Security

Malware Analysis – amadey – a324ed7b304360cc9ed41e619478b953

January 13, 2023

Score: 10 MALWARE FAMILY: amadeyTAGS:family:amadey, family:djvu, family:smokeloader, family:socelars, family:vidar, botnet:19, botnet:494, backdoor, discovery, persistence, ransomware, stealer, trojan, vmprotectMD5: a324ed7b304360cc9ed41e619478b953SHA1: 7e9094fb9c32ad70bc9cb9df3202d5b068e1f415ANALYSIS...

Malware Analysis – djvu – 0b9f0bf3d076c5e133d61c2453261034

January 13, 2023

Score: 10 MALWARE FAMILY: djvuTAGS:family:djvu, family:vidar, botnet:19, discovery, persistence, ransomware, spyware, stealerMD5: 0b9f0bf3d076c5e133d61c2453261034SHA1: fc850da7eaf11a0884eccdd2a354e6da8dca7df4ANALYSIS DATE: 2023-01-12T22:26:14ZTTPS: T1005, T1081, T1060, T1112,...

Malware Analysis – djvu – 3e71c7e166194c5ee25021452f4133ea

January 13, 2023

Score: 10 MALWARE FAMILY: djvuTAGS:family:djvu, family:vidar, botnet:19, discovery, persistence, ransomware, spyware, stealerMD5: 3e71c7e166194c5ee25021452f4133eaSHA1: e89e8e017c5de78c0c468e1d6363c1854ffd4ec9ANALYSIS DATE: 2023-01-12T23:34:43ZTTPS: T1053, T1005, T1081, T1012,...

Malware Analysis – evasion – 23d173a46e32cbafcce943108f6ce5f2

January 13, 2023

Score: 9 MALWARE FAMILY: evasionTAGS:evasion, ransomwareMD5: 23d173a46e32cbafcce943108f6ce5f2SHA1: 0d764bf3eb47f4b3e597b0f6d6e28e504d018c63ANALYSIS DATE: 2023-01-12T22:36:43ZTTPS: T1490, T1107 ScoreMeaningExample10Known badA malware family was detected.8-9Likely maliciousOne or...

Malware Analysis – ransomware – 4031d34c9039c51a0d9e34bab0eafab7

January 13, 2023

Score: 8 MALWARE FAMILY: ransomwareTAGS:ransomware, spyware, stealerMD5: 4031d34c9039c51a0d9e34bab0eafab7SHA1: 58bddccf9dfda1b46361a1503c456cb7e1de0a4eANALYSIS DATE: 2023-01-12T23:37:58ZTTPS: T1005, T1081, T1012, T1082 ScoreMeaningExample10Known badA malware family was...

Malware Analysis – amadey – 57dc07b0383a9d5aafe5ab318acd7eb7

January 13, 2023

Score: 10 MALWARE FAMILY: amadeyTAGS:family:amadey, family:djvu, family:smokeloader, family:socelars, family:vidar, botnet:19, botnet:494, backdoor, discovery, persistence, ransomware, spyware, stealer, trojan, vmprotectMD5: 57dc07b0383a9d5aafe5ab318acd7eb7SHA1:...

Malware Analysis – evasion – 9ee884d1d2f17ef13b510a032114bb6a

January 13, 2023

Score: 7 MALWARE FAMILY: evasionTAGS:evasion, ransomwareMD5: 9ee884d1d2f17ef13b510a032114bb6aSHA1: 26b0bf7ec28ac885326075aa57ef598c16e47dc9ANALYSIS DATE: 2023-01-12T23:40:50ZTTPS: ScoreMeaningExample10Known badA malware family was detected.8-9Likely maliciousOne or more known...

Malware Analysis – globeimposter – c99e32fb49a2671a6136535c6537c4d7

January 13, 2023

Score: 10 MALWARE FAMILY: globeimposterTAGS:family:globeimposter, persistence, ransomware, spyware, stealerMD5: c99e32fb49a2671a6136535c6537c4d7SHA1: ada9bcb3da63e7b989b279fb6c3bc9fe7ff7b41fANALYSIS DATE: 2023-01-12T23:37:11ZTTPS: T1112, T1107, T1490, T1158, T1060, T1082, T1005,...

Posh C2 Detected – 94[.]130[.]106[.]165:443

January 13, 2023

The Information provided at the time of posting was detected as "Posh C2". Depending on when you are viewing this...

CISA: CISA Releases Twelve Industrial Control Systems Advisories

January 12, 2023

CISA Releases Twelve Industrial Control Systems Advisories CISA released twelve Industrial Control Systems (ICS) advisories on January 12, 2023. These...

CISA: Drupal Releases Security Update to Address Vulnerability in Private Taxonomy Terms

January 12, 2023

Drupal Releases Security Update to Address Vulnerability in Private Taxonomy Terms Drupal has released a security update to address a...

Cobalt Stike Beacon Detected – 101[.]43[.]109[.]197:443

January 12, 2023

The Information provided at the time of posting was detected as "Cobalt Strike". Depending on when you are viewing this...

Cobalt Stike Beacon Detected – 3[.]110[.]152[.]25:443

January 12, 2023

The Information provided at the time of posting was detected as "Cobalt Strike". Depending on when you are viewing this...

KRIe – Linux Kernel Runtime Integrity With eBPF

January 12, 2023

KRIe is a research project that aims to detect Linux Kernel exploits with eBPF. KRIe is far from being a...

Cobalt Stike Beacon Detected – 119[.]29[.]1[.]212:9088

January 12, 2023

The Information provided at the time of posting was detected as "Cobalt Strike". Depending on when you are viewing this...

Cobalt Stike Beacon Detected – 43[.]143[.]45[.]237:81

January 12, 2023

The Information provided at the time of posting was detected as "Cobalt Strike". Depending on when you are viewing this...

Cobalt Stike Beacon Detected – 13[.]211[.]122[.]16:80

January 12, 2023

The Information provided at the time of posting was detected as "Cobalt Strike". Depending on when you are viewing this...

Malware Analysis – smokeloader – 7a806996e4de228c9b3e60b9de5c4640

January 12, 2023

Score: 10 MALWARE FAMILY: smokeloaderTAGS:family:smokeloader, backdoor, trojanMD5: 7a806996e4de228c9b3e60b9de5c4640SHA1: 8ba775b47660510c4ba37b45ef7407cec9f9cb46ANALYSIS DATE: 2023-01-12T09:56:03ZTTPS: T1012, T1120, T1082 ScoreMeaningExample10Known badA malware family was detected.8-9Likely...

Malware Analysis – evasion – 1e288142a45ebe7244ab899798cea643

January 12, 2023

Score: 7 MALWARE FAMILY: evasionTAGS:evasion, ransomwareMD5: 1e288142a45ebe7244ab899798cea643SHA1: 078295d1cda8319ed69f64b5443e4d89705d8523ANALYSIS DATE: 2023-01-12T09:04:04ZTTPS: ScoreMeaningExample10Known badA malware family was detected.8-9Likely maliciousOne or more known...

Malware Analysis – evasion – fefd16276a420a89681e28fffefd0b4a

January 12, 2023

Score: 6 MALWARE FAMILY: evasionTAGS:evasion, ransomwareMD5: fefd16276a420a89681e28fffefd0b4aSHA1: 7cb58f1143acd578a4085d36d1462b0465e64f6aANALYSIS DATE: 2023-01-12T09:12:11ZTTPS: ScoreMeaningExample10Known badA malware family was detected.8-9Likely maliciousOne or more known...

Cobalt Stike Beacon Detected – 3[.]85[.]177[.]52:443

January 12, 2023

The Information provided at the time of posting was detected as "Cobalt Strike". Depending on when you are viewing this...

Malware Analysis – djvu – e2f5aa85d03fb41ad591e198090eb8e8

January 12, 2023

Score: 10 MALWARE FAMILY: djvuTAGS:family:djvu, family:vidar, botnet:19, discovery, persistence, ransomware, spyware, stealerMD5: e2f5aa85d03fb41ad591e198090eb8e8SHA1: 58834f285e6e8d58444cb6b766216508757c3e0aANALYSIS DATE: 2023-01-12T09:41:51ZTTPS: T1060, T1112, T1082, T1005,...

Malware Analysis – discovery – f69d9c918a8ad06c71d7f0f26ccfee12

January 12, 2023

Score: 10 MALWARE FAMILY: discoveryTAGS:discovery, persistence, ransomwareMD5: f69d9c918a8ad06c71d7f0f26ccfee12SHA1: b3a7db5d394149862db9ae23682a745b1cdea128ANALYSIS DATE: 2023-01-12T10:19:25ZTTPS: T1012, T1120, T1082, T1060, T1112 ScoreMeaningExample10Known badA malware family...

Malware Analysis – darkcomet – 19c677bb8cda5703f42c143bb4251e6a

January 12, 2023

Score: 10 MALWARE FAMILY: darkcometTAGS:family:darkcomet, family:njrat, family:xmrig, discovery, evasion, miner, persistence, ransomware, rat, spyware, stealer, trojan, upxMD5: 19c677bb8cda5703f42c143bb4251e6aSHA1: ad85336a7304a4e58b2a4f5c40b02f578aa00923ANALYSIS DATE:...

Security

Malware Analysis – amadey – a324ed7b304360cc9ed41e619478b953

Malware Analysis – djvu – 0b9f0bf3d076c5e133d61c2453261034

Malware Analysis – djvu – 3e71c7e166194c5ee25021452f4133ea

Malware Analysis – evasion – 23d173a46e32cbafcce943108f6ce5f2

Malware Analysis – ransomware – 4031d34c9039c51a0d9e34bab0eafab7

Malware Analysis – amadey – 57dc07b0383a9d5aafe5ab318acd7eb7

Malware Analysis – evasion – 9ee884d1d2f17ef13b510a032114bb6a

Malware Analysis – globeimposter – c99e32fb49a2671a6136535c6537c4d7

Posh C2 Detected – 94[.]130[.]106[.]165:443

CISA: CISA Releases Twelve Industrial Control Systems Advisories

CISA: Drupal Releases Security Update to Address Vulnerability in Private Taxonomy Terms

Cobalt Stike Beacon Detected – 101[.]43[.]109[.]197:443

Cobalt Stike Beacon Detected – 3[.]110[.]152[.]25:443

KRIe – Linux Kernel Runtime Integrity With eBPF

Cobalt Stike Beacon Detected – 119[.]29[.]1[.]212:9088

Cobalt Stike Beacon Detected – 43[.]143[.]45[.]237:81

Cobalt Stike Beacon Detected – 13[.]211[.]122[.]16:80

Malware Analysis – smokeloader – 7a806996e4de228c9b3e60b9de5c4640

Malware Analysis – evasion – 1e288142a45ebe7244ab899798cea643

Malware Analysis – evasion – fefd16276a420a89681e28fffefd0b4a

Cobalt Stike Beacon Detected – 3[.]85[.]177[.]52:443

Malware Analysis – djvu – e2f5aa85d03fb41ad591e198090eb8e8

Malware Analysis – discovery – f69d9c918a8ad06c71d7f0f26ccfee12

Malware Analysis – darkcomet – 19c677bb8cda5703f42c143bb4251e6a

Securing Critical Infrastructure in the Digital Age

Cobalt Strike Beacon Detected – 47[.]76[.]30[.]15:80

Cobalt Strike Beacon Detected – 52[.]140[.]245[.]31:80

Cobalt Strike Beacon Detected – 120[.]27[.]235[.]78:80

Cobalt Strike Beacon Detected – 8[.]138[.]47[.]245:80

You may have missed