OSINT

Malware Analysis – smokeloader – e2e90686080b3a73208ab9bb1f62cb8b

December 24, 2022

Score: 10 MALWARE FAMILY: smokeloaderTAGS:family:smokeloader, backdoor, trojanMD5: e2e90686080b3a73208ab9bb1f62cb8bSHA1: c6ad315e0d676332960cab1e604baeabeb7c25f1ANALYSIS DATE: 2022-12-23T22:01:05ZTTPS: T1012, T1120, T1082 ScoreMeaningExample10Known badA malware family was detected.8-9Likely...

Malware Analysis – smokeloader – f842773eeae971948df273f1b72811ef

December 24, 2022

Score: 10 MALWARE FAMILY: smokeloaderTAGS:family:smokeloader, backdoor, trojanMD5: f842773eeae971948df273f1b72811efSHA1: 53c32961609be41cbbaf6a7c239c28ceb7edbcadANALYSIS DATE: 2022-12-23T23:02:05ZTTPS: T1012, T1120, T1082 ScoreMeaningExample10Known badA malware family was detected.8-9Likely...

Malware Analysis – djvu – 8a3f8592ad4bfe56b0d3ecd8a45756d0

December 24, 2022

Score: 10 MALWARE FAMILY: djvuTAGS:family:djvu, discovery, persistence, ransomware, spyware, stealerMD5: 8a3f8592ad4bfe56b0d3ecd8a45756d0SHA1: e52b42276aa6ab284f4321cdda1f78e3d83e2ce5ANALYSIS DATE: 2022-12-23T22:46:55ZTTPS: T1222, T1082, T1012, T1005, T1081, T1060,...

Malware Analysis – djvu – 90363754a46ff1f0261845d1ede47a3a

December 24, 2022

Score: 10 MALWARE FAMILY: djvuTAGS:family:djvu, discovery, persistence, ransomware, spyware, stealerMD5: 90363754a46ff1f0261845d1ede47a3aSHA1: 2a032c2e0d53897b258362bc98a271f7b8b4e51eANALYSIS DATE: 2022-12-23T23:42:32ZTTPS: T1005, T1081, T1053, T1082, T1012, T1060,...

Malware Analysis – djvu – 60d534b335e0bab1e6b44e3f39962663

December 24, 2022

Score: 10 MALWARE FAMILY: djvuTAGS:family:djvu, discovery, persistence, ransomware, spyware, stealerMD5: 60d534b335e0bab1e6b44e3f39962663SHA1: c8ec8c06bdef1e2fa36e126c21ac735e55249cc9ANALYSIS DATE: 2022-12-23T23:57:20ZTTPS: T1012, T1082, T1060, T1112, T1005, T1081,...

IcedID Botnet Distributors Abuse Google PPC to Distribute Malware

December 23, 2022

We analyze the latest changes in IcedID botnet from a campaign that abuses Google pay per click (PPC) ads to...

S3Crets_Scanner – Hunting For Secrets Uploaded To Public S3 Buckets

December 23, 2022

S3cret Scanner tool designed to provide a complementary layer for the Contributing Pull requests and forks are welcome. For major...

Cobalt Stike Beacon Detected – 91[.]240[.]118[.]218:8093

December 23, 2022

The Information provided at the time of posting was detected as "Cobalt Strike". Depending on when you are viewing this...

Cobalt Stike Beacon Detected – 43[.]138[.]33[.]133:8001

December 23, 2022

The Information provided at the time of posting was detected as "Cobalt Strike". Depending on when you are viewing this...

Cobalt Stike Beacon Detected – 199[.]195[.]248[.]79:443

December 23, 2022

The Information provided at the time of posting was detected as "Cobalt Strike". Depending on when you are viewing this...

Cobalt Stike Beacon Detected – 88[.]214[.]27[.]53:80

December 23, 2022

The Information provided at the time of posting was detected as "Cobalt Strike". Depending on when you are viewing this...

Cobalt Stike Beacon Detected – 106[.]75[.]218[.]220:80

December 23, 2022

The Information provided at the time of posting was detected as "Cobalt Strike". Depending on when you are viewing this...

Cobalt Stike Beacon Detected – 18[.]194[.]244[.]87:443

December 23, 2022

The Information provided at the time of posting was detected as "Cobalt Strike". Depending on when you are viewing this...

Royal Ransomware Victim: Aegea Group companies

December 23, 2022

RoyalRansomware NOTE: No files or stolen information are by RedPacket Security. Any legal issues relating to the content of the...

Royal Ransomware Victim: Rech Informatica Ltda

December 23, 2022

RoyalRansomware NOTE: No files or stolen information are by RedPacket Security. Any legal issues relating to the content of the...

Cobalt Stike Beacon Detected – 121[.]37[.]5[.]94:7777

December 23, 2022

The Information provided at the time of posting was detected as "Cobalt Strike". Depending on when you are viewing this...

Cobalt Stike Beacon Detected – 121[.]4[.]138[.]60:9999

December 23, 2022

The Information provided at the time of posting was detected as "Cobalt Strike". Depending on when you are viewing this...

Cobalt Stike Beacon Detected – 198[.]74[.]115[.]207:8080

December 23, 2022

The Information provided at the time of posting was detected as "Cobalt Strike". Depending on when you are viewing this...

Cobalt Stike Beacon Detected – 77[.]73[.]131[.]193:443

December 23, 2022

The Information provided at the time of posting was detected as "Cobalt Strike". Depending on when you are viewing this...

Cobalt Stike Beacon Detected – 119[.]29[.]162[.]38:8088

December 23, 2022

The Information provided at the time of posting was detected as "Cobalt Strike". Depending on when you are viewing this...

Cobalt Stike Beacon Detected – 106[.]75[.]247[.]178:80

December 23, 2022

The Information provided at the time of posting was detected as "Cobalt Strike". Depending on when you are viewing this...

Cobalt Stike Beacon Detected – 8[.]131[.]94[.]164:7443

December 23, 2022

The Information provided at the time of posting was detected as "Cobalt Strike". Depending on when you are viewing this...

Cobalt Stike Beacon Detected – 43[.]138[.]41[.]95:80

December 23, 2022

The Information provided at the time of posting was detected as "Cobalt Strike". Depending on when you are viewing this...

Malware Analysis – djvu – 31779136196425ada7f38369086e99cc

December 23, 2022

Score: 10 MALWARE FAMILY: djvuTAGS:family:djvu, discovery, persistence, ransomware, spyware, stealerMD5: 31779136196425ada7f38369086e99ccSHA1: 65121e085572620c45d16e6683663ead301e5b03ANALYSIS DATE: 2022-12-23T09:12:06ZTTPS: T1005, T1081, T1012, T1082, T1222, T1053,...

OSINT

Malware Analysis – smokeloader – e2e90686080b3a73208ab9bb1f62cb8b

Malware Analysis – smokeloader – f842773eeae971948df273f1b72811ef

Malware Analysis – djvu – 8a3f8592ad4bfe56b0d3ecd8a45756d0

Malware Analysis – djvu – 90363754a46ff1f0261845d1ede47a3a

Malware Analysis – djvu – 60d534b335e0bab1e6b44e3f39962663

IcedID Botnet Distributors Abuse Google PPC to Distribute Malware

S3Crets_Scanner – Hunting For Secrets Uploaded To Public S3 Buckets

Cobalt Stike Beacon Detected – 91[.]240[.]118[.]218:8093

Cobalt Stike Beacon Detected – 43[.]138[.]33[.]133:8001

Cobalt Stike Beacon Detected – 199[.]195[.]248[.]79:443

Cobalt Stike Beacon Detected – 88[.]214[.]27[.]53:80

Cobalt Stike Beacon Detected – 106[.]75[.]218[.]220:80

Cobalt Stike Beacon Detected – 18[.]194[.]244[.]87:443

Royal Ransomware Victim: Aegea Group companies

Royal Ransomware Victim: Rech Informatica Ltda

Cobalt Stike Beacon Detected – 121[.]37[.]5[.]94:7777

Cobalt Stike Beacon Detected – 121[.]4[.]138[.]60:9999

Cobalt Stike Beacon Detected – 198[.]74[.]115[.]207:8080

Cobalt Stike Beacon Detected – 77[.]73[.]131[.]193:443

Cobalt Stike Beacon Detected – 119[.]29[.]162[.]38:8088

Cobalt Stike Beacon Detected – 106[.]75[.]247[.]178:80

Cobalt Stike Beacon Detected – 8[.]131[.]94[.]164:7443

Cobalt Stike Beacon Detected – 43[.]138[.]41[.]95:80

Malware Analysis – djvu – 31779136196425ada7f38369086e99cc

[WARLOCK] – Ransomware Victim: tein[.]co[.]jp

[WARLOCK] – Ransomware Victim: mytune[.]me

[WARLOCK] – Ransomware Victim: energogroup[.]net

[WARLOCK] – Ransomware Victim: goldenline[.]com

[WARLOCK] – Ransomware Victim: metro[.]local

You may have missed