threatintel

Malware Analysis – evasion – 3e7b527b02f4c9d8e73b2dedffbe6519

February 26, 2023

Score: 10 MALWARE FAMILY: evasionTAGS:evasion, ransomwareMD5: 3e7b527b02f4c9d8e73b2dedffbe6519SHA1: db4d167c06270ed8ca86024efe5646326f4ed049ANALYSIS DATE: 2023-02-26T11:24:46ZTTPS: T1107, T1490, T1031, T1562, T1489, T1012, T1120, T1082, T1112, T1018...

Malware Analysis – discovery – 70a14ae99707c359c24d5e52f30502f3

February 26, 2023

Score: 10 MALWARE FAMILY: discoveryTAGS:discovery, ransomwareMD5: 70a14ae99707c359c24d5e52f30502f3SHA1: 79ad03d9cb065ed82ad2137749d4e85e4f838d42ANALYSIS DATE: 2023-02-26T10:43:38ZTTPS: T1082, T1057, T1012 ScoreMeaningExample10Known badA malware family was detected.8-9Likely maliciousOne...

Malware Analysis – djvu – d9d5aeb697436e9c5796c050ad37a733

February 26, 2023

Score: 10 MALWARE FAMILY: djvuTAGS:family:djvu, family:vidar, discovery, persistence, ransomware, spyware, stealerMD5: d9d5aeb697436e9c5796c050ad37a733SHA1: e53ad8bb6af2dacf9af01863d1350c5f80f3e0bfANALYSIS DATE: 2023-02-26T10:50:03ZTTPS: T1005, T1081, T1012, T1082, T1060,...

Malware Analysis – evasion – 980ea1789565f4a365e180413383e083

February 26, 2023

Score: 10 MALWARE FAMILY: evasionTAGS:evasion, ransomwareMD5: 980ea1789565f4a365e180413383e083SHA1: 980f0eb6db868e2a92fb5973874fc332fa75d7a7ANALYSIS DATE: 2023-02-26T11:56:38ZTTPS: T1107, T1490, T1112, T1031, T1562, T1489, T1012, T1120, T1082 ScoreMeaningExample10Known...

Cobalt Stike Beacon Detected – 124[.]221[.]66[.]75:60001

February 26, 2023

The Information provided at the time of posting was detected as "Cobalt Strike". Depending on when you are viewing this...

Cobalt Stike Beacon Detected – 104[.]243[.]143[.]71:80

February 26, 2023

The Information provided at the time of posting was detected as "Cobalt Strike". Depending on when you are viewing this...

Cobalt Stike Beacon Detected – 116[.]62[.]231[.]188:443

February 26, 2023

The Information provided at the time of posting was detected as "Cobalt Strike". Depending on when you are viewing this...

Cobalt Stike Beacon Detected – 139[.]198[.]187[.]234:80

February 26, 2023

The Information provided at the time of posting was detected as "Cobalt Strike". Depending on when you are viewing this...

Malware Analysis – djvu – eee1b3def7ccf85f54e78ea8908e482b

February 26, 2023

Score: 10 MALWARE FAMILY: djvuTAGS:family:djvu, family:vidar, discovery, persistence, ransomware, spyware, stealerMD5: eee1b3def7ccf85f54e78ea8908e482bSHA1: d8abb83ba1b87bfd76adf59f825e27c8aacf0d7eANALYSIS DATE: 2023-02-26T03:21:57ZTTPS: T1222, T1060, T1112, T1053, T1005,...

Malware Analysis – djvu – ec7a59120aa48d773c8716798409ef6c

February 26, 2023

Score: 10 MALWARE FAMILY: djvuTAGS:family:djvu, family:vidar, discovery, persistence, ransomware, spyware, stealerMD5: ec7a59120aa48d773c8716798409ef6cSHA1: c48161f62e5407188c0fc96b951c16d0e300b20aANALYSIS DATE: 2023-02-26T05:23:02ZTTPS: T1005, T1081, T1082, T1012, T1060,...

Malware Analysis – chaos – aeb08e18c57936e33a56cad7aba7d16e

February 26, 2023

Score: 10 MALWARE FAMILY: chaosTAGS:family:chaos, evasion, ransomware, spyware, stealerMD5: aeb08e18c57936e33a56cad7aba7d16eSHA1: ce7dc6ce99d6a4e3c52e0fb0ac7b167455e5215aANALYSIS DATE: 2023-02-26T04:59:38ZTTPS: T1490, T1059, T1107, T1005, T1081, T1012, T1082,...

Malware Analysis – djvu – 0b9d8d3130f041d552cbc9bd81f2e356

February 26, 2023

Score: 10 MALWARE FAMILY: djvuTAGS:family:djvu, family:vidar, discovery, persistence, ransomware, spyware, stealerMD5: 0b9d8d3130f041d552cbc9bd81f2e356SHA1: 12b926487abe2849e85290a81fb99dab6241b212ANALYSIS DATE: 2023-02-26T04:29:57ZTTPS: T1005, T1081, T1053, T1012, T1082,...

Malware Analysis – djvu – 10c1d309a43c0ae8c867d445f0983a7c

February 26, 2023

Score: 10 MALWARE FAMILY: djvuTAGS:family:djvu, family:smokeloader, family:vidar, backdoor, discovery, evasion, persistence, ransomware, stealer, trojan, vmprotectMD5: 10c1d309a43c0ae8c867d445f0983a7cSHA1: 7e81c65fa44afac85129806815dc422e42e7f421ANALYSIS DATE: 2023-02-26T04:34:56ZTTPS: T1012,...

Posh C2 Detected – 164[.]92[.]110[.]36:443

February 26, 2023

The Information provided at the time of posting was detected as "Posh C2". Depending on when you are viewing this...

Posh C2 Detected – 178[.]20[.]47[.]220:443

February 26, 2023

The Information provided at the time of posting was detected as "Posh C2". Depending on when you are viewing this...

Cobalt Stike Beacon Detected – 194[.]87[.]46[.]87:4433

February 26, 2023

The Information provided at the time of posting was detected as "Cobalt Strike". Depending on when you are viewing this...

Malware Analysis – djvu – 934b82044d9260bb02a2fde1ca2ffaf7

February 26, 2023

Score: 10 MALWARE FAMILY: djvuTAGS:family:djvu, family:vidar, discovery, persistence, ransomware, spyware, stealerMD5: 934b82044d9260bb02a2fde1ca2ffaf7SHA1: 61091945cdd6b85531044aea55c8743e443bc434ANALYSIS DATE: 2023-02-25T21:28:51ZTTPS: T1060, T1112, T1005, T1081, T1012,...

Malware Analysis – djvu – 807fe85241027aa8b78b2679cad1a2df

February 26, 2023

Score: 10 MALWARE FAMILY: djvuTAGS:family:djvu, family:vidar, discovery, persistence, ransomware, spyware, stealerMD5: 807fe85241027aa8b78b2679cad1a2dfSHA1: 18cfca4adf42d019d28fde5fbd5cf7703c95b4ebANALYSIS DATE: 2023-02-25T21:42:59ZTTPS: T1082, T1012, T1060, T1112, T1053,...

Malware Analysis – djvu – 1ecf6c599b5035d4536c883996175b77

February 26, 2023

Score: 10 MALWARE FAMILY: djvuTAGS:family:djvu, family:vidar, discovery, persistence, ransomware, spyware, stealerMD5: 1ecf6c599b5035d4536c883996175b77SHA1: 297eaa1223c33f4769ac12a81bda9f05dd0ea7c4ANALYSIS DATE: 2023-02-25T21:43:05ZTTPS: T1053, T1005, T1081, T1012, T1060,...

Cobalt Stike Beacon Detected – 124[.]221[.]144[.]169:443

February 26, 2023

The Information provided at the time of posting was detected as "Cobalt Strike". Depending on when you are viewing this...

Cobalt Stike Beacon Detected – 77[.]91[.]84[.]1:80

February 26, 2023

The Information provided at the time of posting was detected as "Cobalt Strike". Depending on when you are viewing this...

Cobalt Stike Beacon Detected – 81[.]69[.]221[.]247:8443

February 26, 2023

The Information provided at the time of posting was detected as "Cobalt Strike". Depending on when you are viewing this...

Cobalt Stike Beacon Detected – 138[.]197[.]148[.]29:4433

February 26, 2023

The Information provided at the time of posting was detected as "Cobalt Strike". Depending on when you are viewing this...

Malware Analysis – djvu – b1737ee23f46fd10a95c3233ad44c021

February 26, 2023

Score: 10 MALWARE FAMILY: djvuTAGS:family:djvu, family:smokeloader, family:vidar, backdoor, discovery, persistence, ransomware, stealer, trojan, vmprotectMD5: b1737ee23f46fd10a95c3233ad44c021SHA1: 9e0d0bb417f617b986256d479ede2c9260375accANALYSIS DATE: 2023-02-25T23:55:47ZTTPS: T1012, T1222,...

threatintel

Malware Analysis – evasion – 3e7b527b02f4c9d8e73b2dedffbe6519

Malware Analysis – discovery – 70a14ae99707c359c24d5e52f30502f3

Malware Analysis – djvu – d9d5aeb697436e9c5796c050ad37a733

Malware Analysis – evasion – 980ea1789565f4a365e180413383e083

Cobalt Stike Beacon Detected – 124[.]221[.]66[.]75:60001

Cobalt Stike Beacon Detected – 104[.]243[.]143[.]71:80

Cobalt Stike Beacon Detected – 116[.]62[.]231[.]188:443

Cobalt Stike Beacon Detected – 139[.]198[.]187[.]234:80

Malware Analysis – djvu – eee1b3def7ccf85f54e78ea8908e482b

Malware Analysis – djvu – ec7a59120aa48d773c8716798409ef6c

Malware Analysis – chaos – aeb08e18c57936e33a56cad7aba7d16e

Malware Analysis – djvu – 0b9d8d3130f041d552cbc9bd81f2e356

Malware Analysis – djvu – 10c1d309a43c0ae8c867d445f0983a7c

Posh C2 Detected – 164[.]92[.]110[.]36:443

Posh C2 Detected – 178[.]20[.]47[.]220:443

Cobalt Stike Beacon Detected – 194[.]87[.]46[.]87:4433

Malware Analysis – djvu – 934b82044d9260bb02a2fde1ca2ffaf7

Malware Analysis – djvu – 807fe85241027aa8b78b2679cad1a2df

Malware Analysis – djvu – 1ecf6c599b5035d4536c883996175b77

Cobalt Stike Beacon Detected – 124[.]221[.]144[.]169:443

Cobalt Stike Beacon Detected – 77[.]91[.]84[.]1:80

Cobalt Stike Beacon Detected – 81[.]69[.]221[.]247:8443

Cobalt Stike Beacon Detected – 138[.]197[.]148[.]29:4433

Malware Analysis – djvu – b1737ee23f46fd10a95c3233ad44c021

[QILIN] – Ransomware Victim: Hitzinger

[HANDALA] – Ransomware Victim: Saturday Spotlight

[QILIN] – Ransomware Victim: SHRM New Mexico

25 Years Of Meatbags Permanently In Space On The Iss

[QILIN] – Ransomware Victim: Wasserverband Wulkatal

You may have missed