Dee
@ViriBack
Followers
10K
Following
6K
Media
679
Statuses
1K
#Malware C2 hunter #infosec passionate. Tweets are my own.
Canada
Joined March 2015
Currently seeing a surge on #CastleLoader malware being delivered through fake websites impersonating software used in enterprise environments such as Zabbix or RVTools (see photo 1 & 2). IOCS below 👾🔎 Please note that this campaign uses the same exact template lures of
2
25
84
If you want to understand attacker actions on target without being the target yourself, check out DeceptionPro. DeceptionPro creates an enterprise network for you to detonate malware payloads. Check out my blogpost in the thread to learn more about how it works. 🔗👇
1
5
22
Cyber Stealer jerk hiding behind se* shop (LLCPPC you need to do something again 🤣) dorklife[.vip cyberv2[.live https[://176[.65.141.143 fofa icon_hash="-516595605" @500mk500
2
1
10
New Active Panel 31[.58.169.29[:1133/login 151[.243.254.56[:1133/login
Lazarus Stealer 🤷♂️☠️(now they speak Russian as well, hehe not real ikr ) 193[.151.108.203[:1133/login 193[.151.108.33[:1133/login 193[.151.108.243[:1133/login 193[.151.108.207[:1133/login 193[.151.108.49[:1133/login @500mk500 @ViriBack
1
6
29
Low detection Latrodecus Signed "Ballbusters Oy" 😳 C2: gansroroyfgdst[.]com/work/, triosdoryumkas[.]com/work/ 49c20938fbd31a92a359147b539de76d59be71abf7560801ecc497ca9c8ae809 AnyRun: https://app.any[.]run/tasks/3becb418-0a63-48c5-b54d-adcea0450e45
4
11
45
🛡️Lazarus Stealer IP : 193.151.108.39 AS 207957( Serv .host Group Ltd ) Low detection on @virustotal more Lazarus servers detected by #C2Watcher on https://t.co/od5mNFcggD
2
3
16
#CYBERSTEALER #panel http[://195.177.94[.232/webpanel/panel/login.php https[://arbitrationengine[.com/webpanel/panel/login.php @500mk500 @ViriBack
#Stealer #WEBPANEL #THREATINTEL
1
5
11
🕵️♂️ SpY-Agent v1.2 IP : 178.16.54[.]226:80 AS 209800( metaspinner net GmbH ) Undetected on @virustotal more Spy-Agent v1.2 servers detected by #C2Watcher on https://t.co/eSMKnpwhzM
1
6
16
🟢 Zerotrace IP : 185.174.135[.]177:8080 AS 59711( HZ Hosting Ltd ) Undetected on @virustotal more Zerotrace servers detected by #C2Watcher on https://t.co/CamTjDYMxD
2
10
37
Since end of August we observe infamous #LummaStealer communicating with DGA-like domain names 🤖👀, for example ⤵️ oneflof .ru georgej .ru bastxtu .top larpfxs .top ... We have seen such domains across 3 distinct IP address, all sharing the same SSL certificate (SHA1
0
19
47
app.any.run
Interactive malware hunting service. Live testing of most type of threats in any environments. No installation and no waiting necessary.
#malware #kamasers C2 ? MD5: 3337e14626b4d56b6604275de3fbfcc9 URL: 5.206.224[.]85:8080/panel_xyz123/panel.php
1
2
8
#malware #lumma via #tinyloader 178.16.53[.]7/icoxn/login[.]php #cracked software see: https://t.co/7hMBqEItkv
1
1
10
#malware #lumma via #tinyloader 178.16.53[.]7/icoxn/login[.]php #cracked software see: https://t.co/7hMBqEItkv
0
2
8
#malware #castle loader C2 panel: 85.158.108[.]135:5050/login 64.52.80[.]44:9999/login re: https://t.co/cLe8wZkM27
0
5
29
🚨 Found C2 login panel of BQTlock / BAQIYATLock RaaS → http[://92.113.146[.56/ @500mk500 @ViriBack
#CyberSecurity #Ransomware #ThreatIntel #BQTlock #BAQIYATLock #loginpanel
2
9
19