threatintel

Malware Analysis – dcrat – 337e23be35ce48644c600dfa6e621935

December 10, 2022

Score: 10 MALWARE FAMILY: dcratTAGS:family:dcrat, family:djvu, family:redline, family:smokeloader, family:vidar, botnet:517, botnet:mario23_10, backdoor, bootkit, collection, discovery, infostealer, persistence, ransomware, rat, spyware,...

Malware Analysis – dcrat – 86f5c0ac5d7174289a605ba00ffdb417

December 10, 2022

Score: 10 MALWARE FAMILY: dcratTAGS:family:dcrat, family:djvu, family:redline, family:vidar, botnet:517, botnet:mario23_10, bootkit, collection, discovery, infostealer, persistence, ransomware, rat, spyware, stealerMD5: 86f5c0ac5d7174289a605ba00ffdb417SHA1:...

Malware Analysis – djvu – 82fd30cac3fbe60424f8b68a42dfaf18

December 10, 2022

Score: 10 MALWARE FAMILY: djvuTAGS:family:djvu, discovery, persistence, ransomwareMD5: 82fd30cac3fbe60424f8b68a42dfaf18SHA1: 7f3bef20950b0acc170beb97d94d626fe0627284ANALYSIS DATE: 2022-12-10T17:24:25ZTTPS: T1060, T1112, T1222, T1082, T1012 ScoreMeaningExample10Known badA malware...

Malware Analysis – djvu – 948fa46063f9f65bcfafe46c43771ffe

December 10, 2022

Score: 10 MALWARE FAMILY: djvuTAGS:family:djvu, family:vidar, botnet:517, discovery, persistence, ransomware, spyware, stealerMD5: 948fa46063f9f65bcfafe46c43771ffeSHA1: 5d7bae7461613a3ba11b4acdf4b6207e0e71039aANALYSIS DATE: 2022-12-10T17:11:32ZTTPS: T1060, T1112, T1082, T1005,...

Malware Analysis – dcrat – 60ff077bb695fbf5542a70c57825a5c4

December 10, 2022

Malware Analysis – djvu – c3488db7bcf308cdc6e6b142dfb5393e

December 10, 2022

Score: 10 MALWARE FAMILY: djvuTAGS:family:djvu, family:vidar, botnet:517, discovery, persistence, ransomware, spyware, stealerMD5: c3488db7bcf308cdc6e6b142dfb5393eSHA1: be86e3e28b8c42f2bfa3436bfb19cd4945c832f0ANALYSIS DATE: 2022-12-10T17:03:12ZTTPS: T1053, T1005, T1081, T1012,...

At least 4,460 vulnerable Pulse Connect Secure hosts are exposed to the Internet

December 10, 2022

Censys researchers warn of more than 4,000 vulnerable Pulse Connect Secure hosts exposed to the Internet. Pulse Connect Secure is a...

LockBit 3.0 Ransomware Victim: rhotelja[.]com

December 10, 2022

LockBit 3.0 Ransomware NOTE: No files or stolen information are by RedPacket Security. Any legal issues relating to the content...

LockBit 3.0 Ransomware Victim: koda[.]com[.]tw

December 10, 2022

LockBit 3.0 Ransomware NOTE: No files or stolen information are by RedPacket Security. Any legal issues relating to the content...

LockBit 3.0 Ransomware Victim: biotipo[.]com[.]br

December 10, 2022

LockBit 3.0 Ransomware NOTE: No files or stolen information are by RedPacket Security. Any legal issues relating to the content...

LockBit 3.0 Ransomware Victim: hawanasalalah[.]com

December 10, 2022

LockBit 3.0 Ransomware NOTE: No files or stolen information are by RedPacket Security. Any legal issues relating to the content...

LockBit 3.0 Ransomware Victim: oltax[.]com

December 10, 2022

LockBit 3.0 Ransomware NOTE: No files or stolen information are by RedPacket Security. Any legal issues relating to the content...

US HHS warns healthcare orgs of Royal Ransomware attacks

December 10, 2022

The US Department of Health and Human Services (HHS) warns healthcare organizations of Royal ransomware attacks. The human-operated Royal ransomware...

Malware Analysis – xorist – 60d155a69731675bb493c707ae205c96

December 10, 2022

Score: 10 MALWARE FAMILY: xoristTAGS:family:xorist, persistence, ransomware, upxMD5: 60d155a69731675bb493c707ae205c96SHA1: 22d7741ea994b80188a8d43955083c760553cb99ANALYSIS DATE: 2022-12-06T00:47:17ZTTPS: T1060, T1112 ScoreMeaningExample10Known badA malware family was detected.8-9Likely...

Cobalt Stike Beacon Detected – 23[.]95[.]44[.]36:443

December 10, 2022

The Information provided at the time of posting was detected as "Cobalt Strike". Depending on when you are viewing this...

Cobalt Stike Beacon Detected – 183[.]57[.]37[.]247:6666

December 10, 2022

The Information provided at the time of posting was detected as "Cobalt Strike". Depending on when you are viewing this...

Malware Analysis – ransomware – c86a231363e8d7aa4d0acf13442ed998

December 10, 2022

Score: 7 MALWARE FAMILY: ransomwareTAGS:ransomwareMD5: c86a231363e8d7aa4d0acf13442ed998SHA1: e7ceb5a16b0563c220a796af88b1e2e02525763aANALYSIS DATE: 2022-12-10T09:46:36ZTTPS: ScoreMeaningExample10Known badA malware family was detected.8-9Likely maliciousOne or more known damaging...

Cobalt Stike Beacon Detected – 114[.]132[.]155[.]224:1433

December 10, 2022

The Information provided at the time of posting was detected as "Cobalt Strike". Depending on when you are viewing this...

Cobalt Stike Beacon Detected – 43[.]143[.]81[.]59:80

December 10, 2022

The Information provided at the time of posting was detected as "Cobalt Strike". Depending on when you are viewing this...

Cobalt Stike Beacon Detected – 39[.]107[.]105[.]128:2087

December 10, 2022

The Information provided at the time of posting was detected as "Cobalt Strike". Depending on when you are viewing this...

Malware Analysis – xorist – 5e9b5b1d952c74996c7f12dba611f205

December 10, 2022

Score: 10 MALWARE FAMILY: xoristTAGS:family:xorist, persistence, ransomware, spyware, stealer, upxMD5: 5e9b5b1d952c74996c7f12dba611f205SHA1: 10458ae6b4a18d93301099f66c7560d2e2fb2d4bANALYSIS DATE: 2022-12-06T00:47:19ZTTPS: T1060, T1112, T1005, T1081 ScoreMeaningExample10Known badA...

Malware Analysis – cerber – a57745a30d63f511d28aa43e4b710e1c

December 10, 2022

Score: 10 MALWARE FAMILY: cerberTAGS:family:cerber, evasion, persistence, ransomware, spyware, stealerMD5: a57745a30d63f511d28aa43e4b710e1cSHA1: 5985e7d1831784fd15de2cc62451deb16b65b046ANALYSIS DATE: 2022-12-10T09:32:04ZTTPS: T1490, T1107, T1158, T1112, T1082, T1005,...

Malware Analysis – dcrat – f42012648010b8dddc5d023e46e64144

December 10, 2022

Cobalt Stike Beacon Detected – 43[.]130[.]228[.]116:80

December 10, 2022

The Information provided at the time of posting was detected as "Cobalt Strike". Depending on when you are viewing this...

threatintel

Malware Analysis – dcrat – 337e23be35ce48644c600dfa6e621935

Malware Analysis – dcrat – 86f5c0ac5d7174289a605ba00ffdb417

Malware Analysis – djvu – 82fd30cac3fbe60424f8b68a42dfaf18

Malware Analysis – djvu – 948fa46063f9f65bcfafe46c43771ffe

Malware Analysis – dcrat – 60ff077bb695fbf5542a70c57825a5c4

Malware Analysis – djvu – c3488db7bcf308cdc6e6b142dfb5393e

At least 4,460 vulnerable Pulse Connect Secure hosts are exposed to the Internet

LockBit 3.0 Ransomware Victim: rhotelja[.]com

LockBit 3.0 Ransomware Victim: koda[.]com[.]tw

LockBit 3.0 Ransomware Victim: biotipo[.]com[.]br

LockBit 3.0 Ransomware Victim: hawanasalalah[.]com

LockBit 3.0 Ransomware Victim: oltax[.]com

US HHS warns healthcare orgs of Royal Ransomware attacks

Malware Analysis – xorist – 60d155a69731675bb493c707ae205c96

Cobalt Stike Beacon Detected – 23[.]95[.]44[.]36:443

Cobalt Stike Beacon Detected – 183[.]57[.]37[.]247:6666

Malware Analysis – ransomware – c86a231363e8d7aa4d0acf13442ed998

Cobalt Stike Beacon Detected – 114[.]132[.]155[.]224:1433

Cobalt Stike Beacon Detected – 43[.]143[.]81[.]59:80

Cobalt Stike Beacon Detected – 39[.]107[.]105[.]128:2087

Malware Analysis – xorist – 5e9b5b1d952c74996c7f12dba611f205

Malware Analysis – cerber – a57745a30d63f511d28aa43e4b710e1c

Malware Analysis – dcrat – f42012648010b8dddc5d023e46e64144

Cobalt Stike Beacon Detected – 43[.]130[.]228[.]116:80

Security Awareness Training that Works for Changing Employee Behavior

Security Awareness Training that Works for Changing Employee Behavior

FreeOnes – 960,213 breached accounts

Cobalt Strike Beacon Detected – 47[.]120[.]32[.]72:8081

Cobalt Strike Beacon Detected – 8[.]147[.]128[.]54:443

Cobalt Strike Beacon Detected – 43[.]100[.]27[.]141:8443

You may have missed

Security Awareness Training that Works for Changing Employee Behavior