threatintel

Malware Analysis – phobos – 715bb8ece6c740ab68a9aa2f4eb0aa04

December 30, 2022

Score: 10 MALWARE FAMILY: phobosTAGS:family:phobos, evasion, persistence, ransomware, spyware, stealerMD5: 715bb8ece6c740ab68a9aa2f4eb0aa04SHA1: 6fef9bbee0ef34c8e0bbc2510eb14c7751329577ANALYSIS DATE: 2022-12-30T05:13:03ZTTPS: T1490, T1059, T1107, T1060, T1112, T1005,...

Malware Analysis – amadey – 4619b57f0aa69fbf3cce99b690019581

December 30, 2022

Score: 10 MALWARE FAMILY: amadeyTAGS:family:amadey, family:dcrat, family:djvu, family:gozi, family:lgoogloader, family:smokeloader, family:vidar, botnet:19, botnet:22500, backdoor, banker, collection, discovery, downloader, infostealer, isfb,...

Malware Analysis – phobos – c5d5171d5af7b55de4056c8ef928b6d2

December 30, 2022

Score: 10 MALWARE FAMILY: phobosTAGS:family:phobos, evasion, persistence, ransomware, spyware, stealerMD5: c5d5171d5af7b55de4056c8ef928b6d2SHA1: 62f92ae34f886ae7c77f5c3eaf52fecdb00d6b77ANALYSIS DATE: 2022-12-30T05:23:03ZTTPS: T1490, T1059, T1107, T1005, T1081, T1060,...

Malware Analysis – djvu – eb1aabb044efe23bdd1b84a58d66feb4

December 30, 2022

Score: 10 MALWARE FAMILY: djvuTAGS:family:djvu, family:vidar, botnet:19, discovery, persistence, ransomware, spyware, stealerMD5: eb1aabb044efe23bdd1b84a58d66feb4SHA1: 604a9ea5a26aa61fe4a3650b91a8fe8d36247ddcANALYSIS DATE: 2022-12-30T05:52:09ZTTPS: T1082, T1012, T1222, T1005,...

Malware Analysis – djvu – f891b2289720468df1c4e8bd715445bb

December 30, 2022

Score: 10 MALWARE FAMILY: djvuTAGS:family:djvu, family:vidar, botnet:19, discovery, persistence, ransomware, stealerMD5: f891b2289720468df1c4e8bd715445bbSHA1: e8243516f0e21048dd96d3a88c18248c611e3369ANALYSIS DATE: 2022-12-30T05:30:06ZTTPS: T1060, T1112, T1222, T1082, T1053,...

threatintel

Malware Analysis – phobos – 715bb8ece6c740ab68a9aa2f4eb0aa04

Malware Analysis – amadey – 4619b57f0aa69fbf3cce99b690019581

Malware Analysis – phobos – c5d5171d5af7b55de4056c8ef928b6d2

Malware Analysis – djvu – eb1aabb044efe23bdd1b84a58d66feb4

Malware Analysis – djvu – f891b2289720468df1c4e8bd715445bb

Cobalt Stike Beacon Detected – 119[.]3[.]173[.]115:18081

Cobalt Stike Beacon Detected – 3[.]145[.]195[.]94:80

Cobalt Stike Beacon Detected – 163[.]123[.]142[.]146:443

Royal Ransomware Victim: Iowa Public Television

Royal Ransomware Victim: Waterloo Wellington Flight Centre

Cobalt Stike Beacon Detected – 185[.]106[.]94[.]9:8080

Cobalt Stike Beacon Detected – 101[.]43[.]109[.]197:8080

Cobalt Stike Beacon Detected – 81[.]70[.]88[.]97:80

Cobalt Stike Beacon Detected – 120[.]48[.]43[.]5:6666

S3Crets_Scanner – Hunting For Secrets Uploaded To Public S3 Buckets

Aftermath – A Free macOS IR Framework

Top 20 Most Popular Hacking Tools in 2022

OFRAK – Unpack, Modify, And Repack Binaries

Autobloody – Tool To Automatically Exploit Active Directory Privilege Escalation Paths Shown By BloodHound

Havoc – Modern and malleable post-exploitation command and control framework

Top 20 Most Popular Hacking Tools in 2022

Top 20 Most Popular Hacking Tools in 2022

Top 20 Most Popular Hacking Tools in 2022

Top 20 Most Popular Hacking Tools in 2022

Cobalt Strike Beacon Detected – 47[.]116[.]208[.]81:8001

Cobalt Strike Beacon Detected – 152[.]136[.]139[.]105:6666

Cobalt Strike Beacon Detected – 47[.]120[.]70[.]161:6666

Cobalt Strike Beacon Detected – 106[.]75[.]215[.]96:8081

Cobalt Strike Beacon Detected – 118[.]25[.]85[.]198:8899

You may have missed