@RedDrip7

Technical Twitter of QiAnXin Technology, leading Chinese security vendor. It is operated by RedDrip Team which focuses on malware, APT and threat intelligence.

ti.qianxin.com
Joined April 2018
  • Tweets488
  • Following29
  • Followers16.7K
367Media
#APT_Digital_Weapon We have categorized #IOCs, mostly #APT related, from public resources and sample details are available on #VT. The #GitHub project will keep updated and hope to help the security community fight against malware and targeted attack. github.com/RedDrip7/APT_Digi…
6
125
8
214
🚨 Free AI threat analyst from QiAnXin. Built on 10yr data + QGPT. Chat-to-judge, covers all IOCs, APT, logs. automated workflows, 32+ scenarios. Saves 70% time. Try now: expert.qianxin.com #Cybersecurity #AI #ThreatHunting
1
3
12,353
It seems that #APT #Donot also used .ACCDR files for initial access. Executed codes are similar to previous samples. 0ecfdece9402c4f8732a4581baf4a927 3c0f8dc931cdc76c9d101b41c258a4dc mtsspk[.net hxxps://mtsspk[.net/TrDGjfgtxkdl3Pl47enr/
RedDrip Team@RedDrip7Mar 3
Replying to @RedDrip7
Related 7c5116f2412ebcbce7ab99ccfbb2a21a 79ca03e5f149f6cddfbc92262d3f6da9 officesite.onrender[.]com 8b9a7fec4bbb53bb7f9b8c673fd4ab52 mnjkuilhgftrew.baiduwebhost[.]com
15
43
22,164
#APT #Bitter ACCDR downloads DLL and uses fsquirt.exe to side-load it -> DLL uses bitsadmin to download EXE -> EXE executes shellcode in a unique way 27f68bcaec9d2085f8804021da8ab70c 0dc4e8723e7860aeaf420cd644c8b1db e25095de50ef896946466f7f5dd47f1a bravojacksonmentor[.com
9
34
18,801
#APT #Bitter 776302eeef68e4d5132424de18976845 4b381a89dc0f3fd44286410d7c826073 grandinaspectrum[.com www.grandinaspectrum[.com/hgdtfjgtyf.php?d=%username%_%computername%
6
17
10,822
#APT #Patchwork #Spyder added codes to detect running environment. 3f4221dacc105466932db94b9b210b84 hxxp://cloudwindowapps[.com/enclose-pdf
14
2
64
25,802
#APT #OceanLotus sample created in 2025 was uploaded to VT last month. DLL decrypts and executes shellcode in memory. C2 seems to be inactive now. 8c13ce3a5f579a4fb4d25222412b775a 152.32.144[.]5:443
19
78
12,177
#APT #Patchwork 2d31067df7ccbcd6eaef1025098ed928 (dll) sandtribes[.org Similar to previous samples
RedDrip Team@RedDrip713 Oct 2025
#APT #Patchwork 076ab63979336e827abc96fcd4fbf534 (lnk) e066b5a875d08507832fc7ed29a7aa30 (dll) b7c2b4d14112356a3d327e99ee97d627 adskochbus[.org theserveunity[.org
9
22
7,077
#APT #Bitter 912804d58dec8c2fdc909f66f900f1a4 ("DraftLetter.accdr") kuraviewconcepts[.com www.kuraviewconcepts[.com/fesrh.php?d=%username%_%computername%
6
15
5,497
#APT #MysteriousElephant 96b15bb9ce8ef7c41b708b1620029d99 (chm) 91693c2d5a4b7d090fe06cc7382dfc18 (exe) 188.214.33[.]170:443
4
14
4,965
#APT #Bitter used windows script file (wsf) to create scheduled task. Malicious code is hidden in plenty of junk code. 4f23a03843c9ece10de1831c84e48244 (rar) 37cfab987b088c7dc9555f73d6d47acc (wsf) www.caravelcruiser[.]com/gbv.pp?uq=%computername%
1
10
42
6,022
Other samples VHDX -> LNK -> jse. Malicious code is hidden after a lot of blank space. 8cb6dee642f510d20825e49435e4f814 (rar) 50c8856d31e28d40c78c6d25afd9b2cb (jse) www.haburyohoteam[.]com/jvdmhawme.okjhvthfv?d=%username%_%computername% Both C2 domains resolve to 104.243.38[.38
2
5
15
3,146
#APT #Donot VBA -> shellcode -> download other payloads 301e257e8ffb69bc2b3a7040053b9a8e 6f3b51b1d9fb1795aa5b1d79113db3f7 63f6302c60c2c0c6e4c83c9b50784c38 0628a33e3f3b08bdff708059b8e00dea ec188d5fcbbf264eeb4025d266d424b6 locaplayz[.]info reggysolution[.]info
1
11
55
5,511
#Malware #SmartLoader disguised using OpenClaw-related topics Threat actor built malicious Github repo on the basis of a legimate one. Report: mp.weixin.qq.com/s/q-86GR8g_… hxxp://89.169.12[.235/api/ hxxp://213.176.73[.145/api/ hxxp://213.176.73[.162/api/
5
35
4,642
#Malware #DCRAT JS -> powershell extracts loader from remote JPEG -> loader gets DCRAT from Github ("albaluzzgom-byte/032026666") 1bfed54ae970308843d0e55ee96eddd9 (js) 8159845a1821df1e5067703af2fa0fb8 (loader) 05aff2b6242e9b2618ade8d34178d46a (DCRAT) vps30002026.kozow[.com:3000
1
14
59
5,725
Related #APT malware (DLL written in Rust) 9a95078a7a5f1045c61fe95ab308ec3f a70e0e057bb9cc33913ca035fb3a1138 hxxps://support.cc-cvbs-sco.workers[.dev:443/api/analytics/collect hxxps://cms.bahria-edu.workers[.dev:443/api/analytics/collect
RedDrip Team@RedDrip7Jan 19
Suspected #APT #Sidewinder VBA macros in .xls downloads EXE + malicous DLL (Rust trojan). Cloudflare workers domain is abused for C2 infra. 753bb1b5d8b879f478babb21ed4d9696 (xls) f310ee836f88cc43d3939f8a88b20495 (dll) *.goldibrowhoami.workers[.dev *.desco-gov-bd.workers[.dev
11
70
7,520
#APT #Bitter 3ee66f56461fc046f600230d11ebe731 (MSI) f57975b8bc1169b35ae17b975327195e (EXE) hxxps://99media.com[.]pk/scvz zoemagicbook[.]com
2
10
28
3,903
#APT #Lazarus #IoC d6296ad786e76b2dd1d7e6de897491d4 45[.]83.140.55:1244
1
8
1
51
12,899
Suspected #APT #Donot samples VBA uses plenty of comment statements to seperate malicious code which creates scheduled tasks and drops BAT files. cab89ee28820b38d1626806f9c1acb9f e5f0a8b4ab983a1457ec2b0a4bff89eb 04cce783b42af18f9208fe5527fa04a8 shop.gladiolus[.]live
2
11
30
6,073
Related 7c5116f2412ebcbce7ab99ccfbb2a21a 79ca03e5f149f6cddfbc92262d3f6da9 officesite.onrender[.]com 8b9a7fec4bbb53bb7f9b8c673fd4ab52 mnjkuilhgftrew.baiduwebhost[.]com
1
1
5
24,637
#APT #Bitter trojan 8523f2ff3ff13e510a9bf75665562b3b ashersoftlib[.]com:44908
5
34
4,922
Load more