BlackonIntel

[BlackonIntel @BlackonIntel]

I'm backed!

[BlackonIntel @BlackonIntel]

smbc-bank[.]com #phishing

[moto_sato @58_158_177_102]

@BlackonIntel https://t.co/4eADMJg3jo

[BlackonIntel @BlackonIntel]

IP: 192.227.247(.)142 #phishing

[BlackonIntel @BlackonIntel]

#phishing suspicious Domain?
npagon(.)com redirect to mufjoe(.)com
https://t.co/IlT9ssyaJT

[BlackonIntel @BlackonIntel]

#Malware #APK
4a144b6482e5b5e5c2c755b45afdad6f85bac99e1ebdc7b12a05d09a5099bec9
https://t.co/auqUHWEZ3m

[BlackonIntel @BlackonIntel]

#phishing Malicious APK dropped.
snwtqxouah(.)duckdns(.)org

[BlackonIntel @BlackonIntel]

#Malware #APK
195a69d27727bfc1cdf7f30a329e66d8e02c491c1a849bcd19453a59ad4b9edd
https://t.co/wS59GslwbD

[BlackonIntel @BlackonIntel]

#phishing Malicious APK dropped.
hagpointlg(.)duckdns(.)org

[JAMESWT @JAMESWT_WT]

Another Day another #Zloader Xls > Vbs @DynamicAnalysis

Sample
✳️https://t.co/WuYU8fcCw7
Backup
✅https://t.co/bwu7ts1eKM

@malwrhunterteam @Arkbird_SOLG @VK_Intel @James_inthe_box @Ethereal_x0r @sugimu_sec @58_158_177_102

[ESET Research @ESETresearch]

#ESETresearch has discovered two ongoing #Mispadu campaigns. One targets Spain 🇪🇸 and has a click counter, the other targets Mexico 🇲🇽 and abuses MEOcloud and #Yandex.Mail to store payloads the same way as described in our blogpost: https://t.co/DeKFiFLmbL @RoboSuman 1/3

[JAMESWT @JAMESWT_WT]

@BlackonIntel @anyrun_app @malwrhunterteam @James_inthe_box @makflwana nf2.exe and nf3.exe are #Orcusrat

[BlackonIntel @BlackonIntel]

@58_158_177_102 It has been used many times?

[BlackonIntel @BlackonIntel]

#phishing Suspicious domain. old?
mufg-blank-jp(.)xyz

[BlackonIntel @BlackonIntel]

@58_158_177_102 Thanks for your response. That is interesting.

[moto_sato @58_158_177_102]

@BlackonIntel We received phshing e-mails including this link at Monday, Thursday and Friday(today).
Mail title said from Mitui-Sumitomo Bank (SMBC) but this domain imitate Mitsubishi UFJ Financial Group Bank(MUFG) :)

[BlackonIntel @BlackonIntel]

#opendir #malware IP: http://47.112.99(.)43/
HASH: bd668ef292ae01d2ed9a32b1ea054e2acb484f61e86481f306669637ba31ce82
https://t.co/pwYuXU76Gn
@anyrun_app @malwrhunterteam @JAMESWT_MHT @James_inthe_box @makflwana

[BlackonIntel @BlackonIntel]

#opendir #malware IP: http://194.87.18(.)147/
HASH: bd86adb11993c876f6a0b12d051dd26911b1fbb453731d45a65a3cd928c6a995
@anyrun_app @malwrhunterteam @JAMESWT_MHT @James_inthe_box @makflwana

[Tino aka Paladin316 @Paladin3161]

#Azorult #malware #OSINT #IOC

cc @JAMESWT_MHT

https://t.co/Oue63llOH2

[abel @abel1ma]

6月26日14時50分頃からamazonを騙った不審メールがばら撒かれています

件名
異常なログインが見つかり

誘導先
hxxp://information-lost-resetting-account-support-amazon[.]com/

#フィッシングメール