OSINT

Malware Analysis – discovery – e397ed4266ab57c298acaf572d864247

December 31, 2022

Score: 10 MALWARE FAMILY: discoveryTAGS:discovery, evasion, persistence, ransomwareMD5: e397ed4266ab57c298acaf572d864247SHA1: 491c1c2dec37d1b56487caaeae3e36168dcbce05ANALYSIS DATE: 2022-12-31T08:49:25ZTTPS: T1060, T1112, T1031, T1130, T1082, T1012, T1120 ScoreMeaningExample10Known...

Malware Analysis – ransomware – 101d606e040f3506412987bfb8bc5182

December 31, 2022

Score: 10 MALWARE FAMILY: ransomwareTAGS:ransomwareMD5: 101d606e040f3506412987bfb8bc5182SHA1: d534c8aa724dfaeeba7686c7c14fd56a9f50f771ANALYSIS DATE: 2022-12-31T09:24:31ZTTPS: T1082, T1012 ScoreMeaningExample10Known badA malware family was detected.8-9Likely maliciousOne or more...

Cobalt Stike Beacon Detected – 179[.]43[.]162[.]9:443

December 31, 2022

The Information provided at the time of posting was detected as "Cobalt Strike". Depending on when you are viewing this...

Cobalt Stike Beacon Detected – 180[.]76[.]166[.]65:9110

December 31, 2022

The Information provided at the time of posting was detected as "Cobalt Strike". Depending on when you are viewing this...

Cobalt Stike Beacon Detected – 43[.]139[.]167[.]44:800

December 31, 2022

The Information provided at the time of posting was detected as "Cobalt Strike". Depending on when you are viewing this...

Cobalt Stike Beacon Detected – 101[.]42[.]19[.]216:80

December 31, 2022

The Information provided at the time of posting was detected as "Cobalt Strike". Depending on when you are viewing this...

Malware Analysis – djvu – 5de11ecab492439480fb87715ec6ae0b

December 31, 2022

Score: 10 MALWARE FAMILY: djvuTAGS:family:djvu, family:vidar, botnet:19, discovery, persistence, ransomware, spyware, stealerMD5: 5de11ecab492439480fb87715ec6ae0bSHA1: 1ac12b149c613639b2fc4cef6af5df4705b692ccANALYSIS DATE: 2022-12-31T11:40:19ZTTPS: T1060, T1112, T1012, T1005,...

Malware Analysis – – bcb1e5b4dc2eae0d6eb0765130dd26bb

December 31, 2022

Score: 3 MALWARE FAMILY: TAGS:MD5: bcb1e5b4dc2eae0d6eb0765130dd26bbSHA1: e2deb24987120b98586fd88269c5d8fe68314a06ANALYSIS DATE: 2022-12-31T11:48:27ZTTPS: T1082 ScoreMeaningExample10Known badA malware family was detected.8-9Likely maliciousOne or more known...

Malware Analysis – amadey – 47de2fabe0fb3d4578c2c7f6f7741c4a

December 31, 2022

Score: 10 MALWARE FAMILY: amadeyTAGS:family:amadey, family:djvu, family:lgoogloader, family:smokeloader, family:vidar, botnet:19, backdoor, collection, discovery, downloader, persistence, ransomware, spyware, stealer, trojan, vmprotectMD5:...

Malware Analysis – smokeloader – f55db70dde213b489bed910191d180d2

December 31, 2022

Score: 10 MALWARE FAMILY: smokeloaderTAGS:family:smokeloader, backdoor, trojanMD5: f55db70dde213b489bed910191d180d2SHA1: faa9789e8bec8b7c03df02b12871231932b32fcdANALYSIS DATE: 2022-12-31T10:02:04ZTTPS: T1012, T1120, T1082 ScoreMeaningExample10Known badA malware family was detected.8-9Likely...

Brute Ratel C4 Detected – 2[.]34[.]225[.]206:9002

December 31, 2022

The Information provided at the time of posting was detected as "Brute Ratel C4". Depending on when you are viewing...

Cobalt Stike Beacon Detected – 154[.]223[.]165[.]16:443

December 31, 2022

The Information provided at the time of posting was detected as "Cobalt Strike". Depending on when you are viewing this...

Cobalt Stike Beacon Detected – 82[.]157[.]102[.]120:8999

December 31, 2022

The Information provided at the time of posting was detected as "Cobalt Strike". Depending on when you are viewing this...

Cobalt Stike Beacon Detected – 3[.]74[.]102[.]137:443

December 31, 2022

The Information provided at the time of posting was detected as "Cobalt Strike". Depending on when you are viewing this...

Cobalt Stike Beacon Detected – 34[.]92[.]28[.]142:443

December 31, 2022

The Information provided at the time of posting was detected as "Cobalt Strike". Depending on when you are viewing this...

Daily Vulnerability Trends: Sat Dec 31 2022

December 31, 2022

Daily Vulnerability Trends (sourced from VulnMon) CVE NAMECVE DescriptionCVE-2021-1961Possible buffer overflow due to lack of offset length check while updating...

Malware Analysis – djvu – e6c13b6e3d5d725d96c3d275be3c38d4

December 31, 2022

Score: 10 MALWARE FAMILY: djvuTAGS:family:djvu, family:vidar, botnet:19, discovery, persistence, ransomware, spyware, stealerMD5: e6c13b6e3d5d725d96c3d275be3c38d4SHA1: 7803f9f7fbb55696f08dd5f961c2826aeb12e752ANALYSIS DATE: 2022-12-31T03:22:02ZTTPS: T1012, T1082, T1005, T1081,...

Malware Analysis – smokeloader – e940a13c2509bd823153f8e0e764d0e8

December 31, 2022

Score: 10 MALWARE FAMILY: smokeloaderTAGS:family:smokeloader, backdoor, trojanMD5: e940a13c2509bd823153f8e0e764d0e8SHA1: 44ac7375cdb880267f9d13c804c218e28c53884dANALYSIS DATE: 2022-12-31T03:32:03ZTTPS: T1012, T1120, T1082 ScoreMeaningExample10Known badA malware family was detected.8-9Likely...

Malware Analysis – smokeloader – 8dad56f7c0cd6da28c485028d5bb79a8

December 31, 2022

Score: 10 MALWARE FAMILY: smokeloaderTAGS:family:smokeloader, backdoor, trojanMD5: 8dad56f7c0cd6da28c485028d5bb79a8SHA1: 4f683dda502920ee1c9dee80e35f9df6adef7ed3ANALYSIS DATE: 2022-12-31T04:02:03ZTTPS: T1012, T1120, T1082 ScoreMeaningExample10Known badA malware family was detected.8-9Likely...

Malware Analysis – ransomware – da64a453f7662e5425946c1d96903d86

December 31, 2022

Score: 8 MALWARE FAMILY: ransomwareTAGS:ransomware, spyware, stealerMD5: da64a453f7662e5425946c1d96903d86SHA1: 1b9f15da6e00b3cc73ea71f27db5d766fabbd62bANALYSIS DATE: 2022-12-31T04:09:02ZTTPS: T1082, T1012, T1120, T1005, T1081 ScoreMeaningExample10Known badA malware family...

Malware Analysis – ransomware – 2454d403b8fd8a0084d966ac136083bc

December 31, 2022

Score: 8 MALWARE FAMILY: ransomwareTAGS:ransomware, spyware, stealerMD5: 2454d403b8fd8a0084d966ac136083bcSHA1: 1bce66750426f1b9db1da2c56227d32ac4608727ANALYSIS DATE: 2022-12-31T04:43:04ZTTPS: T1082, T1005, T1081 ScoreMeaningExample10Known badA malware family was detected.8-9Likely...

Malware Analysis – smokeloader – b1d2c66939121ccd165b024d9451cb4d

December 31, 2022

Score: 10 MALWARE FAMILY: smokeloaderTAGS:family:smokeloader, backdoor, trojanMD5: b1d2c66939121ccd165b024d9451cb4dSHA1: e08bddb59f360a78f9c38bf30f1ad45d8e3ec060ANALYSIS DATE: 2022-12-31T05:31:10ZTTPS: T1012, T1120, T1082 ScoreMeaningExample10Known badA malware family was detected.8-9Likely...

Malware Analysis – djvu – b407a3f0e6290013e97b1c53fd935eff

December 31, 2022

Score: 10 MALWARE FAMILY: djvuTAGS:family:djvu, family:vidar, botnet:19, discovery, persistence, ransomware, spyware, stealerMD5: b407a3f0e6290013e97b1c53fd935effSHA1: 430978c3912c16c45fb4bdb38b7d8829cba198adANALYSIS DATE: 2022-12-31T05:31:29ZTTPS: T1222, T1005, T1081, T1012,...

Malware Analysis – amadey – d0f554a0c60d749227776e1c3a557c10

December 31, 2022

Score: 10 MALWARE FAMILY: amadeyTAGS:family:amadey, family:dcrat, family:djvu, family:lgoogloader, family:redline, family:smokeloader, botnet:8888888, botnet:letgo, botnet:sport, backdoor, collection, discovery, downloader, infostealer, persistence, ransomware,...

OSINT

Malware Analysis – discovery – e397ed4266ab57c298acaf572d864247

Malware Analysis – ransomware – 101d606e040f3506412987bfb8bc5182

Cobalt Stike Beacon Detected – 179[.]43[.]162[.]9:443

Cobalt Stike Beacon Detected – 180[.]76[.]166[.]65:9110

Cobalt Stike Beacon Detected – 43[.]139[.]167[.]44:800

Cobalt Stike Beacon Detected – 101[.]42[.]19[.]216:80

Malware Analysis – djvu – 5de11ecab492439480fb87715ec6ae0b

Malware Analysis – – bcb1e5b4dc2eae0d6eb0765130dd26bb

Malware Analysis – amadey – 47de2fabe0fb3d4578c2c7f6f7741c4a

Malware Analysis – smokeloader – f55db70dde213b489bed910191d180d2

Brute Ratel C4 Detected – 2[.]34[.]225[.]206:9002

Cobalt Stike Beacon Detected – 154[.]223[.]165[.]16:443

Cobalt Stike Beacon Detected – 82[.]157[.]102[.]120:8999

Cobalt Stike Beacon Detected – 3[.]74[.]102[.]137:443

Cobalt Stike Beacon Detected – 34[.]92[.]28[.]142:443

Daily Vulnerability Trends: Sat Dec 31 2022

Malware Analysis – djvu – e6c13b6e3d5d725d96c3d275be3c38d4

Malware Analysis – smokeloader – e940a13c2509bd823153f8e0e764d0e8

Malware Analysis – smokeloader – 8dad56f7c0cd6da28c485028d5bb79a8

Malware Analysis – ransomware – da64a453f7662e5425946c1d96903d86

Malware Analysis – ransomware – 2454d403b8fd8a0084d966ac136083bc

Malware Analysis – smokeloader – b1d2c66939121ccd165b024d9451cb4d

Malware Analysis – djvu – b407a3f0e6290013e97b1c53fd935eff

Malware Analysis – amadey – d0f554a0c60d749227776e1c3a557c10

[AKIRA] – Ransomware Victim: Christina Development

[AKIRA] – Ransomware Victim: Coilplus

[SAFEPAY] – Ransomware Victim: mcintoshlabs[.]com

[QILIN] – Ransomware Victim: Maine Course Hospitality Group

[DRAGONFORCE] – Ransomware Victim: SAIGON INDUSTRIAL SERVICE

You may have missed