: 10 MALWARE FAMILY: amadeyTAGS:family:amadey, family:djvu, family:laplas, family:smokeloader, family:vidar, botnet:19, backdoor, clipper, discovery, persistence, ransomware, spyware, stealer, trojan, vmprotectMD5: cffb8a63b2c022bb8396a36c3c1d1cc1SHA1:...

Malware Analysis – djvu – 83f8cfa0ca3163d58d3394f430b6a3d7

February 6, 2023

Score: 10 MALWARE FAMILY: djvuTAGS:family:djvu, family:vidar, botnet:19, discovery, persistence, ransomware, spyware, stealerMD5: 83f8cfa0ca3163d58d3394f430b6a3d7SHA1: 2be35fa3e4606916f54c43c7072ec2e948a68270ANALYSIS DATE: 2023-02-06T10:47:28ZTTPS: T1012, T1082, T1005, T1081,...

Malware Analysis – djvu – 33d2fef7a2a0bbec3c6cac10d112df34

February 6, 2023

Score: 10 MALWARE FAMILY: djvuTAGS:family:djvu, family:vidar, botnet:19, discovery, persistence, ransomware, spyware, stealerMD5: 33d2fef7a2a0bbec3c6cac10d112df34SHA1: 320bb536a40dc2cc795c378fcad84ec20d06cad6ANALYSIS DATE: 2023-02-06T10:30:12ZTTPS: T1060, T1112, T1222, T1082,...

Malware Analysis – bootkit – 42e52b8daf63e6e26c3aa91e7e971492

February 6, 2023

Score: 7 MALWARE FAMILY: bootkitTAGS:bootkit, persistence, spyware, stealerMD5: 42e52b8daf63e6e26c3aa91e7e971492SHA1: 98b3fb74b3e8b3f9b05a82473551c5a77b576d54ANALYSIS DATE: 2023-02-06T11:31:35ZTTPS: T1005, T1081, T1067 ScoreMeaningExample10Known badA malware family was...

Malware Analysis – smokeloader – 923e961badeb135ef2f942a26b2c205a

February 6, 2023

Score: 10 MALWARE FAMILY: smokeloaderTAGS:family:smokeloader, backdoor, trojanMD5: 923e961badeb135ef2f942a26b2c205aSHA1: fd98590b040d496d37fc02b739a1582839ca12fdANALYSIS DATE: 2023-02-06T11:01:43ZTTPS: T1012, T1120, T1082 ScoreMeaningExample10Known badA malware family was detected.8-9Likely...

Malware Analysis – amadey – 28c22b525e425af8500a7d403ba20cea

February 6, 2023

Malware Analysis – banker – ec9f857999b4fc3dd007fdb786b7a8d1

February 6, 2023

Score: 8 MALWARE FAMILY: bankerTAGS:banker, evasion, ransomwareMD5: ec9f857999b4fc3dd007fdb786b7a8d1SHA1: 3fa48a36d22d848ad111b246ca94fa58088dbb7aANALYSIS DATE: 2023-02-06T11:15:50ZTTPS: ScoreMeaningExample10Known badA malware family was detected.8-9Likely maliciousOne or more...

Daily Vulnerability Trends: Mon Feb 06 2023

February 6, 2023

Daily Vulnerability Trends (sourced from VulnMon) CVE NAMECVE DescriptionCVE-2022-27596A vulnerability has been reported to affect QNAP device running QuTS hero,...

8a791c2febb4c2edb28cecf4a4fb5b5ceb8f0d76944397e4777c2652bc9ceec3

Aws-Security-Assessment-Solution – An AWS Tool To Help You Create A Point In Time Assessment Of Your AWS Account Using Prowler And Scout As Well As Optional AWS Developed Ransomware Checks

February 6, 2023

Self-Service Security Assessment too l Cybersecurity remains a very important topic and point of concern for many CIOs, CISOs, and...

OSINT

Malware Analysis – discovery – 259146c9c627a0b7afd36df0065ee45d

Malware Analysis – smokeloader – dd89ebe4d3d6ee44a15591607cd374e2

Cobalt Stike Beacon Detected – 184[.]72[.]146[.]182:443

Malware Analysis – lockbit – 276cd95358453f33882de2253969280d

Malware Analysis – smokeloader – 379d835b0c9a62d7fe8a00ac59cf4e2f

Malware Analysis – smokeloader – a974539f8a333563092df0526dad19e6

Malware Analysis – smokeloader – 0a1b22b3d185b189572a5a810d09080b

Cobalt Stike Beacon Detected – 124[.]223[.]215[.]12:80

Cobalt Stike Beacon Detected – 45[.]61[.]186[.]121:443

Cobalt Stike Beacon Detected – 107[.]189[.]13[.]130:443

Cobalt Stike Beacon Detected – 104[.]243[.]143[.]71:443

Malware Analysis – smokeloader – edfe3e765085055a28f27904219853de

Malware Analysis – amadey – cffb8a63b2c022bb8396a36c3c1d1cc1

Malware Analysis – djvu – 83f8cfa0ca3163d58d3394f430b6a3d7

Malware Analysis – djvu – 33d2fef7a2a0bbec3c6cac10d112df34

Malware Analysis – bootkit – 42e52b8daf63e6e26c3aa91e7e971492

Malware Analysis – smokeloader – 923e961badeb135ef2f942a26b2c205a

Malware Analysis – amadey – 28c22b525e425af8500a7d403ba20cea

Malware Analysis – banker – ec9f857999b4fc3dd007fdb786b7a8d1

Daily Vulnerability Trends: Mon Feb 06 2023

Aws-Security-Assessment-Solution – An AWS Tool To Help You Create A Point In Time Assessment Of Your AWS Account Using Prowler And Scout As Well As Optional AWS Developed Ransomware Checks

Suborner – The Invisible Account Forger

Monomorph – MD5-Monomorphic Shellcode Packer – All Payloads Have The Same MD5 Hash

Winevt_Logs_Analysis – Searching .Evtx Logs For Remote Connections

[SINOBI] – Ransomware Victim: Post Ranch Inn

CVE Alert: CVE-2025-24893 – xwiki – xwiki-platform

CVE Alert: CVE-2025-41244 – VMware – VCF operations

[THEGENTLEMEN] – Ransomware Victim: Silverlake Axis

[AKIRA] – Ransomware Victim: Huber , Erickson & Bowman

You may have missed