ExecuteMalware
@executemalware
Followers
27K
Following
77K
Media
1K
Statuses
17K
#malware hunter & analyst. Opinions are my own.
Cold country
Joined June 2016
New research by yours truly ๐๐๐ Featuring: ๐ Web Injects ๐บ Fake-Captchas โ๏ธโ๐ฅ Blockchain Analysis ๐ Mac Malware ๐ฅ๏ธ Steam based Dynamic C2 ๐ฌ Telegram Fallback ๐ Click-Fix EtherHiding blends Fake CAPTCHAs, Click-Fix lures, and blockchain staging. Payloads rotate inside
๐ต๏ธโโ๏ธ New Censys research investigates EtherHiding, an adversarial tactic that stores payload stages inside smart contracts and uses Fake CAPTCHAs and Click-Fix lures to push victims into running OS-specific commands. EtherHiding can produce resilient delivery paths that donโt
1
6
21
0
3
6
Evil #logmeinrescue at: https:// connectme-1ke.pages. dev/LogMeInResolve_Unattended.msi e56e5f1f37b6c2ae9f4f1b2e7ab2f7aee9ca91c4c84334dd5bb49675de619736 Company ID: 8400521075231559185
1
2
4
๐PE-bear: The Art of Intuitive Malware Analysis How Visual Design Turns the โFirst Viewโ into Actionable Insights for Reverse Engineering https://t.co/vh9QjCtrpy
3
13
112
Just learned something wild โ maybe everyone else already knewโฆ In Edge/Chrome, you can bypass the HTTPS security warning by typing: ๐ thisisunsafe No button, no prompt. Just type it. Instantly skips the warning and loads the site. ๐คฏ Great write-up explaining it here:
29
125
1K
It's live ๐ I think every security person should have this tool (@malcat4ever) installed. https://t.co/sJgxqpy048
19
33
169
1 week after the the operation on Rhadamanthys, it seems to be more disruptive than the one did on Lumma (which should be a good comparation) since the infostealer has not returned soon. So it seems we can start talking about another one missing on the Internet, at least for
First thoughts about #Rhadamanthys Stealer "disruption" (?) and what to expect in the next days with the current information as of November 13th: The same way I did with Lumma I want to share some words ( https://t.co/t5wpfVCa85) Leaving to one side from the discussion anything
2
10
36
#stealerium hosted at: http://31.57.147.77:6464/gethta
http://31.57.147.77:6464/getdll hash 88feadbb2f9548d3c0cb9c6519bcea476acf9ac2a3eeccde5655457cbba29db4 on the dll
1
5
10
๐จ ๐๐ฆ๐๐๐๐ฑ๐ฟ: ๐ ๐๐น๐๐ถ-๐ฆ๐๐ฎ๐ด๐ฒ ๐๐ผ๐ฎ๐ฑ๐ฒ๐ฟ ๐๐ฒ๐น๐ถ๐๐ฒ๐ฟ๐ถ๐ป๐ด ๐ฃ๐ต๐ฎ๐ป๐๐ผ๐บ๐ฆ๐๐ฒ๐ฎ๐น๐ฒ๐ฟ TL;DR: We identified #JSGuLdr, a multi-stage JavaScript-to-PowerShell loader used to deliver #PhantomStealer. A JScript file triggers PowerShell through an Explorer COM call,
0
15
71
โ ๏ธ Just one email targeting a US state agency exposed a full FormBook infection chain. Spoofed headers, failed SPF checks, and C2 activity become visible in seconds. ๐จโ๐ป See how attacks on government institutions were uncovered and analyzed using #ANYRUN: https://t.co/vvSMTSYcgW
0
15
33
Long overdue, but hereโs my writeup for #FlareOn12 Task 9:
0
36
161
Yet another new stealer in town: #ArkanixStealer ๐ฅ %AppData%\Arkanix_lol\history.json %AppData%\Arkanix_lol\system_info.json %AppData%\Arkanix_lol\screenshot_monitor_1.png Akranix botnet C2: ๐ก https://arkanix .pw/api/session/create ๐ก https://arkanix .pw/delivery
3
32
144
โ ๏ธ Rundll32, certutil, mshta; attackers abuse them to load payloads without raising alerts. Security teams using real-time analysis expose these #LOLBin tactics fast. Hereโs how to achieve it inside your SOC ๐ https://t.co/mJBj2nl9RF
any.run
Learn how attackers misuse trusted Windows binaries and how SOC teams can spot LOLBin abuse early.
0
27
93
Free Candy anyone? Well, not quite free candy, but it might seem like it if youโre a user of the Free edition of Binary Ninja! In 5.2, weโre adding many new features from the paid versions to Free: Objective-C workflow, WARP plugin, DWARF Import and TTD support!
1
5
19
Phishing activity in the past 7 days ๐ Track latest #phishing threats in TI Lookup: https://t.co/WtleCMOYeo
#TopPhishingThreats
0
3
16
0
1
3
Potential new stealer dropped by #Amadey, caught by @Bitsight ๐ค๐Who can name it? โคต๏ธ ๐ https://t.co/OnS2kroAIF Botnet C2 domains: ๐กdefender-temeerty .sbs ๐กtelemetry-defender .lol Botnet C2 server: ๐185.100.157.69:443 (Partner Hosting ๐ฌ๐ง) Malware sample: ๐
6
6
32
Top 10 last week's threats by uploads ๐ โฌ๏ธ #Xworm 1044 (641) โฌ๏ธ #Lumma 479 (476) โฌ๏ธ #Asyncrat 398 (275) โฌ๏ธ #Quasar 371 (390) โฌ๏ธ #Vidar 370 (292) โฌ๏ธ #Remcos 318 (271) โฌ๏ธ #Stealc 282 (174) โฌ๏ธ #Agenttesla 193 (167) โฌ๏ธ #Guloader 176 (171) โฌ๏ธ #Smoke 160 (164) Explore malware in
0
4
13