Obfu$Cat

Malware Researcher | Threat hunter | Mobile Security.
#infosec #cybersecurity #Cats
All opinions are my own:)

[Obfu$Cat @0bfusCat]

@FisherYariv הייתי שם עם חברים וזה לא מה שהיה, הבר הנמיך ואפילו סגר את המוזיקה, נכנסו כמה מפגינים שהחליטו לעשות בלאגן במקום

[Obfu$Cat @0bfusCat]

@felixw3000 @avman1995 https://t.co/CxVdNyPJmT

[Obfu$Cat @0bfusCat]

@500mk500 Yeah i know it's Cerberus, but look at the panel, and also as i said the communication with the C2 is messed up🙃

[Obfu$Cat @0bfusCat]

Is it just me, or this #Cerberus has a #Blackrock panel?
Also the traffic is a mess....

C2: 217.8.117.30
MD5: 2a2474e8bb2e83d4b6fd8503c2e57b29

[Obfu$Cat @0bfusCat]

@500mk500 @Cengiz86035319 @Vlad86317048 Any samples to share?

[Obfu$Cat @0bfusCat]

@SoulRage6

[Obfu$Cat @0bfusCat]

#Hydra #android #banker using familiar methods for updating C2.

C2: garage5473[.]xyz
MD5: dacf987a7d270f8b4abd08c12680923a

[Obfu$Cat @0bfusCat]

@CryptoInsane Any sample to share?

[Obfu$Cat @0bfusCat]

@sirpedrotavares @SoulRage6

[Obfu$Cat @0bfusCat]

#IcedID targeting US financial institutes
MD5: f0e8c9292351bf02223aaea6d3dda8d1
C2: accentio.]online, zalkipamat.]top

[Obfu$Cat @0bfusCat]

@pr3wtd @Nethanella @m0br3v @jag_chandra @mobilesecurity_ @ReBensk @sh1shk0va @SoulRage6 @apkdetect Great job man😉 I knew you will figure it out🤟

[Obfu$Cat @0bfusCat]

#Anubis --> seems like a new type of packer(.psx)

MD5: 6a3d439e471a80cf1727a9283a70d6b5

If you figure how to unpack(statically) please let me know :)

@Nethanella @m0br3v @jag_chandra @mobilesecurity_ @ReBensk @sh1shk0va @pr3wtd @SoulRage6

[Obfu$Cat @0bfusCat]

Interesting #BlackRock is using the same packer
MD5: 33d9c6b05f029ecab621c4a5e34d391f

[Obfu$Cat @0bfusCat]

@neontaster @SoulRage6

[Obfu$Cat @0bfusCat]

@SoulRage6

[Obfu$Cat @0bfusCat]

#Cometbot Mobile #Malware targeting 200 financial institutions.
C2: athan.]ru/private/add_log.]php
MD5: ca50d6e7c624c4a0a678907e9e84d81f

@pr3wtd @yusaerguven @ReBensk

[Obfu$Cat @0bfusCat]

#Android #MysteryBot Malware targeting social networking apps.

C2: 176.121.14.]127/Parasitusss/login.]php
MD5: 51a9cd06be4b8f4217b0e64d3ac6b1d6

More here:
https://t.co/jZbBqby2OG

[Mobile Security @mobilesecurity_]

How to hook Android Native methods with Frida (Noob Friendly)
#MobileSecurity #AndroidSecurity
https://t.co/rGWKnompqO

[Obfu$Cat @0bfusCat]

#MysteryBot #covid haven't seen one in a while.
C2: 176.121.14.]127/covid/gate.]php
MD5: 9447627bdd4070ef65f8c36933bf7f03

[Obfu$Cat @0bfusCat]

@CryptoInsane @LukasStefanko @SoulRage6