threatintel

Malware Analysis – evasion – dcd6e52f2caeafa113f1c60001869b77

November 24, 2022

Score: 9 MALWARE FAMILY: evasionTAGS:evasion, persistence, ransomware, trojanMD5: dcd6e52f2caeafa113f1c60001869b77SHA1: a79961c2b141b7b428a77f920c3840d7414e76ceANALYSIS DATE: 2022-11-24T07:27:43ZTTPS: T1082, T1060, T1112, T1107, T1490 ScoreMeaningExample10Known badA malware...

Cobalt Stike Beacon Detected – 124[.]222[.]95[.]72:8443

November 24, 2022

The Information provided at the time of posting was detected as "Cobalt Strike". Depending on when you are viewing this...

Cobalt Stike Beacon Detected – 148[.]70[.]167[.]199:9443

November 24, 2022

The Information provided at the time of posting was detected as "Cobalt Strike". Depending on when you are viewing this...

Cobalt Stike Beacon Detected – 185[.]239[.]70[.]229:443

November 24, 2022

The Information provided at the time of posting was detected as "Cobalt Strike". Depending on when you are viewing this...

Cobalt Stike Beacon Detected – 5[.]61[.]36[.]132:80

November 24, 2022

The Information provided at the time of posting was detected as "Cobalt Strike". Depending on when you are viewing this...

Malware Analysis – ransomware – e2e275413ad1246b9ac9de9d175f5103

November 24, 2022

Score: 8 MALWARE FAMILY: ransomwareTAGS:ransomware, spyware, stealerMD5: e2e275413ad1246b9ac9de9d175f5103SHA1: dac9e13cf3289c7870da32a94e76e7bef34b945dANALYSIS DATE: 2022-11-24T08:08:31ZTTPS: T1018, T1005, T1081 ScoreMeaningExample10Known badA malware family was detected.8-9Likely...

Malware Analysis – evasion – e46421290522060e95dc6c6ac9bab9c8

November 24, 2022

Score: 9 MALWARE FAMILY: evasionTAGS:evasion, persistence, ransomware, trojanMD5: e46421290522060e95dc6c6ac9bab9c8SHA1: 08aaa1203dca088e366ea31253ec264ca710f015ANALYSIS DATE: 2022-11-24T07:48:05ZTTPS: T1060, T1112, T1107, T1490, T1082 ScoreMeaningExample10Known badA malware...

Malware Analysis – evasion – b0710804b8d1057855fdefcfa0112e66

November 24, 2022

Score: 9 MALWARE FAMILY: evasionTAGS:evasion, persistence, ransomware, trojanMD5: b0710804b8d1057855fdefcfa0112e66SHA1: 78db1b4541e821fb43d147e7809607733180b3ceANALYSIS DATE: 2022-11-24T07:48:10ZTTPS: T1060, T1112, T1107, T1490, T1082 ScoreMeaningExample10Known badA malware...

Malware Analysis – persistence – b725067c7926e8a3268d2fabfcad7b4e

November 24, 2022

Score: 9 MALWARE FAMILY: persistenceTAGS:persistence, ransomwareMD5: b725067c7926e8a3268d2fabfcad7b4eSHA1: 2518fb688bec920f49e6b20144dc385866a2a70cANALYSIS DATE: 2022-11-24T07:48:23ZTTPS: T1107, T1490, T1060, T1112 ScoreMeaningExample10Known badA malware family was detected.8-9Likely...

Cobalt Stike Beacon Detected – 110[.]40[.]201[.]49:443

November 24, 2022

The Information provided at the time of posting was detected as "Cobalt Strike". Depending on when you are viewing this...

Cobalt Stike Beacon Detected – 43[.]139[.]156[.]186:443

November 24, 2022

The Information provided at the time of posting was detected as "Cobalt Strike". Depending on when you are viewing this...

Cobalt Stike Beacon Detected – 172[.]86[.]123[.]13:443

November 24, 2022

The Information provided at the time of posting was detected as "Cobalt Strike". Depending on when you are viewing this...

Cobalt Stike Beacon Detected – 85[.]208[.]136[.]49:443

November 24, 2022

The Information provided at the time of posting was detected as "Cobalt Strike". Depending on when you are viewing this...

Malware Analysis – djvu – a5b4c672812208b47b9a9370902d4e1c

November 24, 2022

Score: 10 MALWARE FAMILY: djvuTAGS:family:djvu, discovery, persistence, ransomwareMD5: a5b4c672812208b47b9a9370902d4e1cSHA1: 0efd3da2bcad33fc6c91fc8a1c2a499c889eb2f6ANALYSIS DATE: 2022-11-24T10:33:48ZTTPS: T1060, T1112, T1222, T1082, T1012 ScoreMeaningExample10Known badA malware...

Malware Analysis – ransomware – fecea0c22b3fc1a848902bcae0d16027

November 24, 2022

Score: 8 MALWARE FAMILY: ransomwareTAGS:ransomwareMD5: fecea0c22b3fc1a848902bcae0d16027SHA1: a5fd3809a7640e4ec3bf7617fff3f70eaff1562bANALYSIS DATE: 2022-11-24T09:02:55ZTTPS: T1012, T1120, T1082 ScoreMeaningExample10Known badA malware family was detected.8-9Likely maliciousOne or...

Malware Analysis – djvu – dfb556e14a10b5145a33f1a3efabdf88

November 24, 2022

Score: 10 MALWARE FAMILY: djvuTAGS:family:djvu, family:vidar, botnet:517, discovery, persistence, ransomware, spyware, stealerMD5: dfb556e14a10b5145a33f1a3efabdf88SHA1: adb76813eda263afa706327cf52ef099f024fd36ANALYSIS DATE: 2022-11-24T10:25:26ZTTPS: T1005, T1081, T1130, T1112,...

Malware Analysis – banker – 425ca585e1689771f69c442036192d78

November 24, 2022

Score: 8 MALWARE FAMILY: bankerTAGS:banker, ransomwareMD5: 425ca585e1689771f69c442036192d78SHA1: 3d7e48669307cc962f18de5639ae0697ed950d1eANALYSIS DATE: 2022-11-24T09:53:04ZTTPS: ScoreMeaningExample10Known badA malware family was detected.8-9Likely maliciousOne or more known...

threatintel

Malware Analysis – evasion – dcd6e52f2caeafa113f1c60001869b77

Cobalt Stike Beacon Detected – 124[.]222[.]95[.]72:8443

Cobalt Stike Beacon Detected – 148[.]70[.]167[.]199:9443

Cobalt Stike Beacon Detected – 185[.]239[.]70[.]229:443

Cobalt Stike Beacon Detected – 5[.]61[.]36[.]132:80

Malware Analysis – ransomware – e2e275413ad1246b9ac9de9d175f5103

Malware Analysis – evasion – e46421290522060e95dc6c6ac9bab9c8

Malware Analysis – evasion – b0710804b8d1057855fdefcfa0112e66

Malware Analysis – persistence – b725067c7926e8a3268d2fabfcad7b4e

Cobalt Stike Beacon Detected – 110[.]40[.]201[.]49:443

Cobalt Stike Beacon Detected – 43[.]139[.]156[.]186:443

Cobalt Stike Beacon Detected – 172[.]86[.]123[.]13:443

Cobalt Stike Beacon Detected – 85[.]208[.]136[.]49:443

Malware Analysis – djvu – a5b4c672812208b47b9a9370902d4e1c

Malware Analysis – ransomware – fecea0c22b3fc1a848902bcae0d16027

Malware Analysis – djvu – dfb556e14a10b5145a33f1a3efabdf88

Malware Analysis – banker – 425ca585e1689771f69c442036192d78

An aggressive malware campaign targets US-based companies with Qakbot to deliver Black Basta Ransomware

LockBit 3.0 Ransomware Victim: nelsonautohaus[.]com

Threat actors exploit discontinues Boa web servers to target critical infrastructure

LockBit 3.0 Ransomware Victim: embalajescapsa[.]com

LockBit 3.0 Ransomware Victim: Nihonsakari Co[.] , Ltd

LockBit 3.0 Ransomware Victim: dcashpro[.]com

Black Friday shoppers beware: online threats so far in 2022

HackerOne Bug Bounty Disclosure: stack-buffer-overflow-in-curl-cookie-parsing-leads-to-rce-batuhanilgarr

BugCrowd Bug Bounty Disclosure: P3 – Publicly Editable Google Docs Linked from NASA SnowEx PPT –

BugCrowd Bug Bounty Disclosure: P3 – Details of the collaboration between NASA and Inmarsat Government and the type of contract –

Apple Products Multiple Vulnerabilities

Miljödata – 870,108 breached accounts

You may have missed