OSINT

Malware Analysis – banker – 09edc47eee95bc8e6e70faf20da6c3fd

December 20, 2022

Score: 8 MALWARE FAMILY: bankerTAGS:banker, evasion, ransomwareMD5: 09edc47eee95bc8e6e70faf20da6c3fdSHA1: 5925a3b50d251718609a7bf8dbc8bcd8e6fe2fc5ANALYSIS DATE: 2022-12-20T11:33:04ZTTPS: ScoreMeaningExample10Known badA malware family was detected.8-9Likely maliciousOne or more...

Malware Analysis – djvu – 6c84cd55dc9d322cbac397f90f9a94d0

December 20, 2022

Score: 10 MALWARE FAMILY: djvuTAGS:family:djvu, discovery, persistence, ransomware, spyware, stealerMD5: 6c84cd55dc9d322cbac397f90f9a94d0SHA1: 7c39f89906feabc5d8218f5d627aa150052138b4ANALYSIS DATE: 2022-12-20T10:36:34ZTTPS: T1222, T1005, T1081, T1053, T1012, T1082,...

Malware Analysis – persistence – dc4ae2105938cb68c5b6988465e13da1

December 20, 2022

Score: 8 MALWARE FAMILY: persistenceTAGS:persistence, ransomwareMD5: dc4ae2105938cb68c5b6988465e13da1SHA1: 4bf9313e1b4f51df9b94cf73e36adb53f8c29ac0ANALYSIS DATE: 2022-12-20T10:31:05ZTTPS: T1060, T1112 ScoreMeaningExample10Known badA malware family was detected.8-9Likely maliciousOne or...

Malware Analysis – ryuk – f62bb82db62dd6b80908dcd79ea51fb2

December 20, 2022

Score: 10 MALWARE FAMILY: ryukTAGS:family:ryuk, discovery, evasion, persistence, ransomwareMD5: f62bb82db62dd6b80908dcd79ea51fb2SHA1: e635ba1b935adf31ffd055d71884098567b3dd4fANALYSIS DATE: 2022-12-20T10:41:33ZTTPS: T1490, T1112, T1082, T1222, T1107, T1060 ScoreMeaningExample10Known...

OSINT

Malware Analysis – banker – 09edc47eee95bc8e6e70faf20da6c3fd

Malware Analysis – djvu – 6c84cd55dc9d322cbac397f90f9a94d0

Malware Analysis – persistence – dc4ae2105938cb68c5b6988465e13da1

Malware Analysis – ryuk – f62bb82db62dd6b80908dcd79ea51fb2

LockBit 3.0 Ransomware Victim: teknowsource[.]in

Daily Vulnerability Trends: Tue Dec 20 2022

CVE-2022-41040 and CVE-2022-41082 – zero-days in MS Exchange

Malicious PyPI package posed as SentinelOne SDK to serve info-stealing malware

Cobalt Stike Beacon Detected – 138[.]197[.]165[.]105:443

Cobalt Stike Beacon Detected – 39[.]98[.]50[.]48:80

Cobalt Stike Beacon Detected – 198[.]46[.]131[.]172:443

Cobalt Stike Beacon Detected – 47[.]104[.]195[.]224:80

Cobalt Stike Beacon Detected – 79[.]137[.]202[.]62:80

Cobalt Stike Beacon Detected – 15[.]164[.]155[.]60:8888

Cobalt Stike Beacon Detected – 194[.]165[.]16[.]58:443

Cobalt Stike Beacon Detected – 47[.]242[.]58[.]73:8899

Cobalt Stike Beacon Detected – 121[.]36[.]165[.]78:444

Cobalt Stike Beacon Detected – 81[.]70[.]203[.]138:443

Cobalt Stike Beacon Detected – 1[.]117[.]231[.]225:443

Cobalt Stike Beacon Detected – 180[.]76[.]166[.]103:443

Cobalt Stike Beacon Detected – 195[.]189[.]99[.]114:80

Cobalt Stike Beacon Detected – 103[.]67[.]191[.]89:8080

Cobalt Stike Beacon Detected – 119[.]91[.]214[.]230:5555

Cobalt Stike Beacon Detected – 195[.]189[.]99[.]114:8080

CVE Alert: CVE-2025-11956 – Proliz Software Ltd. Co. – OBS (Student Affairs Information System)

[AKIRA] – Ransomware Victim: E-First Aid Supplies

[NIGHTSPIRE] – Ransomware Victim: vratatech

[NIGHTSPIRE] – Ransomware Victim: speedmais

[NIGHTSPIRE] – Ransomware Victim: Brihta

You may have missed