threatintel

Malware Analysis – amadey – 24450d22a44831b8d4e20e3eb99d9fb9

January 12, 2023

Score: 10 MALWARE FAMILY: amadeyTAGS:family:amadey, family:aurora, family:dcrat, family:djvu, family:smokeloader, family:vidar, botnet:19, backdoor, discovery, infostealer, persistence, ransomware, rat, spyware, stealer, trojanMD5:...

Malware Analysis – djvu – 7f89e30634f529406e25c94728138ac2

January 12, 2023

Score: 10 MALWARE FAMILY: djvuTAGS:family:djvu, family:vidar, botnet:19, discovery, persistence, ransomware, spyware, stealerMD5: 7f89e30634f529406e25c94728138ac2SHA1: 107e604b48c37e9c01768ed0a79b6204a12d496fANALYSIS DATE: 2023-01-12T04:00:36ZTTPS: T1012, T1082, T1005, T1081,...

Malware Analysis – djvu – 947fe80a2c26a998c18cafe4ac2c6fa9

January 12, 2023

Score: 10 MALWARE FAMILY: djvuTAGS:family:djvu, family:vidar, botnet:19, discovery, persistence, ransomware, spyware, stealerMD5: 947fe80a2c26a998c18cafe4ac2c6fa9SHA1: 7337ef39800091ea808fa9c1c074e37feb4b95ccANALYSIS DATE: 2023-01-12T05:54:51ZTTPS: T1060, T1112, T1053, T1005,...

Malware Analysis – aurora – dfc9518f5e0b145f1fa786628670863d

January 12, 2023

Score: 10 MALWARE FAMILY: auroraTAGS:family:aurora, family:blacknet, family:darkcomet, family:dcrat, family:djvu, family:redline, family:smokeloader, family:vidar, family:wannacry, botnet:19, backdoor, collection, discovery, infostealer, persistence, ransomware,...

Cobalt Stike Beacon Detected – 43[.]139[.]146[.]60:2222

January 12, 2023

The Information provided at the time of posting was detected as "Cobalt Strike". Depending on when you are viewing this...

Cobalt Stike Beacon Detected – 103[.]149[.]90[.]238:2000

January 12, 2023

The Information provided at the time of posting was detected as "Cobalt Strike". Depending on when you are viewing this...

Malware Analysis – discovery – a7798f8706cb8c4c347da090eb320de9

January 12, 2023

Score: 10 MALWARE FAMILY: discoveryTAGS:discovery, persistence, ransomwareMD5: a7798f8706cb8c4c347da090eb320de9SHA1: 66a8b77a2ab4a5b4598f84895559edb0e44873daANALYSIS DATE: 2023-01-11T20:49:11ZTTPS: T1112, T1042, T1012, T1082, T1060 ScoreMeaningExample10Known badA malware family...

Malware Analysis – discovery – 1e262e85af7822f199da3f27c7f5d406

January 12, 2023

Score: 10 MALWARE FAMILY: discoveryTAGS:discovery, persistence, ransomwareMD5: 1e262e85af7822f199da3f27c7f5d406SHA1: 3b934e6d859308cc9af07a1b184ea90021ff7a36ANALYSIS DATE: 2023-01-11T23:05:24ZTTPS: T1112, T1012, T1082, T1060, T1042 ScoreMeaningExample10Known badA malware family...

Malware Analysis – amadey – b4be08f67e4b5fed600bf5558b119168

January 12, 2023

Score: 10 MALWARE FAMILY: amadeyTAGS:family:amadey, family:aurora, family:dcrat, family:djvu, family:icedid, family:smokeloader, family:vidar, botnet:19, campaign:3131022508, backdoor, banker, discovery, infostealer, loader, persistence, ransomware,...

Malware Analysis – evasion – 26b5b59d0c9ff7a575eced46612d8e25

January 12, 2023

Score: 5 MALWARE FAMILY: evasionTAGS:evasion, ransomwareMD5: 26b5b59d0c9ff7a575eced46612d8e25SHA1: f28ecc9dda6c7c3848c2e20913b3bd39155004bdANALYSIS DATE: 2023-01-11T22:43:03ZTTPS: ScoreMeaningExample10Known badA malware family was detected.8-9Likely maliciousOne or more known...

Malware Analysis – djvu – 793032b03418e42783b294836132e84e

January 12, 2023

Score: 10 MALWARE FAMILY: djvuTAGS:family:djvu, family:vidar, botnet:19, discovery, persistence, ransomware, spyware, stealerMD5: 793032b03418e42783b294836132e84eSHA1: a395aca39b0a1ce4b5af893f4014f1a96687f2bcANALYSIS DATE: 2023-01-11T22:44:58ZTTPS: T1053, T1005, T1081, T1060,...

US-CERT Bulletin (SB23-009):Vulnerability Summary for the Week of January 2, 2023

January 11, 2023

The CISA Vulnerability Bulletin provides a summary of new vulnerabilities that have been recorded by the National Institute of Standards...

CISA: NCSC-UK Releases Guidance on Using MSP for Administering Cloud Services

January 11, 2023

NCSC-UK Releases Guidance on Using MSP for Administering Cloud Services The United Kingdom’s National Cyber Security Centre (NCSC-UK) has released...

BlackCat/ALPHV Ransomware Victim: TIME TECHNOPLAST LIMITED

January 11, 2023

BlackCat / ALPHV Ransomware NOTE: No files or stolen information are by RedPacket Security. Any legal issues relating to the...

BlackCat/ALPHV Ransomware Victim: Liebra Permana

January 11, 2023

BlackCat / ALPHV Ransomware NOTE: No files or stolen information are by RedPacket Security. Any legal issues relating to the...

c2f941e109d3f913b12d82efdcf116fea5d147fff783caba368c7d51f68e8e56

PowerHuntShares – Audit Script Designed In Inventory, Analyze, And Report Excessive Privileges Configured On Active Directory Domains

January 11, 2023

PowerHuntShares is design to automatically inventory, analyze, and report excessive privilege assigned to SMB shares on Active Directory domain joined...

LockBit 3.0 Ransomware Victim: circlevillecourt[.]com

January 11, 2023

LockBit 3.0 Ransomware NOTE: No files or stolen information are by RedPacket Security. Any legal issues relating to the content...

LockBit 3.0 Ransomware Victim: datair[.]com

January 11, 2023

LockBit 3.0 Ransomware NOTE: No files or stolen information are by RedPacket Security. Any legal issues relating to the content...

Cobalt Stike Beacon Detected – 43[.]132[.]122[.]84:80

January 11, 2023

The Information provided at the time of posting was detected as "Cobalt Strike". Depending on when you are viewing this...

Cobalt Stike Beacon Detected – 116[.]204[.]211[.]163:443

January 11, 2023

The Information provided at the time of posting was detected as "Cobalt Strike". Depending on when you are viewing this...

Cobalt Stike Beacon Detected – 87[.]251[.]67[.]166:80

January 11, 2023

The Information provided at the time of posting was detected as "Cobalt Strike". Depending on when you are viewing this...

Malware Analysis – lockbit – a8e0d56f8c67f1f7b6e592c12d87acab

January 11, 2023

Score: 10 MALWARE FAMILY: lockbitTAGS:family:lockbit, ransomwareMD5: a8e0d56f8c67f1f7b6e592c12d87acabSHA1: ed555f0162ea6ec5b8b8bada743cfc628d376274ANALYSIS DATE: 2023-01-11T09:07:12ZTTPS: T1491, T1112 ScoreMeaningExample10Known badA malware family was detected.8-9Likely maliciousOne or...

Cobalt Stike Beacon Detected – 101[.]42[.]46[.]117:80

January 11, 2023

The Information provided at the time of posting was detected as "Cobalt Strike". Depending on when you are viewing this...

Cobalt Stike Beacon Detected – 157[.]245[.]102[.]164:443

January 11, 2023

The Information provided at the time of posting was detected as "Cobalt Strike". Depending on when you are viewing this...

threatintel

Malware Analysis – amadey – 24450d22a44831b8d4e20e3eb99d9fb9

Malware Analysis – djvu – 7f89e30634f529406e25c94728138ac2

Malware Analysis – djvu – 947fe80a2c26a998c18cafe4ac2c6fa9

Malware Analysis – aurora – dfc9518f5e0b145f1fa786628670863d

Cobalt Stike Beacon Detected – 43[.]139[.]146[.]60:2222

Cobalt Stike Beacon Detected – 103[.]149[.]90[.]238:2000

Malware Analysis – discovery – a7798f8706cb8c4c347da090eb320de9

Malware Analysis – discovery – 1e262e85af7822f199da3f27c7f5d406

Malware Analysis – amadey – b4be08f67e4b5fed600bf5558b119168

Malware Analysis – evasion – 26b5b59d0c9ff7a575eced46612d8e25

Malware Analysis – djvu – 793032b03418e42783b294836132e84e

US-CERT Bulletin (SB23-009):Vulnerability Summary for the Week of January 2, 2023

CISA: NCSC-UK Releases Guidance on Using MSP for Administering Cloud Services

BlackCat/ALPHV Ransomware Victim: TIME TECHNOPLAST LIMITED

BlackCat/ALPHV Ransomware Victim: Liebra Permana

PowerHuntShares – Audit Script Designed In Inventory, Analyze, And Report Excessive Privileges Configured On Active Directory Domains

LockBit 3.0 Ransomware Victim: circlevillecourt[.]com

LockBit 3.0 Ransomware Victim: datair[.]com

Cobalt Stike Beacon Detected – 43[.]132[.]122[.]84:80

Cobalt Stike Beacon Detected – 116[.]204[.]211[.]163:443

Cobalt Stike Beacon Detected – 87[.]251[.]67[.]166:80

Malware Analysis – lockbit – a8e0d56f8c67f1f7b6e592c12d87acab

Cobalt Stike Beacon Detected – 101[.]42[.]46[.]117:80

Cobalt Stike Beacon Detected – 157[.]245[.]102[.]164:443

[QILIN] – Ransomware Victim: Mainetti

[QILIN] – Ransomware Victim: fcsserves[.]org

CVE Alert: CVE-2025-6959

CVE Alert: CVE-2025-50405

CVE Alert: CVE-2025-6961

You may have missed