threatintel

Malware Analysis – discovery – b7cdd21a7d0fabcd1ce4168972768842

January 22, 2023

Score: 8 MALWARE FAMILY: discoveryTAGS:discovery, persistence, ransomware, spyware, stealerMD5: b7cdd21a7d0fabcd1ce4168972768842SHA1: 93f6c45b6d57c9ba9938e0466bbbb1c6d6d64620ANALYSIS DATE: 2023-01-22T10:41:49ZTTPS: T1082, T1060, T1112, T1012, T1120, T1005, T1081...

Malware Analysis – discovery – 8a9690b972368f4b037caabc85d2118f

January 22, 2023

Score: 10 MALWARE FAMILY: discoveryTAGS:discovery, persistence, ransomwareMD5: 8a9690b972368f4b037caabc85d2118fSHA1: d209481d5629089db3ba95662110ec3efbfcdf7bANALYSIS DATE: 2023-01-22T10:30:28ZTTPS: T1012, T1082, T1060, T1112, T1130 ScoreMeaningExample10Known badA malware family...

Malware Analysis – djvu – e1e817e5b87307ca93a995eb612892f5

January 22, 2023

Score: 10 MALWARE FAMILY: djvuTAGS:family:djvu, family:vidar, botnet:19, discovery, persistence, ransomware, spyware, stealerMD5: e1e817e5b87307ca93a995eb612892f5SHA1: cddcf161783f0de3b69d41e557c4c1f45cbb01c7ANALYSIS DATE: 2023-01-22T10:43:32ZTTPS: T1082, T1053, T1005, T1081,...

Malware Analysis – djvu – 243940be99aa38e3cc06b7f589064103

January 22, 2023

Score: 10 MALWARE FAMILY: djvuTAGS:family:djvu, family:vidar, botnet:19, discovery, persistence, ransomware, spyware, stealerMD5: 243940be99aa38e3cc06b7f589064103SHA1: f4b9ddd11cf143c1e1b21993172914e89a91418bANALYSIS DATE: 2023-01-22T11:42:54ZTTPS: T1060, T1112, T1005, T1081,...

threatintel

Malware Analysis – discovery – b7cdd21a7d0fabcd1ce4168972768842

Malware Analysis – discovery – 8a9690b972368f4b037caabc85d2118f

Malware Analysis – djvu – e1e817e5b87307ca93a995eb612892f5

Malware Analysis – djvu – 243940be99aa38e3cc06b7f589064103

LockBit 3.0 Ransomware Victim: ibb-business-team[.]de

LockBit 3.0 Ransomware Victim: miguelmechanical[.]com

Tai-e – An Easy-To-Learn/Use Static Analysis Framework For Java

Cobalt Stike Beacon Detected – 43[.]138[.]215[.]2:8001

Cobalt Stike Beacon Detected – 23[.]227[.]202[.]188:443

Cobalt Stike Beacon Detected – 194[.]180[.]49[.]48:80

Cobalt Stike Beacon Detected – 100[.]26[.]163[.]51:443

Cobalt Stike Beacon Detected – 35[.]75[.]239[.]134:443

Cobalt Stike Beacon Detected – 179[.]43[.]187[.]24:80

Cobalt Stike Beacon Detected – 35[.]88[.]90[.]115:80

Cobalt Stike Beacon Detected – 37[.]72[.]168[.]213:80

Posh C2 Detected – 141[.]145[.]213[.]10:443

Royal Ransomware Victim: Pillar Resource Services

LAUSD says Vice Society ransomware gang stole contractors’ SSNs

Critical ManageEngine RCE bug now exploited to open reverse shells

Over 19,000 end-of-life Cisco routers exposed to RCE attacks

New Boldmove Linux malware used to backdoor Fortinet devices

The Week in Ransomware – January 20th 2023 – Targeting Crypto Exchanges

Exploits released for two Samsung Galaxy App Store vulnerabilities

Cobalt Stike Beacon Detected – 182[.]92[.]67[.]97:8443

[KAWA4096] – Ransomware Victim: tokiomarine-nichido[.]co[.]jp

[KAWA4096] – Ransomware Victim: www[.]ogr-jp[.]com

[QILIN] – Ransomware Victim: exhibits-intl[.]com

CVE Alert: CVE-2024-12915

CVE Alert: CVE-2025-2895

You may have missed