← Feed

Posts

• View post

  Fresh #salsastealer: https://app.any.run/tasks/fcd555b3-6b72-4c99-b19e-c2297df4567a/

• View post

  Couple #screenconnect droppers at: https:// doc. papperldoculess\.top/edocument/

• View post

  f you're using any of those Monster A19 wifi lightbulbs (monsterilluminessence . com) be aware your data appears to be going to @splunk cloud.

• View post

  In light of recent LLM's breaking out of their guardrails and doing damage, I felt compelled to write this. https://gist.github.com/silence-is-best/e8fe274d219fc509ed950286deeae502

• View post

  An interesting development with #PureLogStealer ....seen this twice now where the Edge flag is invalid: https://app.any.run/tasks/992252ed-c867-4ad9-8b3f-f53c9ca8451b

• View post

  PSA: If you're seeing links that literally start with _wildcard_ in #malspam, these are dropping #screenconnect (usual relay c2) via #zoom update lure. 1f7ab5418d489fdd2fb392ada3accc77c13586f94f059ee8e5cc83c0974b614b

• View post

  Some 2 day old #valleyrat https://app.any.run/tasks/7a1480fa-e0fc-4e13-ae1a-535cf1077b6d

• View post

  A csv formatted list of #malspam campaigns that crossed my path in July to include #malware type, subjects, c2's, hashes, and email exfil addresses: https://gist.github.com/silence-is-best/48b613e82bf64f1fd8b9a231ccdd590b #retrohunt

• View post

  Handful of IOC's for those .js #purelogs #stealer #malspams: https://app.any.run/tasks/43e561e4-707a-4189-8b4c-d4795b2451a6 Exfil port is 4449 Calls hidden Edge Calls hidden Chrome

• View post

  #xloader 's (c6713b3c5ba4da5044d96463cae74227a6a898abb051a5f75ab7b508eb20f7e1) choice of which executable to inject into continues to fascinate me...

• View post

  #clickfix to #vidar (among other things) via: http:// www\.apcconstruction\.com/ https://app.any.run/tasks/4599dbb0-1041-43f3-b127-a42cfc7ca60e

• View post

  Got tired of mucking with these miserable #screenconnect msi's so here's a #suricata rule to catch the initial check via sni: https://gist.github.com/silence-is-best/29afec335264313e9bf5bfa1c6e60144 https://app.any.run/tasks/73887f39-a8ac-4702-a67d-36465caca294 cc @da_667@infosec.exchange

• View post

  #remcos hta and payload in an #opendir at: http://157.254.223\.141/25/

• View post

  Some fresh #raton https://app.any.run/tasks/d020658f-dbca-4a1c-bfec-557db23a332d C:\Users\Cristian\Desktop\NewRaton\DONOTDELETE\Commands.pdb

• View post

  #medusahvnc in a js -> autoit: https://app.any.run/tasks/86ddc895-ed72-4eae-8c9c-f1e7b81abaf9

• View post

  Fresh #purerat : https://app.any.run/tasks/4bd07f35-3a29-477a-8e2b-7e4d31182cd7 cc @da_667@infosec.exchange

• View post

  From #clickfix -> #vidar https://app.any.run/tasks/dac83ca5-fa36-4478-8332-2dbce48c6dbc

• View post

  @signalapp@mastodon.world Where are they stored? What's the encryption level? Who has access?

• View post

  This meets my expectations: https://www.thatprivacyguy.com/blog/anthropic-spyware/

• View post

  #unknown panel associated with: bf777e4dee6918d2373ba83433b4a7530d6e69465a1b6107ef4fd43f4ea60ec4

• View post

  #reverseloader payloads at: http://66.179.248\.120/img/ #remcos c2: 23.95.62\.25:7070

• View post

  #Cyberchef down: https://downforeveryoneorjustme.com/cyberchef.gchq.gov.uk

• View post

  Much hatred for the latest #Wireshark

• View post

  #nanocore......#ransomware ..? https://app.any.run/tasks/0f06cf0b-8417-4e7d-83db-0fd384472772 No files actually encrypted though 🤔

• View post

  An on time (yay) csv formatted list of #malspam campaigns that crossed my path in April to include #malware type, c2, hash, subject, and email exfil addresses: https://gist.github.com/silence-is-best/bc95a949f272f8c5487d057bbd74d14f #retrohunt