ps66uk retweeted
#MalwareChallenge
What is this Java #malware
(besides "Branchlock Obfuscator")
C2: {italimmuo,skadooo}.ddns[.]net:{1006,8793}
ZIP (mail attach)
virustotal.com/gui/file/76cf…
JAR Sample:
virustotal.com/gui/file/eb51…
C2 pcap:
virustotal.com/gui/file/7f47…
No IDS hits 🤔 (malware specific)
ps66uk retweeted
#MalwareChallenge
Password protected #malware ZIP attach with unknown password.
Who can provide the password or EXE sample?
ZIP sample provided here:
bazaar.abuse.ch/sample/23894…
RFQ.exe
2637855 bytes
Date: 2024-09-24 05:48:58
ps66uk retweeted
So @censysio just deployed the "suspicious-open-dir" label to their search engine.
So far it appears a game changer, giving very solid hit rates on finding malicious infrastructure.
So for today, this will be a thread documenting my findings using the new feature.
1/x
ps66uk retweeted
Appreciation post time.
There are a lot of security researchers who have an entire career focused on tracking botnets, or information stealers, and do so for years with little to no recognition. We'd like to take a minute to shoutout a few people who we think are doing great stuff and not getting enough love and respect.
- @malwrhunterteam, consistently for years tracking malware, initial access malware, and openly sharing information it
- @Max_Mal_, @Cryptolaemus1 (and whoever is part of the group), @JAMESWT_MHT, and @1ZRR4H, for ruthlessly tracking many of the big names botnets and loaders and openly sharing information on it
- @JaffaCakes118, and @Neiki__, they both are some of the largest malware collectors and distributors. They've freely shared millions of malware samples for years.
- @Gootloader, actively tracking Gootloader, the initial access malware used by many ransomware groups, and doing so, for free, for literally years.
- @bmmaloney97, the number one expert in Windows One Drive analysis and internal. He has openly and freely shared his research for years.
- @RussianPanda9xx, for actively tracking Lumma Stealer (and tons of others), for what feels like forever, and openly sharing information and updates on the malware.
There's so many more we could shoutout, but we can't think of anymore off the top of our our head. But your work is respected and remembered. Thank you so much for the things you do for the researchers and the world.
ps66uk retweeted
📌 Uncovering ongoing #phishing attacks distributing HTM and HTML files – #ExploreWithANYRUN
⚠️️ Over the past few weeks, we’ve been tracking several active campaigns spreading #malicious documents named “Play_VM”, “payment", “PurchaseOrder”, etc.
Take a look at the examples:
1️⃣ The #script is not hidden, but pushed down to the bottom of the page with weak obfuscation:
app.any.run/tasks/639968d4-a…
👉 #IOC: Redirect to http[s]://ythcongress[.]com/wpfile/unsubscribe?277=YWFiYXphQGdlbWluaS1ob2xkaW5nLmNvbQ
2️⃣ The #obfuscation includes many misleading comments to hinder analysis:
app.any.run/tasks/518835ff-a…
3️⃣ Unobfuscated #phish page containing #BASE64-encoded images:
app.any.run/tasks/f7433771-6…
👉 IOC: Redirect to http[s]://sgsfserer[.]mypi[.]co/orvc/pdfz[.]php
4️⃣ Fully #obfuscated script without an HTML body:
app.any.run/tasks/87546a76-0…
👉 Fetches and decrypts fake PDF images along with scripts from the body
5️⃣ Large gaps between lines on the page make it hard to read the file:
app.any.run/tasks/f295cb46-a…
👉 IOC: Redirect to http[s]://href[.]li/?http[s]://yMU8H[.]inarmitat[.]com/Tfsjj/iligai.jigshj@pilai[.]com
Analyze and investigate the latest #malware and phishing attacks with #ANYRUN 🛡️
ps66uk retweeted
Replying to @sans_isc
Nice article @xme!
To remove bloat from PE files, there's also the debloat tool by @SquiblydooBlog:
github.com/Squiblydoo/debloa…
ps66uk retweeted
So after the investigation by #Qurium and #Correctiv, the Bayrische Verfassungsschutz (LfV Bayern) seized 2 servers operated by #Doppelgaenger #disinformation group.
The LfV basically proved involvement of #Russia.
1/2
ps66uk retweeted
In 1974, I co-founded Métal Hurlant together with Moebius, Jean-Pierre Dionnet and Bernard Farkas 🚀 it was a dream come true. It became a beacon for sci-fi and fantasy art. Proud to be part of such a revolutionary movement
ps66uk retweeted
We're launching major upgrades to our scanning engine! 🌐 Live Browsing: Interact with websites in real-time, dismiss alerts, solve CAPTCHAs, and more. Real Device Scanning: High-fidelity scans with actual mobile devices. Blog: urlscan.io/blog/2024/07/08/l…
ps66uk retweeted
4. Beowulf, Unknown
This legendary poem tells of the hero Beowulf, who leads a quest to save the Danish people from the monster Grendel.
Beowulf's list of creatures heavily influenced the creation of some of the races in Middle-Earth.
ps66uk retweeted
📌 Abuse of Telegram and Discord messengers by #malware
#ARfinds – our new hashtag for interesting samples we find
Attackers use instant messengers to store both stolen data and attack logs, as well as server addresses used in the process of stealing the victim’s data.
📃 We have collected for you the top submission stealers over the last week with this feature:
BlankGrabber (Exfil) app.any.run/tasks/52737c82-e…
Agent Tesla (Exfil) app.any.run/tasks/2139be2c-2…
XWorm (Log) app.any.run/tasks/f10d42a1-b…
DarkCrystal (Log) app.any.run/tasks/5fac9cf3-f…
Umbral-Stealer (Exfil) app.any.run/tasks/439ba696-3…
Vidar (DDR) app.any.run/tasks/a032380d-6…
WhiteSnake (Log) app.any.run/tasks/002acbf4-e…
Creal-Stealer (Exfil) app.any.run/tasks/1d2b547d-0…
🔍 #TI search strings:
ThreatName:"telegram" and ThreatName:"stealer"
ThreatName:"discord" and ThreatName:"stealer"
ThreatName:"discordgrabber"
MITRE:"T1102"
⬇️ Try #ANYRUN's Threat Intelligence Lookup yourself intelligence.any.run/analysi…
We welcome submission links with abuse cases in the comments 👇
ps66uk retweeted
Today @RecordedFuture released a research paper on using malware infostealer logs to identify CSAM consumers.
RecordedFuture identified over 3,000 individuals purchasing CSAM. All users were reported to their respective law enforcement agency.
recordedfuture.com/caught-in…
ps66uk retweeted
CVE-2024-4577, our rapid analysis of a vuln found by @orange_8361
labs.watchtowr.com/no-way-ph…
Discover the latest in #ransomware and data leak site monitoring with our May 2024 updates.
Curious to see the data for yourself? Experience it firsthand with a free trial for your cybersecurity experts at ecrime.ch. Don't miss out!
ps66uk retweeted
Announcing the JA4+ Database!
ja4db.com
Under *very* active development but ready for use. Expect orders of magnitude more data and JA4+ combinations over the next few months. I recommend downloading the DB and loading up in your data explorer of choice for now.
Everyone has a different use-case for JA4+ so we're trying to make it easy to find what you're looking for. Below are some examples you can do in a data explorer like Elastic.
JA4 to JA4H
JA4 to User-Agent String
JA4 to Application
JA4 to Library
JA4T to Device
JA4X to Device
JA4X to Application
JA4X to Issuers
JA4X to JA4T
etc. etc. etc.
There are so many combinations and use cases for each.
Please send me any feedback, improvement suggestions.




































