Who said what @g0njxa profile

Who said what

@g0njxa

Followers

2,042

Following

189

Media

617

Statuses

2,351

qui fa lo que pot no esta obligat a mes | objetivo 2028 | Bad Student, enthusiast, more likely than an expert DMs are open, feel free to reach! 😼☂️🟣🍇👾

Valencia, Spain 🇪🇸

Joined January 2023

Don't wanna be here? Send us removal request.

Explore tweets Explore followers Explore following

Explore trending content on Musk Viewer

PondPhuwin WeAre EP10 • 244405 Tweets

#해차니_생일_와떠여 • 144566 Tweets

D-Day • 82733 Tweets

Janones • 64530 Tweets

Star Wars • 60146 Tweets

NEVER LET GO D-1 • 44176 Tweets

Nikolas • 41125 Tweets

Rachadinha • 39802 Tweets

Día Mundial del Medio Ambiente • 32369 Tweets

対象の3作品 • 31220 Tweets

Meral Akşener • 27830 Tweets

Conselho de Ética • 22493 Tweets

James Biden • 22382 Tweets

Jim Crow • 21838 Tweets

Lauryn • 19516 Tweets

Giovanni van Bronckhorst • 16987 Tweets

Birx • 15838 Tweets

Byron Donalds • 15594 Tweets

EL X VENIR 6 MILLONES • 13448 Tweets

Paolini • 11849 Tweets

Hochul • 11358 Tweets

Sabalenka • 10697 Tweets

Rosalinda López Hernández • 10078 Tweets

#UnderdogPicks

Cam Sutton

Mariona

Nirmala

Matos

Romário

ソビエト蓮舫

Sergen

$WIFI

Connie Ansaldi

第867回

Asian Value

Taborda

Camarda

Slater

Hasan Arat

Sister Act 2

$BASED

Alpha Eagle

Mirra Andreeva

Hürler Geliyor

$BENDOG

#مستشار_البناء_واسمنت_الكويت

#حنا_تحت_الارض

#ام_تالا_تنخاكم

#ZIGonBinance

#هايسنس_تشجيعك_يربحك

Last Seen Profiles

@LaurieCoyne2

@FranConnect

@DonnieWash420

@robert26bell

@Franko_Robo

@melon9281

@BruceBaron2

@5280gabe

@TanteStwbali

@StainSilencer

@BiondiNicole

@Portlandhair

@STORMEDFURY

@Wolfgambino1017

@raquelb_a

@reus_benjamin

@SimpleMillsCEO

@konusmali_turk

@adri_geanlira

@JoselLeiv

Pinned Tweet

Who said what

@g0njxa

6 months

In the past weeks I interviewed the staff from the major infostealers projects, a total of 7: Lumma,Raccoon,Meduza,Vidar,Amadey,StealC,Meta. Below you will find a short summary of this series that ends today, and also the ones who refused to talk. 👀👇

Approaching stealers devs: Summary & refused talks.

Consider this the end of a series that lasted a few weeks. I tried to contact almost everyone related to the infostealer ecosystem, that I…

g0njxa.medium.com

5

20

76

Who said what

@g0njxa

1 year

1

128

4

Who said what

@g0njxa

8 months

I mean... Dont let your archive be exposed to the public. 😅😅 #opendir http://77.91.68.78/lend/ Redline, Lumma, Warzone RAT, Meduza Stealer, Povertystealer, Formbook, Raccoon, AsyncRAT, Rhadamanthys, Smoke Loader, WhiteSnake & a miner on hashvault

Fox_threatintel

@banthisguy9349

9 months

http://77.91.68.[78/lend/?C=M;O=D #opendir with #redline

0

2

14

5

44

178

Who said what

@g0njxa

7 months

#Meduza Stealer is not dead! Search for C2 panels on @fofabot : icon_hash="-559608920" Some New panels: 193.233.133.81 146.70.161.13 77.105.147.136 185.106.94.31 212.113.116.56 89.185.85.132 95.181.173.235 95.181.173.8 95.181.173.233 89.185.85.34 👀👇

2

28

90

Who said what

@g0njxa

1 year

#Raccoon Stealer has been observed using a new User-Agent: GunnaWunnaBlueTips, since at least 05-13 hxxps://telegra.ph/WareHacks-Soft-04-22 C2 ⚙️ #RacconV2 #Recordbreaker 37.220.87.66 45.9.74.99 UA: GunnaWunnaBlueTips @crep1x 🙌 👇👇

Analysis https://telegra.ph/WareHacks-Soft-04-22 Malicious activity - Interactive analysis ANY.RUN

Interactive malware hunting service. Live testing of most type of threats in any environments. No installation and no waiting necessary.

app.any.run

3

32

88

Who said what

@g0njxa

10 months

Anonfiles, one of the major free file storage providers that existed in the past years, has announced the end of its service and domain is now for sale @vxunderground RIP anonfiles :(

2

29

68

Who said what

@g0njxa

1 year

#Raccoon Stealer has been spotted with an update! New user agent: DuckTales C2⚙️ #Recordbreaker #RaccoonV2 94.142.138.74 🇷🇺 Build is from June 19th @Gi7w0rm @crep1x 👇👇

Analysis https://productkeyforfree.com Malicious activity - Interactive analysis ANY.RUN

Interactive malware hunting service. Live testing of most type of threats in any environments. No installation and no waiting necessary.

app.any.run

4

40

67

Who said what

@g0njxa

5 months

#Rhadamanthys Stealer being spread via fake KMSPico downloads /kms-full.com/install.php > /kms-product.eu > /kms-product.pro > DropBox Loaded from /176.113.115.224:6230/3178c C2: 185.130.226.143:6575 Detonation:

3

23

64

Who said what

@g0njxa

1 month

The infamous #Rhadamanthys Stealer has been banned from XSS forum after failing to provide protection to CIS countries people. Rhadamanthys was used against Russian military infrastructure (), also by some fellow traffers guys... 🫂🫡

3

18

66

Who said what

@g0njxa

7 months

I recently made an interview with #Lumma Stealer staff. Just a brief talk :) They want to say Hello, to all of us. The malware project is near to the 1st Anniversary, it's time to dive into Lumma 🕊️ Read it at:

Approaching stealers devs : a brief interview with LummaC2

To completely understand what’s going on in a market that has been growing in the last years I found mandatory to know which players are…

g0njxa.medium.com

3

18

62

Who said what

@g0njxa

6 months

I made a little interview with #Meduza Stealer staff. The "Immaculate" stealer and heir to Aurora's (RIP) legacy shared a little time talking about his product. Take a look at:

Approaching stealers devs : a brief interview with Meduza

To completely understand what’s going on in a market that has been growing in the last years I found mandatory to know which players are…

g0njxa.medium.com

4

15

60

Who said what

@g0njxa

6 months

You can also track the latest #Qakbot c2 servers with @fofabot jarm="21d14d00021d21d21c42d43d0000007abc6200da92c2a1b69c0a56366cbe21" && header_hash="480868286" 👇👇👇👇

Ven0m

@V3n0mStrike

6 months

🔥I have some certainty that these hunting rules would help identify command and control servers. Shodan: Censys: #Qakbot

2

10

55

2

15

60

Who said what

@g0njxa

7 months

#Rhadamanthys stealer is now offering a similar service than #Lumma : 👀 Restoration of expired Google sessions

𝕯𝖒𝖎𝖙𝖗𝖞 𝕾𝖒𝖎𝖑𝖞𝖆𝖓𝖊𝖙𝖘

@ddd1ms

7 months

There is a very interesting development happening with #Lumma Stealer. Seems like they figured out a way to restore expired Google sessions.

3

25

126

0

20

58

Who said what

@g0njxa

9 months

The new exfiltration method used by #Lumma Stealer would be POST requests to a new endpoint at C2 servers Lets say goodbye to /c2sock & /c2conf (RIP 🙏🏼🙏🏼) New endpoint: /api act=recive_message (Configuration request) act=send_message (Exfiltration) @AnFam17 @evstykas

7

22

57

Who said what

@g0njxa

4 months

#Lumma Stealer has just been updated Featuring the partnership with "GhostSocks", a SOCKS5 manager. So it seems like Lumma Stealer will now be leveraging Socks5 proxies from victims. I don't know how this works but I believe something like other proxy malware ( #SystemBC )

1

27

57

Who said what

@g0njxa

1 month

#Lumma Stealer implemented a bot protection system, "pre-trained on screenshots of known virtual machines" 2 months ago. They now claim to have detected 483k bots avoiding 68k "garbage logs", reducing usage of HDDs and helping the world to become cleaner with less CO2 emissions

3

16

56

Who said what

@g0njxa

8 months

Introducing #Amadey Botnet v4, as seen in newly PrivateLoader Campaigns. http://77.91.97.162/g93kdwj3S/Login.php So far, a new GUI has been discovered and URLs are now 2 chars longer Traffic cc @Jane_0sint NEW v4 OLD v3

1

18

53

Who said what

@g0njxa

10 months

Yayy!! 🦝 #RaccoonV2 #recordbreaker Stealer updated its user-agent. Seen via #Lgoogloader being distributed on #PrivateLoader campaigns New UA: Xmlst C2: 77.246.102[.]57 @NexusFuzzy @Gi7w0rm 👇👇 raccoon v2.3.0 is live 🦝

Analysis kj84DRLsDIxc4tnYES7OjFz5.exe (MD5: 1FB683C2CB13D0160E37F9D0EEFDA008) Malicious activity -...

Interactive malware hunting service. Live testing of most type of threats in any environments. No installation and no waiting necessary.

app.any.run

3

12

50

Who said what

@g0njxa

11 months

Something new has been spotted on YT #Redline and #Ransomware MAD HAT #MADHAT Ransom is $50 , so honest price to "protect" a data already stolen by Redline 😅 @AnFam17 @Gi7w0rm @Jane_0sint 👇👇

0

24

48

Who said what

@g0njxa

4 months

Following the ban on XSS forum, Lockbit profile has also been banned from Exploit. reason: Ripper

AzAl Security

@azalsecurity

4 months

LockbitSupp has been banned from XSS forum for not paying the 10% as requested by the admin. cc: @Jon__DiMaggio @ddd1ms @3xp0rtblog @AShukuhi @vxunderground @Cyberknow20 @uuallan @BrettCallow @BushidoToken

10

41

155

4

12

51

Who said what

@g0njxa

6 months

I made an interview with #StealC stealer owner, We talked about his malware project, and he "wishes us good luck" in our hunting. Please read it at:👀👇

Approaching stealers devs : a brief interview with StealC

To completely understand what’s going on in a market that has been growing in the last years I found mandatory to know which players are…

g0njxa.medium.com

1

14

50

Who said what

@g0njxa

3 months

@ddd1ms @vxunderground actually more

0

9

49

Who said what

@g0njxa

28 days

Seems like now #infostealers found a way to collect valuable information from Mozilla-based browsers extensions. This are new features on some known Stealers, firstly reported by #Lumma Stealer at mid April and followed, for example, by #ACR Stealer and #Vidar at the moment 👇

3

25

50

Who said what

@g0njxa

11 months

So this seems to be something new spotted on YT! #Root Team Stealer Uploading logs at temp linx server http://5.42.66.26/ (Same behaviour as for example Darth Project Stealer) Sandbox log: http://5.42.66.26/mk7nl8q3y3.zip 👇👇

Analysis https://telegra.ph/HIFIXLauncher-07-01 Malicious activity - Interactive analysis ANY.RUN

Interactive malware hunting service. Live testing of most type of threats in any environments. No installation and no waiting necessary.

app.any.run

4

16

47

Who said what

@g0njxa

6 months

I made an interview with #Vidar staff, The infamous Vidar stealer (at its 5th Anniversary) and I had a little talk about his malware project. They say that "there is no need to hold a grudge against us"... Read it at: 👇👇

Approaching stealers devs : a brief interview with Vidar

To completely understand what’s going on in a market that has been growing in the last years I found mandatory to know which players are…

g0njxa.medium.com

0

12

48

Who said what

@g0njxa

6 months

I made an interview with #Recordbreaker Stealer staff. Not many questions, just asking things about Raccoon Stealer. Will "MrBidenNeverKnow" be the next User Agent that we will find on this stealer? Take a look at: 🦝🦝🦝🦝

Approaching stealers devs : a brief interview with Recordbreaker

To completely understand what’s going on in a market that has been growing in the last years I found mandatory to know which players are…

g0njxa.medium.com

5

24

48

Who said what

@g0njxa

1 month

Have you ever heard about #Dracula stealer? Sample: C2 - 195.10.205.74:1953 Detonation: ping @RussianPanda9xx @Jane_0sint

7

13

46

Who said what

@g0njxa

8 months

If you didn't noticed, some websites involved with #ClearFake #FakeUpdates campaigns seems to be sending download records to a Telegram Bot, forwarded to a Group. 46.255.201.42 - CN authenticprod[.]fr styktraffred - Group Name applemalicalo_bot - Bot user

0

14

45

Who said what

@g0njxa

2 months

Just been across a weird #malware campaign being spread on X via malicious ads (help!) TL showed me this ad /Andristo_88/status/1776305295263756467 which is aiming to /audacityteam.top (suspended) . Find it at archive showing the website and +👇

4

16

46

Who said what

@g0njxa

4 months

While #lockbit disruption is getting deservedly all the attention, Seems like other ransomware gangs are getting issues, talking about #Stormous ransomware 👀 Stormous #DOWN

2

8

44

Who said what

@g0njxa

8 months

Yayyy!!!! #Raccoon Stealer aka #recordbreaker has been updated. ☀️🌄🌕👀 I'm updating the User-Agents and Official Announcements Chart. @Gi7w0rm @crep1x Hunt the raccoon!!! 🦝🦝🎯🎯 Thanks, @suyog41

Yogesh Londhe

@suyog41

8 months

Raccoon Stealer New User-Agent : SunShineMoonLight 24bdb92d93d301d2e58b84f4e5161909 #Raccoon #Stealer #IOC

0

4

12

2

13

44

Who said what

@g0njxa

4 months

Privateloader Rewind 2023 ⏳ +1 million unique installs in 2023🎯 A humble blog about the InstallsKey PPI service. Profiling customers, the sources of their installations and the service itself! Also available at /t.me/privateloader (🇺🇲&🇷🇺) 👇🏻👇🏻

PrivateLoader: InstallsKey Rewind 2023

Privateloader is the name of a malware that was created to load othermalware families into infected machines, being used into a PPI…

g0njxa.medium.com

1

20

44

Who said what

@g0njxa

7 months

CHAOS is an open-source RAT (/github.com/tiagorlampert/CHAOS) that was somewhat popular and abused last year, and it's still in use! Track this on @fofabot 👇👇 fid="9BUak7FRNMoqKoJPH7v8Lw=="

2

9

42

Who said what

@g0njxa

7 months

US, Canada, UK and Australia websites are compromised to serve Fortnite Spam (again) At first, TA seems to be abusing Kentico CMS Media libraries. Compromised websites includes Bing Blogs, Credit Unions, Medical Institutions and NGO's See full list!

3

14

42

Who said what

@g0njxa

5 months

#WhiteSnake Stealer is now releasing an update featuring Google Cookies restoration 🍪👀 Same features after #Lumma , #Rhadamanthys , #Risepro , #Meduza , #Stealc Anyone else?😂

1

12

42

Who said what

@g0njxa

1 year

hxxp://77.91.78.118/test2.bat Cute privilege scalation method dropped by #Amadey Loader It also disables any restore point from the infected host and block downloads from browsers.

3

10

42

Who said what

@g0njxa

7 months

Ironhost IO - BulletProof Servers joined the PrivateLoader campaign serving as a c2 since 1st November. 91.92.243.151 - ironhost[.]io Need a fast and reliable bulletproof server? Do not wait!

1

4

42

Who said what

@g0njxa

2 months

Have you ever wondered what is going on with Vietnamese 🇻🇳 malware targeting Facebook accounts? I did, so you can get a quick overview of these threat actors activities and how they are spending (and earning) millions of $$$ Read now! 👇👀 #dropshipping

From Vietnam to United States: Malware, Fraud and Dropshipping

A quick overview on the Vietnamese cybercrime landscape, spending millions of dollars in fraud activities.

g0njxa.medium.com

4

13

42

Who said what

@g0njxa

6 months

You can also hunt #Mirai botnet C2 servers with @fofabot body_hash="331221342" 👇👇 Evidence since September 17th👀

Germán Fernández

@1ZRR4H

6 months

Hunting #Mirai botnet C2 servers 👋 Shodan: Censys: Combining the results (12 C&C): 91.92.249.96 45.142.182.95 104.248.150.52 45.156.24.179 91.92.243.156 93.123.85.86 64.227.96.75 46.29.162.49 205.185.122.208 45.63.6.19

7

28

111

0

14

40

Who said what

@g0njxa

11 months

What kind of Stealer is this? Something new? C2 ⚙️ 94.142.138.97/Up I think this stealer likes browser cookies the most Take a look! 👇👇

Analysis https://productkeyforfree.com Malicious activity - Interactive analysis ANY.RUN

Interactive malware hunting service. Live testing of most type of threats in any environments. No installation and no waiting necessary.

app.any.run

5

14

40

Who said what

@g0njxa

8 months

Fresh #BlankGrabber Python stealer () being shared on Youtube targeting users via fake Valorant Cheats. be578842ae7a7d0b51f20bac551645a6 log password "baim123" 👇👇

1

6

40

Who said what

@g0njxa

11 months

#Lumma Stealer updated its capabilities recently. It now has the ability to load other files while executing main stealer and self deletion after that This behavior is common on other stealers like #Vidar or #recordbreaker , loading crypto clippers like #laplas . Very active.

4

22

40

Who said what

@g0njxa

6 months

A few days ago, #Amadey owner and I did a brief interview. We talk about past, present and future of the infamous #Amadey Loader, one of the biggest products in the MaaS environment. Something worth a read. Please find it at:

Approaching stealers devs : a brief interview with Amadey

To completely understand what’s going on in a market that has been growing in the last years I found mandatory to know which players are…

g0njxa.medium.com

2

21

39

Who said what

@g0njxa

1 month

⚠️Watch out fake AV websites sharing malware #Spynote (for android) /avast-securedownload.com @Avast #Lumma Stealer /bitdefender-app.com @Bitdefender #StealC (via Buer Loader?) /malwarebytes.pro @Malwarebytes samples and detonations below 👀

2

14

39

Who said what

@g0njxa

11 months

Android Botnets ain't dead! 📲 #Ermac V3.0 Botnet C2 Panel 91.215.85.213 Didn't find any information on this new version of this botnet. Previous V2 had some leak on March 2023 This was a previous C2 for StealC @0x6rss want to take a look? :)

4

11

39

Who said what

@g0njxa

11 months

An unkown #stealer has been spotted on YT! C2 ⚙️ http://146.71.81.144/ Cookie Stealer, File Grabber, Crypto wallets, Password managers and Screenshoots, everything POST to C2 Take a look!👇👇 Just uploaded to VT

Analysis https://tinyurl.com/tr7z28fj Malicious activity - Interactive analysis ANY.RUN

Interactive malware hunting service. Live testing of most type of threats in any environments. No installation and no waiting necessary.

app.any.run

3

13

38

Who said what

@g0njxa

2 months

Let's discover one of the "youngest" infostealers traffers teams playing bad around... Ghostbusters aka MMM Team 👻 +70k victims recorded in less than a year with +100 members disclosed, still active 👀 Absolute customization of builds and more!! 🪙👇

Profiling Трафферы: GhostBusters (MMM)

In the infostealer ecosystem, there are communities of malware operators spreading its malicious builds in a daily basis, working under a…

g0njxa.medium.com

1

14

39

Who said what

@g0njxa

2 months

FYI, Last updates: Ⓜ️META - 4.5.1 (Mar 12) 📈RedLine - 30 (Feb 22) 🕊️Lumma - Apr 10 🦝Raccoon - 2.3.1.1 (⌛️?💀) 🔱Vidar - 9 (Apr 10) ⚓️StealC - 1.8.1 (Feb 23) 🐍 Meduza - 2.5.1 (Apr 3) 🤍WhiteSnake - 1.6.1.9 (Mar 20) 🐉Rhadamanthys - 0.6.0 (Feb 17) ☣️Amadey - 4.19.2 (Apr 8)

0

4

39

Who said what

@g0njxa

7 months

More live #Clearfake ! This is not about RU, this is China! 🇨🇳🇨🇳 Search on @fofabot title="Google Chrome 网络浏览器" Examples: /www.updateload.live/ /ggsdown.top /update.chrome-up.com/ /y13xlt1d.xyz/ /url.drvceo.com /kcdq78.fit Check samples!

2

12

37

Who said what

@g0njxa

8 months

@LinkedIn accounts are compromised in a daily basis to join a big SEO poisoning campaign via LinkedIn Pulses. Users are then redirected to fake malicious sites where malware is being distributed, mainly #Lumma Stealer, #Cryptbot and #AMOS for Mac Users (finally found! 🍎) 👇👇

3

12

37

Who said what

@g0njxa

2 months

The infamous Raccoon stealer 🦝 has not been updated for long months and the activity in the wild has dropped (Talking about me I see no more Raccoon) Asked his staff, seems like the old coder left and there's a new one working on, so we must expect new updates soon! 👇⚙️

0

7

37

Who said what

@g0njxa

10 months

hxxp://bratzen.duckdns.org/byte/ #Opendir Unknown #loader Hosting unkown payloads as a Comercial Loader for malware distribution. Stored as .txt with the client TG username. Seen on #PrivateLoader campaigns

1

11

36

Who said what

@g0njxa

3 months

Watch out Dynamics 365 *.microsoftcrmportals domains, abused at the "free vbucks" SEO poisoning campaign 🙄 /osvolunteers.microsoftcrmportals.com /fms.microsoftcrmportals.com /indspire.microsoftcrmportals.com /ecosoft.microsoftcrmportals.com /bggtscsp.microsoftcrmportals.com

0

5

35

Who said what

@g0njxa

8 months

#Amadey is back on Privateloader campaigns after some days of inactivity. Loaded via #opendir (LgoogLoader) /85.217.144.143/files/ new C2 panel ⚙️ http://193.42.32.29/9bDc8sQ/Login.php Still not fixed, patch it NOW! @evstykas Full detonation: 👇👇

1

9

35

Who said what

@g0njxa

8 months

Hunting #Clearfake with @fofabot fid="QddxtK34KUI1XP5ujfy5bw==" Track the latest compromised domains /altenara.com /doolittles.be /easymall.co.th /megacarwreckers.com.au /filmovita.ba /staging.armipour.com /or-and.com /esmito.com /sistemajogodobicho.com There should be more!

1

8

35

Who said what

@g0njxa

6 months

@vxunderground @Elsaidy_pastry from Egypt 😭😭

7

1

35

Who said what

@g0njxa

4 months

#Meta Stealer just got updated to v4.3 So it seems like malware developers are now using AI to sign builds in order to avoid detections? @NexusFuzzy I believe the same updates will be seen on Redline soon, as usual. Check everything 👇🏻👀

2

14

35

Who said what

@g0njxa

7 months

Track #HookBot panels with @fofabot fid="8ZfqDfBADcCVT8Cf796SUg==" recent ones (Novemeber): /bravevikingser.xyz /91.92.249.18 /20.39.184.218 /161.35.235.125 /178.23.190.21 /87.98.185.14 /199.101.135.49 /94.156.64.181 /91.92.245.80 /91.215.85.153 more!

0xperator

@0xperator

11 months

#Malware #HookBot Source Code Leaked Content: * Builder Panel Source Code * app/bot Kotlin Files (APK) You can find it on my Github: /w @0xrb 👑

8

88

245

1

11

33

Who said what

@g0njxa

1 month

#Vidar Stealer announced today the launch of a cryptocurrency token named $VIDAR coin, on the TON platform (Telegram Open Network). They have also launched some NFTs. 1 $VIDAR = $0.11 Official page /vidar.news NFTs /getgems.io/vidar

1

14

34

Who said what

@g0njxa

6 months

Something crazy is now being pushed by #Privateloader opens a pop-up window with a Microsoft error and a QR Code. /pcrrent.com (Microsoft phishing) 🇨🇳?? Financial information is asked and exfiltrated via POST to /pcrrent.com/index.php Full Detonation:

1

13

33

Who said what

@g0njxa

7 months

#FAKEUPDATES live update /88.99.105.167 /63.141.252.148 /51.38.115.103 /paolomorettifurs.com/temp/EngineChromium.zip Drops from #opendir /77.105.147.44/river/strit/wantworkerpro.zip #Purelogs Stealer 185.138.164.41:7705 Detonation 👇👇

Analysis https://paolomorettifurs.com/temp/EngineChromium.zip Malicious activity - Interactive...

Interactive malware hunting service. Live testing of most type of threats in any environments. No installation and no waiting necessary.

app.any.run

1

12

33

Who said what

@g0njxa

5 months

The use of SSL certificates on #stealers commn. to C2 servers is becoming popular among this malware projects. Exfiltration over HTTPS allegedly makes them to "receive less detections on c2s and prolong its life" A recent example is #Lumma Stealer 👇👀

1

8

32

Who said what

@g0njxa

8 months

@1ZRR4H Some similar obfuscator is Samples are detected as Little-endian UTF-16 so it can be a possibility

GitHub - SkyEmie/batch-obfuscator: Easy way to obfuscuate batch files (Windows)

Easy way to obfuscuate batch files (Windows). Contribute to SkyEmie/batch-obfuscator development by creating an account on GitHub.

github.com

0

3

33

Who said what

@g0njxa

8 months

#opendir Lumma Stealer /167.88.160.150/ps143m/ loaded by steganography Steg: hxxps://i.ibb.co/kgZ7SgM/Graphics-Card-PCB-Assembly-Final.jpg C2:⚙️ firmpanacewa[.]fun 👇👇

Analysis http://167.88.160.150/ps143m/ Malicious activity - Interactive analysis ANY.RUN

Interactive malware hunting service. Live testing of most type of threats in any environments. No installation and no waiting necessary.

app.any.run

0

7

32

Who said what

@g0njxa

9 months

After a long search, a build of the #Vega Stealer v2 has been found. @suyog41 @Jane_0sint 41b8caca7e2c1ec36c2528fcd6a3f334 Log at C:\Users\<user>\AppData\Local\SystemFiles\ 👇👇

3

7

30

Who said what

@g0njxa

10 months

Meet Chenlun , a worldwide phishing & carding campaigns provider A community around a developer of rental products, with thousands of pishing victims, specialized on smishing attacks and looking for Credit Card Information 👇👇 Check it now!

Chenlun: A worldwide phishing & carding campaigns provider

Read about one of the most active carding communities, specialized in smishing attacks that redirect users to fake shipping & e-commerce…

link.medium.com

4

14

30

Who said what

@g0njxa

7 months

New Amadey Update, just to "get ride of some detections". Fresh C2s from our beloved #Privateloader 👀 v4.03 is out! /167.235.20.126/bjdm32DP/index.php v4.02 /185.196.8.176/7jshasdS/index.php Full detonation 👇👇

Who said what

@g0njxa

8 months

If #Amadey keeps updating, we keep tracking it! v4.02 is out From /193.42.33.7/newumma.exe C2 http://193.42.33.7/mbSDvj3/index.php Via #PrivateLoader , you can check the full detonation of it :)

0

9

29

1

3

30

Who said what

@g0njxa

11 months

#Poverty Stealer is now being dropped by Privateloader C2⚙️ #Poverty Stealer 185.253.96.117:2227 👇👇

Analysis https://storedechuladas.com/wp-content/download/File_pass1234.7z Malicious activity -...

Interactive malware hunting service. Live testing of most type of threats in any environments. No installation and no waiting necessary.

app.any.run

2

11

29

Who said what

@g0njxa

7 months

Threat Actors are doing their best trying to spread malware at GitHub Recently, they were found sharing malicious Screensavers (.scr) files disguised as .sln files in a legit VS project in order to share #AsyncRAT abusing Discord CDN Full run

2

5

29

Who said what

@g0njxa

9 months

#44caliber is an open-source Stealer (hxxps://github.com/razexgod/44CALIBER) that relies on Discord Webhook as an exfiltration method of victim's information. Seen back in 2021 and 2022, now it has been observed again at Youtube campaigns targeting Russian-based users 👇👇👀

2

10

29

Who said what

@g0njxa

11 months

stealerskymtni3tiagmx3pqktjgkm2iigwj6e2touws773emrfjvoyd[.]onion #Rhadamanthys Stealer Official Page on the underground They even got a wiki page rhadwikiwwzr6sfzygsr3qh7lwu5ghnaoupxwpsj2xuxjcgcebikh7id[.]onion And some "media publicity" 😂 @SentinelOne @proofpoint @zscaler

ANY.RUN

@anyrun_app

11 months

🔍 Update in Malware Trends Tracker: #Rhadamanthys ! This #stealer is equipped with lots of features — including very unusual ones. Rising popularity makes it a notable #cybersecurity concern. Dive into the Rhadamanthys overview and samples here 👇

0

7

13

0

10

29

Who said what

@g0njxa

7 months

#Amadey updates on the v4.1 (4.11, 4.12 and 4.13) Featuring: Support for Psi+ XMPP client has been added to the stealer module. Implementation of Reverse Proxy on the panel Hundred small changes in EXE files Check some IOCs 👇👇

R.

@0xrb

7 months

@RustyNoob619 @embee_research @urlscanio All New #Amadey V4.12 you can find it here

1

4

19

0

11

29

Who said what

@g0njxa

8 months

If #Amadey keeps updating, we keep tracking it! v4.02 is out From /193.42.33.7/newumma.exe C2 http://193.42.33.7/mbSDvj3/index.php Via #PrivateLoader , you can check the full detonation of it :)

Who said what

@g0njxa

8 months

The release of Amadey v4 was set to October 8th, 2023. That was the 5th anniversary of the malware project, I kindly want to congratulate it for being a pain in the ass all these years. 🥳🥳🥳 How many years it will last? Amadey - Hancintor - Hynamer - more AV names OLD pics

1

4

19

0

9

29

Who said what

@g0njxa

6 months

#Meta Stealer just announced one of the biggest updates in his entire operation time. Meta Stealer v4.0: New information exfiltrated from the victim host New build encryption New structure of requests between build & panel More! Time to 👀 Read the full changelog below:😅😅😅

RussianPanda 🐼 🇺🇦

@RussianPanda9xx

7 months

Checkout my writeup on #MetaStealer 👾 It's not to be confused with #RedlineStealer ! Big thanks to @cod3nym for the review!

11

69

189

1

5

28

Who said what

@g0njxa

1 year

A malware campaign on YouTube spreading fake installs via gopcworlds[.]com is hosting malware on an opendir #opendir 5.42.64.15/bo 🇷🇺 Theres full of .zip with binaries, crashing when sandbox testing but even so I could identify some #Redline and #SystemBC 👇👇

2

8

29

Who said what

@g0njxa

3 months

🪙📥: #Alphv / #Blackcat ransomware related account has been banned after failing to appeal to the scam report. Total amount discussed of ~350 BTC 💸 GG, exit scam. Indeed the seizure was fake alphv is the next ransom gang that choosed this way to end operations after noEscape

𝕯𝖒𝖎𝖙𝖗𝖞 𝕾𝖒𝖎𝖑𝖞𝖆𝖓𝖊𝖙𝖘

@ddd1ms

3 months

"feds screwed us over"

3

20

85

3

7

27

Who said what

@g0njxa

27 days

Let's have look on the #Cerberus Team (the rebrand of the infamous #Amnesia Team) 🐐 Traffers that have been targeting Russian-based people for a long time (not as other teams), but also with more than 300k infected users around the world.

Profiling Трафферы: Cerberus (ex-Amnesia)

In the infostealer ecosystem, there are communities of malware operators spreading its malicious builds in a daily basis, working under a…

g0njxa.medium.com

4

10

28

Who said what

@g0njxa

8 months

Tracking the activity of Alfa Team with FOFA 👀👀 👇👇 icon_hash="-1901078794" First shells appearing on May, most recent October 21th Live shell: /research.plu.ac.th Extra (related): /b0ru70.github.io ref: 👇

FOFA Search Engine

FOFA is a Cyberspace search engine. By conducting Cyberspace mapping, it can help researchers or enterprises quickly match network assets, such as vulnerability impact range analysis, application...

en.fofa.info

Karol Paciorek

@karol_paciorek

8 months

📌 Solevisible / ALFA TEAM 🔗 #OpenDir : 139.59.113[.]146 💻 Panel: 139.59.113[.]146/lol.php In the files, I found scripts containing #Metasploit . @digitalocean , please take a look :) CC: @500mk500 @NexusFuzzy @g0njxa

4

6

41

1

14

27

Who said what

@g0njxa

4 months

Hey @WHO is this supposed to be from your organization?

2

8

28

Who said what

@g0njxa

11 months

There's a update on this campaign C2 #Vidar 168.119.55.206 Dropping C2 New #Amadey @Viriback hxxp://45.9.74.164/b7djSDcPcZ/index.php Dropping C2 #SystemBC 5.42.65.67 👇👇

Analysis https://boraflow.click Malicious activity - Interactive analysis ANY.RUN

Interactive malware hunting service. Live testing of most type of threats in any environments. No installation and no waiting necessary.

app.any.run

1

10

27

Who said what

@g0njxa

3 months

The #Stormous ransomware is back with two new onion blogs. They also promoting a new affiliate program with paid and free versions, and a "PYV service" to use their blog to sell and publish data on a fee. Stormous.X/GhostLocker

Who said what

@g0njxa

4 months

While #lockbit disruption is getting deservedly all the attention, Seems like other ransomware gangs are getting issues, talking about #Stormous ransomware 👀 Stormous #DOWN

2

8

44

2

9

27

Who said what

@g0njxa

11 months

FYI it seems to be a misconfiguration on one site shared here that replaced .zip malware download into a download of the entire web server. So you can now take a look on .php files, admin settings and other hidden things, for FREE!! Caution, 👇👇

template

www.mediafire.com

Who said what

@g0njxa

11 months

One of the fancy methods used by threat actors to spread malware is using a fake software website under a common template. This is a trend, and this week I noticed a weird high amount of this websites, which I never seen in months Featuring #RootTeam , #Redline and others 👇👇

1

2

17

2

6

27

Who said what

@g0njxa

9 months

Hunting #Socks5Systemz panels rel. to #TeamSpy with FOFA title=="Phichichi" && fid="hC3Y75PtrHXEGYlvOGjMNw==" /185.141.63.172/auth.php /109.236.85.145/auth.php /193.242.211.141/auth.php /109.230.199.181/auth.php /212.8.242.211/auth.php dead panel /178.32.216.234/ @ViriBack

1

4

25

Who said what

@g0njxa

6 months

Interesting build being shared by #privateloader /185.198.57.117/sservc.exe That is using infected machine to brute ssh, ftp, php admin, wp-login and other services from gov and edu domains worldwide using TOR? Have you ever seen that? Is this #tofsee ?

Analysis 185.198.57.117 (MD5: 4F17E0E8D7F6931D86BCEF776619A2B5) Malicious activity - Interactive...

Interactive malware hunting service. Live testing of most type of threats in any environments. No installation and no waiting necessary.

app.any.run

0

11

26

Who said what

@g0njxa

7 months

Go hunt #MetaStealer ! Submit IOCs to @abuse_ch Meta is not Redline!!!

ET Labs

@ET_Labs

7 months

12 new OPEN, 12 new PRO (12 + 0) TA444, MetaStealer, LNK/imageres, TA422, ClearFake, Win32/Agent.UAF Thanks @AnFam17 , @g0njxa , @StopMalvertisin

0

1

6

2

4

27

Who said what

@g0njxa

6 months

#Risepro Stealer is also offering a "Google Cookies Restoration" Service. 👀🍪 This would be the third stealer malware project offering this kind of service after #Lumma and #Rhadamanthys .

Who said what

@g0njxa

7 months

#Rhadamanthys stealer is now offering a similar service than #Lumma : 👀 Restoration of expired Google sessions

0

20

58

1

8

25

Who said what

@g0njxa

1 month

Today May 4th, 2024 #Lumma Stealer added support for Windows XP on his builds. Windows XP was released October 25th, 2001 (23 years ago) Final exceptional end of support at April 9, 2019 (5 years ago) Is Windows XP still a thing in today's world? 😟😟

6

8

26

Who said what

@g0njxa

8 months

UPDATE: The previosly seen campaign of Lumma Stealer + AMOS for MacOS users via Linkedin, is also being spread via Twitter Spam. AMOS is using hash busting Currently serving via hxxp://dafu-xiaoniangao.monster/askdaskdIB/22987ggg C2 Lumma - IB4 /nursepridespan.fun/api

Who said what

@g0njxa

8 months

Do you ever noticed that at some point malware was also distributed via Twitter compromised accounts? I only found months old tweets with videos sharing dead Redline builds, BUT everything still up. Also some people running affiliate download campaigns Very poor effort

0

3

5

1

9

25

Who said what

@g0njxa

6 months

Have you ever seen a #Rhadamanthys panel? #Rhadamanthys Stealer offers a web-based panel hosted in the TOR network. Today you will be able to see a v0.5.0 panel. Here you can see how everything looks: (But make sure to check the analysis from @hasherezade first!) 1/3 👇

Check Point Research

@_CPResearch_

6 months

#Rhadamanthys stealer keeps evolving. In our new blog, @hasherezade takes you on a deep dive into version 0.5.0, layer by layer, discovering new features and techniques.

5

66

142

1

5

24

Who said what

@g0njxa

11 months

#Mystic Stealer is now being dropped by #PrivateLoader via #Smoke Loader C2⚙️ #Mystic Stealer 109.248.206.137 Panel at 109.248.206.137/login 👇👇

Analysis File_pass1234.7z (MD5: 4483D5690270B7692A1AEF79ACF05EF7) Malicious activity - Interactive...

Interactive malware hunting service. Live testing of most type of threats in any environments. No installation and no waiting necessary.

app.any.run

0

10

25

Who said what

@g0njxa

9 months

Nvm, here's the login panel #Lumma Stealer hxxp://seobrokerstv.fun/login 188.114.96.3

Who said what

@g0njxa

9 months

While web location of the panel remains undiscovered, the main panel used by #Lumma stealer developers and staff achieved astonishing results since the major update (June 2023) At 09/09, 478.690 victims were infected by Lumma only by those individuals, in 10 campaigns. 👇👇👇

3

9

21

3

24

Who said what

@g0njxa

1 year

@elhackernet Lockbit sufrio un DDOS en agosto despues de la filtracion de Entrust que mantuvo su infrastructura caida por un par de dias. El ataque no frenó nada y parece que fortalecio las tacticas criminales del grupo... Si buscan desencadenar algo parecido, ya saben las consecuencias

1

24

Who said what

@g0njxa

8 months

From the same creator, #Umbral Stealer () being shared on malicious Github Accounts sharing Microsoft Office cracks 910a5896b1488769e91e985b0dbba73f f77cd86cb44f7d53e84fb258115b2374

Who said what

@g0njxa

8 months

Fresh #BlankGrabber Python stealer () being shared on Youtube targeting users via fake Valorant Cheats. be578842ae7a7d0b51f20bac551645a6 log password "baim123" 👇👇

1

6

40

0

7

24

Who said what

@g0njxa

6 months

Fake downloads of games are a serious threat to the whole Internet , especially when malware or abusive spam is involved. I was able to talk to threat actors and victims about this. A threat hunting journey with the help of @Malcoreio ! Read it on 👇👇👀

Endless Malvertising & Deadly Spam: Threat hunting with Malcore!

Read about insights on real malware and spam campaigns based in the testimony of a victim and a threat actor!

g0njxa.medium.com

2

7

25

Who said what

@g0njxa

9 months

One of the first things i see on this update is a new look for Lumma C2s. Now they will be showing another poetry from "Шарль Бодлер" Charles Baudelaire CHARLES BAUDELAIRE, "FLOWERS OF EVIL", VERSE 29 C2 #Lumma Stealer /gaspatchommm.fun/ /blockbeerman.fun/ So fancy russians

RussianPanda 🐼 🇺🇦

@RussianPanda9xx

9 months

Here come the new updates for #LummaC2 (14.09) ✅ New communication protocol with the server ✅ 11 randomized servers and they will be constantly changing Would be nice to see some new samples 😅

1

8

39

1

4

24

Who said what

@g0njxa

5 months

Seems like there have been some irl defacements of billboards around the world in support of Palestine and claimed by CasperSecurity @vxunderground @malwrhunterteam Guys out there have seen too much Watch Dogs 😭 Reports on Indonesia, Albania, Mexico, Malaysia and Italia

3

12

22

Who said what

@g0njxa

11 months

Seen on YT C2⚙️ #Collector Stealer f0837288.xsph[.]ru Exfiltration via /collect.php Uploaded to VT (crashed at anyrun) 👇👇

Analysis https://gg.gg/ExternalBear Malicious activity - Interactive analysis ANY.RUN

Interactive malware hunting service. Live testing of most type of threats in any environments. No installation and no waiting necessary.

app.any.run

2

7

23

Who said what

@g0njxa

4 months

"Reputation takes a lifetime to build, but seconds to destroy"

AzAl Security

@azalsecurity

4 months

LockbitSupp has been banned from XSS forum for not paying the 10% as requested by the admin. cc: @Jon__DiMaggio @ddd1ms @3xp0rtblog @AShukuhi @vxunderground @Cyberknow20 @uuallan @BrettCallow @BushidoToken

10

41

155

2

6

24

Who said what

@g0njxa

6 months

Fake #GtaVI downloads being promoted via Twitter Ads Spreading #Lumma + #AMOS Stealer windows /sergiocostantino.com/temp/Gta6Alpha.zip Mac (FUD 2/56) /codeelectron.com/upload/gta6alpha_launcher.dmg Lumma ID -> TRNGVa--gads

0

10

24

Who said what

@g0njxa

1 year

self-games[.]com self-games[.]pw seen on YT Distribution of #Redline Stealer via fake software installs C2 ⚙️ #Redline 104.193.255.48 get-vbs[.]com is dropping redline binaries via wget, redirect from vbs1[.]pw vbs2[.]pw vbs3[.]pw 👇👇

Analysis https://seIf-games.com/#cheats Malicious activity - Interactive analysis ANY.RUN

Interactive malware hunting service. Live testing of most type of threats in any environments. No installation and no waiting necessary.

app.any.run

1

9

23