threatintel

Malware Analysis – ransomware – ab143512b0edba5e6a9435c6951de6db

March 22, 2023

Score: 6 MALWARE FAMILY: ransomwareTAGS:ransomwareMD5: ab143512b0edba5e6a9435c6951de6dbSHA1: 7ff91fefeebcfb4d3ca536582e23c0433b56ded2ANALYSIS DATE: 2023-03-22T16:37:59ZTTPS: ScoreMeaningExample10Known badA malware family was detected.8-9Likely maliciousOne or more known damaging...

Malware Analysis – amadey – 301c0b6c9341de9df8fd19d5060690f6

March 22, 2023

Score: 10 MALWARE FAMILY: amadeyTAGS:family:amadey, family:djvu, family:pseudomanuscrypt, family:smokeloader, family:vidar, botnet:pub1, botnet:sprg, backdoor, discovery, loader, persistence, ransomware, spyware, stealer, trojanMD5: 301c0b6c9341de9df8fd19d5060690f6SHA1:...

Malware Analysis – djvu – eb7cde7a579009ffad981b0913e5eb80

March 22, 2023

Score: 10 MALWARE FAMILY: djvuTAGS:family:djvu, family:vidar, discovery, persistence, ransomware, spyware, stealerMD5: eb7cde7a579009ffad981b0913e5eb80SHA1: 5a218c588fefa80e5caae1dce70b53e3a81a997eANALYSIS DATE: 2023-03-22T17:49:28ZTTPS: T1012, T1082, T1053, T1005, T1081,...

Malware Analysis – djvu – a6fadaa1eb6aa09bdf59fbe7bf7a412d

March 22, 2023

Score: 10 MALWARE FAMILY: djvuTAGS:family:djvu, family:vidar, discovery, persistence, ransomware, spyware, stealerMD5: a6fadaa1eb6aa09bdf59fbe7bf7a412dSHA1: aac28bcfa92e4858d74986ad6b66adfd9d7d53bfANALYSIS DATE: 2023-03-22T17:31:56ZTTPS: T1005, T1081, T1012, T1082, T1060,...

Malware Analysis – djvu – e1eb13ebba30f934ea877664941086c7

March 22, 2023

Score: 10 MALWARE FAMILY: djvuTAGS:family:djvu, family:vidar, discovery, persistence, ransomware, spyware, stealerMD5: e1eb13ebba30f934ea877664941086c7SHA1: 6c7501843bb39591b25b920c477ef73a797a2b3dANALYSIS DATE: 2023-03-22T18:57:18ZTTPS: T1005, T1081, T1012, T1060, T1112,...

Malware Analysis – smokeloader – 97db31adf01533c265b499816678c8b0

March 22, 2023

Score: 10 MALWARE FAMILY: smokeloaderTAGS:family:smokeloader, backdoor, trojanMD5: 97db31adf01533c265b499816678c8b0SHA1: d3ece081db72c74da1e263a92e86936d5cb809d5ANALYSIS DATE: 2023-03-22T18:14:04ZTTPS: T1012, T1120, T1082 ScoreMeaningExample10Known badA malware family was detected.8-9Likely...

Invoke-PSObfuscation – An In-Depth Approach To Obfuscating The Individual Components Of A PowerShell Payload Whether You’Re On Windows Or Kali Linux

March 21, 2023

Traditional obfuscation techniques tend to add layers to encapsulate standing code, such as base64 or compression. These payloads do continue...

threatintel

Malware Analysis – ransomware – ab143512b0edba5e6a9435c6951de6db

Malware Analysis – amadey – 301c0b6c9341de9df8fd19d5060690f6

Malware Analysis – djvu – eb7cde7a579009ffad981b0913e5eb80

Malware Analysis – djvu – a6fadaa1eb6aa09bdf59fbe7bf7a412d

Malware Analysis – djvu – e1eb13ebba30f934ea877664941086c7

Malware Analysis – smokeloader – 97db31adf01533c265b499816678c8b0

CISA Alerts on Critical Security Vulnerabilities in Industrial Control Systems

New ‘Bad Magic’ Cyber Threat Disrupts Ukraine’s Key Sectors Amid War

Preventing Insider Threats in Your Active Directory

NAPLISTENER: New Malware in REF2924 Group’s Arsenal for Bypassing Detection

ScarCruft’s Evolving Arsenal: Researchers Reveal New Malware Distribution Techniques

LockBit 3.0 Ransomware Victim: kaycan[.]com

LockBit 3.0 Ransomware Victim: cabinet-paillet[.]fr

LockBit 3.0 Ransomware Victim: mangiainc[.]com

New NAPLISTENER Malware Used by REF2924 Group to Evade Network Detection

Rogue NuGet Packages Infect .NET Developers with Crypto-Stealing Malware

Coinbase Wallet ‘Red Pill’ flaw allowed attacks to evade detection

Hackers use new PowerMagic and CommonMagic malware to steal data

LockBit ransomware gang now also claims City of Oakland breach

Clop ransomware claims Saks Fifth Avenue, retailer says mock data stolen

Breached hacking forum shuts down, fears it’s not ‘safe’ from FBI

BreachForums Administrator Baphomet Shuts Down Infamous Hacking Forum

RansomHouse Ransomware Victim: Design CATAPULT

Invoke-PSObfuscation – An In-Depth Approach To Obfuscating The Individual Components Of A PowerShell Payload Whether You’Re On Windows Or Kali Linux

HackerOne Bug Bounty Disclosure: low-privileged-user-can-enable-or-disable-lovable-ai-for-new-projects-in-workspace-anxioussick

HackerOne Bug Bounty Disclosure: unauthorized-password-reset-allows-account-takeover-across-tenant-boundaries-mcdave

[AKIRA] – Ransomware Victim: PLP SoCal

[CLOP] – Ransomware Victim: RHEEM[.]COM

[AKIRA] – Ransomware Victim: Soapy Joe’s Car Wash

You may have missed