OSINT

Malware Analysis – maze – ca927fc487ca5f9196493b8f22ff611c

February 1, 2023

Score: 10 MALWARE FAMILY: mazeTAGS:family:maze, ransomware, spyware, stealer, trojanMD5: ca927fc487ca5f9196493b8f22ff611cSHA1: afbe838c881e5b223351ff8fa05ddeb3678581baANALYSIS DATE: 2023-02-01T05:13:48ZTTPS: T1005, T1081, T1107, T1490, T1491, T1112, T1082...

Malware Analysis – djvu – bdc7ff51ade65fde49d77d149c3ab603

February 1, 2023

Score: 10 MALWARE FAMILY: djvuTAGS:family:djvu, family:smokeloader, family:vidar, botnet:19, backdoor, discovery, persistence, ransomware, spyware, stealer, trojan, vmprotectMD5: bdc7ff51ade65fde49d77d149c3ab603SHA1: bce076a5c43cd896ecb92f8f26e40cf7d89731f2ANALYSIS DATE: 2023-02-01T03:46:45ZTTPS:...

Malware Analysis – banker – 1fa35993c075d9884558b6c7990cdc7e

February 1, 2023

Score: 8 MALWARE FAMILY: bankerTAGS:banker, ransomwareMD5: 1fa35993c075d9884558b6c7990cdc7eSHA1: 327cd6e3c8639b7681b49f4ce939fa8165029c6eANALYSIS DATE: 2023-02-01T05:23:57ZTTPS: ScoreMeaningExample10Known badA malware family was detected.8-9Likely maliciousOne or more known...

Malware Analysis – smokeloader – 071c11210a2edc6b3d92fb55617dca53

February 1, 2023

Score: 10 MALWARE FAMILY: smokeloaderTAGS:family:smokeloader, backdoor, trojanMD5: 071c11210a2edc6b3d92fb55617dca53SHA1: 887064a172b18b0409ec880c7ecce2a10ba8d919ANALYSIS DATE: 2023-02-01T05:30:03ZTTPS: T1012, T1120, T1082 ScoreMeaningExample10Known badA malware family was detected.8-9Likely...

Malware Analysis – sodinokibi – 4b4c98ac8f04680f7c529956cfe8519b

February 1, 2023

Score: 10 MALWARE FAMILY: sodinokibiTAGS:family:sodinokibi, botnet:$2a$10$qq5kf6jmnztrqdzq4ez/rez9tdkves4amex9dq.5v6uwjq4wsyzky, campaign:3537, ransomwareMD5: 4b4c98ac8f04680f7c529956cfe8519bSHA1: e6dccf4b1fc5ab116b6bc1321346b35dbf42f387ANALYSIS DATE: 2023-02-01T05:34:04ZTTPS: T1082 ScoreMeaningExample10Known badA malware family was detected.8-9Likely maliciousOne...

Malware Analysis – djvu – 5ac925dd0ed8f683443c4873fd48a37b

February 1, 2023

Score: 10 MALWARE FAMILY: djvuTAGS:family:djvu, family:smokeloader, family:vidar, botnet:19, backdoor, discovery, persistence, ransomware, spyware, stealer, trojan, vmprotectMD5: 5ac925dd0ed8f683443c4873fd48a37bSHA1: 97ddc705341f4825fe41c738cab0373851c52132ANALYSIS DATE: 2023-02-01T05:46:20ZTTPS:...

Sandfly-Entropyscan – Tool To Detect Packed Or Encrypt ed Binaries Related To Malware, Finds Malicious Files And Linux Processes And Gives Output With Cryptographic Hashes

February 1, 2023

What is sandfly-entropyscan? sandfly-entropyscan is a utility to quickly scan files or running processes and report on their entropy (measure...

OSINT

Malware Analysis – maze – ca927fc487ca5f9196493b8f22ff611c

Malware Analysis – djvu – bdc7ff51ade65fde49d77d149c3ab603

Malware Analysis – banker – 1fa35993c075d9884558b6c7990cdc7e

Malware Analysis – smokeloader – 071c11210a2edc6b3d92fb55617dca53

Malware Analysis – sodinokibi – 4b4c98ac8f04680f7c529956cfe8519b

Malware Analysis – djvu – 5ac925dd0ed8f683443c4873fd48a37b

Sandfly-Entropyscan – Tool To Detect Packed Or Encrypt ed Binaries Related To Malware, Finds Malicious Files And Linux Processes And Gives Output With Cryptographic Hashes

Cobalt Stike Beacon Detected – 89[.]185[.]85[.]247:80

Cobalt Stike Beacon Detected – 35[.]153[.]50[.]171:80

Cobalt Stike Beacon Detected – 182[.]61[.]13[.]166:8090

Cobalt Stike Beacon Detected – 78[.]128[.]112[.]196:443

Vice Society Ransomware Victim: Societa Italiana Brevetti SpA

Vice Society Ransomware Victim: TechInsights

Cobalt Stike Beacon Detected – 161[.]35[.]17[.]28:80

Cobalt Stike Beacon Detected – 91[.]215[.]85[.]143:443

Cobalt Stike Beacon Detected – 101[.]34[.]163[.]3:9999

Cobalt Stike Beacon Detected – 107[.]189[.]28[.]121:80

Cobalt Stike Beacon Detected – 180[.]76[.]154[.]33:443

Cobalt Stike Beacon Detected – 23[.]227[.]196[.]194:80

Cobalt Stike Beacon Detected – 209[.]141[.]52[.]22:80

Cobalt Stike Beacon Detected – 43[.]139[.]8[.]152:9999

Cobalt Stike Beacon Detected – 23[.]227[.]193[.]33:443

Cobalt Stike Beacon Detected – 156[.]96[.]157[.]120:443

Cobalt Stike Beacon Detected – 110[.]81[.]153[.]37:10443

[QILIN] – Ransomware Victim: alissco[.]com

[AKIRA] – Ransomware Victim: Clarion Safety Systems

[COINBASECARTEL] – Ransomware Victim: PF / PS

[QILIN] – Ransomware Victim: Altimedia

[QILIN] – Ransomware Victim: echolakefoods[.]com

You may have missed