@Ledtech3

System Repair, Windows system tools ,Security research. IDA Challenged.

pcsxcetrasupport3.wordpress.com/
Joined December 2015
  • Tweets31.3K
  • Following288
  • Followers3.5K
3.4KMedia
As others have mentioned, the "presidents" #qakbot #qbot distribution (obama221) is back to using "DLL Search Order Hijacking" today (see screenshot). Here are the IOCs: github.com/executemalware/Ma…
10
1
44
Anyone seeing #Socgholish using localsys-shield[.]com today?
1
2
David Ledbetter retweeted
Kelsey@k3dg314 Nov 2022
#IcedID mixing it up today with CHM files BotID: 1609463178 Loader C2: trolspeaksunt\.com pw-protected, zipped ISO attachments tria.ge/221114-xg9eaada24/be… bazaar.abuse.ch/sample/0306e…
13
1
32
David Ledbetter retweeted
hasherezade
@hasherezade14 Nov 2022
I added my solution for the Task 8: hshrzd.wordpress.com/2022/11… // #FlareOn9

Flare-On 9 – Task 8

For those of you who don’t know, Flare-On is an annual “reverse engineering marathon” organized by Mandiant (formerly by FireEye). It runs for 6 weeks, and contains usually 10-12 tasks of inc…

hshrzd.wordpress.com
hasherezade
@hasherezade12 Nov 2022
so, #FlareOn9 is over! congrats to all the finishers! you can find some of my solution here: hshrzd.wordpress.com/tag/fla… (work-in-progress, I will be adding more)

FlareOn9 – hasherezade's 1001 nights

hshrzd.wordpress.com
3
10
47
David Ledbetter retweeted
hasherezade
@hasherezade12 Nov 2022
so, #FlareOn9 is over! congrats to all the finishers! you can find some of my solution here: hshrzd.wordpress.com/tag/fla… (work-in-progress, I will be adding more)

FlareOn9 – hasherezade's 1001 nights

hshrzd.wordpress.com
29
1
139
David Ledbetter retweeted
Kirk Sayre@bigmacjpg11 Nov 2022
New #socgholish stage 3 C2 seen today. Block all *[.]rate[.]coinangel[.]online .
5
17
David Ledbetter retweeted
Germán Fernández
@1ZRR4H10 Nov 2022
Malware dirigido a empresas en Perú 🇵🇪 email > html > zip +password > vbs Descarga desde (#geofenced): /sunat-mail.xyz/2/ /easynsecureinvest.com/cobr/?id=1 Payloads/C2 desde: /gringox1.chickenkiller.com/g1/ +Header: UA-CPU Samples: bazaar.abuse.ch/browse/tag/g… Sin atribución 🤔
4
21
1
36
David Ledbetter retweeted
ExecuteMalware@executemalware9 Nov 2022
Here are some #icedid #bokbot IOCs from today. Arrived via email with a password protected .zip file attachment. github.com/executemalware/Ma…
10
20
David Ledbetter retweeted
Cryptolaemus@Cryptolaemus19 Nov 2022
new Emotet E5 urls detected. [DLL] (1/2) hxxp://www[.]muyehuayi[.]com/cmp/8asA99KPsyA/v6lUsWbLen/ hxxps://wijsneusmedia[.]nl/cgi-bin/kFB/ hxxp://concivilpa[.]com[.]py/wp-admin/i3CQu9dzDrMW/
1
5
12
David Ledbetter retweeted
Kelsey@k3dg38 Nov 2022
#Bumblebee HTML Attachments rolling in. general pattern: Document_[0-9]{4]_Scan_(Nov8)\.html Looks like some updated evasion in this sample. bazaar.abuse.ch/sample/99dee…

MalwareBazaar - Document_3944_Scan_(Nov8).html (BumbleBee)

Document_3944_Scan_(Nov8).html has been detected as BumbleBee by MalwareBazaar

bazaar.abuse.ch
2
13
35
David Ledbetter retweeted
Fate112@tosscoinwitcher7 Nov 2022
Also an few #Emotet today. @James_inthe_box @pr0xylife @0xToxin @0n315 @Cryptolaemus1 @JRoosen All of the sheets are visible in this one and each is the same as sheet 1? Did Ivan do a drunk again? tria.ge/221107-xd7raaceb2/be…
2
16
David Ledbetter retweeted
Kelsey@k3dg37 Nov 2022
#TA551 HTML Attachments incoming ID 1559130321 #IcedID Loader C2: anisamnatyrel\.com bazaar.abuse.ch/sample/8df33… tria.ge/221107-whz2kaagd2/be…
18
35
David Ledbetter retweeted
SentinelOne
@SentinelOne5 Nov 2022
🏭 In May, SentinelLabs has investigated a supply-chain attack against the Rust development community that we refer to as ‘CrateDepression’. Learn more sentinelone.com/labs/cratede… @LabsSentinel #infosec #cybersecurity #supplychain

CrateDepression | Rust Supply-Chain Attack Infects Cloud CI Pipelines with Go Malware | SentinelOne

Software developers using GitLab CI are being targeted with malware through a typosquatting attack, putting downstream users at risk.

sentinelone.com
17
24
David Ledbetter retweeted
Filescan.io@filescan_itsec4 Nov 2022
[UPDATE] Here's a #maldoc with (still) live C2 that is quite evasive and shows the detection capability ex-OSINT. Download URL has a "ski" gTLD. Download the sample with a user account (it's not on VT) for free: filescan.io/uploads/6365860b… // #DFIR #malware #analysis
1
11
1
24
anyone know of companies hiring director level folks? ideally mobile/web work? i have a good friend looking and he'd be an epic hire.
3
11
1
13
David Ledbetter retweeted
Florian Roth ⚡️
@cyb3rops4 Nov 2022
Noticed an interesting registry export with powershell loader working completely on data stored in the registry Reg export hastebin.com/jadunepoke.prop… Sample virustotal.com/gui/file/6702…
3
34
93
David Ledbetter retweeted
Chris@phage_nz4 Nov 2022
Saw a couple of Emotet messages land here this afternoon. First from this recent revival. Thread hijacking. XLM4.0 maldoc attachment. Epoch4 botnet. Sample: tria.ge/221104-m3qtyseea2
10
1
22
David Ledbetter retweeted
ExecuteMalware@executemalware3 Nov 2022
I also received a handful of #emotet (E4) emails today. I saw traffic to the same C2 as yesterday. Here are the IOCs: github.com/executemalware/Ma…
10
30
David Ledbetter retweeted
InQuest@InQuest3 Nov 2022
Over 400 Emotet samples available for download on InQuest Labs (unique by hash, but not by content): labs.inquest.net/dfi/search/… Among them are 44 payload URLs, all on compromised websites, we'll update this list periodically: inquest-labs.notion.site/202…
3
18
2
55
David Ledbetter retweeted
James@James_inthe_box3 Nov 2022
Some fresh (2022-11-02 18:22:43) #cryptbot in this run: app.any.run/tasks/eebd8da8-8… payload: http://okwydg05[.]top/amyous.dat c2: http://towspd42[.]top/gate.php

Analysis file (MD5: F8165DE24870859CE07B94948CD336B5) Malicious activity - Interactive analysis...

Interactive malware hunting service. Live testing of most type of threats in any environments. No installation and no waiting necessary.

app.any.run
1
4
10
Load more