OSINT

Malware Analysis – medusalocker – 646698572afbbf24f50ec5681feb2db7

January 26, 2023

Score: 10 MALWARE FAMILY: medusalockerTAGS:family:medusalocker, evasion, ransomware, spyware, stealer, trojanMD5: 646698572afbbf24f50ec5681feb2db7SHA1: 70530bc23bad38e6aee66cbb2c2f58a96a18fb79ANALYSIS DATE: 2023-01-26T05:33:48ZTTPS: T1082, T1112, T1012, T1120, T1107, T1490,...

Malware Analysis – ransomware – f7b5b9fd8c7020dedb138ef75190dffc

January 26, 2023

Score: 9 MALWARE FAMILY: ransomwareTAGS:ransomwareMD5: f7b5b9fd8c7020dedb138ef75190dffcSHA1: adebd8a52b6dc9ad35dee583eae8d93e0040b837ANALYSIS DATE: 2023-01-26T05:34:00ZTTPS: T1012, T1120, T1082, T1107, T1490 ScoreMeaningExample10Known badA malware family was detected.8-9Likely...

Malware Analysis – persistence – 20ebc478a429ac5c954870668f453cb2

January 26, 2023

Score: 8 MALWARE FAMILY: persistenceTAGS:persistence, ransomwareMD5: 20ebc478a429ac5c954870668f453cb2SHA1: 91c5fa33d5848a4e5bce867cf06a760aafd9dbd0ANALYSIS DATE: 2023-01-26T05:33:55ZTTPS: T1060, T1112 ScoreMeaningExample10Known badA malware family was detected.8-9Likely maliciousOne or...

Malware Analysis – dharma – 8bacbf2e386dbc47af1f1390e1bdbbf7

January 26, 2023

Score: 10 MALWARE FAMILY: dharmaTAGS:family:dharma, persistence, ransomware, spyware, stealerMD5: 8bacbf2e386dbc47af1f1390e1bdbbf7SHA1: 1101a108e9ae5aa0a0b905dd3cbbbaa05b7dd41dANALYSIS DATE: 2023-01-26T05:33:52ZTTPS: T1107, T1490, T1005, T1081, T1082, T1112, T1060...

Malware Analysis – djvu – 504863d5dc6d3062a34f399173b61ec7

January 26, 2023

Score: 10 MALWARE FAMILY: djvuTAGS:family:djvu, family:smokeloader, family:vidar, botnet:19, backdoor, discovery, persistence, ransomware, spyware, stealer, trojan, vmprotectMD5: 504863d5dc6d3062a34f399173b61ec7SHA1: c895012708971193f8462d28860bacfe3e36d510ANALYSIS DATE: 2023-01-26T05:42:07ZTTPS:...

Cobalt Stike Beacon Detected – 124[.]221[.]169[.]111:8080

January 26, 2023

The Information provided at the time of posting was detected as "Cobalt Strike". Depending on when you are viewing this...

Cobalt Stike Beacon Detected – 154[.]204[.]43[.]31:443

January 26, 2023

The Information provided at the time of posting was detected as "Cobalt Strike". Depending on when you are viewing this...

Cobalt Stike Beacon Detected – 118[.]31[.]8[.]234:9955

January 26, 2023

The Information provided at the time of posting was detected as "Cobalt Strike". Depending on when you are viewing this...

Cobalt Stike Beacon Detected – 3[.]90[.]213[.]150:80

January 26, 2023

The Information provided at the time of posting was detected as "Cobalt Strike". Depending on when you are viewing this...

Brute Ratel C4 Detected – 35[.]72[.]0[.]113:80

January 26, 2023

The Information provided at the time of posting was detected as "Brute Ratel C4". Depending on when you are viewing...

Brute Ratel C4 Detected – 149[.]28[.]251[.]203:80

January 26, 2023

The Information provided at the time of posting was detected as "Brute Ratel C4". Depending on when you are viewing...

CISA: CISA, NSA, and MS-ISAC Release Advisory on the Malicious Use of RMM Software

January 25, 2023

CISA, NSA, and MS-ISAC Release Advisory on the Malicious Use of RMM Software Today, the Cybersecurity and Infrastructure Security Agency...

CISA: VMware Releases Security Updates for VMware vRealize Log Insight

January 25, 2023

VMware Releases Security Updates for VMware vRealize Log Insight VMware released security updates to address multiple vulnerabilities in VMware vRealize...

3a7bcbbd60f416df9a81ccffd6671a24a5c9a049a5f024aeb48a0302aab22143

DC-Sonar – Analyzing AD Domains For Security Risks Related To User Accounts

January 25, 2023

DC Sonar Community Repositories The project consists of repositories: dc-sonar-frontend dc-sonar-user-layer dc-sonar-workers-layer ntlm-scrutinizer Disclaimer It's only for education purposes. Avoid...

Cobalt Stike Beacon Detected – 39[.]101[.]1[.]65:8443

January 25, 2023

The Information provided at the time of posting was detected as "Cobalt Strike". Depending on when you are viewing this...

Cobalt Stike Beacon Detected – 81[.]161[.]229[.]168:443

January 25, 2023

The Information provided at the time of posting was detected as "Cobalt Strike". Depending on when you are viewing this...

Cobalt Stike Beacon Detected – 18[.]197[.]201[.]242:4433

January 25, 2023

The Information provided at the time of posting was detected as "Cobalt Strike". Depending on when you are viewing this...

Cobalt Stike Beacon Detected – 124[.]223[.]215[.]12:8091

January 25, 2023

The Information provided at the time of posting was detected as "Cobalt Strike". Depending on when you are viewing this...

LockBit 3.0 Ransomware Victim: flatironssolutions[.]com

January 25, 2023

LockBit 3.0 Ransomware NOTE: No files or stolen information are by RedPacket Security. Any legal issues relating to the content...

Daily Vulnerability Trends: Wed Jan 25 2023

January 25, 2023

Daily Vulnerability Trends (sourced from VulnMon) CVE NAMECVE DescriptionCVE-2023-22809In Sudo before 1.9.12p2, the sudoedit (aka -e) feature mishandles extra arguments...

Malware Analysis – darkcomet – 0370e5464c8f4718128f18548ca236aa

January 25, 2023

Score: 10 MALWARE FAMILY: darkcometTAGS:family:darkcomet, ransomware, rat, trojanMD5: 0370e5464c8f4718128f18548ca236aaSHA1: a7dc7c6526971d70b887b937bd6965ee82e5fdd0ANALYSIS DATE: 2023-01-25T03:51:31ZTTPS: T1012, T1082, T1491, T1112 ScoreMeaningExample10Known badA malware family...

Malware Analysis – djvu – c82d642d03203afc33ec1bf6c736b5c5

January 25, 2023

Score: 10 MALWARE FAMILY: djvuTAGS:family:djvu, family:vidar, botnet:19, discovery, persistence, ransomware, spyware, stealerMD5: c82d642d03203afc33ec1bf6c736b5c5SHA1: 45385bbb8d54c5adc84e49450c7ec1f69b60906bANALYSIS DATE: 2023-01-25T03:43:41ZTTPS: T1012, T1082, T1005, T1081,...

Malware Analysis – djvu – f297068017e333ac96d70756a87babf6

January 25, 2023

Score: 10 MALWARE FAMILY: djvuTAGS:family:djvu, family:vidar, botnet:19, discovery, persistence, ransomware, stealerMD5: f297068017e333ac96d70756a87babf6SHA1: 6dbfc207b81246788e0cab826b3dd96a31dfb276ANALYSIS DATE: 2023-01-25T04:11:03ZTTPS: T1130, T1112, T1060, T1222, T1082...

Malware Analysis – djvu – 333bcc4a842670afc9f50160d7e3055c

January 25, 2023

Score: 10 MALWARE FAMILY: djvuTAGS:family:djvu, family:vidar, botnet:19, discovery, persistence, ransomware, spyware, stealerMD5: 333bcc4a842670afc9f50160d7e3055cSHA1: b72cdacbb3e38a705344cdaab0454996563e98fdANALYSIS DATE: 2023-01-25T05:09:28ZTTPS: T1082, T1012, T1005, T1081,...

OSINT

Malware Analysis – medusalocker – 646698572afbbf24f50ec5681feb2db7

Malware Analysis – ransomware – f7b5b9fd8c7020dedb138ef75190dffc

Malware Analysis – persistence – 20ebc478a429ac5c954870668f453cb2

Malware Analysis – dharma – 8bacbf2e386dbc47af1f1390e1bdbbf7

Malware Analysis – djvu – 504863d5dc6d3062a34f399173b61ec7

Cobalt Stike Beacon Detected – 124[.]221[.]169[.]111:8080

Cobalt Stike Beacon Detected – 154[.]204[.]43[.]31:443

Cobalt Stike Beacon Detected – 118[.]31[.]8[.]234:9955

Cobalt Stike Beacon Detected – 3[.]90[.]213[.]150:80

Brute Ratel C4 Detected – 35[.]72[.]0[.]113:80

Brute Ratel C4 Detected – 149[.]28[.]251[.]203:80

CISA: CISA, NSA, and MS-ISAC Release Advisory on the Malicious Use of RMM Software

CISA: VMware Releases Security Updates for VMware vRealize Log Insight

DC-Sonar – Analyzing AD Domains For Security Risks Related To User Accounts

Cobalt Stike Beacon Detected – 39[.]101[.]1[.]65:8443

Cobalt Stike Beacon Detected – 81[.]161[.]229[.]168:443

Cobalt Stike Beacon Detected – 18[.]197[.]201[.]242:4433

Cobalt Stike Beacon Detected – 124[.]223[.]215[.]12:8091

LockBit 3.0 Ransomware Victim: flatironssolutions[.]com

Daily Vulnerability Trends: Wed Jan 25 2023

Malware Analysis – darkcomet – 0370e5464c8f4718128f18548ca236aa

Malware Analysis – djvu – c82d642d03203afc33ec1bf6c736b5c5

Malware Analysis – djvu – f297068017e333ac96d70756a87babf6

Malware Analysis – djvu – 333bcc4a842670afc9f50160d7e3055c

[BLACKSHRANTAC] – Ransomware Victim: CyPark Resources Berhad

CVE Alert: CVE-2025-33003 – IBM – InfoSphere Information Server

CVE Alert: CVE-2025-12115 – wpclever – WPC Name Your Price for WooCommerce

[QILIN] – Ransomware Victim: Gun Accessory Supply

[AKIRA] – Ransomware Victim: Hometown Credit Union

You may have missed