Security

Malware Analysis – cryptolocker – de400607d06b41a6f8b0935c3607541d

December 11, 2022

Score: 10 MALWARE FAMILY: cryptolockerTAGS:family:cryptolocker, persistence, ransomwareMD5: de400607d06b41a6f8b0935c3607541dSHA1: f9924a0eb4e715f2c5e370235d39f295b6f95aa8ANALYSIS DATE: 2022-12-06T19:57:44ZTTPS: T1060, T1112 ScoreMeaningExample10Known badA malware family was detected.8-9Likely maliciousOne...

Malware Analysis – cryptolocker – e9cd494b249cea7b968fa89f1e7d40de

December 11, 2022

Score: 10 MALWARE FAMILY: cryptolockerTAGS:family:cryptolocker, persistence, ransomwareMD5: e9cd494b249cea7b968fa89f1e7d40deSHA1: fd514fe256f815cfecf67fb57e16d106443d90dcANALYSIS DATE: 2022-12-06T20:09:24ZTTPS: T1060, T1112 ScoreMeaningExample10Known badA malware family was detected.8-9Likely maliciousOne...

Cobalt Stike Beacon Detected – 45[.]15[.]156[.]72:80

December 11, 2022

The Information provided at the time of posting was detected as "Cobalt Strike". Depending on when you are viewing this...

Cobalt Stike Beacon Detected – 47[.]104[.]195[.]224:443

December 11, 2022

The Information provided at the time of posting was detected as "Cobalt Strike". Depending on when you are viewing this...

Cobalt Stike Beacon Detected – 47[.]99[.]188[.]174:8888

December 11, 2022

The Information provided at the time of posting was detected as "Cobalt Strike". Depending on when you are viewing this...

Cobalt Stike Beacon Detected – 47[.]108[.]180[.]121:80

December 11, 2022

The Information provided at the time of posting was detected as "Cobalt Strike". Depending on when you are viewing this...

Malware Analysis – ransomware – e16b5576b95393b3665cd557a11c3ca7

December 11, 2022

Score: 8 MALWARE FAMILY: ransomwareTAGS:ransomwareMD5: e16b5576b95393b3665cd557a11c3ca7SHA1: 3af32b357fcace447b6474f4105f62159eae6d3fANALYSIS DATE: 2022-12-11T08:59:49ZTTPS: ScoreMeaningExample10Known badA malware family was detected.8-9Likely maliciousOne or more known damaging...

Malware Analysis – dcrat – e5760df2c65c11d905780331e136cfc7

December 11, 2022

Score: 10 MALWARE FAMILY: dcratTAGS:family:dcrat, family:djvu, family:redline, family:smokeloader, family:vidar, botnet:517, botnet:mario23_10, backdoor, bootkit, collection, discovery, infostealer, persistence, ransomware, rat, spyware,...

Malware Analysis – djvu – 7011a50374f20222e50adbf8c57d1730

December 11, 2022

Score: 10 MALWARE FAMILY: djvuTAGS:family:djvu, discovery, persistence, ransomwareMD5: 7011a50374f20222e50adbf8c57d1730SHA1: f96e41f353a7b2b79afcf52863d5569297104b2cANALYSIS DATE: 2022-12-11T09:41:48ZTTPS: T1060, T1112, T1222, T1082, T1012 ScoreMeaningExample10Known badA malware...

Malware Analysis – djvu – b85200da07534670c19a452e8cf94d40

December 11, 2022

Score: 10 MALWARE FAMILY: djvuTAGS:family:djvu, family:vidar, botnet:517, discovery, persistence, ransomware, spyware, stealerMD5: b85200da07534670c19a452e8cf94d40SHA1: e9debd6ea4862a077cfa269799c0c70d507f6462ANALYSIS DATE: 2022-12-11T11:45:22ZTTPS: T1222, T1053, T1005, T1081,...

MuddyWater APT group is back with updated TTPs

December 11, 2022

The Iran-linked MuddyWater APT is targeting countries in the Middle East as well as Central and West Asia in a new campaign....

Malware Analysis – upx – 7e3f8869d34b959d0b4381edae96e70a

December 11, 2022

Score: 8 MALWARE FAMILY: upxTAGS:upxMD5: 7e3f8869d34b959d0b4381edae96e70aSHA1: cd3c93170a853fb61324c4a7aba76f9fe61f472cANALYSIS DATE: 2022-12-06T15:12:41ZTTPS: ScoreMeaningExample10Known badA malware family was detected.8-9Likely maliciousOne or more known damaging...

Malware Analysis – evasion – b750a814e27003acd2de430638e637a5

December 11, 2022

Score: 10 MALWARE FAMILY: evasionTAGS:evasion, persistence, ransomwareMD5: b750a814e27003acd2de430638e637a5SHA1: b797699ec9e70a05112ece86f5583881a911b56cANALYSIS DATE: 2022-12-06T15:43:34ZTTPS: T1158, T1012, T1120, T1082, T1112, T1060 ScoreMeaningExample10Known badA malware...

Malware Analysis – djvu – becd0d98fcc5851e2096d2e17a9a1983

December 11, 2022

Score: 10 MALWARE FAMILY: djvuTAGS:family:djvu, family:vidar, botnet:517, discovery, persistence, ransomware, stealerMD5: becd0d98fcc5851e2096d2e17a9a1983SHA1: 5065dd217c08d075a1db7cea02cc159467b8f29fANALYSIS DATE: 2022-12-11T04:48:33ZTTPS: T1060, T1112, T1082, T1012, T1053,...

Malware Analysis – ransomware – 8a3450d84f03d9ea8abb543d2ba41288

December 11, 2022

Score: 6 MALWARE FAMILY: ransomwareTAGS:ransomwareMD5: 8a3450d84f03d9ea8abb543d2ba41288SHA1: 819576e1d411354fb7102a6e64e0aaeaf29af450ANALYSIS DATE: 2022-12-11T04:30:05ZTTPS: T1491, T1112 ScoreMeaningExample10Known badA malware family was detected.8-9Likely maliciousOne or more...

Security

Malware Analysis – cryptolocker – de400607d06b41a6f8b0935c3607541d

Malware Analysis – cryptolocker – e9cd494b249cea7b968fa89f1e7d40de

Cobalt Stike Beacon Detected – 45[.]15[.]156[.]72:80

Cobalt Stike Beacon Detected – 47[.]104[.]195[.]224:443

Cobalt Stike Beacon Detected – 47[.]99[.]188[.]174:8888

Cobalt Stike Beacon Detected – 47[.]108[.]180[.]121:80

Malware Analysis – ransomware – e16b5576b95393b3665cd557a11c3ca7

Malware Analysis – dcrat – e5760df2c65c11d905780331e136cfc7

Malware Analysis – djvu – 7011a50374f20222e50adbf8c57d1730

Malware Analysis – djvu – b85200da07534670c19a452e8cf94d40

MuddyWater APT group is back with updated TTPs

Malware Analysis – upx – 7e3f8869d34b959d0b4381edae96e70a

Malware Analysis – evasion – b750a814e27003acd2de430638e637a5

Malware Analysis – djvu – becd0d98fcc5851e2096d2e17a9a1983

Malware Analysis – ransomware – 8a3450d84f03d9ea8abb543d2ba41288

Malware Analysis – dcrat – 3c10dc9df5b42968e8bbe67387bc30a2

Cobalt Stike Beacon Detected – 91[.]245[.]254[.]116:443

Cobalt Stike Beacon Detected – 91[.]242[.]217[.]59:4433

Cobalt Stike Beacon Detected – 154[.]209[.]82[.]138:80

Cobalt Stike Beacon Detected – 8[.]130[.]38[.]49:80

Cobalt Stike Beacon Detected – 125[.]124[.]127[.]206:8001

Cobalt Stike Beacon Detected – 121[.]41[.]108[.]155:800

Cobalt Stike Beacon Detected – 39[.]98[.]50[.]48:8099

Cobalt Stike Beacon Detected – 154[.]209[.]82[.]138:443

HackerOne Bug Bounty Disclosure: stack-buffer-overflow-in-curl-cookie-parsing-leads-to-rce-batuhanilgarr

BugCrowd Bug Bounty Disclosure: P3 – Publicly Editable Google Docs Linked from NASA SnowEx PPT –

BugCrowd Bug Bounty Disclosure: P3 – Details of the collaboration between NASA and Inmarsat Government and the type of contract –

Apple Products Multiple Vulnerabilities

Miljödata – 870,108 breached accounts

You may have missed