OSINT

Malware Analysis – phobos – 3f37b06e74816784da1e831a340f381b

October 20, 2022

Score: 10 MALWARE FAMILY: phobosTAGS:family:phobos, evasion, persistence, ransomwareMD5: 3f37b06e74816784da1e831a340f381bSHA1: dc0a75381841eb844fe2efbcd9624b66309de690ANALYSIS DATE: 2022-10-20T08:15:35ZTTPS: T1490, T1059, T1107, T1060, T1112, T1031 ScoreMeaningExample10Known badA...

Malware Analysis – djvu – 4ce7edb3a966f0921ad4531008ac38a2

October 20, 2022

Score: 10 MALWARE FAMILY: djvuTAGS:family:djvu, family:vidar, botnet:517, discovery, persistence, ransomware, spyware, stealerMD5: 4ce7edb3a966f0921ad4531008ac38a2SHA1: 34b59085def8dd808add17dbf4639784746079b0ANALYSIS DATE: 2022-10-20T08:17:54ZTTPS: T1053, T1005, T1081, T1012,...

Malware Analysis – ransomware – ce36475e41157b1187801d6b663ab744

October 20, 2022

Score: 9 MALWARE FAMILY: ransomwareTAGS:ransomwareMD5: ce36475e41157b1187801d6b663ab744SHA1: 70a4c1e77ab8c2de2cdf928dabd7fedfbd7a41c4ANALYSIS DATE: 2022-10-20T08:15:26ZTTPS: T1059, T1107, T1490 ScoreMeaningExample10Known badA malware family was detected.8-9Likely maliciousOne or...

Malware Analysis – ransomware – fcf60247b76ebd52d7a265434e57619a

October 20, 2022

Score: 10 MALWARE FAMILY: ransomwareTAGS:ransomwareMD5: fcf60247b76ebd52d7a265434e57619aSHA1: 08f9aafc93253a657890230a15e7ef98ad607c44ANALYSIS DATE: 2022-10-20T08:15:29ZTTPS: ScoreMeaningExample10Known badA malware family was detected.8-9Likely maliciousOne or more known damaging...

Malware Analysis – djvu – b0b76a11cd7740660bf9578d391b3ec2

October 20, 2022

Score: 10 MALWARE FAMILY: djvuTAGS:family:djvu, family:smokeloader, family:vidar, botnet:517, backdoor, collection, discovery, persistence, ransomware, spyware, stealer, trojanMD5: b0b76a11cd7740660bf9578d391b3ec2SHA1: 788a8e188d94f04904abc97ae926f424768f8729ANALYSIS DATE: 2022-10-20T08:42:00ZTTPS:...

Malware Analysis – djvu – b7bc860cee7201e0c810642890a03246

October 20, 2022

Score: 10 MALWARE FAMILY: djvuTAGS:family:djvu, family:vidar, botnet:517, discovery, persistence, ransomware, spyware, stealerMD5: b7bc860cee7201e0c810642890a03246SHA1: d9edc9d61baf9d8cad3f840bba699ffd9219cce0ANALYSIS DATE: 2022-10-20T08:18:24ZTTPS: T1060, T1112, T1005, T1081,...

Malware Analysis – wannacry – 5ba23e04ccf1eef1456abdff691fb2aa

October 20, 2022

Score: 10 MALWARE FAMILY: wannacryTAGS:family:wannacry, discovery, ransomware, wormMD5: 5ba23e04ccf1eef1456abdff691fb2aaSHA1: dcce86681d9e061263584b494ce6bc0f2ddec264ANALYSIS DATE: 2022-10-20T08:20:20ZTTPS: T1046 ScoreMeaningExample10Known badA malware family was detected.8-9Likely maliciousOne...

Malware Analysis – evasion – df19e7599e4f0c5e3f59d0e8a5ac3b23

October 20, 2022

Score: 10 MALWARE FAMILY: evasionTAGS:evasion, ransomware, trojanMD5: df19e7599e4f0c5e3f59d0e8a5ac3b23SHA1: f9c2dcff2e4dc1cf9d7ca098457af1080261df2cANALYSIS DATE: 2022-10-20T08:40:15ZTTPS: T1012, T1120, T1082, T1107, T1490, T1112, T1088, T1089, T1057,...

Malware Analysis – smokeloader – 463484338d38a607293add6cbb3e00a7

October 20, 2022

Score: 10 MALWARE FAMILY: smokeloaderTAGS:family:smokeloader, backdoor, trojanMD5: 463484338d38a607293add6cbb3e00a7SHA1: 2f1886433a8d9ddae76c307804390f3078b2f19eANALYSIS DATE: 2022-10-20T08:42:06ZTTPS: T1012, T1120, T1082 ScoreMeaningExample10Known badA malware family was detected.8-9Likely...

Malware Analysis – smokeloader – e23c95d91c7786c48e5273833610046f

October 20, 2022

Score: 10 MALWARE FAMILY: smokeloaderTAGS:family:smokeloader, backdoor, trojanMD5: e23c95d91c7786c48e5273833610046fSHA1: cafcb78b479773cb1ddd5dfeeb3861e967a3772cANALYSIS DATE: 2022-10-20T09:02:03ZTTPS: T1012, T1120, T1082 ScoreMeaningExample10Known badA malware family was detected.8-9Likely...

Malware Analysis – djvu – 81d8155a7b79464fc7a3d44e96cf9434

October 20, 2022

Score: 10 MALWARE FAMILY: djvuTAGS:family:djvu, family:vidar, botnet:517, discovery, persistence, ransomware, spyware, stealerMD5: 81d8155a7b79464fc7a3d44e96cf9434SHA1: 9646e3aa9fec2f8ff9628901850b30cd06f23d8dANALYSIS DATE: 2022-10-20T09:04:16ZTTPS: T1060, T1112, T1222, T1005,...

Malware Analysis – djvu – 9a6c2e678306a8ce57170cb9a55bbada

October 20, 2022

Score: 10 MALWARE FAMILY: djvuTAGS:family:djvu, family:vidar, botnet:517, discovery, persistence, ransomware, spyware, stealerMD5: 9a6c2e678306a8ce57170cb9a55bbadaSHA1: ea8b4aca2b630252f5751984708285476ba89df2ANALYSIS DATE: 2022-10-20T09:08:13ZTTPS: T1060, T1112, T1082, T1005,...

Cobalt Stike Beacon Detected – 91[.]213[.]50[.]75:80

October 20, 2022

The Information provided at the time of posting was detected as "Cobalt Strike". Depending on when you are viewing this...

Cobalt Stike Beacon Detected – 206[.]81[.]13[.]205:443

October 20, 2022

The Information provided at the time of posting was detected as "Cobalt Strike". Depending on when you are viewing this...

Cobalt Stike Beacon Detected – 23[.]224[.]42[.]16:80

October 20, 2022

The Information provided at the time of posting was detected as "Cobalt Strike". Depending on when you are viewing this...

Cobalt Stike Beacon Detected – 152[.]89[.]196[.]33:4433

October 20, 2022

The Information provided at the time of posting was detected as "Cobalt Strike". Depending on when you are viewing this...

Malware Analysis – djvu – 1c6bb19ae533873990aaa818367bc3c1

October 20, 2022

Score: 10 MALWARE FAMILY: djvuTAGS:family:djvu, family:vidar, botnet:517, discovery, persistence, ransomware, spyware, stealerMD5: 1c6bb19ae533873990aaa818367bc3c1SHA1: 54c8df637d8482c6513063cddc3647e69b6e3591ANALYSIS DATE: 2022-10-20T09:51:01ZTTPS: T1082, T1130, T1112, T1012,...

Malware Analysis – smokeloader – 66d0352427e8fda1e99bff34113199ca

October 20, 2022

Score: 10 MALWARE FAMILY: smokeloaderTAGS:family:smokeloader, backdoor, trojanMD5: 66d0352427e8fda1e99bff34113199caSHA1: 26aacac8b86bcf6d8bab4b8c82e5a7fdaafece3fANALYSIS DATE: 2022-10-20T09:27:24ZTTPS: T1012, T1120, T1082 ScoreMeaningExample10Known badA malware family was detected.8-9Likely...

Malware Analysis – djvu – 851f7b783fe0dfcfb4d9befc8f167e95

October 20, 2022

Score: 10 MALWARE FAMILY: djvuTAGS:family:djvu, family:vidar, botnet:517, discovery, persistence, ransomware, spyware, stealerMD5: 851f7b783fe0dfcfb4d9befc8f167e95SHA1: 1e0683b9e3b8fa7695605c93eecb92ee7b4488bbANALYSIS DATE: 2022-10-20T09:51:01ZTTPS: T1005, T1081, T1222, T1012,...

Malware Analysis – djvu – f4a2cd44617ac4e483d616c0453e8ca5

October 20, 2022

Score: 10 MALWARE FAMILY: djvuTAGS:family:djvu, family:vidar, botnet:517, discovery, persistence, ransomware, spyware, stealerMD5: f4a2cd44617ac4e483d616c0453e8ca5SHA1: a8541588032b692f419032c69cb93577545044d0ANALYSIS DATE: 2022-10-20T09:35:25ZTTPS: T1222, T1005, T1081, T1012,...

OSINT

Malware Analysis – phobos – 3f37b06e74816784da1e831a340f381b

Malware Analysis – djvu – 4ce7edb3a966f0921ad4531008ac38a2

Malware Analysis – ransomware – ce36475e41157b1187801d6b663ab744

Malware Analysis – ransomware – fcf60247b76ebd52d7a265434e57619a

Malware Analysis – djvu – b0b76a11cd7740660bf9578d391b3ec2

Malware Analysis – djvu – b7bc860cee7201e0c810642890a03246

Malware Analysis – wannacry – 5ba23e04ccf1eef1456abdff691fb2aa

Malware Analysis – evasion – df19e7599e4f0c5e3f59d0e8a5ac3b23

Malware Analysis – smokeloader – 463484338d38a607293add6cbb3e00a7

Malware Analysis – smokeloader – e23c95d91c7786c48e5273833610046f

Malware Analysis – djvu – 81d8155a7b79464fc7a3d44e96cf9434

Malware Analysis – djvu – 9a6c2e678306a8ce57170cb9a55bbada

Cobalt Stike Beacon Detected – 91[.]213[.]50[.]75:80

Cobalt Stike Beacon Detected – 206[.]81[.]13[.]205:443

Cobalt Stike Beacon Detected – 23[.]224[.]42[.]16:80

Cobalt Stike Beacon Detected – 152[.]89[.]196[.]33:4433

Malware Analysis – djvu – 1c6bb19ae533873990aaa818367bc3c1

Malware Analysis – smokeloader – 66d0352427e8fda1e99bff34113199ca

Malware Analysis – djvu – 851f7b783fe0dfcfb4d9befc8f167e95

Malware Analysis – djvu – f4a2cd44617ac4e483d616c0453e8ca5

Cobalt Stike Beacon Detected – 206[.]119[.]205[.]200:443

Cobalt Stike Beacon Detected – 206[.]119[.]205[.]66:443

Cobalt Stike Beacon Detected – 206[.]119[.]205[.]213:443

Cobalt Stike Beacon Detected – 188[.]241[.]240[.]137:80

[INCRANSOM] – Ransomware Victim: VZW Avalon

Ai Layoffs To Backfire: Half Quietly Rehired At Lower Pay

[BLACKSHRANTAC] – Ransomware Victim: The Matlusky Firm LLC

[QILIN] – Ransomware Victim: bagnoles[.]nl

[BLACKSHRANTAC] – Ransomware Victim: ApleNet Co[.], Ltd

You may have missed