MalwareHawk2

Researcher, threat hunting, APT hunting, opinions are mine.
📍DM open for research collabs

[MalwareHawk2 @MalwareHawk]

5a57584cfec7f8dc2a9e23bfebbfb622
New Rat
c2 - https://t.co/QXZYSFnjak
#IOC @abuse_ch #malware #hunting #virustotal

[MalwareHawk2 @MalwareHawk]

New Vidar C2
c2 - https://t.co/aMQ8CE7jjm
47c1cf344ba551cde1da1ccaf40b6a2b
abf044288c2ae64b453fbfbddafcfb65
f03a0908da1413d07a24d727f6b6d4f4
#IOC #pws @EmergingTh59785 #threathunting.

[MalwareHawk2 @MalwareHawk]

Sars Letter phishing file is targeting South Africans — disguised as a tax authority letter.

SARS eFiling Letter Notification.msg (Email)
95fdd2207ebd2970a3d76bed3f72d08b
01077809cf6d633e0e89a529971ab957
fd7e67464d559b4b3a961ad974916fa1

[MalwareHawk2 @MalwareHawk]

Less AV detection Ration Valley RAT
crypter - 6315faaecbf15b5c492846f19e40f2ea
payload - ce7b9a6793f1af244f2227d84c188735
#downloader #loader #IOC @EmergingThreats @ET_Labs

[MalwareHawk2 @MalwareHawk]

Pulsar RAT
8531015e99baa8b08bca3a19d8b528d3
5deca39909f9db81e7b941f68b267abe
#RAT #Malware #IOC

[MalwareHawk2 @MalwareHawk]

@JAMESWT_WT password dump- 5ca8a416e606e60dfcf9be973b4b5a6d (win32)
- 7bb15295595f49f23b67650766bb8ab7 (jar)
604bd003c53cc933af07e4882f81908d

hxxps://bambooware.ru phish url involved in campaighn
hxxps://bambooware.ru/static/payload.jar
#IOC #malwareamy

[MalwareHawk2 @MalwareHawk]

Alert New Ransomware
VBS
nouveau_curriculum_vitae.vbs - 1710ea0e24bbd06cff4094c8f1ff9641
ccbc238010e2f018dfbec4c042d5eba1
0c0195c48b6b8582fa6f6373032118da vuln sys file
39398b07a7c4199ac81b2c89867b16df scheduled task xml
7874dd098ba9da2d61de2ffce3d1b894
#ransomware @JAMESWT_WT

[MalwareHawk2 @MalwareHawk]

c18740f70b8ee70abe3a148c04b6580b
491eb99507115721134083eb6e214474
bf6653202524eabe25392f4d89693b30
C2-
coordenacao2026[.]writesthisblog[.]com/resdocb/receptor.php
Targets Brazilian banks - steals victim's data, crypto wallets
#Brazil #ThreatHunting @abuse_ch @joe4security #Banks

[MalwareHawk2 @MalwareHawk]

#ScreenConnect
https://t.co/29ZFfZ9zNc

new C2 #ThreatHunting #RMM @joe4security

[MalwareHawk2 @MalwareHawk]

HijackLoader
http://109.107.165.95/Package.zip
zip - 10c621072b59ffed6c9b405c6b15823c
exe - e45060e0c7f541d1ae06c96fb3010894

#loader #downloader @abuse_ch @jstrosch #malwareamy @joe4security

[MalwareHawk2 @MalwareHawk]

RedTiger Stealer

github - https://t.co/HDHiQog3KT
hash - 8159755f61c3ed39fcadd7f95e4e447c

#Anti-Analysis #Crypto/Obfuscation #Surveillance
#DataTheftCapabilities #C2/Exfiltration
#stealer #IOC #github #malwareamy @abuse_ch

[MalwareHawk2 @MalwareHawk]

@securityresearcher kindly add signature to
https://t.co/0uAmL3wjts
hash - e43bf657000660eea81c046eaa95c243
infuture you may see infostealers using DumpBrowserSecrets tool as injection process.
#detection @MalDevAcademy #EDR #AV #stealer #infostealer #blockit

[MalwareHawk2 @MalwareHawk]

#SalatStealer
47c8731b2526613e1e3bc61a88680cd0 exe
7c72e53642130007556aee0cd9253cdd ps1
malware distributer - 46.151.182.238:6969
#clipper #miner #Rat @JAMESWT_WT #stealer @malwrhunterteam @MalwareTechBlog #MalwareDev

[MalwareHawk2 @MalwareHawk]

f0667dff4f53a909ed9590e4876528d8
C2 - https://t.co/RHFCey57h0
#new #stealer #IOC @JAMESWT_WT @abuse_ch

[MalwareHawk2 @MalwareHawk]

hash - 339cbd6c882dfbec25c4cc4b3daa7bd6
MBSB Bank Year End Benefit Details

#lnk #IOC @malwrhunterteam #RAT

[MalwareHawk2 @MalwareHawk]

APT36 TransparentTribe targeting President of India, DGBR
5c4488b4eda72d245dac5382f3587f09 - iso
4a15c836678dcaf9083be420c1b091cf - iso
5b4a48815446cd40d8e141cbf8582296 Crimson RAT
http://93.127.133.9/ - C2
#APT36 #TransparentTribe #RAT @JAMESWT_WT @abuse_ch

[MalwareHawk2 @MalwareHawk]

@JAMESWT_WT @abuse_ch another sample
403c5bb75ad75d27061a2cdfe40d6952
Extension - EXT

[MalwareHawk2 @MalwareHawk]

Hash - 0bcb125b5143ab919a958da07faad026
#LockBit #ransomware #Ransom #ransomwareattack
Restore file - a19a82d2697e7cb8f173d797fb76712e
torlink - http[:]//lockbitapt.onion
#Threat #hunting #MalwareDev
@JAMESWT_WT @abuse_ch