OSINT

Malware Analysis – djvu – 4fc50e305f9719c90d875264755aa9f1

October 14, 2022

Score: 10 MALWARE FAMILY: djvuTAGS:family:djvu, family:vidar, botnet:517, discovery, persistence, ransomware, stealerMD5: 4fc50e305f9719c90d875264755aa9f1SHA1: 7017615409a08f6384fd00d6e26ada2a8b671767ANALYSIS DATE: 2022-10-14T09:52:18ZTTPS: T1130, T1112, T1222, T1082, T1012,...

Malware Analysis – ransomware – c39d02e577302bf8caa4e4d483300f60

October 14, 2022

Score: 9 MALWARE FAMILY: ransomwareTAGS:ransomware, spyware, stealerMD5: c39d02e577302bf8caa4e4d483300f60SHA1: 5260376d86035057f7df26df8c73c7927ada50a5ANALYSIS DATE: 2022-10-14T09:40:08ZTTPS: T1005, T1081, T1082, T1107, T1490, T1091 ScoreMeaningExample10Known badA malware...

Malware Analysis – ransomware – 316d49bb419c374794ac38cb426576b9

October 14, 2022

Score: 9 MALWARE FAMILY: ransomwareTAGS:ransomwareMD5: 316d49bb419c374794ac38cb426576b9SHA1: 4003353dedc40548b27b703cc9e010de43a064dcANALYSIS DATE: 2022-10-14T09:40:26ZTTPS: T1107, T1490, T1091, T1082 ScoreMeaningExample10Known badA malware family was detected.8-9Likely maliciousOne...

Malware Analysis – ransomware – 9ab4626608328e493a9aa75cb82b0c3f

October 14, 2022

Score: 9 MALWARE FAMILY: ransomwareTAGS:ransomwareMD5: 9ab4626608328e493a9aa75cb82b0c3fSHA1: a22a3325f78a61226f78419dba5264fd701d7903ANALYSIS DATE: 2022-10-14T09:40:17ZTTPS: T1091, T1082, T1107, T1490 ScoreMeaningExample10Known badA malware family was detected.8-9Likely maliciousOne...

Cobalt Stike Beacon Detected – 157[.]245[.]254[.]149:443

October 14, 2022

The Information provided at the time of posting was detected as "Cobalt Strike". Depending on when you are viewing this...

Cobalt Stike Beacon Detected – 174[.]139[.]150[.]250:4443

October 14, 2022

The Information provided at the time of posting was detected as "Cobalt Strike". Depending on when you are viewing this...

Cobalt Stike Beacon Detected – 154[.]221[.]25[.]206:443

October 14, 2022

The Information provided at the time of posting was detected as "Cobalt Strike". Depending on when you are viewing this...

Cobalt Stike Beacon Detected – 5[.]44[.]42[.]16:80

October 14, 2022

The Information provided at the time of posting was detected as "Cobalt Strike". Depending on when you are viewing this...

Malware Analysis – danabot – 3572e56a91ed00b2a383c8efd1b64653

October 14, 2022

Score: 10 MALWARE FAMILY: danabotTAGS:family:danabot, family:djvu, family:smokeloader, family:vidar, botnet:517, backdoor, banker, collection, discovery, persistence, ransomware, spyware, stealer, trojan, vmprotectMD5: 3572e56a91ed00b2a383c8efd1b64653SHA1:...

Malware Analysis – djvu – a1f3f1f4e250c96cbbee38b5d6babd7e

October 14, 2022

Score: 10 MALWARE FAMILY: djvuTAGS:family:djvu, family:vidar, botnet:517, discovery, persistence, ransomware, spyware, stealerMD5: a1f3f1f4e250c96cbbee38b5d6babd7eSHA1: 34f96b5e8d04ea15f2079d51383986a1cbc91123ANALYSIS DATE: 2022-10-14T10:24:10ZTTPS: T1222, T1082, T1053, T1005,...

Malware Analysis – djvu – 381c69c453ddd6ecebb0535db66d069a

October 14, 2022

Score: 10 MALWARE FAMILY: djvuTAGS:family:djvu, family:vidar, botnet:517, discovery, persistence, ransomware, spyware, stealerMD5: 381c69c453ddd6ecebb0535db66d069aSHA1: f023209a0bc9a96fe9cb9d17a5012ddc2ee28462ANALYSIS DATE: 2022-10-14T10:37:50ZTTPS: T1005, T1081, T1012, T1082,...

Malware Analysis – ransomware – 45ac7cd59d7f250217c69d5ec042632d

October 14, 2022

Score: 9 MALWARE FAMILY: ransomwareTAGS:ransomwareMD5: 45ac7cd59d7f250217c69d5ec042632dSHA1: cf41622eea189b592cc3f31d9eadceba56144310ANALYSIS DATE: 2022-10-14T10:34:50ZTTPS: T1107, T1490 ScoreMeaningExample10Known badA malware family was detected.8-9Likely maliciousOne or more...

Cobalt Stike Beacon Detected – 139[.]9[.]1[.]63:80

October 14, 2022

The Information provided at the time of posting was detected as "Cobalt Strike". Depending on when you are viewing this...

Cobalt Stike Beacon Detected – 82[.]157[.]245[.]205:4433

October 14, 2022

The Information provided at the time of posting was detected as "Cobalt Strike". Depending on when you are viewing this...

Cobalt Stike Beacon Detected – 104[.]168[.]117[.]95:80

October 14, 2022

The Information provided at the time of posting was detected as "Cobalt Strike". Depending on when you are viewing this...

Cobalt Stike Beacon Detected – 66[.]42[.]48[.]182:6443

October 14, 2022

The Information provided at the time of posting was detected as "Cobalt Strike". Depending on when you are viewing this...

Experts released PoC exploit code for critical bug CVE-2022-40684 in Fortinet products

October 14, 2022

Experts released the PoC exploit code for the authentication bypass flaw CVE-2022-40684 in FortiGate firewalls and FortiProxy web proxies. A...

DJI drone tracking data exposed in the US

October 14, 2022

Over 80,000 drone IDs were exposed in the leak of a database containing information from airspace monitoring devices manufactured by...

Daily Vulnerability Trends: Fri Oct 14 2022

October 14, 2022

Daily Vulnerability Trends (sourced from VulnMon) CVE NAMECVE DescriptionCVE-2022-41033Windows COM+ Event System Service Elevation of Privilege Vulnerability.CVE-2022-36067vm2 is a sandbox...

Ongoing exploitation of CVE-2022-41352 (Zimbra 0-day)

October 14, 2022

Overview On September 10, 2022, a user reported on Zimbra’s official forums that their team detected a security incident originating...

Malware Analysis – discovery – 6905e9e6ec69c8f324f51d755f8a85f0

October 14, 2022

Score: 8 MALWARE FAMILY: discoveryTAGS:discovery, exploitMD5: 6905e9e6ec69c8f324f51d755f8a85f0SHA1: 18b8badd020675e0251c7431899c58de4fb76533ANALYSIS DATE: 2022-10-13T22:30:48ZTTPS: T1222 ScoreMeaningExample10Known badA malware family was detected.8-9Likely maliciousOne or more...

Malware Analysis – evasion – 493d67f1e5dad681c15249f4c8737980

October 14, 2022

Score: 10 MALWARE FAMILY: evasionTAGS:evasion, persistence, ransomware, trojanMD5: 493d67f1e5dad681c15249f4c8737980SHA1: c49a0dcd26cc9c3cfe43e5398dc7e9f928ba1f97ANALYSIS DATE: 2022-10-13T23:23:45ZTTPS: T1082, T1012, T1120, T1491, T1112, T1004, T1060, T1091,...

Malware Analysis – djvu – 40afe7409ce7634d460ba5e85c477efc

October 14, 2022

Score: 10 MALWARE FAMILY: djvuTAGS:family:djvu, family:smokeloader, family:vidar, botnet:517, backdoor, collection, discovery, persistence, ransomware, spyware, stealer, trojan, vmprotectMD5: 40afe7409ce7634d460ba5e85c477efcSHA1: 609cc6265c63ea0b9ceaa8e8e0a9bfe81032c3d4ANALYSIS DATE:...

Malware Analysis – smokeloader – 5a1dc674681bf0652500813bedd52416

October 14, 2022

Score: 10 MALWARE FAMILY: smokeloaderTAGS:family:smokeloader, backdoor, trojanMD5: 5a1dc674681bf0652500813bedd52416SHA1: 02209e45efac844b5cf7a8dbfe098172a81630a9ANALYSIS DATE: 2022-10-14T02:02:45ZTTPS: T1012, T1120, T1082 ScoreMeaningExample10Known badA malware family was detected.8-9Likely...

OSINT

Malware Analysis – djvu – 4fc50e305f9719c90d875264755aa9f1

Malware Analysis – ransomware – c39d02e577302bf8caa4e4d483300f60

Malware Analysis – ransomware – 316d49bb419c374794ac38cb426576b9

Malware Analysis – ransomware – 9ab4626608328e493a9aa75cb82b0c3f

Cobalt Stike Beacon Detected – 157[.]245[.]254[.]149:443

Cobalt Stike Beacon Detected – 174[.]139[.]150[.]250:4443

Cobalt Stike Beacon Detected – 154[.]221[.]25[.]206:443

Cobalt Stike Beacon Detected – 5[.]44[.]42[.]16:80

Malware Analysis – danabot – 3572e56a91ed00b2a383c8efd1b64653

Malware Analysis – djvu – a1f3f1f4e250c96cbbee38b5d6babd7e

Malware Analysis – djvu – 381c69c453ddd6ecebb0535db66d069a

Malware Analysis – ransomware – 45ac7cd59d7f250217c69d5ec042632d

Cobalt Stike Beacon Detected – 139[.]9[.]1[.]63:80

Cobalt Stike Beacon Detected – 82[.]157[.]245[.]205:4433

Cobalt Stike Beacon Detected – 104[.]168[.]117[.]95:80

Cobalt Stike Beacon Detected – 66[.]42[.]48[.]182:6443

Experts released PoC exploit code for critical bug CVE-2022-40684 in Fortinet products

DJI drone tracking data exposed in the US

Daily Vulnerability Trends: Fri Oct 14 2022

Ongoing exploitation of CVE-2022-41352 (Zimbra 0-day)

Malware Analysis – discovery – 6905e9e6ec69c8f324f51d755f8a85f0

Malware Analysis – evasion – 493d67f1e5dad681c15249f4c8737980

Malware Analysis – djvu – 40afe7409ce7634d460ba5e85c477efc

Malware Analysis – smokeloader – 5a1dc674681bf0652500813bedd52416

Cobalt Strike Beacon Detected – 121[.]43[.]37[.]134:4434

Cobalt Strike Beacon Detected – 119[.]29[.]231[.]118:443

Cobalt Strike Beacon Detected – 39[.]101[.]74[.]162:443

Cobalt Strike Beacon Detected – 8[.]218[.]112[.]112:8880

Cobalt Strike Beacon Detected – 47[.]109[.]48[.]57:443

You may have missed