Last 5 Entries

ID User Tweet Date
1 nekomimimaiden 電車でD SS 13パッチ: https://www.dropbox.com/s/qrobg6bit8fmy45/dend_ss_ver113_all.zip?dl= 1 ハッシュ値: https://www.dropbox.com/s/wwp3tqx3g528fh2/dend_ss_ver113_check_sum_utf8.txt?dl= 1 カスペルスキー&ウイルストータル( https://www.virustotal.com/gui/file/b677418ffd65ec8f1952f33309733be871472e4dd5719dcba7b264c4a6412843/detection ) では脅威なし。 アップデートパス: https://twitter.com/nekomimimaiden/status/1366874644024725505/photo/1 2021-03-02 22:14:45
2 neonprimetime #malware received today 3/2/2021 subject: order 09748 Package attachment: invoice.jnlp download url: invoicesecure.net/documents https://www.joesandbox.com/analysis/361228/0/html https://www.virustotal.com/gui/file/91c8702137880cebf55f89e1d0b07df0c7c05b277850879384fa1dfe7470006c/community https://twitter.com/neonprimetime/status/1366868658954194945/photo/1 2021-03-02 21:50:58
3 bl4ckh0l3z @malwrhunterteam #donot confirmed. 💻 C2: shortler.xyz 2021-03-02 21:43:37
4 3eslan أفضل 6 مواقع لفحص جهازك وملفاتك أون لاين وإزالة الفيروسات بدون تثبيت أي شئ 1- https://metadefender.opswat.com/?lang= en 2 - https://virustotal.com/gui/home/search 3- https://pandasecurity.com/en/homeusers/solutions/cloud-cleaner/ 4- https://eset.com/uk/home/online-scanner/ 5- https://lite.al/jOTmV 6- https://virscan.org https://twitter.com/3eslan/status/1366857193904046083/photo/1 2021-03-02 21:05:24
5 dubstard 🎯 Fake Elon Musk "giveaway" scam ⚠ /ilogivemus-2021­.info ☣ AS50465 193.106.175.25 🌐 @regru 🖧 IQHost Ξ 0xeD80d06d49EFcB4FAc90546De2b8d71Bb2f724C0 ₿ 12Ss9yu4pvQWjQgNwzXpbt1LwsnWD9kXHf cc @ActorExpose @CryptoPhishing @CryptoScamDB @JAMESWT_MHT @sniko_ https://twitter.com/dubstard/status/1366851201686470658/photo/1 2021-03-02 20:41:36
6 neonprimetime live credential #phishing abusing @dropbox targeting @Office365 users final domain: 2wag32vqfdsv3nzermj9ba-on.drv.tw https://app.any.run/tasks/8fa4cbbb-a23d-4a7d-a2cf-14cddce73abc/ https://twitter.com/neonprimetime/status/1366848382153732102/photo/1 2021-03-02 20:30:23
7 HeliosCert @HeliosCert Sample analysed on #virustotal VirusTotal-Score: 66 VirusTotal: https://www.virustotal.com/gui/file/536e72b2445a6b84f17407affa4b6228eda08b7e60cd1bac9b02e4757bbebe15/detection/f-536e72b2445a6b84f17407affa4b6228eda08b7e60cd1bac9b02e4757bbebe15-1582092842 Threat: Ransom_WCRY.SMALYM (TrendMicro) 2021-03-02 20:30:02
8 InQuest If you are looking for a real fun #maldoc to analyze. take a look at this #LokiBot sample. Appears to have a @swiftcommunity transaction themed lure. https://labs.inquest.net/dfi/sha256/548296865b8b5a459b2b10452f1ae241e0a986f16bb926c0e32abede05382dc8 https://twitter.com/InQuest/status/1366848153203462146/photo/1 2021-03-02 20:29:29
9 wwp96 #bitrat @JAMESWT_MHT eni4.exe c2 via api.telegram.org hxxp://hk-chemlab.com/plugin/eni4.exe hxxp://hk-chemlab.com/plugin/best4.exe 2f97eae8d78bcbe6fcbb6e19be4bda85 7879ad6172d23092b29031d2bccaba26 - eni4.exe https://app.any.run/tasks/c56eff7f-f8c5-4c54-9ca4-4365650c380f/ 2021-03-02 19:57:28
10 wwp96 #LokiBot @hexlax @JAMESWT_MHT hxxp://gilardoni-it.xyz/MY/five/fre.php 3ba6f23f9212861c618d968582f891e5 https://app.any.run/tasks/cdbc0530-3cf9-40d8-a25a-4c5a6ff4f7d3/ 2021-03-02 19:49:16
11 OTX status Completed: An upgrade to the OTX Web site is complete. https://stspg.io/lzyd2jz8jj3f?u= z0sjnqgvy67s 2021-03-02 19:44:11
12 wwp96 #vjworm @JAMESWT_MHT hxxp://wodmainenew.xyz:1001/Vre 8caf8fd00757e2363f43aa3d2b7dd4a4 https://app.any.run/tasks/03f066cb-ee7e-4d0e-8ecd-64c513ea6c4d/ 2021-03-02 19:42:52
13 wwp96 #opendir #floxif #neutrino @JAMESWT_MHT hxxp://krntix.com/ntr/tasks.php cfcb6a5c16929238bbfb020445160f3c https://app.any.run/tasks/59e0ed0d-5f24-4adb-9a63-61a211c1259e/ https://twitter.com/wwp96/status/1366835703963934725/photo/1 2021-03-02 19:40:01
14 Racco42 #malspam " FACTURA N° 472-830" with .js attachment brings #wshrat https://app.any.run/tasks/47099b5d-ba7c-4fd5-9989-ddb4a1c9a00f C2: nitrot.duckdns.org:4561 2021-03-02 19:39:47
15 micham Why do services "provide" email addresses that bounce for days to no avail? My report of a #phishing site (still up) targeting @1und1service to a @lolipopjp address (gathered from whois) will just burn up energy without a meaningful outcome. ¯\_(ツ)_/¯ https://www.virustotal.com/gui/url/54e1cfe8cce53c21b99b64d540b5b27a1d7ae3a9e2b136d66f2875510600afd0/detection https://twitter.com/micham/status/1366835210906574849/photo/1 2021-03-02 19:38:03
16 wwp96 #LokiBot @hexlax @JAMESWT_MHT hxxp://hiqhway39clothing.com/zoro/zoro6/fre.php 43f9fd0e3e8bf66bee9581e616f870f5 https://app.any.run/tasks/0237678f-1d3c-4c63-a53b-6f62b6fe4651/ 2021-03-02 19:30:36
17 wwp96 #LokiBot @hexlax @JAMESWT_MHT hxxp://sunwindz.in.net/.cgi-in/fre.php 1f9ac8ae695caf124ea03af7f4853944 https://app.any.run/tasks/eca52689-17c4-4422-9e41-0f70c69f0f4d/ 2021-03-02 19:30:18
18 RangXOR #Qealler is back 🆕 The #CnC server at 179.43.145.245 - currently hosted at @PrivateLayer https://www.virustotal.com/gui/ip-address/179.43.145.245/community New sample (discovered by @wwp96) appears to be an updated instance of the #infostealer - at first glance the code is slightly more sophisticated 1/2 2021-03-02 19:11:09
19 500mk500 @sysk1ll3r @malwrhunterteam @TRCert alcakpkk.net cukurevimizidrisbabamiz.site kahpeapo2023.net rehberkuranhedefturan.site sonosmanlidevleti.site turkhavasahasi1.net turkislamdevletleri.site https://www.virustotal.com/gui/ip-address/47.254.133.23/relations 2021-03-02 18:59:36
20 phishunt_io #NewPhishing | #phishing #scam 🌐 /covid.scotiabank.ds04.teksideapps.online/ 🚩 199.175.0.197 ☁ TEKSIDEIO 🔒 R3 https://twitter.com/phishunt_io/status/1366825290203361287/photo/1 2021-03-02 18:58:38
21 micham If u tipsy. u need enkripsi? #Indonesia #ikan #GoHome #enkripsi Stay safe! https://www.virustotal.com/gui/url/4a665c38b1d4d58329a7cf0a73ac2e38a82471dfbcb9fdc6174d5edae1f3760c/detection https://twitter.com/micham/status/1366819503745630208/photo/1 2021-03-02 18:35:38
22 MBThreatIntel New domain registered by #malsmoke threat actor to social engineer visitors to adult sites. pornohdmovies.com Our original blog: https://blog.malwarebytes.com/threat-analysis/2020/11/malsmoke-operators-abandon-exploit-kits-in-favor-of-social-engineering-scheme/ https://twitter.com/MBThreatIntel/status/1366810023016337413/photo/1 2021-03-02 17:57:58
23 p5yb34m #Trickbot .dll (rob21 botnet): ://metalin-cr.com/appdata/datafile.php .xls Sample: https://bazaar.abuse.ch/sample/5249e43b972f40a78393ddc43b32e444c5ff30bd068078e63112a9da85abfcd5/ .dll Sample: https://bazaar.abuse.ch/sample/cd1a99942b7a7e273ebf42e7435aeb7692fb90f38600a0282fa3ff605d9733e6/ Malware Config (C2s): https://tria.ge/210302-1r1rkzhbzx 2021-03-02 17:33:57
24 MBThreatIntel Tech support scam #browlock stadnewstoday.xyz 161.35.57.57 https://twitter.com/MBThreatIntel/status/1366800862069202946/photo/1 2021-03-02 17:21:34
25 kyleehmke Probable CloudAtlas domain ms-officeupdate.org (192.99.221.76) was registered on 3/1/21 using khalid.hussain@tutanota.com. Previous report from @jfslowik/@DomainTools on probable related infrastructure: https://www.domaintools.com/resources/blog/the-continuous-conundrum-of-cloud-atlas In @ThreatConnect: https://app.threatconnect.com/auth/incident/incident.xhtml?incident= 4658093532 https://twitter.com/kyleehmke/status/1366796835541684224/photo/1 2021-03-02 17:05:34
26 DeZio91 @LeonEbersmann @prepaidhosterDE Kann da nichts feststellen. https://www.virustotal.com/gui/url/ea766832895499f83cd064f344c7e5953e8da04faa7af2d6c36ca2098cc2a8e6/detection https://sitecheck.sucuri.net/results/https/webmail.prepaid-webspace.de 2021-03-02 16:56:23
27 kyleehmke Set of 2/22/21 suspicious Njalla-registered domains hosted at 80.78.23.11: endpoint.fail endpoint.support connect.flights Some Njalla domains from 2/19 probably related: endpoint.live (37.120.193.206) endpoint.bet https://twitter.com/kyleehmke/status/1366789816789176333/photo/1 2021-03-02 16:37:40
28 James_inthe_box It's past time to start nuking this #lokibot c2 IP @ovh_support_en 51.195.53.221 been like this for months now.. https://twitter.com/James_inthe_box/status/1366789522864803842/photo/1 2021-03-02 16:36:30
29 andpalmier http://verifica-sicurezza-online.com 🗒 @tldsol 🔐 @letsencrypt ☢️ 103.153.183.33 (AS140947) 🔍 https://urlscan.io/result/135f7daa-4e28-4dd2-82b2-3e3d12b3069a/ https://archivioclienti.me/info/index.php 🗒 @NameCheap 🔐 @SectigoHQ ☢️ 192.64.117.203 (AS22612) 🔍 https://urlscan.io/result/5afb88d4-034e-4471-abf9-b3555e46c6b1/ 2021-03-02 16:35:40
30 andpalmier http://portale-cliente-me-x.com 🗒 #publicdomainregistry 🔐 @letsencrypt ☢️ 207.174.212.247 (AS394695) 🔍 https://urlscan.io/result/e73e168a-d5d0-4a2e-b08a-ff25a11961dc/ https://portale-cliente-me-x.com 🗒 @gandi_net 🔐 @CloudflareHelp ☢️ 207.174.212.247 (AS394695) 🔍 https://urlscan.io/result/811e991b-586c-4c51-9e17-dc355673be70/ 2021-03-02 16:35:39
31 andpalmier https://www.intesasicur-web.com 🗒 @NameCheap 🔐 @SectigoHQ ☢️ 192.64.117.163 (AS22612) 🔍 https://urlscan.io/result/843ad07a-fe07-47eb-a1ee-0bbcbecc8394/ http://procedi-per-i-nuovi-criteri2021.profit-groupe.net 🗒 @PROFITGroupe 🔐 @cpanel ☢️ 5.39.67.131 (AS16276) 🔍 https://urlscan.io/result/b7dc770b-5807-4925-ad5c-ef2ad3e56c80/ 2021-03-02 16:35:39
32 andpalmier http://gruppo-isp-banking-secur.com 🗒 @NameCheap 🔐 @SectigoHQ ☢️ 162.0.209.203 (AS22612) 🔍 https://urlscan.io/result/ed56f36f-8de6-4134-bc8d-3a892b4c39e4/ https://www.dominio-security-isp.com 🗒 @NameCheap 🔐 @SectigoHQ ☢️ 162.0.215.5 (AS22612) 🔍 https://urlscan.io/result/9c0d3a87-a0e8-46c8-965b-18107050288e/ 2021-03-02 16:35:39
33 andpalmier #mwitaly 🎣 active #phishing targeting italian banks 🇮🇹 CC @JAMESWT_MHT 🎯 @intesasanpaolo @INGItalia 🚨 list include compromised sites list: https://gist.github.com/andpalmier/5e74c6469e894b29cfc2cca1442965d7 Thread for info ⬇️ https://twitter.com/andpalmier/status/1366789305042145293/photo/1 2021-03-02 16:35:38
34 reecdeep #FormBook #Malware targets #Italy 🇮🇹 02/03/2021 "PAGAMENTO Fattura" https://app.any.run/tasks/e2fb9cb5-511e-4b2c-b643-2345e6a9f74c 🔥 https://tria.ge/210302-2b41wctf52 Using NSIS + hardened loader (7vjan5zljeas9uo.dll) #infosec #CyberSecurity #cybercrime #Security #cyber 2021-03-02 16:29:06
35 fmondini GitHub #Squatting #Campaign #XForce has identified a new squatting campaign used by #threat actors to target #media sector. The campaign has a global scope assumingly luring users into giving away their login #credentials. #Phishing. #Credential #Theft https://exchange.xforce.ibmcloud.com/collection/d0e5b562efc4f5caf7a9c0e4b41e4cf2 2021-03-02 16:18:14
36 fmondini LinkedIn #Squatting #Campaign #XForce has identified a new squatting campaign used by #threat actors to target #media sector. The campaign has a global scope assumingly luring users into giving away their login credentials. #Phishing. #CredentialTheft https://exchange.xforce.ibmcloud.com/collection/6b8bc4ff097549974c6be2fa8c588b22 2021-03-02 16:15:00
37 kyleehmke Suspicious domain perslime.com was registered through Njalla on 2/25/21 and is hosted at 80.92.206.186. https://twitter.com/kyleehmke/status/1366784059419033604/photo/1 2021-03-02 16:14:48
38 kyleehmke Suspicious domain killyheal.com was registered through Aminserve on 2/24/21 using xiomararhitz@protonmail.com and is hosted at 91.228.218.66. https://twitter.com/kyleehmke/status/1366781046843449353/photo/1 2021-03-02 16:02:49
39 InQuest #opendir with Phish kit and source code: paulhofstadler.com Poses as locked invoice document requiring sign-in to view. https://twitter.com/InQuest/status/1366777783142260743/photo/1 2021-03-02 15:49:51
40 r3dbU7z https://www.virustotal.com/gui/file/2417357dd09e9c1a7992de3d4daca9c3fefb8661e931a11f3e15f655fc8a596c/detection https://twitter.com/r3dbU7z/status/1366773363146952709/photo/1 2021-03-02 15:32:17
41 500mk500 @B0rys_Grishenko @PaczkomatyPL @apkdetect @CSIRT_KNF @CERT_OPL @CERT_Polska @PPiekutowski @ThreatLabsPL As far as I can see/guess: all .*ga. *.top. *.tw domains for 2021 year could be covered as #Android #Cerberus detection: https://www.virustotal.com/gui/ip-address/47.254.157.47/relations 2021-03-02 15:30:37
42 siri_urz https://www.first.org/events/web/cti-apr2021/ Call for Speakers 2021-03-02 15:15:01
43 James_inthe_box doc hash: 9567ee669eaeb8ec571d37759c0e9e3c6f8d6f5c711039a3745296084e2f900f dll hash: 46ef7a76af23c6b073fabeb7242c7b5727c379a07cc1081532212e4ba2132abe 2021-03-02 15:08:34
44 siri_urz F194605B1026C00A6DB40ADAD0D4E165 Dropper ^^ 2021-03-02 15:04:32
45 James_inthe_box Incoming #hancitor run. DocuSign subject. @google doc links. metalplessparts.net sender: https://docs.google.com/document/d/e/2PACX-1vT38Zmi5k1sCKdNRCaTa4nd8Pyf0m3Gvb0NIK5jOQAOXHMBzCHtkuYRMzGRMthBT3W61R2fjerYgid3/pub https://twitter.com/James_inthe_box/status/1366766147182321668/photo/1 2021-03-02 15:03:37
46 siri_urz E48D9011E9A01A48EE04ED4E05E335EE Snake MBR Killer C:\Users\kaise\Downloads\overwrite_mbr-master\overwrite_mbr\Release\Release.pdb https://twitter.com/siri_urz/status/1366765487657484296/photo/1 2021-03-02 15:01:00
47 h2jazi The actor has used a new dynamic DNS domain: varifsecuripass.duckdns.org 159.89.238.15 1beb2cc546e7cd8a4aac6c76eacc4dfc "BANK TRANSFER CONFIRMATION.zip" 2021-03-02 14:53:21
48 siri_urz 3729FEA74EC3A3081A1EE7E92BA2BB64 TheWarehouse #Ransomware (TheSynt4x) C:\Users\gigaz\Downloads\TheWarehouse-master\TheWarehouse-master\TheWarehouse2\obj\Debug\TheWarehouse.pdb https://twitter.com/siri_urz/status/1366760764716023822/photo/1 2021-03-02 14:42:14
49 kyleehmke Per @urlscanio. two of the domains -- ffoxnewz.com and tesiaa.com -- redirect to or host redirected content from the legitimate Fox and BBC websites. respectively. https://twitter.com/kyleehmke/status/1366759681486643206/photo/1 2021-03-02 14:37:55
50 kyleehmke Set of suspicious domains registered on 2/16 through MonoVM using panthebt@protonmail.com: bbcsworld.com (185.243.114.102) ffoxnewz.com (161.129.64.104) redeitt.com (45.86.163.221) tesiaa.com (46.30.188.198) In @ThreatConnect: https://app.threatconnect.com/auth/incident/incident.xhtml?incident= 4658049688 https://twitter.com/kyleehmke/status/1366759676789084169/photo/1 2021-03-02 14:37:54