Dee

Verified account

@ViriBack

#Malware C2 hunter #infosec passionate. Tweets are my own.

Canada

Joined March 2015

1.1K Following

10.7K Followers

1.5K Posts

Pinned Tweet

almost 3 years ago

Over the 10k #malware C2 panels on https://t.co/NCtVSQlP6n

ViriBack's tweet photo. Over the 10k #malware C2 panels on https://t.co/NCtVSQlP6n https://t.co/YT3NPsBW0Q

5

79

17

37

21K

ViriBack retweeted

Michael Koczwara

@MichalKoczwara

4 days ago

Just finished the full walkthrough of my TraderTraitor infrastructure research today. From one reported ROOFDECK C2 to 13 linked endpoints using certificates, TLS fingerprints and historical records. Full walkthrough. Hope you enjoy it, and happy hunting! https://t.co/aKwxOeFUiE

MichalKoczwara's tweet photo. Just finished the full walkthrough of my TraderTraitor infrastructure research today.

From one reported ROOFDECK C2 to 13 linked endpoints using certificates, TLS fingerprints and historical records.

Full walkthrough.

Hope you enjoy it, and happy hunting!

https://t.co/aKwxOeFUiE

1

162

39

102

10K

ViriBack retweeted

MalwareHunterTeam

@malwrhunterteam

23 days ago

Another "WHisKEY - Remote Device Management" panel: http://only1mafia[.]net/ 😂 🤷‍♂️

malwrhunterteam's tweet photo. Another "WHisKEY - Remote Device Management" panel: http://only1mafia[.]net/
😂
🤷‍♂️ https://t.co/gliKCfDiLD

2

24

4

8

7K

ViriBack retweeted

Coral Jasmine @Fact_Finder03

6 days ago

217.154.47.115 vt3.]eu #HVNC #Console @500mk500 @skocherhan @smica83 @ViriBack @malwrhunterteam #C2 #Panel #CTI

Fact_Finder03's tweet photo. 217.154.47.115
vt3.]eu

#HVNC #Console

@500mk500
@skocherhan
@smica83
@ViriBack
@malwrhunterteam

#C2 #Panel #CTI https://t.co/AA3nHGmV1j

Fact_Finder03's tweet photo. 217.154.47.115
vt3.]eu

#HVNC #Console

@500mk500
@skocherhan
@smica83
@ViriBack
@malwrhunterteam

#C2 #Panel #CTI https://t.co/AA3nHGmV1j

Fact_Finder03's tweet photo. 217.154.47.115
vt3.]eu

#HVNC #Console

@500mk500
@skocherhan
@smica83
@ViriBack
@malwrhunterteam

#C2 #Panel #CTI https://t.co/AA3nHGmV1j

0

9

3

2

347

Who to follow

Malware slayer Member of @CuratedIntel

DFIR | Malware Hunter | @Cryptolaemus1

Malware Researcher | Developer | @Cryptolaemus1 | @NVIDIA bsky: [email protected]

ViriBack retweeted

Coral Jasmine @Fact_Finder03

7 days ago

103.214.71.68[:5000/login 103.214.71.68 103.214.71.68[.sslip.io #GALODO 302d62816fc064d2cd19feea1a3d46c259762ccbfc64fa8be917d1165ef1dd47 @500mk500 @skocherhan @smica83 @ViriBack @malwrhunterteam #C2 #Panel #CTI

Fact_Finder03's tweet photo. 103.214.71.68[:5000/login
103.214.71.68
103.214.71.68[.sslip.io

#GALODO

302d62816fc064d2cd19feea1a3d46c259762ccbfc64fa8be917d1165ef1dd47

@500mk500
@skocherhan
@smica83
@ViriBack
@malwrhunterteam

#C2 #Panel #CTI https://t.co/XUkg4muIwi

0

12

2

5

779

ViriBack retweeted

MalwareHunterTeam

@malwrhunterteam

7 days ago

Some panel titled "Control Panel": https://c2.staticbdfe[.]com/ "Secure Access" "Command Center" This panel also surely has nothing to do with AI... 😂 🤷‍♂️

malwrhunterteam's tweet photo. Some panel titled "Control Panel": https://c2.staticbdfe[.]com/
"Secure Access"
"Command Center"
This panel also surely has nothing to do with AI...
😂
🤷‍♂️ https://t.co/aRrVYhwIv5

0

26

2

0

4K

ViriBack retweeted

Coral Jasmine @Fact_Finder03

7 days ago

https://t.co/l6AlXKORGx #ScarStealer #C2 @500mk500 @skocherhan @ViriBack @smica83 @malwrhunterteam #CTI

Fact_Finder03's tweet photo. https://t.co/l6AlXKORGx

#ScarStealer #C2

@500mk500
@skocherhan
@ViriBack
@smica83
@malwrhunterteam

#CTI https://t.co/vkxbZTnsbG

0

3

2

1

274

ViriBack retweeted

MalwareHunterTeam

@malwrhunterteam

8 days ago

Some panel titled "AMBRELA RAT": https://kyamich[.]dev/login 🤷‍♂️

malwrhunterteam's tweet photo. Some panel titled "AMBRELA RAT": https://kyamich[.]dev/login
🤷‍♂️ https://t.co/FNIFjE9lwW

1

22

2

6

5K

ViriBack retweeted

MalwareHunterTeam

@malwrhunterteam

9 days ago

Another "WHisKEY - Remote Device Management" panel: http://50.114.179[.]29/ 🤷‍♂️

malwrhunterteam's tweet photo. Another "WHisKEY - Remote Device Management" panel: http://50.114.179[.]29/
🤷‍♂️ https://t.co/orX73HjjiB

1

33

3

12

7K

ViriBack retweeted

MalwareHunterTeam

@malwrhunterteam

9 days ago

Some Russian, totally not made with AI panel titled "ClickFix Panel 2.0": https://polaternaert[.]top/ 😂 🤷‍♂️

malwrhunterteam's tweet photo. Some Russian, totally not made with AI panel titled "ClickFix Panel 2.0": https://polaternaert[.]top/
😂
🤷‍♂️ https://t.co/y3c4u7knlV

4

28

4

5

5K

ViriBack retweeted

Coral Jasmine @Fact_Finder03

24 days ago

153.75.85.28:8080 @500mk500 @skocherhan @JAMESWT_WT @ViriBack @malwrhunterteam #C2 #CTI

Fact_Finder03's tweet photo. 153.75.85.28:8080

@500mk500
@skocherhan
@JAMESWT_WT
@ViriBack
@malwrhunterteam

#C2 #CTI https://t.co/RY7rohGJnz

0

3

2

0

316

ViriBack retweeted

MalwareHunterTeam

@malwrhunterteam

25 days ago

Some panel titled "SourceUse": https://sourceuse[.]cyou/ https://callmylove[.]cyou/ http://91.92.40[.]28:7777/ "SOURCEUSE" "command & control" 🤷‍♂️

malwrhunterteam's tweet photo. Some panel titled "SourceUse":
https://sourceuse[.]cyou/
https://callmylove[.]cyou/
http://91.92.40[.]28:7777/
"SOURCEUSE"
"command & control"
🤷‍♂️ https://t.co/7tMkQZTQoE

1

25

3

5

4K

ViriBack retweeted

Coral Jasmine @Fact_Finder03

about 1 month ago

124.198.128.74[:8080 @500mk500 @skocherhan @ViriBack @malwrhunterteam #Satan #Stealer #Panel #CTI

Fact_Finder03's tweet photo. 124.198.128.74[:8080

@500mk500
@skocherhan
@ViriBack
@malwrhunterteam

#Satan #Stealer #Panel #CTI https://t.co/ud7aiZZaQQ

0

5

2

2

479

ViriBack retweeted

Coral Jasmine @Fact_Finder03

about 1 month ago

92.118.230.55 https://t.co/BUtY0MvbVQ #Qatar #Stealer #panel @500mk500 @skocherhan @ViriBack @malwrhunterteam #CTI

Fact_Finder03's tweet photo. 92.118.230.55
https://t.co/BUtY0MvbVQ

#Qatar #Stealer #panel

@500mk500
@skocherhan
@ViriBack
@malwrhunterteam

#CTI https://t.co/8T11fbc640

1

6

3

3

432

ViriBack retweeted

Coral Jasmine @Fact_Finder03

about 1 month ago

157.230.224.101 @500mk500 @skocherhan @ViriBack @malwrhunterteam #Stealer #Panel #CTI

Fact_Finder03's tweet photo. 157.230.224.101

@500mk500
@skocherhan
@ViriBack
@malwrhunterteam

#Stealer #Panel #CTI https://t.co/r2CjjlomA9

1

10

4

1

722

ViriBack retweeted

MalwareHunterTeam

@malwrhunterteam

about 1 month ago

Some panel here: http://109.238.87[.]111/login "The CIS does not knock and will never knock" 🤔 🤷‍♂️

malwrhunterteam's tweet photo. Some panel here: http://109.238.87[.]111/login
"The CIS does not knock and will never knock"
🤔
🤷‍♂️ https://t.co/awNoNRVq0h

2

14

4

11

7K

ViriBack retweeted

Coral Jasmine @Fact_Finder03

about 2 months ago

158.247.255.167[:8080 @500mk500 @skocherhan @JAMESWT_WT @ViriBack @malwrhunterteam #ShadowExt #Panel #C2 #CTI

Fact_Finder03's tweet photo. 158.247.255.167[:8080

@500mk500
@skocherhan
@JAMESWT_WT
@ViriBack
@malwrhunterteam

#ShadowExt #Panel #C2 #CTI https://t.co/x1ubEu3uRw

0

8

1

3

497

ViriBack retweeted

Coral Jasmine @Fact_Finder03

2 months ago

178.128.173.9:]8000 @500mk500 @skocherhan @JAMESWT_WT @ViriBack @malwrhunterteam #Stealer #C2 #Panel #CTI

Fact_Finder03's tweet photo. 178.128.173.9:]8000

@500mk500
@skocherhan
@JAMESWT_WT
@ViriBack
@malwrhunterteam

#Stealer #C2 #Panel #CTI https://t.co/pPXum58o8u

0

8

3

2

544

ViriBack retweeted

James @James_inthe_box

2 months ago

#unknown panels at: http://108.165.15\.70/view/view.php http://169.58.168\.28:3847 cc @ViriBack @Fact_Finder03

$James_inthe_box's tweet photo. #unknown panels at: http://108.165.15\.70/view/view.php http://169.58.168\.28:3847 cc @ViriBack @Fact_Finder03 https://t.co/ulzaI39txE$

1

19

7

5

3K

ViriBack retweeted

ܛܔܔܔܛܔܛܔܛ

3 months ago

'Overlord' pinkfriend[.]top 553f64001e0e802a9619bd934d791155 7d9bc569fb5fc333b02b31fc0f765a51 bc480c5e99cc86f26c33ea43d0fe8c68 #Amadey #c2

skocherhan's tweet photo. 'Overlord'
pinkfriend[.]top

553f64001e0e802a9619bd934d791155
7d9bc569fb5fc333b02b31fc0f765a51
bc480c5e99cc86f26c33ea43d0fe8c68
#Amadey #c2 https://t.co/bTGW9bIl0d

2

9

2

3

1K

ViriBack retweeted

3 months ago

NeedleStealer 🪡🪝 written in Go ⤵️ 🔎 HTTP user agents observed: User-Agent: Loader-cli/v1 user-agent: Go-http-client/2.0 📡 Botnet C2s, all behind Cloudflare CDN: http://woolvilli .com/api/v2 http://allremdeskriki .com/api/v2 http://dubl1allremriki .com/api/v2 http://dubl2allremriki .com/api/v2 💡 Related C2 infrastructure at Vultr 🇳🇱: http://136.244.100 .54:8899/api/v1/agent/register http://136.244.100 .54:8899/api/v1/agent/ws ⚱️ Artifacts: \Sessions\1\BaseNamedObjects\Local\NeedleRemoteAgentSingle C:\Users\user\AppData\Local\Temp\needle-2fa 📄 Malware samples: https://t.co/re9St3VLwC 🦊 Relevant IOCs are on ThreatFox: https://t.co/vpsjVZG1Wq Stealer admin panel⤵️

$abuse_ch's tweet photo. NeedleStealer 🪡🪝 written in Go ⤵️ 🔎 HTTP user agents observed: User-Agent: Loader-cli/v1 user-agent: Go-http-client/2.0 📡 Botnet C2s, all behind Cloudflare CDN: http://woolvilli .com/api/v2 http://allremdeskriki .com/api/v2 http://dubl1allremriki .com/api/v2 http://dubl2allremriki .com/api/v2 💡 Related C2 infrastructure at Vultr 🇳🇱: http://136.244.100 .54:8899/api/v1/agent/register http://136.244.100 .54:8899/api/v1/agent/ws ⚱️ Artifacts: \Sessions\1\BaseNamedObjects\Local\NeedleRemoteAgentSingle C:\Users\user\AppData\Local\Temp\needle-2fa 📄 Malware samples: https://t.co/re9St3VLwC 🦊 Relevant IOCs are on ThreatFox: https://t.co/vpsjVZG1Wq Stealer admin panel⤵️$

3

69

27

40

9K

Last Seen Users on Sotwe

Trends for you

Most Popular Users