CVE-2019-8561: A Hard-to-Banish PackageKit Framework Vulnerability in macOS
This blog entry details our investigation of CVE-2019-8561, a vulnerability that exists in the macOS PackageKit framework, a component used...
Security
Long-running surveillance campaigns target Uyghurs with BadBazaar and MOONSHINE spyware
Lookout researchers discovered two long-running surveillance campaigns targeting the ethnic minority Uyghurs. Researchers from mobile security firm Lookout uncovered two...
Man charged for role in LockBit ransomware operation
The U.S. DoJ charged a Russian-Canadian national for his alleged role in LockBit ransomware attacks against organizations worldwide. The U.S. Department of...
TeamFiltration – Cross-Platform Framework For Enumerating, Spraying, Exfiltrating, And Backdooring O365 AAD Accounts
TeamFiltration is a cross-platform framework for enumerating, spraying, exfiltrating, and backdooring O365 AAD accounts. See the TeamFiltration wiki page for...
Cobalt Stike Beacon Detected – 5[.]230[.]74[.]105:81
The Information provided at the time of posting was detected as "Cobalt Strike". Depending on when you are viewing this...
Cobalt Stike Beacon Detected – 5[.]230[.]74[.]105:82
The Information provided at the time of posting was detected as "Cobalt Strike". Depending on when you are viewing this...
Cobalt Stike Beacon Detected – 107[.]173[.]214[.]112:443
The Information provided at the time of posting was detected as "Cobalt Strike". Depending on when you are viewing this...
Cobalt Stike Beacon Detected – 5[.]230[.]74[.]105:443
The Information provided at the time of posting was detected as "Cobalt Strike". Depending on when you are viewing this...
Cobalt Stike Beacon Detected – 104[.]156[.]225[.]85:8443
The Information provided at the time of posting was detected as "Cobalt Strike". Depending on when you are viewing this...
Cobalt Stike Beacon Detected – 5[.]230[.]74[.]105:80
The Information provided at the time of posting was detected as "Cobalt Strike". Depending on when you are viewing this...
Cobalt Stike Beacon Detected – 8[.]218[.]126[.]118:443
The Information provided at the time of posting was detected as "Cobalt Strike". Depending on when you are viewing this...
Cobalt Stike Beacon Detected – 43[.]154[.]52[.]127:8080
The Information provided at the time of posting was detected as "Cobalt Strike". Depending on when you are viewing this...
Cobalt Stike Beacon Detected – 107[.]189[.]14[.]155:443
The Information provided at the time of posting was detected as "Cobalt Strike". Depending on when you are viewing this...
Cobalt Stike Beacon Detected – 1[.]13[.]192[.]171:8443
The Information provided at the time of posting was detected as "Cobalt Strike". Depending on when you are viewing this...
Malware Analysis – ransomware – b95c6f70b133038529bbd6e2104f7c09
Score: 7 MALWARE FAMILY: ransomwareTAGS:ransomwareMD5: b95c6f70b133038529bbd6e2104f7c09SHA1: 243655716e183ecc8c42be7159e1751037a17f52ANALYSIS DATE: 2022-11-11T08:50:13ZTTPS: ScoreMeaningExample10Known badA malware family was detected.8-9Likely maliciousOne or more known damaging...
Cobalt Stike Beacon Detected – 172[.]247[.]32[.]61:443
The Information provided at the time of posting was detected as "Cobalt Strike". Depending on when you are viewing this...
Cobalt Stike Beacon Detected – 124[.]220[.]186[.]174:80
The Information provided at the time of posting was detected as "Cobalt Strike". Depending on when you are viewing this...
Cobalt Stike Beacon Detected – 77[.]73[.]133[.]120:443
The Information provided at the time of posting was detected as "Cobalt Strike". Depending on when you are viewing this...
Cobalt Stike Beacon Detected – 185[.]150[.]24[.]122:80
The Information provided at the time of posting was detected as "Cobalt Strike". Depending on when you are viewing this...
Malware Analysis – – 989ae3d195203b323aa2b3adf04e9833
Score: 1 MALWARE FAMILY: TAGS:MD5: 989ae3d195203b323aa2b3adf04e9833SHA1: 31a45521bc672abcf64e50284ca5d4e6b3687dc8ANALYSIS DATE: 2022-11-11T09:58:45ZTTPS: ScoreMeaningExample10Known badA malware family was detected.8-9Likely maliciousOne or more known damaging...
Malware Analysis – amadey – c76febd9daaa3e0947a5ea9605f25666
Score: 10 MALWARE FAMILY: amadeyTAGS:family:amadey, family:dcrat, family:djvu, family:redline, family:smokeloader, family:vidar, botnet:517, botnet:google2, botnet:mario23_10, backdoor, collection, discovery, infostealer, persistence, ransomware, rat,...
Malware Analysis – djvu – 6217143e74d63023a7ffc734769cee70
Score: 10 MALWARE FAMILY: djvuTAGS:family:djvu, family:vidar, botnet:517, discovery, persistence, ransomware, spyware, stealerMD5: 6217143e74d63023a7ffc734769cee70SHA1: b83a507b8edada916cfd00fac554d3c92919697aANALYSIS DATE: 2022-11-11T10:01:49ZTTPS: T1060, T1112, T1222, T1005,...
Malware Analysis – djvu – 3fa9b77952faa7ca394215a860d03001
Score: 10 MALWARE FAMILY: djvuTAGS:family:djvu, family:redline, family:smokeloader, family:vidar, botnet:517, botnet:google2, botnet:mario23_10, backdoor, collection, discovery, infostealer, persistence, ransomware, spyware, stealer, trojan,...
Malware Analysis – – 920769685bd617b61b989ab41011af4a
Score: 1 MALWARE FAMILY: TAGS:MD5: 920769685bd617b61b989ab41011af4aSHA1: beff31e1163a142adfda7d14bb87a32a9c918e7eANALYSIS DATE: 2022-11-11T11:11:59ZTTPS: ScoreMeaningExample10Known badA malware family was detected.8-9Likely maliciousOne or more known damaging...
