threatintel

Malware Analysis – quasar – 5c15c3545fa841deb975d3c0d7fdbe1e

November 15, 2022

Score: 10 MALWARE FAMILY: quasarTAGS:family:quasar, botnet:venom client, agilenet, discovery, persistence, ransomware, spyware, stealer, trojanMD5: 5c15c3545fa841deb975d3c0d7fdbe1eSHA1: 4e3c5266247aa594671eba955c940268e95e5025ANALYSIS DATE: 2022-11-15T08:59:15ZTTPS: T1012, T1120,...

Black Basta Ransomware Victim: Kessing Rechtsanwälte und Fachanwälte in PartGmbB

November 15, 2022

Black Basta Ransomware NOTE: No files or stolen information are by RedPacket Security. Any legal issues relating to the content...

Malware Analysis – ransomware – 01492156ce8b4034c5b1027130f4cf4e

November 15, 2022

Score: 9 MALWARE FAMILY: ransomwareTAGS:ransomwareMD5: 01492156ce8b4034c5b1027130f4cf4eSHA1: 6b0deb67a178fe20e81691133b257df3bafa3006ANALYSIS DATE: 2022-11-15T10:46:56ZTTPS: T1107, T1490 ScoreMeaningExample10Known badA malware family was detected.8-9Likely maliciousOne or more...

Malware Analysis – djvu – 623ec8b8c74e4e45a2380c41b5bb8045

November 15, 2022

Score: 10 MALWARE FAMILY: djvuTAGS:family:djvu, family:vidar, botnet:517, discovery, persistence, ransomware, spyware, stealerMD5: 623ec8b8c74e4e45a2380c41b5bb8045SHA1: 47e9d882222e753be4ffe638b500c9ae7f74a48dANALYSIS DATE: 2022-11-15T10:27:58ZTTPS: T1053, T1005, T1081, T1012,...

Cobalt Stike Beacon Detected – 5[.]44[.]42[.]46:443

November 15, 2022

The Information provided at the time of posting was detected as "Cobalt Strike". Depending on when you are viewing this...

Cobalt Stike Beacon Detected – 194[.]165[.]16[.]91:80

November 15, 2022

The Information provided at the time of posting was detected as "Cobalt Strike". Depending on when you are viewing this...

Cobalt Stike Beacon Detected – 124[.]71[.]145[.]63:443

November 15, 2022

The Information provided at the time of posting was detected as "Cobalt Strike". Depending on when you are viewing this...

Cobalt Stike Beacon Detected – 5[.]181[.]86[.]248:443

November 15, 2022

The Information provided at the time of posting was detected as "Cobalt Strike". Depending on when you are viewing this...

Malware Analysis – discovery – cff0e1b4af4ef5a2d4cb78ea5d403d58

November 15, 2022

Score: 10 MALWARE FAMILY: discoveryTAGS:discovery, evasion, exploitMD5: cff0e1b4af4ef5a2d4cb78ea5d403d58SHA1: 5224506ce265475452aeddf540f5f9b996f84bd6ANALYSIS DATE: 2022-11-15T10:22:20ZTTPS: T1031, T1562, T1489, T1053, T1082, T1130, T1112, T1102, T1222...

Malware Analysis – amadey – 086e4feb401610ae41653bd6aa8027e6

November 15, 2022

Score: 10 MALWARE FAMILY: amadeyTAGS:family:amadey, family:dcrat, family:djvu, family:redline, family:smokeloader, family:vidar, botnet:517, botnet:mario23_10, backdoor, collection, discovery, infostealer, persistence, ransomware, rat, spyware,...

Malware Analysis – smokeloader – 30f5717c7d19ac946764014ae49b8670

November 15, 2022

Score: 10 MALWARE FAMILY: smokeloaderTAGS:family:smokeloader, backdoor, trojanMD5: 30f5717c7d19ac946764014ae49b8670SHA1: f6ec0fa83c48e36ad5457610d0219af07ab8076cANALYSIS DATE: 2022-11-15T11:22:07ZTTPS: T1012, T1120, T1082 ScoreMeaningExample10Known badA malware family was detected.8-9Likely...

Malware Analysis – djvu – 8fc3fff3efe99267c5b2bfffff18d77c

November 15, 2022

Score: 10 MALWARE FAMILY: djvuTAGS:family:djvu, family:vidar, botnet:517, discovery, persistence, ransomware, spyware, stealerMD5: 8fc3fff3efe99267c5b2bfffff18d77cSHA1: c174206043042369386f0e44826b17ef23e761c7ANALYSIS DATE: 2022-11-15T11:07:33ZTTPS: T1012, T1082, T1005, T1081,...

Malware Analysis – amadey – 497e58c722c33d1b5a4674e70a3f67a2

November 15, 2022

Score: 10 MALWARE FAMILY: amadeyTAGS:family:amadey, family:djvu, family:redline, family:smokeloader, family:vidar, botnet:517, botnet:@redlinevip cloud (tg: @fatherofcarders), botnet:boy, botnet:mario23_10, botnet:new1, botnet:rozena1114, backdoor, collection,...

Malware Analysis – djvu – 397ae229dec0f1c462965b2d01109259

November 15, 2022

Score: 10 MALWARE FAMILY: djvuTAGS:family:djvu, family:vidar, botnet:517, discovery, persistence, ransomware, spyware, stealerMD5: 397ae229dec0f1c462965b2d01109259SHA1: db5c33388009d4e32a41493f0d9c457caecd376cANALYSIS DATE: 2022-11-15T11:21:03ZTTPS: T1012, T1082, T1005, T1081,...

Google to Pay a record $391M fine for misleading users about the collection of location data

November 15, 2022

Google is going to pay $391.5 million to settle with 40 states in the U.S. for secretly collecting personal location...

Previously undetected Earth Longzhi APT group is a subgroup of APT41

November 15, 2022

Trend Micro reported that the Earth Longzhi group, a previously undocumented subgroup of APT41, targets Ukraine and Asian Countries. Early this...

Avast details Worok espionage group’s compromise chain

November 15, 2022

Cyber espionage group Worok abuses Dropbox API to exfiltrate data via using a backdoor hidden in apparently innocuous image files. Researchers...

KSB2022_Advanced-threat-predictions-990x400-1

Advanced threat predictions for 2023

November 15, 2022

It is fair to say that since last year’s predictions, the world has dramatically changed. While the geopolitical landscape has...

Malware Analysis – amadey – 6b635d80897c987ca64e28cc9004a249

November 15, 2022

Score: 10 MALWARE FAMILY: amadeyTAGS:family:amadey, family:djvu, family:redline, family:smokeloader, family:vidar, botnet:517, botnet:mario23_10, botnet:rozena1114, backdoor, collection, discovery, infostealer, persistence, ransomware, spyware, stealer,...

Malware Analysis – djvu – bf29eecd8ccb668323d7f61ff026b109

November 15, 2022

Score: 10 MALWARE FAMILY: djvuTAGS:family:djvu, family:vidar, botnet:517, discovery, persistence, ransomware, spyware, stealerMD5: bf29eecd8ccb668323d7f61ff026b109SHA1: a19a0edf8ba13b93c0a37c14e7a203a97cb94a2cANALYSIS DATE: 2022-11-15T04:49:33ZTTPS: T1005, T1081, T1012, T1060,...

Black Basta Ransomware Victim: Kessing Rechtsanwälte und Fachanwälte in PartGmbB

November 15, 2022

Black Basta Ransomware NOTE: No files or stolen information are by RedPacket Security. Any legal issues relating to the content...

Malware Analysis – evasion – f582c50979a0af794c0f2d3b8f94ab16

November 15, 2022

Score: 10 MALWARE FAMILY: evasionTAGS:evasion, persistence, ransomware, spyware, stealer, trojanMD5: f582c50979a0af794c0f2d3b8f94ab16SHA1: 6633d9ab4aefffd8298d0f50eaa2192e2fa57099ANALYSIS DATE: 2022-11-15T04:56:49ZTTPS: T1060, T1112, T1158, T1088, T1089, T1082,...

Malware Analysis – nitro – 5c3f73f74ff01937543395e7c97af556

November 15, 2022

Score: 10 MALWARE FAMILY: nitroTAGS:family:nitro, persistence, ransomware, spyware, stealerMD5: 5c3f73f74ff01937543395e7c97af556SHA1: 81ea3ba54b1100945c15bdabf4d49b25f27ed13dANALYSIS DATE: 2022-11-15T05:07:03ZTTPS: T1102, T1060, T1112, T1005, T1081, T1491 ScoreMeaningExample10Known...

Malware Analysis – azov – c85b63aa4526b91acc9ad26f2b142688

November 15, 2022

Score: 10 MALWARE FAMILY: azovTAGS:family:azov, persistence, ransomware, wiperMD5: c85b63aa4526b91acc9ad26f2b142688SHA1: 3adf5f527aa132e874b48a0309f1392f5730430dANALYSIS DATE: 2022-11-15T05:01:13ZTTPS: T1060, T1112, T1012, T1120, T1082 ScoreMeaningExample10Known badA malware...

threatintel

Malware Analysis – quasar – 5c15c3545fa841deb975d3c0d7fdbe1e

Black Basta Ransomware Victim: Kessing Rechtsanwälte und Fachanwälte in PartGmbB

Malware Analysis – ransomware – 01492156ce8b4034c5b1027130f4cf4e

Malware Analysis – djvu – 623ec8b8c74e4e45a2380c41b5bb8045

Cobalt Stike Beacon Detected – 5[.]44[.]42[.]46:443

Cobalt Stike Beacon Detected – 194[.]165[.]16[.]91:80

Cobalt Stike Beacon Detected – 124[.]71[.]145[.]63:443

Cobalt Stike Beacon Detected – 5[.]181[.]86[.]248:443

Malware Analysis – discovery – cff0e1b4af4ef5a2d4cb78ea5d403d58

Malware Analysis – amadey – 086e4feb401610ae41653bd6aa8027e6

Malware Analysis – smokeloader – 30f5717c7d19ac946764014ae49b8670

Malware Analysis – djvu – 8fc3fff3efe99267c5b2bfffff18d77c

Malware Analysis – amadey – 497e58c722c33d1b5a4674e70a3f67a2

Malware Analysis – djvu – 397ae229dec0f1c462965b2d01109259

Google to Pay a record $391M fine for misleading users about the collection of location data

Previously undetected Earth Longzhi APT group is a subgroup of APT41

Avast details Worok espionage group’s compromise chain

Advanced threat predictions for 2023

Malware Analysis – amadey – 6b635d80897c987ca64e28cc9004a249

Malware Analysis – djvu – bf29eecd8ccb668323d7f61ff026b109

Black Basta Ransomware Victim: Kessing Rechtsanwälte und Fachanwälte in PartGmbB

Malware Analysis – evasion – f582c50979a0af794c0f2d3b8f94ab16

Malware Analysis – nitro – 5c3f73f74ff01937543395e7c97af556

Malware Analysis – azov – c85b63aa4526b91acc9ad26f2b142688

Cobalt Strike Beacon Detected – 119[.]91[.]203[.]199:88

Cobalt Strike Beacon Detected – 106[.]54[.]239[.]134:80

Cobalt Strike Beacon Detected – 81[.]69[.]98[.]230:50010

Cobalt Strike Beacon Detected – 103[.]43[.]18[.]10:80

Cobalt Strike Beacon Detected – 38[.]190[.]198[.]55:80

You may have missed