0x0pc0d3

10% Luck; 20% Skill; 15% Concentrated power of will; 5% Pleasure; 50% Pain;

[Stephan Berger @malmoeb]

While investigating yet another BEC incident, I stumbled upon..

{
"Name": "UserAgent",
"Value": "axios/1.7.7"
}

🥳 This becomes a really good IOC.

[ScumBots @ScumBots]

#StagedC2 config observed at Mon Jul 29 09:51:08 2024 UTC, located at hXXps://pastebin[.]com/raw/NXqmAbHb C2: 39[.]114[.]81[.]81:4444

[ScumBots @ScumBots]

#StagedC2 config observed at Mon Jul 29 09:41:13 2024 UTC, located at hXXps://pastebin[.]com/raw/kRhzsMGF C2: tuesday-grows[.]gl[.]at[.]ply[.]gg:41136 (IP: 147.185.221.21)

[ScumBots @ScumBots]

#StagedC2 config observed at Mon Jul 29 10:11:05 2024 UTC, located at hXXps://pastebin[.]com/raw/Hc625diY C2: red-frost-78994[.]pktriot[.]net:22406 (IP: 157.245.65.139)

[ScumBots @ScumBots]

#njRat SHA256: 3584010af4c61f06ddedbc2d740c5c787ac08e62e00f6ec267cd73baef3b21f4 C2: patria[.]duckdns[.]org:1995

[ScumBots @ScumBots]

#Remcos SHA256: bdca4b93d9d26ac631324c961fd814e25b7bfbb7d38c8fc2503fc4dcb79e7268 C2: tcp://salwanazeeze[.]duckdns[.]org:9595,

[ScumBots @ScumBots]

#Remcos SHA256: 431f53278c89aa423d08ddc7ea4ddaa23e1c40cf7910b764201efd6890af7afe C2: tcp://mexbar[.]duckdns[.]org:3119,

[ScumBots @ScumBots]

#Remcos SHA256: 46578af72eee4fa34a150d0f9409041fcdad17a061e77f1017640ef7373a6da6 C2: tcp://salwanazeeze[.]duckdns[.]org:9595,

[ScumBots @ScumBots]

#Remcos SHA256: 60baa67ddc14257cb00f965efde95d2df191f827a4da9fbf10722c95e01b0922 C2: tcp://money001[.]duckdns[.]org:9596,

[ScumBots @ScumBots]

#xworm SHA256: fe8b320087553eaee75439ab0c4c523a67687c5cb70763bcf042bcfabb205f11 C2: dzn[.]ddns[.]net:5552

[Stephan Berger @malmoeb]

1/ "The APT actors deleted some of their entries in Apache httpd logs using mi.war, a malicious Tomcat application that deletes log entries based on the string in keywords.txt. The actors deleted log entries with the string Firefox/107.0." [1]

The sample is available on VT. [2]

[vx-underground @vxunderground]

The vx-underground x @SentinelOne malware research competition has come to a conclusion and a winner has been chosen.

@tr3gleos discovered an unknown malware family named "Net_Neo" which targets banking institutions primarily in Spain and Chile.

https://t.co/7XBg7c0oj1

[Michael Koczwara @MichalKoczwara]

Let's continue with Brute Ratel C4 Hunting 🎯

Last time we started from VT/hash attributed to badger implant, we grabbed one JARM from BRc4 C2 51.77.112.254 and combined with the HTTP Response hash.

Today we will pivot from another Brute Ratel C4 JARM and we will find more threat actors infra🤝

[Karsten Hahn @struppigel]

New Video: C2 extraction for 3CX SmoothOperator 🦔📹

#MalwareAnalysisForHedgehogs #3CX #SmoothOperator
https://t.co/shZhGFmdiq

[Lloyd Davies @LloydLabs]

Microsoft's https://t.co/FExGESVtzW service is being used as a Cobalt Strike C2.

Encrypted beacon: d599f5a81d0bc8bf45f21585d89b93cbbc07be04c3e501127f1fd9669659376b
C2: devbox[.]microsoft[.]com/sync/lf1AQtwJeF-n7vM3EZW5UAyfPQLtyTXVQ1EWL

[vx-underground @vxunderground]

LAPSUS$ extortion group claims to have breached @Okta. They have released 8 photos as proof.

The photos we are sharing has been edited so no sensitive information or user identities are displayed.

Image 1 - 4 attached below.

[Jesko Hüttenhain @huettenhain]

Recent #Emotet downloaders use:
XLSX ➡ VBA ➡ batch ➡ PowerShell
Based on some great work by @DissectMalware, binary refinery now has a batch deobfuscator. Ripping out those C2s is easier than ever!
🏭 xlxtr | bat | carve -sd b64 | xtp url
🌐 https://t.co/UFEAIVxsJx

[Vitali Kremez @VK_Intel]

2021-12-29: 🔥#IcedID aka #BokBot Malware | ↪️Hooking Engine

📚API hook splicing technique to intercept API calls by inserting a jump instruction for browser and other API for information-stealing purposes

Similar hooking engine in concept from ZeusVM:
https://t.co/wKJXbxa1qc

[The DFIR Report @TheDFIRReport]

CONTInuing the Bazar Ransomware Story

➡️ Initial Access: BazarLoader
➡️ Discovery: Nltest, Net, Ping, PowerView, ADFind
➡️ C2: #CobaltStrike & #BazarLoader
➡️ Lateral movement: wmic
➡️ Exfil: Rclone
➡️ Impact: #Conti ransomware

https://t.co/YAZfLCjwDA