Threat Intelligence Analyst @EG_CERT | Malware Researching | AI Malware Detection | ArcX Hat-trick https://xitter.cf/t.co/U4a5O3ubU4
Egypt
Joined April 2024
- Tweets144
- Following181
- Followers175
- Likes35
Michelle Khalil retweeted
Hi guys,
I just deployed a platform I’ve been working on and would love for you to give it a try.
TRACEON.re is a free real-time Telegram threat intelligence platform. I’ve indexed over 70M messages.
You can search, filter and export data.
I’m working on more enhancements that I’ll be adding soon.
You can help me by using the contribution form with more Telegram sources, or share your thoughts via the feedback form.
#ThreatIntel #OSINT #CyberSecurity
Maverick to Top Gun
I’m proud to share that I have joined @EG_CERT as a Threat Intelligence Analyst.
I identified these IPs communicating over 443 and assessed them as #ValleyRAT #C2 endpoints based on traffic behavior and infra patterns:
111.45.11.83:443
111.45.3.198:443
8.153.206.141:443
8.132.215.201:443
14.215.182.140:443
14.215.183.79:443
47.117.74.94:443
#myth stealer payloads, with 0 detections in VT !!!
IOCs:
68ba579ba12fac0390316606552146950b6e30ed9b5b0f646d9c3e5d0a04d7bb
a7a9be14e77b4a9d23c3bd452623d3e3f940ebc05c22f8f94454242227fdac59
b6d1dac89173036ad38cac36744f85ed7515c11df11ac174f5c06a9827ede279
@James_inthe_box
@ViriBack
@nas_bench
@f0wlsec
@JAMESWT_MHT
@James_inthe_bo
@ViriBac
@cyber_anubi
@pmelso
@siri_ur
@fr0gger
@Myrtus0x
@malwrhunterteam
@pmelson
@MalGamy12
@siri_urz
@struppigel
@fr0gger_
@0xbahaa
@nu11charb
@hasherezade
@th3_protoCOL
@cyb3rops
@kienbigmummy
One of my YARA rules got FP
I decided to investigate, and that led to an unexpected find
Triage showed 3/10 detection
VirusTotal showed low detection
After reversing, I identified the sample as #Kiwistealer
4b62fc86273cdc424125a34d6142162000ab8b97190bf6af428d3599e4f4c175
@James_inthe_box
@ViriBack
@nas_bench
@f0wlsec
@JAMESWT_MHT
@James_inthe_bo
@ViriBac
@cyber_anubi
@pmelso
@siri_ur
@fr0gger
@Myrtus0x
@malwrhunterteam
@pmelson
@MalGamy12
@siri_urz
@struppigel
@fr0gger_
@0xbahaa
@nu11charb
@hasherezade
@th3_protoCOL
@cyb3rops
@kienbigmummy
My YARA rule targets AsyncRAT successfully identified 208 samples.
Hunt Results:
Total Matches: 208
New (Not on VirusTotal): 31
To support the community and streamline malware analysis, I have created a GitHub repo named IOCs.
IOC Repository—IOCs:
lnkd.in/d4wC8uNK
@James_inthe_box
@ViriBack
@nas_bench
@f0wlsec
@JAMESWT_MHT
@James_inthe_bo
@ViriBac
@cyber_anubi
@pmelso
@siri_ur
@fr0gger
@Myrtus0x
@malwrhunterteam
@pmelson
@MalGamy12
@siri_urz
@struppigel
@fr0gger_
@0xbahaa
@nu11charb
@hasherezade
@th3_protoCOL
@cyb3rops
@kienbigmummy
DCRAT welcomed in the detection party!!! During my daily malware research, I noticed that one of my YARA rules, which detects #DCRAT unpacked samples, just hunted 9 samples submitted to Hybird Sandbox — few of them aren't detcted as DCRAT in VT.
IOCs:
lnkd.in/dmCR9_xG
During my daily malware research, I got that one of my YARA rules, detect #AsyncRAT unpacked, had identified 23 fresh samples submitted to the Hybrid Sandbox, all have the same family detection on VT and triage with no FPs with any RAT families.
IOCs:
lnkd.in/g4UFBFjr
During my daily malware research, I noticed that one of my YARA rules, which detects #aurora stealer unpacked samples, just hunted 3 fresh samples submitted to Hybird Sandbox — all of which have 0 detections on VirusTotal at the time of analysis.
#iocs
linkedin.com/posts/apophis13…
I encountered a case of a PowerShell script, the script found at a suspicious URL with zero antivirus detection, that installs Tactical RMM software configured to connect to an unauthorized command and control server.
linkedin.com/posts/apophis13…
