David Ledbetter

System Repair, Windows system tools ,Security research.
IDA Challenged.

[David Ledbetter @Ledtech3]

@1ZRR4H @malwrhunterteam @JAMESWT_MHT @StopMalvertisin @James_inthe_box @pr0xylife @0xToxin @ankit_anubhav Fished Decoding these 1 at a time.
Interesting strings for sandbox checks

[David Ledbetter @Ledtech3]

@1ZRR4H @malwrhunterteam @JAMESWT_MHT @StopMalvertisin @James_inthe_box @pr0xylife @0xToxin @ankit_anubhav

[David Ledbetter @Ledtech3]

@GelosSnake Well it is on 'reddit' so ..🤷‍♂️

[ExecuteMalware @executemalware]

As others have mentioned, the "presidents" #qakbot #qbot distribution (obama221) is back to using "DLL Search Order Hijacking" today (see screenshot).

Here are the IOCs:
https://t.co/JqSmNQxUIf

[Scarlet Shark Security @ScarletSharkSec]

Anyone seeing #Socgholish using localsys-shield[.]com today?

[Kelsey @k3dg3]

#IcedID mixing it up today with CHM files

BotID: 1609463178
Loader C2: trolspeaksunt\.com

pw-protected, zipped ISO attachments

https://t.co/9PDXgxpRAF

https://t.co/1jlSljsrFu

[David Ledbetter @Ledtech3]

@c_APT_ure you can bck up most of the stuff, but If I remember correctly it doesn't do the DM's thoguh.
I've done 2 backup's since i've been here

[David Ledbetter @Ledtech3]

@t3ft3lb It looks like the site is down already. Is there a hash for what it downloaded ?

[David Ledbetter @Ledtech3]

@t3ft3lb Ok thanks.
I'll have to download this and take a closer look at the shellcode.

Looks interesting.

[David Ledbetter @Ledtech3]

@hacks4pancakes I have several people that I have DM'd with and the DM's have disappeared but I'm not sure how they do it.

[David Ledbetter @Ledtech3]

@Cryptolaemus1 I was waiting for a 'Ivan Season' to pop up.. 🤷‍♂️

[David Ledbetter @Ledtech3]

@ankit_anubhav @1ZRR4H @Max_Mal_ @pr0xylife @0xToxin @Gi7w0rm I think my tool got it right.
(Still a work in progress)
It is just like all of those document links that download the rtf's with the Shellcode I wrote about here.
https://t.co/OZuqcUWL4e

There are a constant change of urls but they are abuse the "@" function.

[hasherezade @hasherezade]

I added my solution for the Task 8: https://t.co/xFNGIxz6eX // #FlareOn9

[David Ledbetter @Ledtech3]

@t3ft3lb I have not had time to look at this one yet 🤔
Just from the screenshots you got the "External Link/Template"
I'll have to see what it downloads

[David Ledbetter @Ledtech3]

@jms_dot_py Morning...☕️

[David Ledbetter @Ledtech3]

@jms_dot_py @lockdownurlife In that case..
(Thought I missed it)
Morning... ☕️ 🤷‍♂️

[David Ledbetter @Ledtech3]

@sherrod_im Um ... ✋..... never mind.. 😳

[David Ledbetter @Ledtech3]

@UK_Daniel_Card looks like a busy IP https://t.co/xIJolt8OUj

[David Ledbetter @Ledtech3]

@bryceabdo Make sure that is screenshots of the Sha-256 Hashes..

[David Ledbetter @Ledtech3]

@Rumsfeld86 @Bandrel Ok i can't help myself 🤷‍♂️