OSINT

Malware Analysis – evasion – 0e6452fbace59927ee883faae2d82f52

February 1, 2023

Score: 8 MALWARE FAMILY: evasionTAGS:evasion, ransomwareMD5: 0e6452fbace59927ee883faae2d82f52SHA1: 7c12fc18061ae904d9ac3b883e2cd8c2f4ea74c5ANALYSIS DATE: 2023-02-01T16:09:00ZTTPS: ScoreMeaningExample10Known badA malware family was detected.8-9Likely maliciousOne or more known...

Malware Analysis – djvu – 700c400a0fcb148eafe327b539bab0fc

February 1, 2023

Score: 10 MALWARE FAMILY: djvuTAGS:family:djvu, family:smokeloader, family:vidar, botnet:19, backdoor, discovery, persistence, ransomware, spyware, stealer, trojan, vmprotectMD5: 700c400a0fcb148eafe327b539bab0fcSHA1: 85d14338e6565a62c3b0deea58f321944751902eANALYSIS DATE: 2023-02-01T15:06:53ZTTPS:...

Malware Analysis – djvu – d8699aa29bad0a63e241a78d7fa7ed4d

February 1, 2023

Score: 10 MALWARE FAMILY: djvuTAGS:family:djvu, family:vidar, botnet:19, discovery, persistence, ransomware, spyware, stealerMD5: d8699aa29bad0a63e241a78d7fa7ed4dSHA1: cb36472d80989e4b2c2996a180ba89099d561d1dANALYSIS DATE: 2023-02-01T15:02:05ZTTPS: T1082, T1005, T1081, T1012,...

CISA: VMware Releases Security Update for VMware vRealize Operations

February 1, 2023

VMware Releases Security Update for VMware vRealize Operations VMware released a security update that addresses a cross-site request forgery bypass...

Malware Analysis – djvu – 0f35d14f2fd868c2235e2ef87a341a77

February 1, 2023

Score: 10 MALWARE FAMILY: djvuTAGS:family:djvu, family:vidar, botnet:19, discovery, persistence, ransomware, spyware, stealerMD5: 0f35d14f2fd868c2235e2ef87a341a77SHA1: 7913ad5f3754c46b2a510e2973093cd289fc3ea9ANALYSIS DATE: 2023-02-01T16:44:26ZTTPS: T1005, T1081, T1060, T1112,...

Malware Analysis – djvu – e401a15ea8319f97d7c841b36a7d360a

February 1, 2023

Score: 10 MALWARE FAMILY: djvuTAGS:family:djvu, family:redline, family:smokeloader, family:vidar, botnet:19, botnet:@2023@new, backdoor, discovery, infostealer, persistence, ransomware, spyware, stealer, trojan, vmprotectMD5: e401a15ea8319f97d7c841b36a7d360aSHA1:...

Malware Analysis – djvu – af5eb1234bcc794162c9f0f2fb4122be

February 1, 2023

Score: 10 MALWARE FAMILY: djvuTAGS:family:djvu, family:vidar, botnet:19, discovery, persistence, ransomware, spyware, stealerMD5: af5eb1234bcc794162c9f0f2fb4122beSHA1: 0fea89cae611ed713452e6588faadf2cc6226e87ANALYSIS DATE: 2023-02-01T17:09:30ZTTPS: T1053, T1005, T1081, T1012,...

Malware Analysis – djvu – 13725d57e1ba5d0feaa5b49dad3c5c0d

February 1, 2023

Score: 10 MALWARE FAMILY: djvuTAGS:family:djvu, family:smokeloader, family:vidar, botnet:19, backdoor, discovery, persistence, ransomware, spyware, stealer, trojan, vmprotectMD5: 13725d57e1ba5d0feaa5b49dad3c5c0dSHA1: cffc84279bdd51c4a8c495cc0fea9645e60b6aefANALYSIS DATE: 2023-02-01T16:28:13ZTTPS:...

Royal Ransomware Victim: TK Elevator

February 1, 2023

RoyalRansomware NOTE: No files or stolen information are by RedPacket Security. Any legal issues relating to the content of the...

Vice Society Ransomware Victim: Guildford County School

February 1, 2023

Vice Society Ransomware NOTE: No files or stolen information are by RedPacket Security. Any legal issues relating to the content...

Cobalt Stike Beacon Detected – 45[.]61[.]186[.]121:80

February 1, 2023

The Information provided at the time of posting was detected as "Cobalt Strike". Depending on when you are viewing this...

Cobalt Stike Beacon Detected – 104[.]208[.]73[.]11:443

February 1, 2023

The Information provided at the time of posting was detected as "Cobalt Strike". Depending on when you are viewing this...

Cobalt Stike Beacon Detected – 81[.]68[.]173[.]143:80

February 1, 2023

The Information provided at the time of posting was detected as "Cobalt Strike". Depending on when you are viewing this...

Cobalt Stike Beacon Detected – 51[.]254[.]53[.]1:80

February 1, 2023

The Information provided at the time of posting was detected as "Cobalt Strike". Depending on when you are viewing this...

Malware Analysis – djvu – a237e7d2a7113dc1ed04f60cccbf77e6

February 1, 2023

Score: 10 MALWARE FAMILY: djvuTAGS:family:djvu, family:vidar, botnet:19, discovery, persistence, ransomware, spyware, stealerMD5: a237e7d2a7113dc1ed04f60cccbf77e6SHA1: 4e629739c773855aa15d702ea789809598844827ANALYSIS DATE: 2023-02-01T10:08:17ZTTPS: T1082, T1005, T1081, T1012,...

Malware Analysis – smokeloader – 5b82951e130e62cdd1ffe83c173c5577

February 1, 2023

Score: 10 MALWARE FAMILY: smokeloaderTAGS:family:smokeloader, backdoor, trojanMD5: 5b82951e130e62cdd1ffe83c173c5577SHA1: ea6d9f216a48d4d11ebb9026d225ba3a48cda3eeANALYSIS DATE: 2023-02-01T09:33:03ZTTPS: T1012, T1120, T1082 ScoreMeaningExample10Known badA malware family was detected.8-9Likely...

Malware Analysis – djvu – 35b59455f922242f7eb712b8a59d09e3

February 1, 2023

Score: 10 MALWARE FAMILY: djvuTAGS:family:djvu, family:smokeloader, family:vidar, botnet:19, backdoor, discovery, persistence, ransomware, spyware, stealer, trojan, vmprotectMD5: 35b59455f922242f7eb712b8a59d09e3SHA1: 56e0003a00e6f0d2f61a9624e5b21f517bae6c4dANALYSIS DATE: 2023-02-01T10:40:04ZTTPS:...

Malware Analysis – discovery – 6ba5c46261ff52e7438f21ccef5f8c7e

February 1, 2023

Score: 8 MALWARE FAMILY: discoveryTAGS:discovery, exploitMD5: 6ba5c46261ff52e7438f21ccef5f8c7eSHA1: acdf309fbfebecb7a93b78068fc1498fae4d9e62ANALYSIS DATE: 2023-02-01T11:38:44ZTTPS: T1222, T1158 ScoreMeaningExample10Known badA malware family was detected.8-9Likely maliciousOne or...

Malware Analysis – djvu – 87fdb817f23819d66aa76611694525cf

February 1, 2023

Score: 10 MALWARE FAMILY: djvuTAGS:family:djvu, family:vidar, botnet:19, discovery, persistence, ransomware, spyware, stealerMD5: 87fdb817f23819d66aa76611694525cfSHA1: 4b4d231ba899be8a4973a96fe86cd34bd79dd05fANALYSIS DATE: 2023-02-01T10:35:26ZTTPS: T1005, T1081, T1222, T1082,...

Malware Analysis – djvu – d9f343ef3d19bcb2d9cf34a026475f6f

February 1, 2023

Score: 10 MALWARE FAMILY: djvuTAGS:family:djvu, family:smokeloader, family:vidar, botnet:19, backdoor, discovery, persistence, ransomware, spyware, stealer, trojan, vmprotectMD5: d9f343ef3d19bcb2d9cf34a026475f6fSHA1: d40edeccf97e8c623be22e282418c507a2d202c5ANALYSIS DATE: 2023-02-01T11:39:00ZTTPS:...

Daily Vulnerability Trends: Wed Feb 01 2023

February 1, 2023

Daily Vulnerability Trends (sourced from VulnMon) CVE NAMECVE DescriptionCVE-2022-47966Multiple Zoho ManageEngine on-premise products, such as ServiceDesk Plus through 14003, allow...

Malware Analysis – evasion – a809cc37ab51220d8f957f9f67d57e09

February 1, 2023

Score: 8 MALWARE FAMILY: evasionTAGS:evasion, ransomwareMD5: a809cc37ab51220d8f957f9f67d57e09SHA1: bea4d2fb6764d041f89f78b5eadc2a5cd2dcfd59ANALYSIS DATE: 2023-02-01T02:45:25ZTTPS: T1012, T1120, T1082, T1112, T1491 ScoreMeaningExample10Known badA malware family was...

Malware Analysis – ransomware – de49129aa659dec2af0736cb8bf08eba

February 1, 2023

Score: 10 MALWARE FAMILY: ransomwareTAGS:ransomwareMD5: de49129aa659dec2af0736cb8bf08ebaSHA1: 24aa45280c7821e0c9e404f6ce846f1ce00b9823ANALYSIS DATE: 2023-02-01T05:12:57ZTTPS: T1082, T1491, T1112, T1130 ScoreMeaningExample10Known badA malware family was detected.8-9Likely maliciousOne...

Malware Analysis – djvu – 4936a6d56013bbedd4c7769e47481772

February 1, 2023

Score: 10 MALWARE FAMILY: djvuTAGS:family:djvu, family:vidar, botnet:19, discovery, persistence, ransomware, spyware, stealerMD5: 4936a6d56013bbedd4c7769e47481772SHA1: 7eb18b3bfd278e4825a23c0bb3fe739586e9d0f6ANALYSIS DATE: 2023-02-01T04:44:26ZTTPS: T1053, T1005, T1081, T1012,...

OSINT

Malware Analysis – evasion – 0e6452fbace59927ee883faae2d82f52

Malware Analysis – djvu – 700c400a0fcb148eafe327b539bab0fc

Malware Analysis – djvu – d8699aa29bad0a63e241a78d7fa7ed4d

CISA: VMware Releases Security Update for VMware vRealize Operations

Malware Analysis – djvu – 0f35d14f2fd868c2235e2ef87a341a77

Malware Analysis – djvu – e401a15ea8319f97d7c841b36a7d360a

Malware Analysis – djvu – af5eb1234bcc794162c9f0f2fb4122be

Malware Analysis – djvu – 13725d57e1ba5d0feaa5b49dad3c5c0d

Royal Ransomware Victim: TK Elevator

Vice Society Ransomware Victim: Guildford County School

Cobalt Stike Beacon Detected – 45[.]61[.]186[.]121:80

Cobalt Stike Beacon Detected – 104[.]208[.]73[.]11:443

Cobalt Stike Beacon Detected – 81[.]68[.]173[.]143:80

Cobalt Stike Beacon Detected – 51[.]254[.]53[.]1:80

Malware Analysis – djvu – a237e7d2a7113dc1ed04f60cccbf77e6

Malware Analysis – smokeloader – 5b82951e130e62cdd1ffe83c173c5577

Malware Analysis – djvu – 35b59455f922242f7eb712b8a59d09e3

Malware Analysis – discovery – 6ba5c46261ff52e7438f21ccef5f8c7e

Malware Analysis – djvu – 87fdb817f23819d66aa76611694525cf

Malware Analysis – djvu – d9f343ef3d19bcb2d9cf34a026475f6f

Daily Vulnerability Trends: Wed Feb 01 2023

Malware Analysis – evasion – a809cc37ab51220d8f957f9f67d57e09

Malware Analysis – ransomware – de49129aa659dec2af0736cb8bf08eba

Malware Analysis – djvu – 4936a6d56013bbedd4c7769e47481772

[QILIN] – Ransomware Victim: alissco[.]com

[AKIRA] – Ransomware Victim: Clarion Safety Systems

[COINBASECARTEL] – Ransomware Victim: PF / PS

[QILIN] – Ransomware Victim: Altimedia

[QILIN] – Ransomware Victim: echolakefoods[.]com

You may have missed