OSINT

Malware Analysis – evasion – e46421290522060e95dc6c6ac9bab9c8

November 24, 2022

Score: 9 MALWARE FAMILY: evasionTAGS:evasion, persistence, ransomware, trojanMD5: e46421290522060e95dc6c6ac9bab9c8SHA1: 08aaa1203dca088e366ea31253ec264ca710f015ANALYSIS DATE: 2022-11-24T07:48:05ZTTPS: T1060, T1112, T1107, T1490, T1082 ScoreMeaningExample10Known badA malware...

Malware Analysis – evasion – b0710804b8d1057855fdefcfa0112e66

November 24, 2022

Score: 9 MALWARE FAMILY: evasionTAGS:evasion, persistence, ransomware, trojanMD5: b0710804b8d1057855fdefcfa0112e66SHA1: 78db1b4541e821fb43d147e7809607733180b3ceANALYSIS DATE: 2022-11-24T07:48:10ZTTPS: T1060, T1112, T1107, T1490, T1082 ScoreMeaningExample10Known badA malware...

Malware Analysis – persistence – b725067c7926e8a3268d2fabfcad7b4e

November 24, 2022

Score: 9 MALWARE FAMILY: persistenceTAGS:persistence, ransomwareMD5: b725067c7926e8a3268d2fabfcad7b4eSHA1: 2518fb688bec920f49e6b20144dc385866a2a70cANALYSIS DATE: 2022-11-24T07:48:23ZTTPS: T1107, T1490, T1060, T1112 ScoreMeaningExample10Known badA malware family was detected.8-9Likely...

Cobalt Stike Beacon Detected – 110[.]40[.]201[.]49:443

November 24, 2022

The Information provided at the time of posting was detected as "Cobalt Strike". Depending on when you are viewing this...

Cobalt Stike Beacon Detected – 43[.]139[.]156[.]186:443

November 24, 2022

The Information provided at the time of posting was detected as "Cobalt Strike". Depending on when you are viewing this...

Cobalt Stike Beacon Detected – 172[.]86[.]123[.]13:443

November 24, 2022

The Information provided at the time of posting was detected as "Cobalt Strike". Depending on when you are viewing this...

Cobalt Stike Beacon Detected – 85[.]208[.]136[.]49:443

November 24, 2022

The Information provided at the time of posting was detected as "Cobalt Strike". Depending on when you are viewing this...

Malware Analysis – djvu – a5b4c672812208b47b9a9370902d4e1c

November 24, 2022

Score: 10 MALWARE FAMILY: djvuTAGS:family:djvu, discovery, persistence, ransomwareMD5: a5b4c672812208b47b9a9370902d4e1cSHA1: 0efd3da2bcad33fc6c91fc8a1c2a499c889eb2f6ANALYSIS DATE: 2022-11-24T10:33:48ZTTPS: T1060, T1112, T1222, T1082, T1012 ScoreMeaningExample10Known badA malware...

Bug Bounty

BugCrowd Bug Bounty Disclosure: – Panel access at https://news-push-88.op-mobile.opera.com/. – By rahul0x01

November 24, 2022

The below information is fully automated and the information is captured from the BugCrowd Disclosure website. The information was correct...

Bug Bounty

BugCrowd Bug Bounty Disclosure: – Impersonation via Broken Link Hijacking on https://sv.hellosign.com – By CoffeeAddict_exe

November 24, 2022

The below information is fully automated and the information is captured from the BugCrowd Disclosure website. The information was correct...

Malware Analysis – ransomware – fecea0c22b3fc1a848902bcae0d16027

November 24, 2022

Score: 8 MALWARE FAMILY: ransomwareTAGS:ransomwareMD5: fecea0c22b3fc1a848902bcae0d16027SHA1: a5fd3809a7640e4ec3bf7617fff3f70eaff1562bANALYSIS DATE: 2022-11-24T09:02:55ZTTPS: T1012, T1120, T1082 ScoreMeaningExample10Known badA malware family was detected.8-9Likely maliciousOne or...

Malware Analysis – djvu – dfb556e14a10b5145a33f1a3efabdf88

November 24, 2022

Score: 10 MALWARE FAMILY: djvuTAGS:family:djvu, family:vidar, botnet:517, discovery, persistence, ransomware, spyware, stealerMD5: dfb556e14a10b5145a33f1a3efabdf88SHA1: adb76813eda263afa706327cf52ef099f024fd36ANALYSIS DATE: 2022-11-24T10:25:26ZTTPS: T1005, T1081, T1130, T1112,...

Malware Analysis – banker – 425ca585e1689771f69c442036192d78

November 24, 2022

Score: 8 MALWARE FAMILY: bankerTAGS:banker, ransomwareMD5: 425ca585e1689771f69c442036192d78SHA1: 3d7e48669307cc962f18de5639ae0697ed950d1eANALYSIS DATE: 2022-11-24T09:53:04ZTTPS: ScoreMeaningExample10Known badA malware family was detected.8-9Likely maliciousOne or more known...

An aggressive malware campaign targets US-based companies with Qakbot to deliver Black Basta Ransomware

November 24, 2022

Researchers warn of an ongoing aggressive Qakbot malware campaign that leads to Black Basta ransomware infections in the US. Experts...

LockBit 3.0 Ransomware Victim: nelsonautohaus[.]com

November 24, 2022

LockBit 3.0 Ransomware NOTE: No files or stolen information are by RedPacket Security. Any legal issues relating to the content...

Threat actors exploit discontinues Boa web servers to target critical infrastructure

November 24, 2022

Microsoft reported that hackers have exploited flaws in a now-discontinued web server called Boa in attacks against critical industries. Microsoft experts...

LockBit 3.0 Ransomware Victim: embalajescapsa[.]com

November 24, 2022

LockBit 3.0 Ransomware NOTE: No files or stolen information are by RedPacket Security. Any legal issues relating to the...

LockBit 3.0 Ransomware Victim: Nihonsakari Co[.] , Ltd

November 24, 2022

LockBit 3.0 Ransomware NOTE: No files or stolen information are by RedPacket Security. Any legal issues relating to the content...

LockBit 3.0 Ransomware Victim: dcashpro[.]com

November 24, 2022

LockBit 3.0 Ransomware NOTE: No files or stolen information are by RedPacket Security. Any legal issues relating to the content...

Daily Vulnerability Trends: Thu Nov 24 2022

November 24, 2022

Daily Vulnerability Trends (sourced from VulnMon) CVE NAMECVE DescriptionCVE-2022-41049Windows Mark of the Web Security Feature Bypass Vulnerability. This CVE ID...

Black Friday shoppers beware: online threats so far in 2022

November 24, 2022

The shopping event of the year, Black Friday, is almost here, and while the big day does not officially arrive...

Malware Analysis – evasion – a4cea260c512dde09d9166744e42aba0

November 24, 2022

Score: 9 MALWARE FAMILY: evasionTAGS:evasion, persistence, ransomwareMD5: a4cea260c512dde09d9166744e42aba0SHA1: 4f0f80519e424c56db49e6287d92af29812f5791ANALYSIS DATE: 2022-11-24T00:09:21ZTTPS: T1490, T1060, T1112 ScoreMeaningExample10Known badA malware family was detected.8-9Likely...

Malware Analysis – evasion – c7acfecc9e19773876dab3f1a83343ab

November 24, 2022

Score: 6 MALWARE FAMILY: evasionTAGS:evasion, ransomwareMD5: c7acfecc9e19773876dab3f1a83343abSHA1: 893f01007c39ce072592ad6b7e946d53039f64b2ANALYSIS DATE: 2022-11-24T02:17:23ZTTPS: ScoreMeaningExample10Known badA malware family was detected.8-9Likely maliciousOne or more known...

Malware Analysis – ransomware – e83cbdb1a9c0a13f007f6fe1e9531453

November 24, 2022

Score: 6 MALWARE FAMILY: ransomwareTAGS:ransomwareMD5: e83cbdb1a9c0a13f007f6fe1e9531453SHA1: e29c7c4321a7e218c447a363710ec36a8f3b35edANALYSIS DATE: 2022-11-24T02:16:24ZTTPS: ScoreMeaningExample10Known badA malware family was detected.8-9Likely maliciousOne or more known damaging...

OSINT

Malware Analysis – evasion – e46421290522060e95dc6c6ac9bab9c8

Malware Analysis – evasion – b0710804b8d1057855fdefcfa0112e66

Malware Analysis – persistence – b725067c7926e8a3268d2fabfcad7b4e

Cobalt Stike Beacon Detected – 110[.]40[.]201[.]49:443

Cobalt Stike Beacon Detected – 43[.]139[.]156[.]186:443

Cobalt Stike Beacon Detected – 172[.]86[.]123[.]13:443

Cobalt Stike Beacon Detected – 85[.]208[.]136[.]49:443

Malware Analysis – djvu – a5b4c672812208b47b9a9370902d4e1c

BugCrowd Bug Bounty Disclosure: – Panel access at https://news-push-88.op-mobile.opera.com/. – By rahul0x01

BugCrowd Bug Bounty Disclosure: – Impersonation via Broken Link Hijacking on https://sv.hellosign.com – By CoffeeAddict_exe

Malware Analysis – ransomware – fecea0c22b3fc1a848902bcae0d16027

Malware Analysis – djvu – dfb556e14a10b5145a33f1a3efabdf88

Malware Analysis – banker – 425ca585e1689771f69c442036192d78

An aggressive malware campaign targets US-based companies with Qakbot to deliver Black Basta Ransomware

LockBit 3.0 Ransomware Victim: nelsonautohaus[.]com

Threat actors exploit discontinues Boa web servers to target critical infrastructure

LockBit 3.0 Ransomware Victim: embalajescapsa[.]com

LockBit 3.0 Ransomware Victim: Nihonsakari Co[.] , Ltd

LockBit 3.0 Ransomware Victim: dcashpro[.]com

Daily Vulnerability Trends: Thu Nov 24 2022

Black Friday shoppers beware: online threats so far in 2022

Malware Analysis – evasion – a4cea260c512dde09d9166744e42aba0

Malware Analysis – evasion – c7acfecc9e19773876dab3f1a83343ab

Malware Analysis – ransomware – e83cbdb1a9c0a13f007f6fe1e9531453

BugCrowd Bug Bounty Disclosure: P3 – Publicly Editable Google Docs Linked from NASA SnowEx PPT –

BugCrowd Bug Bounty Disclosure: P3 – Details of the collaboration between NASA and Inmarsat Government and the type of contract –

Apple Products Multiple Vulnerabilities

Miljödata – 870,108 breached accounts

Cobalt Strike Beacon Detected – 119[.]91[.]203[.]199:88

You may have missed