OSINT

Malware Analysis – evasion – 5bbd9c831523b2e5dfa65171a64357d0

December 4, 2022

Score: 5 MALWARE FAMILY: evasionTAGS:evasion, ransomwareMD5: 5bbd9c831523b2e5dfa65171a64357d0SHA1: e7628e660fc27f4c9bff681d9329b184e1ef7190ANALYSIS DATE: 2022-12-02T01:47:07ZTTPS: ScoreMeaningExample10Known badA malware family was detected.8-9Likely maliciousOne or more known...

Cobalt Stike Beacon Detected – 43[.]154[.]112[.]12:443

December 4, 2022

The Information provided at the time of posting was detected as "Cobalt Strike". Depending on when you are viewing this...

Cobalt Stike Beacon Detected – 110[.]40[.]214[.]45:9999

December 4, 2022

The Information provided at the time of posting was detected as "Cobalt Strike". Depending on when you are viewing this...

Cobalt Stike Beacon Detected – 107[.]175[.]221[.]48:80

December 4, 2022

The Information provided at the time of posting was detected as "Cobalt Strike". Depending on when you are viewing this...

Cobalt Stike Beacon Detected – 103[.]146[.]158[.]251:80

December 4, 2022

The Information provided at the time of posting was detected as "Cobalt Strike". Depending on when you are viewing this...

Malware Analysis – evasion – e49004538555fc8d439ca0d88c85a3f8

December 4, 2022

Score: 5 MALWARE FAMILY: evasionTAGS:evasion, ransomwareMD5: e49004538555fc8d439ca0d88c85a3f8SHA1: f11cbabd6e66481677b8c7f2ba85741d41012bccANALYSIS DATE: 2022-12-02T01:47:18ZTTPS: ScoreMeaningExample10Known badA malware family was detected.8-9Likely maliciousOne or more known...

Malware Analysis – evasion – 2b9e7c1928e8ae67684942d50dd88461

December 4, 2022

Score: 5 MALWARE FAMILY: evasionTAGS:evasion, ransomwareMD5: 2b9e7c1928e8ae67684942d50dd88461SHA1: 87e9f3c7bc67b317da37fbfd840fdaa900e543f2ANALYSIS DATE: 2022-12-02T01:47:11ZTTPS: ScoreMeaningExample10Known badA malware family was detected.8-9Likely maliciousOne or more known...

Malware Analysis – evasion – 602649de342594e8a55b68406d20c655

December 4, 2022

Score: 5 MALWARE FAMILY: evasionTAGS:evasion, ransomwareMD5: 602649de342594e8a55b68406d20c655SHA1: ab042860e33f17c64b7a9aa63633397b097fdaaaANALYSIS DATE: 2022-12-02T01:47:14ZTTPS: ScoreMeaningExample10Known badA malware family was detected.8-9Likely maliciousOne or more known...

Malware Analysis – evasion – 191e418994c948b9e5bf4a438dd218d0

December 4, 2022

Score: 5 MALWARE FAMILY: evasionTAGS:evasion, ransomwareMD5: 191e418994c948b9e5bf4a438dd218d0SHA1: ce87ab69fde61d6222408814278811fa3827bf0dANALYSIS DATE: 2022-12-02T01:47:16ZTTPS: ScoreMeaningExample10Known badA malware family was detected.8-9Likely maliciousOne or more known...

Malware Analysis – ransomware – dab11b8dbfb0c1cb3f0fd3df308d8e94

December 4, 2022

Score: 7 MALWARE FAMILY: ransomwareTAGS:ransomwareMD5: dab11b8dbfb0c1cb3f0fd3df308d8e94SHA1: e5d79c2a355f802591641f4662c5d9671eb9ba48ANALYSIS DATE: 2022-12-02T01:47:26ZTTPS: ScoreMeaningExample10Known badA malware family was detected.8-9Likely maliciousOne or more known damaging...

Malware Analysis – evasion – 3da609d88fe839a1b018c75bcda3b3a3

December 4, 2022

Score: 5 MALWARE FAMILY: evasionTAGS:evasion, ransomwareMD5: 3da609d88fe839a1b018c75bcda3b3a3SHA1: 60268488e200fe1180d910f431f187c324b92fb6ANALYSIS DATE: 2022-12-02T01:47:22ZTTPS: ScoreMeaningExample10Known badA malware family was detected.8-9Likely maliciousOne or more known...

Malware Analysis – evasion – e00df873211d6b7b51b8d629f99475e1

December 4, 2022

Score: 6 MALWARE FAMILY: evasionTAGS:evasion, ransomwareMD5: e00df873211d6b7b51b8d629f99475e1SHA1: fb1c7071fd389281abcff78f34bdea0c54e4c041ANALYSIS DATE: 2022-12-02T01:47:44ZTTPS: ScoreMeaningExample10Known badA malware family was detected.8-9Likely maliciousOne or more known...

Malware Analysis – evasion – 054e7668c1fcb01b49f91bf99addfad0

December 4, 2022

Score: 5 MALWARE FAMILY: evasionTAGS:evasion, ransomwareMD5: 054e7668c1fcb01b49f91bf99addfad0SHA1: 73bbf5c7aae2be20903c112f5e2b789f1598ff04ANALYSIS DATE: 2022-12-02T01:47:20ZTTPS: ScoreMeaningExample10Known badA malware family was detected.8-9Likely maliciousOne or more known...

Malware Analysis – djvu – bdab05df8c6c8830252a72d63388d8a0

December 4, 2022

Score: 10 MALWARE FAMILY: djvuTAGS:family:djvu, family:vidar, botnet:517, discovery, persistence, ransomware, spyware, stealerMD5: bdab05df8c6c8830252a72d63388d8a0SHA1: 6b805e0cac38152af945e99a16659718a5a80249ANALYSIS DATE: 2022-12-04T09:21:56ZTTPS: T1005, T1081, T1012, T1082,...

Malware Analysis – djvu – 742a41e65b1f1b54ad4761f68c6ce637

December 4, 2022

Score: 10 MALWARE FAMILY: djvuTAGS:family:djvu, family:vidar, botnet:517, discovery, persistence, ransomware, spyware, stealerMD5: 742a41e65b1f1b54ad4761f68c6ce637SHA1: 90bd97ec51a8931f447ca84be4571e1d6e0d7d28ANALYSIS DATE: 2022-12-04T09:31:23ZTTPS: T1222, T1060, T1112, T1082,...

Malware Analysis – ransomware – 0d966e7dbb91a9b97f868f8c1e9651a1

December 4, 2022

Score: 5 MALWARE FAMILY: ransomwareTAGS:ransomwareMD5: 0d966e7dbb91a9b97f868f8c1e9651a1SHA1: 15e9df96a441bfa169a627ce3155007cf0e80278ANALYSIS DATE: 2022-12-02T01:49:01ZTTPS: ScoreMeaningExample10Known badA malware family was detected.8-9Likely maliciousOne or more known damaging...

Malware Analysis – djvu – b2b85df334493b707eb639de28331b8a

December 4, 2022

Score: 10 MALWARE FAMILY: djvuTAGS:family:djvu, family:smokeloader, family:vidar, botnet:517, backdoor, collection, discovery, persistence, ransomware, spyware, stealer, trojanMD5: b2b85df334493b707eb639de28331b8aSHA1: 6a535dd2de73c00456b34682463d45bf903fc749ANALYSIS DATE: 2022-12-04T09:45:34ZTTPS:...

Malware Analysis – djvu – 2567fd482ef2662f504e93b94b707b71

December 4, 2022

Score: 10 MALWARE FAMILY: djvuTAGS:family:djvu, family:vidar, botnet:517, discovery, persistence, ransomware, spyware, stealerMD5: 2567fd482ef2662f504e93b94b707b71SHA1: b7af6fa0c9e8330ffd8b6ef42d5194a4b0929954ANALYSIS DATE: 2022-12-04T10:54:04ZTTPS: T1082, T1005, T1081, T1012,...

Malware Analysis – djvu – 29e926d6493d8dc2dc2acb9cd5ad9218

December 4, 2022

Score: 10 MALWARE FAMILY: djvuTAGS:family:djvu, family:vidar, botnet:517, discovery, persistence, ransomware, spyware, stealerMD5: 29e926d6493d8dc2dc2acb9cd5ad9218SHA1: f381c50833fa3bac6248c6f4e382e7d3307dc5c6ANALYSIS DATE: 2022-12-04T11:23:31ZTTPS: T1060, T1112, T1222, T1053,...

Malware Analysis – dcrat – 229987ee645fe5cc7d111305f60ce710

December 4, 2022

Score: 10 MALWARE FAMILY: dcratTAGS:family:dcrat, family:djvu, family:smokeloader, family:vidar, botnet:517, backdoor, collection, discovery, infostealer, persistence, ransomware, rat, spyware, stealer, trojanMD5: 229987ee645fe5cc7d111305f60ce710SHA1:...

Malware Analysis – djvu – 4c756f3cc6bd5369242a495fea388406

December 4, 2022

Score: 10 MALWARE FAMILY: djvuTAGS:family:djvu, discovery, persistence, ransomwareMD5: 4c756f3cc6bd5369242a495fea388406SHA1: 30755db29f81a095d384d2a24e8a894e66825491ANALYSIS DATE: 2022-12-04T10:41:23ZTTPS: T1060, T1112, T1222 ScoreMeaningExample10Known badA malware family was...

OSINT

Malware Analysis – evasion – 5bbd9c831523b2e5dfa65171a64357d0

Cobalt Stike Beacon Detected – 43[.]154[.]112[.]12:443

Cobalt Stike Beacon Detected – 110[.]40[.]214[.]45:9999

Cobalt Stike Beacon Detected – 107[.]175[.]221[.]48:80

Cobalt Stike Beacon Detected – 103[.]146[.]158[.]251:80

Malware Analysis – evasion – e49004538555fc8d439ca0d88c85a3f8

Malware Analysis – evasion – 2b9e7c1928e8ae67684942d50dd88461

Malware Analysis – evasion – 602649de342594e8a55b68406d20c655

Malware Analysis – evasion – 191e418994c948b9e5bf4a438dd218d0

Malware Analysis – ransomware – dab11b8dbfb0c1cb3f0fd3df308d8e94

Malware Analysis – evasion – 3da609d88fe839a1b018c75bcda3b3a3

Malware Analysis – evasion – e00df873211d6b7b51b8d629f99475e1

Malware Analysis – evasion – 054e7668c1fcb01b49f91bf99addfad0

Malware Analysis – djvu – bdab05df8c6c8830252a72d63388d8a0

Malware Analysis – djvu – 742a41e65b1f1b54ad4761f68c6ce637

Malware Analysis – ransomware – 0d966e7dbb91a9b97f868f8c1e9651a1

Malware Analysis – djvu – b2b85df334493b707eb639de28331b8a

Malware Analysis – djvu – 2567fd482ef2662f504e93b94b707b71

Malware Analysis – djvu – 29e926d6493d8dc2dc2acb9cd5ad9218

Malware Analysis – dcrat – 229987ee645fe5cc7d111305f60ce710

Malware Analysis – djvu – 4c756f3cc6bd5369242a495fea388406

Royal Ransomware Victim: Trussbilt LLC

Royal Ransomware Victim: Duplicator Sales & Service

LockBit 3.0 Ransomware Victim: abilways[.]com

[INCRANSOM] – Ransomware Victim: sensationalteeth[.]com

[RHYSIDA] – Ransomware Victim: KISS FM

[INTERLOCK] – Ransomware Victim: Shelbyville Police Department

[AKIRA] – Ransomware Victim: Nobu Restaurants

[AKIRA] – Ransomware Victim: The Fence People

You may have missed