threatintel

Malware Analysis – eternity – dafc8e7ccd381af36f19267a2a9b3f9b

January 20, 2023

Score: 10 MALWARE FAMILY: eternityTAGS:family:eternity, evasion, ransomwareMD5: dafc8e7ccd381af36f19267a2a9b3f9bSHA1: 742c9021f4f0fb264c32a59a66e3ac514b8e166bANALYSIS DATE: 2023-01-20T04:15:13ZTTPS: T1053, T1018, T1107, T1490, T1082 ScoreMeaningExample10Known badA malware family...

Malware Analysis – wannacry – 7339a0efc768310a86b6d4f61d88b910

January 20, 2023

Score: 10 MALWARE FAMILY: wannacryTAGS:family:wannacry, ransomware, wormMD5: 7339a0efc768310a86b6d4f61d88b910SHA1: 05cebfdb6729ed57ca111ae18b645335af7cf006ANALYSIS DATE: 2023-01-20T03:37:13ZTTPS: ScoreMeaningExample10Known badA malware family was detected.8-9Likely maliciousOne or more...

PayPal accounts breached in large-scale credential stuffing attack

January 20, 2023

PayPal is sending out data breach notifications to thousands of users who had their accounts accessed through credential stuffing attacks...

Ransomware profits drop 40% in 2022 as victims refuse to pay

January 20, 2023

Ransomware gangs extorted from victims about $456.8 million throughout 2022, a drop of roughly 40% from the record-breaking $765 million...

New ‘Blank Image’ attack hides phishing scripts in SVG files

January 20, 2023

An unusual phishing technique has been observed in the wild, hiding empty SVG files inside HTML attachments pretending to be...

Ransomware gang steals data from KFC, Taco Bell, and Pizza Hut brand owner

January 20, 2023

Yum! Brands, the fast food brand operator of KFC, Pizza Hut, Taco Bell, and The Habit Burger Grill fast-food restaurant...

T-Mobile hacked to steal data of 37 million accounts in API data breach

January 20, 2023

T-Mobile disclosed a new data breach after a threat actor stole the personal information of 37 million current postpaid and prepaid customer...

Exploit released for critical ManageEngine RCE bug, patch now

January 20, 2023

Proof-of-concept exploit code is now available for a remote code execution (RCE) vulnerability in multiple Zoho ManageEngine products. This pre-authentication...

New ‘Hook’ Android malware lets hackers remotely control your phone

January 20, 2023

A new Android malware named 'Hook' is being sold by cybercriminals, boasting it can remotely take over mobile devices in...

Roaming Mantis’ Android malware adds DNS changer to hack WiFi routers

January 20, 2023

Image: AI-generated through Midjourney The Roaming Mantis malware distribution campaign has updated its Android malware to include a DNS changer...

Vice Society Ransomware Victim: Monmouth College

January 20, 2023

Vice Society Ransomware NOTE: No files or stolen information are by RedPacket Security. Any legal issues relating to the content...

Vice Society Ransomware Victim: University of Duisburg-Essen

January 20, 2023

Vice Society Ransomware NOTE: No files or stolen information are by RedPacket Security. Any legal issues relating to the content...

Cobalt Stike Beacon Detected – 121[.]4[.]154[.]240:4000

January 20, 2023

The Information provided at the time of posting was detected as "Cobalt Strike". Depending on when you are viewing this...

Cobalt Stike Beacon Detected – 194[.]165[.]16[.]62:443

January 20, 2023

The Information provided at the time of posting was detected as "Cobalt Strike". Depending on when you are viewing this...

Cobalt Stike Beacon Detected – 182[.]160[.]0[.]248:80

January 20, 2023

The Information provided at the time of posting was detected as "Cobalt Strike". Depending on when you are viewing this...

Posh C2 Detected – 146[.]190[.]86[.]212:4443

January 20, 2023

The Information provided at the time of posting was detected as "Posh C2". Depending on when you are viewing this...

DragonCastle – A PoC That Combines AutodialDLL Lateral Movement Technique And SSP To Scrape NTLM Hashes From LSASS Process

January 19, 2023

A PoC that combines AutodialDLL lateral movement technique and SSP to scrape NTLM hashes from LSASS process. Description Upload a...

Malware Analysis – djvu – c266d56f0bbea899b2cfa58f192a9f86

January 19, 2023

Score: 10 MALWARE FAMILY: djvuTAGS:family:djvu, family:vidar, botnet:19, discovery, persistence, ransomware, spyware, stealerMD5: c266d56f0bbea899b2cfa58f192a9f86SHA1: 0f2191d9571e04ed4cf14188b9eab8f210f6c652ANALYSIS DATE: 2023-01-19T16:59:57ZTTPS: T1222, T1082, T1005, T1081,...

Malware Analysis – persistence – da8e21489a2c6c01ee676c304c8541c1

January 19, 2023

Score: 8 MALWARE FAMILY: persistenceTAGS:persistenceMD5: da8e21489a2c6c01ee676c304c8541c1SHA1: 40e6d3aa1f0fa21fae1a9563174b45b432aa3306ANALYSIS DATE: 2023-01-19T17:42:31ZTTPS: T1060, T1112, T1012, T1120, T1082 ScoreMeaningExample10Known badA malware family was detected.8-9Likely...

Malware Analysis – djvu – 50fee0fee96a3c681b9c47eada3fffdf

January 19, 2023

Score: 10 MALWARE FAMILY: djvuTAGS:family:djvu, family:vidar, botnet:19, discovery, persistence, ransomware, spyware, stealerMD5: 50fee0fee96a3c681b9c47eada3fffdfSHA1: db64c7d74705e4a3c08ca50c140fa84d3c4fce09ANALYSIS DATE: 2023-01-19T17:22:07ZTTPS: T1012, T1222, T1082, T1005,...

Malware Analysis – locky – fb6ca1cd232151d667f6cd2484fee8c8

January 19, 2023

Score: 10 MALWARE FAMILY: lockyTAGS:family:locky, ransomwareMD5: fb6ca1cd232151d667f6cd2484fee8c8SHA1: f7bb52767afd2cd32ede8b5f83012eb99ba1ce28ANALYSIS DATE: 2023-01-19T17:42:29ZTTPS: ScoreMeaningExample10Known badA malware family was detected.8-9Likely maliciousOne or more known...

Malware Analysis – discovery – 133af41cfec522b7f583fcf77be37b1a

January 19, 2023

Score: 8 MALWARE FAMILY: discoveryTAGS:discoveryMD5: 133af41cfec522b7f583fcf77be37b1aSHA1: 50fde70e193eeea8d15c13dfc62cdcb4cbc2bcd0ANALYSIS DATE: 2023-01-19T17:13:15ZTTPS: T1082, T1012 ScoreMeaningExample10Known badA malware family was detected.8-9Likely maliciousOne or more...

LockBit 3.0 Ransomware Victim: tvk[.]nl

January 19, 2023

LockBit 3.0 Ransomware NOTE: No files or stolen information are by RedPacket Security. Any legal issues relating to the content...

Product Security Incident Response: Key Strategies and Best Practices

January 19, 2023

Written By: Samuel Cure, CISO, AMI In today's digital landscape, it is essential to implement proactive measures to ensure the...

threatintel

Malware Analysis – eternity – dafc8e7ccd381af36f19267a2a9b3f9b

Malware Analysis – wannacry – 7339a0efc768310a86b6d4f61d88b910

PayPal accounts breached in large-scale credential stuffing attack

Ransomware profits drop 40% in 2022 as victims refuse to pay

New ‘Blank Image’ attack hides phishing scripts in SVG files

Ransomware gang steals data from KFC, Taco Bell, and Pizza Hut brand owner

T-Mobile hacked to steal data of 37 million accounts in API data breach

Exploit released for critical ManageEngine RCE bug, patch now

New ‘Hook’ Android malware lets hackers remotely control your phone

Roaming Mantis’ Android malware adds DNS changer to hack WiFi routers

Vice Society Ransomware Victim: Monmouth College

Vice Society Ransomware Victim: University of Duisburg-Essen

Cobalt Stike Beacon Detected – 121[.]4[.]154[.]240:4000

Cobalt Stike Beacon Detected – 194[.]165[.]16[.]62:443

Cobalt Stike Beacon Detected – 182[.]160[.]0[.]248:80

Posh C2 Detected – 146[.]190[.]86[.]212:4443

DragonCastle – A PoC That Combines AutodialDLL Lateral Movement Technique And SSP To Scrape NTLM Hashes From LSASS Process

Malware Analysis – djvu – c266d56f0bbea899b2cfa58f192a9f86

Malware Analysis – persistence – da8e21489a2c6c01ee676c304c8541c1

Malware Analysis – djvu – 50fee0fee96a3c681b9c47eada3fffdf

Malware Analysis – locky – fb6ca1cd232151d667f6cd2484fee8c8

Malware Analysis – discovery – 133af41cfec522b7f583fcf77be37b1a

LockBit 3.0 Ransomware Victim: tvk[.]nl

Product Security Incident Response: Key Strategies and Best Practices

[SINOBI] – Ransomware Victim: Seward County, KS

[SINOBI] – Ransomware Victim: CapitalPlus Exchange

Cobalt Strike Beacon Detected – 43[.]163[.]112[.]217:443

Cobalt Strike Beacon Detected – 45[.]204[.]216[.]24:443

Cobalt Strike Beacon Detected – 8[.]155[.]0[.]238:443

You may have missed