侍 𝑶𝒈𝒖𝒛𝒉𝒂𝒏 𝑨. 🇹🇷

Stoic.
Principal Security Engineer
Aquila non captat muscas ⚔️ I break stuff to make the world a safer place
1337

[侍 𝑶𝒈𝒖𝒛𝒉𝒂𝒏 𝑨. 🇹🇷 @SmashTheKernel]

@orange_8361 Gods don't need OSEE certification : ) 👑😎🍊🍊🍊

[侍 𝑶𝒈𝒖𝒛𝒉𝒂𝒏 𝑨. 🇹🇷 @SmashTheKernel]

@electrocode Sorumluluklarım research yapmama izin vermiyor malesef😄Spektrum analizi, frekans rastgeleleştirme ve frekans filtreleme. Ek olarak sinyal analizi gerekli tüm keywordler gibi.

[侍 𝑶𝒈𝒖𝒛𝒉𝒂𝒏 𝑨. 🇹🇷 @SmashTheKernel]

@electrocode Artık her EMP tipi atak vektörü görünce komple faraday kafesinde gezelim olsun bitsin moduna giriyorum : )

[侍 𝑶𝒈𝒖𝒛𝒉𝒂𝒏 𝑨. 🇹🇷 @SmashTheKernel]

@iremosbyy Artış&zam veremeyenler, altı boş titlelerla steroid gibi şişiriyorlar.Özellikle son yıllarda standart olan titlelar tamamen karmaşık bir hal aldı.O yüzden genelde yıl deneyimini baz almak lazım. Birçoğu gerçek kurumsalda yıla göre değerlendirilince düz uzman olarak geliyor : )

[侍 𝑶𝒈𝒖𝒛𝒉𝒂𝒏 𝑨. 🇹🇷 @SmashTheKernel]

@h4ck2s3c Mamikovv ne güldürdün😄😄😄

[侍 𝑶𝒈𝒖𝒛𝒉𝒂𝒏 𝑨. 🇹🇷 @SmashTheKernel]

@mhcifci Since you cannot use a cloud solution on end-user endpoints, there seems to be no other solution but to minimize the occurrence of such vendor-related problems. It can be a server-specific solution, but this time country regulatory criteria can be a problem.

[侍 𝑶𝒈𝒖𝒛𝒉𝒂𝒏 𝑨. 🇹🇷 @SmashTheKernel]

@falc7n Varol hıştocum gönüllerdesin ve payloadlarımızdasın, we've actually always been around here :) 🕴️‍♂️🕶️

[侍 𝑶𝒈𝒖𝒛𝒉𝒂𝒏 𝑨. 🇹🇷 @SmashTheKernel]

Hi my friends in the cyber security ecosystem, my X account, which was suspended for about 4 years without knowing the reason, has been reactivated.Of course, there had to be retaliation by actors against the contributions made to this ecosystem. Here again and stronger than ever

[侍 𝑶𝒈𝒖𝒛𝒉𝒂𝒏 𝑨. 🇹🇷 @SmashTheKernel]

5."1785091d1e5213758fcaf3764ab1e5201685307b5e4339f421b24d7d27b20595"

[侍 𝑶𝒈𝒖𝒛𝒉𝒂𝒏 𝑨. 🇹🇷 @SmashTheKernel]

Ramadan Android Banker Incıdent

From: senbugundeevdekaldiye[.]com
ramazan-hediyesi.apk
Hash:"0988d23f8866d69638d2a73498e38697ce4d5f78e4be90cd563eb6ac3f0785a1"

https://t.co/m1EQSqdfer

5 different variant samples same C&C here⬇️
Target:🇹🇷
C2: hemamasm[.]com

@malwrhunterteam

[侍 𝑶𝒈𝒖𝒛𝒉𝒂𝒏 𝑨. 🇹🇷 @SmashTheKernel]

1."0988d23f8866d69638d2a73498e38697ce4d5f78e4be90cd563eb6ac3f0785a1"
2."e7f82e7b1b4098596d5a969c763e4603c61d228fa6eb97ed455f2ed170fda6e0"
3."254cedf269d80d4c48c7c289c9e4ba9f85a67e3cb3bbcd90d8d583f2f77fb9b8"
4."83dc3b0295a0f7c853f88f65a47b140313c0087b2c11c70667ce3c1c34b63b50" ⬇️⬇️

[Will @BushidoToken]

@SmashTheKernel @malwrhunterteam @LukasStefanko Yeah all connected to the Cerberus BitBucket campaign:

[侍 𝑶𝒈𝒖𝒛𝒉𝒂𝒏 𝑨. 🇹🇷 @SmashTheKernel]

@BushidoToken @malwrhunterteam @LukasStefanko Oh sweet topology 🍬

[侍 𝑶𝒈𝒖𝒛𝒉𝒂𝒏 𝑨. 🇹🇷 @SmashTheKernel]

Android Banker Incident

Froms:
sen-evdekal20gbkazan[.]com
bitbucket[.]org/emreadamol/emreadamol34/downloads/20gbinternet-evdekal.apk

82d7f887ec682ef752f71119c5a31a415bd907864e0d207943a68916ec96b7b3

https://t.co/JGqisP68XU

C2: besieged[.]top

@malwrhunterteam @LukasStefanko

[侍 𝑶𝒈𝒖𝒛𝒉𝒂𝒏 𝑨. 🇹🇷 @SmashTheKernel]

@BushidoToken @malwrhunterteam @LukasStefanko Thanks dude excellent work, I found out that the first 2 domains on the list were C&C servers.

[侍 𝑶𝒈𝒖𝒛𝒉𝒂𝒏 𝑨. 🇹🇷 @SmashTheKernel]

Android Banker Incident

From: yuklesm[.]org
Name: 20gb_hediye_internet.apk

Hash"d0c73e7bb87c22cac394ed5691b6557648152486362c5d8cf78cf7aaa088908c"

https://t.co/ZU1XsBVRpM

Target:🇹🇷
C2: binsletr[.]net

@malwrhunterteam @LukasStefanko @JAMESWT_MHT
#android #banker #malware

[侍 𝑶𝒈𝒖𝒛𝒉𝒂𝒏 𝑨. 🇹🇷 @SmashTheKernel]

Indicator of Attack(IOA) vs. Indicator of Compromises(IOC) includes assets. The combination formed in the shadow of this conflict is Indicator of Pivoting (IOP)

https://t.co/0lCgeEr4GJ

#ThreatHunting #Threatanalysis #infosec

[侍 𝑶𝒈𝒖𝒛𝒉𝒂𝒏 𝑨. 🇹🇷 @SmashTheKernel]

@salatalik İlâhi ya, orucuna değilde cebine olabilir ama :))

[侍 𝑶𝒈𝒖𝒛𝒉𝒂𝒏 𝑨. 🇹🇷 @SmashTheKernel]

Ramadan Android Banker Incıdent

From: turkiye-evdekal[.]com

https://t.co/impHkLzEJf

10 different variant samples C&C server here⬇️
Target:🇹🇷
C2: code-maj[.]com
C2: topleamna[.]com
C2: krazmnnat[.]com
C2: yasimmena[.]tech

@malwrhunterteam @LukasStefanko @JAMESWT_MHT
#malware

[侍 𝑶𝒈𝒖𝒛𝒉𝒂𝒏 𝑨. 🇹🇷 @SmashTheKernel]

Samples Hashes Continue⬇️

ramazan-hediyesi.apk

6. 1d374f96e6901ff63b16911994b303236f4539d8
7. d725ca4f117eee80bfff6e4682f05fd34fcccead
8. 8d9659518b86e9eb0d9a6a3031e4ff08e7b6ddab
9. dae89c7ba31bd31c7ffd16f54227c64656e0a923
10. cd6cbe9d088181eccf513ef8423ab5b91fdfd120

[侍 𝑶𝒈𝒖𝒛𝒉𝒂𝒏 𝑨. 🇹🇷 @SmashTheKernel]

Samples Hashes Here⬇️

ramazan-hediyesi.apk

1. acd4204fa9c3ae9b6fada5691fcb8d86883ef233
2. 6e4ce5d7390f1052b3dd60644f65f750e164605b
3. e9919301df3f1c0d015be57732f9e3bac7ee1cb6
4. 08acdeec826a3c31270c42a3773f9c5b7097ad2d
5. 706eebcc50ec5d9398bb56518d0794b91b8d9085