@HazMalware

threat research and malware analysis

 hex editor
hazmalware.wordpress.com
Joined November 2015
  • Tweets2.7K
  • Following149
  • Followers6.1K
225Media
hazmalware retweeted
herrcore
@herrcore8 Dec 2022
🔴We are live rn! Join us with special guest @mrexodia for a deep dive into hacking #ChatGPT Let’s see far off the rails we can push this thing! twitch.tv/oalabslive
6
2
22
👀
URSNIFleak@URSNIFleak7 Dec 2022
URSNIF member 2 of 4 - Meet Borisenko aka mrgreen. Next release gets bigger. 6 hours time...
2
9
hazmalware retweeted
Max_Malyutin@Max_Mal_8 Dec 2022
#Bumblebee Infection Flow TTPs🐝 [+] Mark-of-the-Web Bypass: IMG (T1553.005) [+] Malicious File: LNK (T1204.002) [+] Windows Command Shell: BAT (T1059.003) [+] Rename System Utilities: copy & rename (T1036.003) [+] Scheduled Task: schtasks.exe (T1053.005) [+] Rundll32(T1218.011)
Unit 42@Unit42_Intel7 Dec 2022
2022-12-07 (Wednesday): #Bumblebee malware from 2022-12-06 led to #CobaltStrike activity on 23.108.57[.]213:443 using ceyuvigi[.]com. IoCs available at: bit.ly/3Y3tj75
Folder showing hidden files, including the Bumblebee DLL, and a Windows shortcut that runs matrix.bat, which runs the Bumblebee DLL

ALT Folder showing hidden files, including the Bumblebee DLL, and a Windows shortcut that runs matrix.bat, which runs the Bumblebee DLL

Image shows the scheduled task to keep the Bumblebee malware infection persistent, as well as the contents of the ProgramData folder, where a copy of rundll32.exe exists along with the Bumblebee malware DLL

ALT Image shows the scheduled task to keep the Bumblebee malware infection persistent, as well as the contents of the ProgramData folder, where a copy of rundll32.exe exists along with the Bumblebee malware DLL

Wireshark pcap showing Bumblebee C2 traffic and where Cobalt Strike traffic starts

ALT Wireshark pcap showing Bumblebee C2 traffic and where Cobalt Strike traffic starts

Certificate information for ceyuvigi[.]com

ALT Certificate information for ceyuvigi[.]com

1
33
93
hazmalware retweeted
JAMESWT@JAMESWT_WT7 Dec 2022
Replying to @c_APT_ure
is not new is a VBS that load AgentTesla and use telegram as C2
1
1
8
hazmalware retweeted
JAMESWT@JAMESWT_WT7 Dec 2022
Mentioned Samples + ⚠️extra 👇 bazaar.abuse.ch/browse/tag/1… #opendir 💠116.203.19.]97/1/ + ⚠️https://raw.githubusercontent.]com/alibaba2044/hauL2/main/wininfo64.zip 🆘https://github].com/alibaba2044?tab=repositories 👇 bazaar.abuse.ch/browse/tag/g… cc @reecdeep @James_inthe_box
Cert AgID@AgidCert6 Dec 2022
Campagna Malware italiana - Trojan osservato per la prima volta Link: ZIP (con password) ⚔️ TTP: Email > link > zip > lnk + bat 🔍 Occorre analizzare in tutto 4 stadi per giungere al malware finale 💣 IoC cert-agid.gov.it/wp-content/… ℹ️ Info su Telegram t.me/certagid/389
2
8
1
23
hazmalware retweeted
lc4m@luc4m1 Jul 2022
nice catch! tracking #ursnif #isfb version:2.50 build:239 group:3000 [Jun 22 2022][WJWoBDOsnmP2wric][/drew/] 5382ef90ef9a33baca2ed2119059154f ioc down here 👇🧐 @felixw3000 @avman1995 @HazMalware @Mesiagh @abuse_ch @malware_traffic
JAMESWT@JAMESWT_WT29 Jun 2022
Mentioned Samples #DHL #ursnif #gozi #isfb #Italy Botnet 3000 build 250239 Xls bazaar.abuse.ch/sample/a6fdd… Dll bazaar.abuse.ch/sample/71288… C2 194.76.225.]112 194.76.225.]113 46.21.153.]203 xmhomestilesh[.at geodezhols[.at 46.21.153.]221 194.76.224.]26 cc @felixw3000 @58_158_177_102
6
13
hazmalware retweeted
lc4m@luc4m17 Dec 2019
The Momentum #botnet uses 36 different methods to launch #DDoS. Nice summary @gbhackers_news ! @dvk01uk @James_inthe_box @JAMESWT_M @malware_traffic @Racco42 @makflwana @pollo290987 @Antelox @bad_packets @HazMalware @Mesiagh
2
10
17
hazmalware retweeted
lc4m@luc4m8 Feb 2022
tracking.. #ursnif #isfb version:2.50 build:225 group:7579 [IL2ue0q04g35Es2C][/drew/][Feb 1 2022] #⃣1fb95166dda235cb6e5279db1b72722a @felixw3000 @VK_Intel @HazMalware @Mesiagh @abuse_ch @malware_traffic
reecDeep@reecdeep2 Feb 2022
🔥Massive #malspam titled "Emergenza #COVID-19" targeting #Italy 🇮🇹 Please pay attention as attached ZIP file is a downloader for #Gozi #Ursnif #ISFB #Malware. 1⃣ hxxps://linepremium.bar/readme.txt 2⃣ hxxps://linkspremium.bar/readme.txt #infosec #cybersecurity #infosecurity
2
3
8
hazmalware retweeted
lc4m@luc4m25 Jan 2022
tracking.. #ursnif #isfb version:2.60 build:224 group:20000 [gs0W1Y167ccgpQOG][Dec 26 2021][/drew/] #⃣b6f0fc5638a110abac1a54805f77e786 @felixw3000 @VK_Intel @HazMalware @Mesiagh @abuse_ch @malware_traffic
JAMESWT@JAMESWT_WT24 Jan 2022
"BRT Bartolini" #malspam #italy #Gozi #ISFB #Ursnif 🇮🇹 Xls bazaar.abuse.ch/sample/e68fc… Dll bazaar.abuse.ch/sample/06e26… Dll Url bizgroupe[.com geofenced ita + ip blacklist C2 giporedtrip.[at giporedtrip.[at > Botnet 20000 build 260224 cc @felixw3000 @fumik0_
4
11
hazmalware retweeted
Paul Melson@pmelson17 Dec 2021
I don’t have a SoundCloud, but if you want to click on something, it would be pretty great if you decided to help out some fellow Americans in dire need right now: secure.kentucky.gov/formserv…
1
3
14
hazmalware retweeted
lc4m@luc4m15 Dec 2021
tracking.. #ursnif #isfb version:2.60 build:222 group:8899 [56473871MNTYAIDA][Dec 6 2021] ac57d694b86d8532b38d3d62f6de3afc @felixw3000 @VK_Intel @HazMalware @Mesiagh @abuse_ch @malware_traffic
1
10
1
23
Lots going in with logj4 but don't forget to look at the new patch Tuesday from @MsftSecIntel Includes CVE-2021-43890 Windows AppX being exploited in the wild.
1
3
7
hazmalware retweeted
abuse.ch
@abuse_ch29 Sep 2021
QakBot + FeodoTracker = 💥 Feodo Tracker is now tracking #QakBot botnet C2s 🥳 👉 feodotracker.abuse.ch/browse… If you are already using Feodo Tracker's blocklist you automatically receive protection against QakBot botnet C2 traffic 🐸🔥 👉 feodotracker.abuse.ch/downlo…
2
49
3
88
New releases: #PESieve/#HollowsHunter 0.3.0: github.com/hasherezade/pe-si… & github.com/hasherezade/hollo… - among the new features: i.e. the support for the scan on inaccessible pages

Releases · hasherezade/pe-sieve

Scans a given process. Recognizes and dumps a variety of potentially malicious implants (replaced/injected PEs, shellcodes, hooks, in-memory patches). - hasherezade/pe-sieve

github.com
hasherezade
@hasherezade30 Jul 2021
Soon in #PEsieve - detection of implants in inaccessible pages (with new `/data 4` option)
3
58
1
178
hazmalware retweeted
lc4m@luc4m29 Jul 2021
tracking.. #ursnif #isfb version:2.50 build:207 group:8877 [30218409ILPAJDUR][Jul 5 2021][/images/] MB:0d68d238d713f63ff02be916ae633466 @malwrhunterteam @James_inthe_box @JAMESWT_MHT @malware_traffic @Racco42 @makflwana @pollo290987 @bad_packets @HazMalware @Mesiagh ioc 👇
JAMESWT@JAMESWT_WT28 Jul 2021
"Rimborso Riferimento PR44095U72Y8823" #enel #enelenergia #ursnif #gozi #isfb #italy 28_07_2021 Xlsm bazaar.abuse.ch/sample/1a186… Dll bazaar.abuse.ch/sample/9c408… Dll Urls geofenced ita + ip blacklist https://inthisplase.[com https://anybiznes.[com C2 zaluoa.[live daskdjknefjkewfnkjwe[.net
3
14
An #unkown #keylogger and #stealer in vb6: app.any.run/tasks/f403243a-e…
8
19
Correction on sample: This is not an APT28 sample. Apologies This was written by a dev at Meresburg University. There is also several ransomware samples written by them on VT as well. APT28/FANCY BEAR Zekapab CSharp Implant bc388933d56e7a7d3e2b6c97c5819539 virustotal.com/gui/file/c25e…
6
25
🔥#Clop Ransomware (CryptoMix) Linked Operation Takedown: From unknown ransomware, only @malwrhunterteam and I tracked early in 2019 as a signed malware - turned to be multimillion operation with ... Tesla car & lavish lifestyle github.com/k-vitali/cryptomi… youtube.com/watch?v=PqGaZgep…

GitHub - k-vitali/cryptomix-clop-ransomware

Contribute to k-vitali/cryptomix-clop-ransomware development by creating an account on GitHub.

github.com
2
17
2
50
hazmalware retweeted
lc4m@luc4m11 May 2021
for tracking.. #ursnif #isfb version:2.50 build:196 group:8877 [May 5 2021][30218409ILPAJDUR][/greed/] MB:50a299d1e92d9205e123404c8e05904d @felixw3000 @VK_Intel @HazMalware @Mesiagh @abuse_ch @malware_traffic ioc 👇
JAMESWT@JAMESWT_WT11 May 2021
#BRT Big Wave "Fattura BRT S.p.A. n. 01962727 del 11/05/21" spread #ursnif #gozi #isfb Xlsm bazaar.abuse.ch/sample/05ed6… Dll bazaar.abuse.ch/sample/3b56b… Dll Url *IE+ITA+blacklist hXXps://fyntiki.com/ C2 worunekulo.[club horunekulo.[website cc @felixw3000 @58_158_177_102 @malware_traffic
1
8
2021-04-06: 🕶️🆕Introducing #Hancitor Loader aka "#MASSLOADER" Internal Project Name⚙️ 📧Spam: DocuSign Theme➡️Google Doc 🤔Filling in King #Emotet Loader King Void in 2021 Fueling High-Value Target Ransomware? ↘️Still largely same (➕ new "&EXT=" URI) vkremez.com/2018/11/lets-lea…
1
41
1
89
Load more