@ps66uk@infosec.exchange

Joined August 2017
#MalwareChallenge What is this Java #malware (besides "Branchlock Obfuscator") C2: {italimmuo,skadooo}.ddns[.]net:{1006,8793} ZIP (mail attach) virustotal.com/gui/file/76cf… JAR Sample: virustotal.com/gui/file/eb51… C2 pcap: virustotal.com/gui/file/7f47… No IDS hits 🤔 (malware specific)
5
3
1
17
4,648
#MalwareChallenge Password protected #malware ZIP attach with unknown password. Who can provide the password or EXE sample? ZIP sample provided here: bazaar.abuse.ch/sample/23894… RFQ.exe 2637855 bytes Date: 2024-09-24 05:48:58
1
3
1
3
4,346
New timer 👀 operation-endgame.com/
5
1
20
3,980
So @censysio just deployed the "suspicious-open-dir" label to their search engine. So far it appears a game changer, giving very solid hit rates on finding malicious infrastructure. So for today, this will be a thread documenting my findings using the new feature. 1/x
13
214
13
1,019
139,042
Appreciation post time. There are a lot of security researchers who have an entire career focused on tracking botnets, or information stealers, and do so for years with little to no recognition. We'd like to take a minute to shoutout a few people who we think are doing great stuff and not getting enough love and respect. - @malwrhunterteam, consistently for years tracking malware, initial access malware, and openly sharing information it - @Max_Mal_, @Cryptolaemus1 (and whoever is part of the group), @JAMESWT_MHT, and @1ZRR4H, for ruthlessly tracking many of the big names botnets and loaders and openly sharing information on it - @JaffaCakes118, and @Neiki__, they both are some of the largest malware collectors and distributors. They've freely shared millions of malware samples for years. - @Gootloader, actively tracking Gootloader, the initial access malware used by many ransomware groups, and doing so, for free, for literally years. - @bmmaloney97, the number one expert in Windows One Drive analysis and internal. He has openly and freely shared his research for years. - @RussianPanda9xx, for actively tracking Lumma Stealer (and tons of others), for what feels like forever, and openly sharing information and updates on the malware. There's so many more we could shoutout, but we can't think of anymore off the top of our our head. But your work is respected and remembered. Thank you so much for the things you do for the researchers and the world.
23
174
4
973
82,386
📌 Uncovering ongoing #phishing attacks distributing HTM and HTML files – #ExploreWithANYRUN ⚠️️ Over the past few weeks, we’ve been tracking several active campaigns spreading #malicious documents named “Play_VM”, “payment", “PurchaseOrder”, etc. Take a look at the examples: 1️⃣ The #script is not hidden, but pushed down to the bottom of the page with weak obfuscation: app.any.run/tasks/639968d4-a… 👉 #IOC: Redirect to http[s]://ythcongress[.]com/wpfile/unsubscribe?277=YWFiYXphQGdlbWluaS1ob2xkaW5nLmNvbQ 2️⃣ The #obfuscation includes many misleading comments to hinder analysis: app.any.run/tasks/518835ff-a… 3️⃣ Unobfuscated #phish page containing #BASE64-encoded images: app.any.run/tasks/f7433771-6… 👉 IOC: Redirect to http[s]://sgsfserer[.]mypi[.]co/orvc/pdfz[.]php 4️⃣ Fully #obfuscated script without an HTML body: app.any.run/tasks/87546a76-0… 👉 Fetches and decrypts fake PDF images along with scripts from the body 5️⃣ Large gaps between lines on the page make it hard to read the file: app.any.run/tasks/f295cb46-a… 👉 IOC: Redirect to http[s]://href[.]li/?http[s]://yMU8H[.]inarmitat[.]com/Tfsjj/iligai.jigshj@pilai[.]com Analyze and investigate the latest #malware and phishing attacks with #ANYRUN 🛡️
1
18
46
4,683
So after the investigation by #Qurium and #Correctiv, the Bayrische Verfassungsschutz (LfV Bayern) seized 2 servers operated by #Doppelgaenger #disinformation group. The LfV basically proved involvement of #Russia. 1/2
1
2
13
2,425
In 1974, I co-founded Métal Hurlant together with Moebius,  Jean-Pierre Dionnet and Bernard Farkas 🚀 it was a dream come true. It became a beacon for sci-fi and fantasy art. Proud to be part of such a revolutionary movement
66
618
43
3,496
167,200
IT teams waking up this morning
686
15,295
1,269
95,595
8,531,398
We're launching major upgrades to our scanning engine! 🌐 Live Browsing: Interact with websites in real-time, dismiss alerts, solve CAPTCHAs, and more. Real Device Scanning: High-fidelity scans with actual mobile devices. Blog: urlscan.io/blog/2024/07/08/l…
4
91
11
332
49,709
4. Beowulf, Unknown This legendary poem tells of the hero Beowulf, who leads a quest to save the Danish people from the monster Grendel. Beowulf's list of creatures heavily influenced the creation of some of the races in Middle-Earth.
4
26
1
633
45,542
📌 Abuse of Telegram and Discord messengers by #malware #ARfinds – our new hashtag for interesting samples we find Attackers use instant messengers to store both stolen data and attack logs, as well as server addresses used in the process of stealing the victim’s data. 📃 We have collected for you the top submission stealers over the last week with this feature: BlankGrabber (Exfil) app.any.run/tasks/52737c82-e… Agent Tesla (Exfil) app.any.run/tasks/2139be2c-2… XWorm (Log) app.any.run/tasks/f10d42a1-b… DarkCrystal (Log) app.any.run/tasks/5fac9cf3-f… Umbral-Stealer (Exfil) app.any.run/tasks/439ba696-3… Vidar (DDR) app.any.run/tasks/a032380d-6… WhiteSnake (Log) app.any.run/tasks/002acbf4-e… Creal-Stealer (Exfil) app.any.run/tasks/1d2b547d-0… 🔍 #TI search strings: ThreatName:"telegram" and ThreatName:"stealer" ThreatName:"discord" and ThreatName:"stealer" ThreatName:"discordgrabber" MITRE:"T1102" ⬇️ Try #ANYRUN's Threat Intelligence Lookup yourself intelligence.any.run/analysi… We welcome submission links with abuse cases in the comments 👇
1
9
1
24
2,808
Today @RecordedFuture released a research paper on using malware infostealer logs to identify CSAM consumers. RecordedFuture identified over 3,000 individuals purchasing CSAM. All users were reported to their respective law enforcement agency. recordedfuture.com/caught-in…
21
136
12
599
57,442
Discover the latest in #ransomware and data leak site monitoring with our May 2024 updates. Curious to see the data for yourself? Experience it firsthand with a free trial for your cybersecurity experts at ecrime.ch. Don't miss out!
2
2
1,715
Announcing the JA4+ Database! ja4db.com Under *very* active development but ready for use. Expect orders of magnitude more data and JA4+ combinations over the next few months. I recommend downloading the DB and loading up in your data explorer of choice for now. Everyone has a different use-case for JA4+ so we're trying to make it easy to find what you're looking for. Below are some examples you can do in a data explorer like Elastic. JA4 to JA4H JA4 to User-Agent String JA4 to Application JA4 to Library JA4T to Device JA4X to Device JA4X to Application JA4X to Issuers JA4X to JA4T etc. etc. etc. There are so many combinations and use cases for each. Please send me any feedback, improvement suggestions.
7
88
3
241
25,653
hello hello Mr. Mors. You there?
2
8
2
20
19,045
Odd also has these names:
2
3
5
4,047