OSINT

Malware Analysis – djvu – a921630469b9a90ee06e2eb1162518d0

December 20, 2022

Score: 10 MALWARE FAMILY: djvuTAGS:family:djvu, discovery, persistence, ransomware, spyware, stealerMD5: a921630469b9a90ee06e2eb1162518d0SHA1: 285f2fe0ccd5404066abd5aa2e2cdc35e8fcbd55ANALYSIS DATE: 2022-12-20T10:21:55ZTTPS: T1222, T1082, T1005, T1081, T1012, T1060,...

Malware Analysis – evasion – 39be65c8a26732e90364ad5c6f98986e

December 20, 2022

Score: 7 MALWARE FAMILY: evasionTAGS:evasion, ransomwareMD5: 39be65c8a26732e90364ad5c6f98986eSHA1: 1d66f11969008d4d4fde5e896b9764d9192fb158ANALYSIS DATE: 2022-12-20T09:10:04ZTTPS: ScoreMeaningExample10Known badA malware family was detected.8-9Likely maliciousOne or more known...

Cobalt Stike Beacon Detected – 47[.]96[.]156[.]250:4445

December 20, 2022

The Information provided at the time of posting was detected as "Cobalt Strike". Depending on when you are viewing this...

Cobalt Stike Beacon Detected – 202[.]95[.]19[.]215:443

December 20, 2022

The Information provided at the time of posting was detected as "Cobalt Strike". Depending on when you are viewing this...

Cobalt Stike Beacon Detected – 43[.]140[.]251[.]169:80

December 20, 2022

The Information provided at the time of posting was detected as "Cobalt Strike". Depending on when you are viewing this...

Cobalt Stike Beacon Detected – 43[.]130[.]228[.]116:443

December 20, 2022

The Information provided at the time of posting was detected as "Cobalt Strike". Depending on when you are viewing this...

Malware Analysis – banker – 09edc47eee95bc8e6e70faf20da6c3fd

December 20, 2022

Score: 8 MALWARE FAMILY: bankerTAGS:banker, evasion, ransomwareMD5: 09edc47eee95bc8e6e70faf20da6c3fdSHA1: 5925a3b50d251718609a7bf8dbc8bcd8e6fe2fc5ANALYSIS DATE: 2022-12-20T11:33:04ZTTPS: ScoreMeaningExample10Known badA malware family was detected.8-9Likely maliciousOne or more...

Malware Analysis – djvu – 6c84cd55dc9d322cbac397f90f9a94d0

December 20, 2022

Score: 10 MALWARE FAMILY: djvuTAGS:family:djvu, discovery, persistence, ransomware, spyware, stealerMD5: 6c84cd55dc9d322cbac397f90f9a94d0SHA1: 7c39f89906feabc5d8218f5d627aa150052138b4ANALYSIS DATE: 2022-12-20T10:36:34ZTTPS: T1222, T1005, T1081, T1053, T1012, T1082,...

Malware Analysis – persistence – dc4ae2105938cb68c5b6988465e13da1

December 20, 2022

Score: 8 MALWARE FAMILY: persistenceTAGS:persistence, ransomwareMD5: dc4ae2105938cb68c5b6988465e13da1SHA1: 4bf9313e1b4f51df9b94cf73e36adb53f8c29ac0ANALYSIS DATE: 2022-12-20T10:31:05ZTTPS: T1060, T1112 ScoreMeaningExample10Known badA malware family was detected.8-9Likely maliciousOne or...

Malware Analysis – ryuk – f62bb82db62dd6b80908dcd79ea51fb2

December 20, 2022

Score: 10 MALWARE FAMILY: ryukTAGS:family:ryuk, discovery, evasion, persistence, ransomwareMD5: f62bb82db62dd6b80908dcd79ea51fb2SHA1: e635ba1b935adf31ffd055d71884098567b3dd4fANALYSIS DATE: 2022-12-20T10:41:33ZTTPS: T1490, T1112, T1082, T1222, T1107, T1060 ScoreMeaningExample10Known...

LockBit 3.0 Ransomware Victim: teknowsource[.]in

December 20, 2022

LockBit 3.0 Ransomware NOTE: No files or stolen information are by RedPacket Security. Any legal issues relating to the content...

Daily Vulnerability Trends: Tue Dec 20 2022

December 20, 2022

Daily Vulnerability Trends (sourced from VulnMon) CVE NAMECVE DescriptionCVE-2022-4543 No description provided CVE-2022-45141 No description provided CVE-2022-37966Windows Kerberos RC4-HMAC Elevation...

CVE-2022-41040 and CVE-2022-41082 – zero-days in MS Exchange

December 20, 2022

Summary At the end of September, GTSC reported an attack on critical infrastructure that took place in August. During the...

Malicious PyPI package posed as SentinelOne SDK to serve info-stealing malware

December 20, 2022

Researchers spotted a malicious package in the Python Package Index (PyPI) repository that impersonates a software development kit (SDK) for...

Cobalt Stike Beacon Detected – 138[.]197[.]165[.]105:443

December 20, 2022

The Information provided at the time of posting was detected as "Cobalt Strike". Depending on when you are viewing this...

Cobalt Stike Beacon Detected – 39[.]98[.]50[.]48:80

December 20, 2022

The Information provided at the time of posting was detected as "Cobalt Strike". Depending on when you are viewing this...

Cobalt Stike Beacon Detected – 198[.]46[.]131[.]172:443

December 20, 2022

The Information provided at the time of posting was detected as "Cobalt Strike". Depending on when you are viewing this...

Cobalt Stike Beacon Detected – 79[.]137[.]202[.]62:80

December 20, 2022

The Information provided at the time of posting was detected as "Cobalt Strike". Depending on when you are viewing this...

Cobalt Stike Beacon Detected – 47[.]104[.]195[.]224:80

December 20, 2022

The Information provided at the time of posting was detected as "Cobalt Strike". Depending on when you are viewing this...

Cobalt Stike Beacon Detected – 15[.]164[.]155[.]60:8888

December 20, 2022

The Information provided at the time of posting was detected as "Cobalt Strike". Depending on when you are viewing this...

Cobalt Stike Beacon Detected – 194[.]165[.]16[.]58:443

December 20, 2022

The Information provided at the time of posting was detected as "Cobalt Strike". Depending on when you are viewing this...

Cobalt Stike Beacon Detected – 47[.]242[.]58[.]73:8899

December 20, 2022

The Information provided at the time of posting was detected as "Cobalt Strike". Depending on when you are viewing this...

Cobalt Stike Beacon Detected – 121[.]36[.]165[.]78:444

December 20, 2022

The Information provided at the time of posting was detected as "Cobalt Strike". Depending on when you are viewing this...

Cobalt Stike Beacon Detected – 81[.]70[.]203[.]138:443

December 20, 2022

The Information provided at the time of posting was detected as "Cobalt Strike". Depending on when you are viewing this...

OSINT

Malware Analysis – djvu – a921630469b9a90ee06e2eb1162518d0

Malware Analysis – evasion – 39be65c8a26732e90364ad5c6f98986e

Cobalt Stike Beacon Detected – 47[.]96[.]156[.]250:4445

Cobalt Stike Beacon Detected – 202[.]95[.]19[.]215:443

Cobalt Stike Beacon Detected – 43[.]140[.]251[.]169:80

Cobalt Stike Beacon Detected – 43[.]130[.]228[.]116:443

Malware Analysis – banker – 09edc47eee95bc8e6e70faf20da6c3fd

Malware Analysis – djvu – 6c84cd55dc9d322cbac397f90f9a94d0

Malware Analysis – persistence – dc4ae2105938cb68c5b6988465e13da1

Malware Analysis – ryuk – f62bb82db62dd6b80908dcd79ea51fb2

LockBit 3.0 Ransomware Victim: teknowsource[.]in

Daily Vulnerability Trends: Tue Dec 20 2022

CVE-2022-41040 and CVE-2022-41082 – zero-days in MS Exchange

Malicious PyPI package posed as SentinelOne SDK to serve info-stealing malware

Cobalt Stike Beacon Detected – 138[.]197[.]165[.]105:443

Cobalt Stike Beacon Detected – 39[.]98[.]50[.]48:80

Cobalt Stike Beacon Detected – 198[.]46[.]131[.]172:443

Cobalt Stike Beacon Detected – 79[.]137[.]202[.]62:80

Cobalt Stike Beacon Detected – 47[.]104[.]195[.]224:80

Cobalt Stike Beacon Detected – 15[.]164[.]155[.]60:8888

Cobalt Stike Beacon Detected – 194[.]165[.]16[.]58:443

Cobalt Stike Beacon Detected – 47[.]242[.]58[.]73:8899

Cobalt Stike Beacon Detected – 121[.]36[.]165[.]78:444

Cobalt Stike Beacon Detected – 81[.]70[.]203[.]138:443

Cobalt Strike Beacon Detected – 121[.]43[.]37[.]134:4434

Cobalt Strike Beacon Detected – 119[.]29[.]231[.]118:443

Cobalt Strike Beacon Detected – 39[.]101[.]74[.]162:443

Cobalt Strike Beacon Detected – 8[.]218[.]112[.]112:8880

Cobalt Strike Beacon Detected – 47[.]109[.]48[.]57:443

You may have missed