threatintel

Malware Analysis – surtr – 393e9f112cc999ebd9333877bcc7535e

November 9, 2022

Score: 10 MALWARE FAMILY: surtrTAGS:family:surtr, evasion, persistence, ransomware, spyware, stealer, trojan, upxMD5: 393e9f112cc999ebd9333877bcc7535eSHA1: ed65581b6c3980b3ddf623a4d2f61ce08ce59bdfANALYSIS DATE: 2022-11-09T16:00:21ZTTPS: T1490, T1107, T1088, T1089,...

CISA: Microsoft Releases November 2022 Security Updates

November 9, 2022

Microsoft Releases November 2022 Security Updates Microsoft has released updates to address multiple vulnerabilities in Microsoft software. An attacker can...

Experts observed Amadey malware deploying LockBit 3.0 Ransomware

November 9, 2022

Experts noticed that the Amadey malware is being used to deploy LockBit 3.0 ransomware on compromised systems. Researchers from AhnLab Security Emergency...

Microsoft Patch Tuesday updates fix 6 actively exploited zero-days

November 9, 2022

Microsoft Patch Tuesday updates for November 2022 addressed 64 vulnerabilities, including six actively exploited zero-days. Microsoft Patch Tuesday updates for...

RDPHijack-BOF – Cobalt Strike Beacon Object File (BOF) That Uses WinStationConnect API To Perform Local/Remote RDP Session Hijacking

November 9, 2022

Cobalt Strike Beacon Object File (BOF) that uses WinStationConnect API to perform local/remote RDP session hijacking. With a valid access...

Cobalt Stike Beacon Detected – 124[.]223[.]65[.]106:81

November 9, 2022

The Information provided at the time of posting was detected as "Cobalt Strike". Depending on when you are viewing this...

Cobalt Stike Beacon Detected – 137[.]184[.]177[.]241:8080

November 9, 2022

The Information provided at the time of posting was detected as "Cobalt Strike". Depending on when you are viewing this...

Cobalt Stike Beacon Detected – 20[.]106[.]173[.]114:443

November 9, 2022

The Information provided at the time of posting was detected as "Cobalt Strike". Depending on when you are viewing this...

Malware Analysis – persistence – 08e972ef95b7bc784b5597be7e391d5c

November 9, 2022

Score: 9 MALWARE FAMILY: persistenceTAGS:persistence, ransomwareMD5: 08e972ef95b7bc784b5597be7e391d5cSHA1: 61a6b9edbbe15a73a0b1566c8cd4907a9d89b8bdANALYSIS DATE: 2022-11-08T08:35:50ZTTPS: T1060, T1112, T1107, T1490 ScoreMeaningExample10Known badA malware family was detected.8-9Likely...

Cobalt Stike Beacon Detected – 109[.]206[.]241[.]183:443

November 9, 2022

The Information provided at the time of posting was detected as "Cobalt Strike". Depending on when you are viewing this...

Cobalt Stike Beacon Detected – 185[.]177[.]117[.]215:9999

November 9, 2022

The Information provided at the time of posting was detected as "Cobalt Strike". Depending on when you are viewing this...

Cobalt Stike Beacon Detected – 175[.]178[.]120[.]190:80

November 9, 2022

The Information provided at the time of posting was detected as "Cobalt Strike". Depending on when you are viewing this...

Cobalt Stike Beacon Detected – 72[.]14[.]178[.]145:80

November 9, 2022

The Information provided at the time of posting was detected as "Cobalt Strike". Depending on when you are viewing this...

Malware Analysis – discovery – 0fa9b4b0aba88cff8c3aab79e87dd570

November 9, 2022

Score: 8 MALWARE FAMILY: discoveryTAGS:discovery, exploitMD5: 0fa9b4b0aba88cff8c3aab79e87dd570SHA1: da27d04edd4f1fdf08872f817fbb9a5ca0ae31f6ANALYSIS DATE: 2022-11-08T09:08:03ZTTPS: T1222 ScoreMeaningExample10Known badA malware family was detected.8-9Likely maliciousOne or more...

Malware Analysis – evasion – a9cb0417f7043a209dc488a9a9571d30

November 9, 2022

Score: 10 MALWARE FAMILY: evasionTAGS:evasion, persistence, ransomware, spyware, stealer, trojanMD5: a9cb0417f7043a209dc488a9a9571d30SHA1: d39d3dcf0a50e41ddbab64e9ab0376f3522bdd00ANALYSIS DATE: 2022-11-08T08:51:24ZTTPS: T1060, T1112, T1158, T1082, T1088, T1089,...

Malware Analysis – discovery – 01d2a08c2976f6f7f3a6579d1d64aa26

November 9, 2022

Score: 8 MALWARE FAMILY: discoveryTAGS:discovery, exploitMD5: 01d2a08c2976f6f7f3a6579d1d64aa26SHA1: 0f4fae2be30446e39ce0e14a5763dd7c41ff4b0fANALYSIS DATE: 2022-11-08T08:41:48ZTTPS: T1222 ScoreMeaningExample10Known badA malware family was detected.8-9Likely maliciousOne or more...

Malware Analysis – discovery – 034a5d389fc637d08c53eb0b683f1e81

November 9, 2022

Score: 8 MALWARE FAMILY: discoveryTAGS:discovery, exploitMD5: 034a5d389fc637d08c53eb0b683f1e81SHA1: 86b0b3bd1a6cb3a4d4920206760874db099e4957ANALYSIS DATE: 2022-11-08T08:51:26ZTTPS: T1222 ScoreMeaningExample10Known badA malware family was detected.8-9Likely maliciousOne or more...

Cobalt Stike Beacon Detected – 194[.]26[.]29[.]239:80

November 9, 2022

The Information provided at the time of posting was detected as "Cobalt Strike". Depending on when you are viewing this...

Cobalt Stike Beacon Detected – 84[.]32[.]128[.]34:8080

November 9, 2022

The Information provided at the time of posting was detected as "Cobalt Strike". Depending on when you are viewing this...

Cobalt Stike Beacon Detected – 60[.]247[.]225[.]30:8876

November 9, 2022

The Information provided at the time of posting was detected as "Cobalt Strike". Depending on when you are viewing this...

Cobalt Stike Beacon Detected – 106[.]55[.]27[.]103:8999

November 9, 2022

The Information provided at the time of posting was detected as "Cobalt Strike". Depending on when you are viewing this...

Malware Analysis – discovery – 0ce83cefec533da1b55a19fb5fbc5a91

November 9, 2022

Score: 8 MALWARE FAMILY: discoveryTAGS:discovery, exploitMD5: 0ce83cefec533da1b55a19fb5fbc5a91SHA1: 274d8fadc082bad379f72e459b6be282db079aeeANALYSIS DATE: 2022-11-08T09:27:48ZTTPS: T1222 ScoreMeaningExample10Known badA malware family was detected.8-9Likely maliciousOne or more...

Malware Analysis – persistence – 230b304784833a5e42db0fe22722dcc7

November 9, 2022

Score: 10 MALWARE FAMILY: persistenceTAGS:persistence, ransomware, spyware, stealerMD5: 230b304784833a5e42db0fe22722dcc7SHA1: 4e0b222862e3faa5d32b98658c00e33ddb3fccfeANALYSIS DATE: 2022-11-08T09:28:23ZTTPS: T1112, T1005, T1081, T1060, T1082, T1107, T1490 ScoreMeaningExample10Known...

Malware Analysis – discovery – 0f6c5bd2ff2951c703254e88358f3c86

November 9, 2022

Score: 8 MALWARE FAMILY: discoveryTAGS:discovery, exploitMD5: 0f6c5bd2ff2951c703254e88358f3c86SHA1: c8e62693552848629a5adeca555430bfacffd368ANALYSIS DATE: 2022-11-08T09:25:00ZTTPS: T1222 ScoreMeaningExample10Known badA malware family was detected.8-9Likely maliciousOne or more...

threatintel

Malware Analysis – surtr – 393e9f112cc999ebd9333877bcc7535e

CISA: Microsoft Releases November 2022 Security Updates

Experts observed Amadey malware deploying LockBit 3.0 Ransomware

Microsoft Patch Tuesday updates fix 6 actively exploited zero-days

RDPHijack-BOF – Cobalt Strike Beacon Object File (BOF) That Uses WinStationConnect API To Perform Local/Remote RDP Session Hijacking

Cobalt Stike Beacon Detected – 124[.]223[.]65[.]106:81

Cobalt Stike Beacon Detected – 137[.]184[.]177[.]241:8080

Cobalt Stike Beacon Detected – 20[.]106[.]173[.]114:443

Malware Analysis – persistence – 08e972ef95b7bc784b5597be7e391d5c

Cobalt Stike Beacon Detected – 109[.]206[.]241[.]183:443

Cobalt Stike Beacon Detected – 185[.]177[.]117[.]215:9999

Cobalt Stike Beacon Detected – 175[.]178[.]120[.]190:80

Cobalt Stike Beacon Detected – 72[.]14[.]178[.]145:80

Malware Analysis – discovery – 0fa9b4b0aba88cff8c3aab79e87dd570

Malware Analysis – evasion – a9cb0417f7043a209dc488a9a9571d30

Malware Analysis – discovery – 01d2a08c2976f6f7f3a6579d1d64aa26

Malware Analysis – discovery – 034a5d389fc637d08c53eb0b683f1e81

Cobalt Stike Beacon Detected – 194[.]26[.]29[.]239:80

Cobalt Stike Beacon Detected – 84[.]32[.]128[.]34:8080

Cobalt Stike Beacon Detected – 60[.]247[.]225[.]30:8876

Cobalt Stike Beacon Detected – 106[.]55[.]27[.]103:8999

Malware Analysis – discovery – 0ce83cefec533da1b55a19fb5fbc5a91

Malware Analysis – persistence – 230b304784833a5e42db0fe22722dcc7

Malware Analysis – discovery – 0f6c5bd2ff2951c703254e88358f3c86

CVE Alert: CVE-2024-13845

CVE Alert: CVE-2025-4099

CVE Alert: CVE-2025-4150

CVE Alert: CVE-2025-3952

CVE Alert: CVE-2025-3502

You may have missed