threatintel

Malware Analysis – evasion – 7bfcc0977c491a7e94898824064bd1b8

December 7, 2022

Score: 9 MALWARE FAMILY: evasionTAGS:evasion, ransomwareMD5: 7bfcc0977c491a7e94898824064bd1b8SHA1: 38a9af9fcdd767dd47cc72a156d4b7212717be6eANALYSIS DATE: 2022-12-07T11:04:35ZTTPS: T1012, T1497, T1082, T1107, T1490, T1120 ScoreMeaningExample10Known badA malware family...

Malware Analysis – ransomware – 20eee122c6a5cf8537f5488d8bb3b37e

December 7, 2022

Score: 9 MALWARE FAMILY: ransomwareTAGS:ransomware, spyware, stealerMD5: 20eee122c6a5cf8537f5488d8bb3b37eSHA1: 0e0bf8188e7e143a15fcf95771b98502804198cbANALYSIS DATE: 2022-12-07T11:04:15ZTTPS: T1005, T1081, T1107, T1490 ScoreMeaningExample10Known badA malware family was...

Malware Analysis – ransomware – 4b9eb7effc356c12d0f6f49593b0f85c

December 7, 2022

Score: 10 MALWARE FAMILY: ransomwareTAGS:ransomwareMD5: 4b9eb7effc356c12d0f6f49593b0f85cSHA1: f7ffa9d3683b0952aecf8899a8a3137173e25023ANALYSIS DATE: 2022-12-07T11:03:53ZTTPS: ScoreMeaningExample10Known badA malware family was detected.8-9Likely maliciousOne or more known damaging...

Malware Analysis – djvu – a62132d1123af4e31d44171ab47046a9

December 7, 2022

Score: 10 MALWARE FAMILY: djvuTAGS:family:djvu, discovery, persistence, ransomwareMD5: a62132d1123af4e31d44171ab47046a9SHA1: 65344c174a79c30a4075455d106173ea2cefec3eANALYSIS DATE: 2022-12-07T11:13:13ZTTPS: T1060, T1112, T1222, T1082, T1012 ScoreMeaningExample10Known badA malware...

Malware Analysis – djvu – d00508b99c98be2802ac83a02f316c3f

December 7, 2022

Score: 10 MALWARE FAMILY: djvuTAGS:family:djvu, family:vidar, botnet:517, discovery, persistence, ransomware, spyware, stealerMD5: d00508b99c98be2802ac83a02f316c3fSHA1: d574649b203bd71556b11f212816f1b5baf23b0fANALYSIS DATE: 2022-12-07T11:26:06ZTTPS: T1005, T1081, T1012, T1222,...

Malware Analysis – djvu – dd2193abb2f82d60a7c2bf612c7ad6a0

December 7, 2022

Score: 10 MALWARE FAMILY: djvuTAGS:family:djvu, family:vidar, botnet:517, discovery, persistence, ransomware, spyware, stealerMD5: dd2193abb2f82d60a7c2bf612c7ad6a0SHA1: 3e6de2aae3aefd649d267c4ee43f9b0bce0db667ANALYSIS DATE: 2022-12-07T11:26:06ZTTPS: T1060, T1112, T1130, T1222,...

Malware Analysis – blackbasta – 2ec0c42040440cddd1ff99ebe2b7d94f

December 7, 2022

Score: 10 MALWARE FAMILY: blackbastaTAGS:family:blackbasta, ransomwareMD5: 2ec0c42040440cddd1ff99ebe2b7d94fSHA1: bb1f269fc9c136d6caeda579482b2b8548795625ANALYSIS DATE: 2022-12-07T11:50:00ZTTPS: T1107, T1490, T1491, T1112 ScoreMeaningExample10Known badA malware family was detected.8-9Likely...

threatintel

Malware Analysis – evasion – 7bfcc0977c491a7e94898824064bd1b8

Malware Analysis – ransomware – 20eee122c6a5cf8537f5488d8bb3b37e

Malware Analysis – ransomware – 4b9eb7effc356c12d0f6f49593b0f85c

Malware Analysis – djvu – a62132d1123af4e31d44171ab47046a9

Malware Analysis – djvu – d00508b99c98be2802ac83a02f316c3f

Malware Analysis – djvu – dd2193abb2f82d60a7c2bf612c7ad6a0

Malware Analysis – blackbasta – 2ec0c42040440cddd1ff99ebe2b7d94f

Sophos fixed a critical flaw in its Sophos Firewall version 19.5

Main phishing and scamming trends and techniques

Royal Ransomware Victim: Adams-Friendship Area School District

BlackCat/ALPHV Ransomware Victim: pro office Büro + Wohnkultur GmbH

LockBit 3.0 Ransomware Victim: g4s[.]com

LockBit 3.0 Ransomware Victim: myersontooth[.]com

Cobalt Stike Beacon Detected – 31[.]172[.]83[.]154:80

Cobalt Stike Beacon Detected – 154[.]209[.]74[.]234:443

Cobalt Stike Beacon Detected – 194[.]135[.]24[.]250:443

Cobalt Stike Beacon Detected – 47[.]101[.]129[.]148:80

Cobalt Stike Beacon Detected – 120[.]27[.]147[.]74:80

Cobalt Stike Beacon Detected – 101[.]43[.]116[.]175:8989

Cobalt Stike Beacon Detected – 121[.]36[.]165[.]78:443

BlackCat/ALPHV Ransomware Victim: pro office Büro + Wohnkultur GmbH

Cobalt Stike Beacon Detected – 120[.]48[.]115[.]160:8080

Cobalt Stike Beacon Detected – 31[.]172[.]83[.]152:443

Cobalt Stike Beacon Detected – 44[.]206[.]242[.]202:443

[QILIN] – Ransomware Victim: Rex-Hide

CVE Alert: CVE-2025-4519 – themeatelier – IDonate – Blood Donation, Request And Donor Management System

CVE Alert: CVE-2025-5483 – niaj – Connector Wizard (formerly LC Wizard)

[STORMOUS] – Ransomware Victim: www[.]marjane[.]ma

Synthient Credential Stuffing Threat Data – 1,957,476,021 breached accounts

You may have missed