Ricky LaFleur

[Ricky LaFleur @RickyLafleur1]

#GINP Android banking trojan drop point:
hxxp://remembergreet.site/index2.php?ref=adsterra111 --> hxxps://behaverear.site/get
SHA-256: 8147dd00df915b66d7a3b6e81f1a07624a7cf07941d19c20c3f582bb0abe7c16
C2: hxxp://purefoe.cc/api201/
hxxp://fatgoose.top/api201/

[Ricky LaFleur @RickyLafleur1]

#Cerberus drop point:
hxxp://azimutmarket.com/Hx5
SHA-256: 4e6226b84275d1185a4d9c5b63e38dd4c399791233146ef22bd77b56f6093cd7
C&C: hxxp://serverscreen.host/gate.php

[Ricky LaFleur @RickyLafleur1]

#Android #Lokibot drop point:
hxxps://whats-app.gq/
SHA-256: a6547415ef61bc66531978ef28913938f74dacb887bbd4ec5fc3a4ee978c4376
C2: hxxp://185.185.71.90/

[hackplayers @hackplayers]

Gracias a @JoelSernaMoreno sorteamos dos cables Evil Crow que podréis ver en el Arsenal de #hc0n2020. Si vas a ir a la Con de @hackplayers y quieres participar en el sorteo haz RT y estate atento a @h_c0n. Daremos a conocer los ganadores el próximo 20/01: https://t.co/TtcoDMxFj7

[Ricky LaFleur @RickyLafleur1]

#Anubis drop point targeting turkish people:
hxxp://bedava-kazan.com/
SHA-256:4c736a4e1c029da46d0047d02d30b591ceedec192352ee99be2ef0896efa8a97

[Ricky LaFleur @RickyLafleur1]

#Phishing targeting french tax agency
hxxp://u521272mba.ha003.t.justns.ru/impots.gouv/espace-clients/

[Ricky LaFleur @RickyLafleur1]

#Ginp drop point:
hxxp://cewavato.tk

SHA256: c6559133aad4284821f98da04a06d84596e2f5c663fcc5a057872ec30201862e
https://t.co/vlNEJlXa0a

C&Cs:
hxxps://designpriorityozone.info
hxxps://animalaround.info

stats:

[Ricky LaFleur @RickyLafleur1]

#azorult
hxxp://18.216.84.23/download_file.php
c2: hxxp://18.216.84.23/lastdll/index.php
https://t.co/BAKs0xulmK

[Ricky LaFleur @RickyLafleur1]

#Cerberus drop point:
hxxp://zydalafobyxo.tk
SHA-256: 52746ddb32ca8023246862acdd1e2f828d5ba7760d4be7909b934b6ca28f117c

[Ricky LaFleur @RickyLafleur1]

#Anubis drop point:
hxxps://tikitok-app.ru
SHA-256: fc45cd699eb461fd58abb259e4d754a754a5cb75209d83293b6370d7f0265504

[Ricky LaFleur @RickyLafleur1]

#Anubis drop point targeting turkish people:
hxxp://hediyeinternet.ga/hediyegb.html
SHA-256: 0b79c55a8a3158ef11a79c98a13827f7af22bb1ebc86c7c27e35472f6fe05165

[Ricky LaFleur @RickyLafleur1]

Other drop point:
hxxp://turkcell10gbgnc.com/
SHA-256: c3cd110ae3c76a132211d05dd5faa9f4898ab685d123cf207734162d0a035f5d

[Ricky LaFleur @RickyLafleur1]

Another Drop point:
hxxp://turkcellhediyeservisleri.com/

[Ricky LaFleur @RickyLafleur1]

#Anubis Drop point targeting @Turkcell costumers:
hxxp://turkcell-10gb.com/
SHA-256: 8569b19b87a786f9ffbfbc3467ea07621adaa54d3f4c8771b59746793720f890

[Ahmet Bilal Can 🦔 @0xabc0]

Oh.. Another #anubis dropper with 10.000+ installs

https://t.co/XmrFfoU4dh

Same c2 as previous one.

https://t.co/UgKOtOy0BC

big thanks to @RickyLafleur1 <3

[NI@FI@70 @ni_fi_70]

#Banker #Anubis found/flagged by @RickyLafleur1 https://t.co/Rt8RaRXH9b with nearly 0 detection VT, OK the Banker itselfe has a better score

[Ricky LaFleur @RickyLafleur1]

#Phishing targeting @ZipRecruiter customers:
hxxps://ziprecruiter.hk/login

[Ricky LaFleur @RickyLafleur1]

#Anubis Drop point:
hxxps://tomupdate.host/
MD5: a21217c355618275e4aa6a1d2aa7aedd

[Luis Vacas de Santos @CyberVaca_]

Gracias a todos los que han hecho posible la #hc0n2019 y @hackplayers . En cuanto pueda os actualizo el readme del github https://t.co/nQ1OsfxmHE