Roland Dela Paz

#malware researcher

[Roland Dela Paz @_ddoxer]

#securityblog #antivirus #incidentresponse #securityoperations #malwareanalysis #informationsecurity
https://t.co/lrHIsLI9x4

[Roland Dela Paz @_ddoxer]

From Anti-virus to Incident Response: What’s it like? (PART 1) https://t.co/wwxEUiHgGn via @LinkedIn

[Roland Dela Paz @_ddoxer]

https://t.co/He527c4DRg

[Rommel @rommeljoven17]

Gobot #IoTMalware #botnet #opendir
-supports macOS
-written in Go
-controlled via IRC

macho -5b1219ae05b3128f7028fa3f788f33ea
x86 - d6bda304f4a59e36e5ffefe421d84396

[Rob @Ptr32Void]

I will be presenting at the #CSO50 conference in April in Arizona. I will be discussing #phishing and #malware detection in an automated fashion using #machinelearning.

[Roland Dela Paz @_ddoxer]

#Automation Driven #SecOps: Making Needles Pop-out of the Haystack
https://t.co/dTLHzmPkc3

[Roland Dela Paz @_ddoxer]

This has been happening for a while https://t.co/8IevMFnmhS

[Roland Dela Paz @_ddoxer]

Heads up: @bankofireland 365 Online phishing campaign at online365boi[.]eu currently happening. Propagating through text on a Sunday afternoon. Please don't fall for it. Cc: @talktoBOI @irisscert @malwrhunterteam

[Roland Dela Paz @_ddoxer]

@bankofireland 365 Online phishing campaign making the rounds again. Via SMS. The phishing site is 365boi[.]net. Note that the legitimate is https://t.co/Eb8SX8oo21.
Cc: @talktoBOI @irisscert @malwrhunterteam

[Vess @VessOnSecurity]

OK, folks, I hear that John McAfee claims to have invented cyber security. (I don't know; he has blocked me.)

Gather 'round the fire, kids, for a short story, because I was around at the time.

[Joe Roosen @JRoosen]

New #Emotet epoch 1 payloads as of 09:00EDT+:
https://t.co/2QebcSHxxH
/www.yetanothersteve.com/Xs6TPwnAAJ/
/flewer.pl/pub/s99556m/
/www.hotelcapital.ru/f6FBJD/
/dc.amegt.com/wp-content/oC4gy4aGL/
/www.armanitour.com/kuNOqI/

[Joe Roosen @JRoosen]

New #Emotet Epoch 1 payloads as of 11:30EDT+:
https://t.co/7QaWnFubqH
/www.avemeadows.com/gbPAHU/
/kosilloperutours.com/mrep9aHq/
/www.customaccessdatabase.com/joiuehtr/9g94p2/
/www.deimplant.com/CFsF9RU/
/nfusedigital.co.za/ECbcfDxq/

[\_(ʘ_ʘ)_/ @pollo290987]

#Emotet 25/06/2018
6 DOC
6 Payload
81 C2

IOC's
https://t.co/p42IW4TS6m

@DecayPotato @Jan0fficial @_ddoxer @luc4m @executemalware @James_inthe_box @bauldini @RealRalf9000 @JRoosen @neonprimetime @Techhelplistcom @NelsonSecurity @HazMalware

[Roland Dela Paz @_ddoxer]

Heads up: @bankofireland 365 Online phishing campaign at online365boi[.]eu currently happening. Propagating through text on a Sunday afternoon. Please don't fall for it. Cc: @talktoBOI @irisscert @malwrhunterteam

[Joe Roosen @JRoosen]

New #emotet epoch 1 payloads 19:30EDT+ and new/old doc look. We are back to the Wells Fargo Overlay again:
https://t.co/dLHyEtEE81
/www.apiperjuangan.com/LrfK/
/www.graca.com.np/zCtof/
/www.answerthebeacon.com/YYCUNZ0/
/www.imperiaskygardens.site/Su7FZ/
/www.katexs.com/rogV/

[\_(ʘ_ʘ)_/ @pollo290987]

@executemalware #Emotet 20/06/2018

1 DOC
2 Payload
43 C2

[+] New IP's and Port 8090

IOC's
https://t.co/CMuXYp0F9O

@RealRalf9000 @bauldini @JRoosen @James_inthe_box @DecayPotato @executemalware @neonprimetime @Techhelplistcom @_ddoxer @NelsonSecurity @Mesiagh

[James @James_inthe_box]

A few #emotet links for today, will update as I get them:

https://t.co/y3XWoKFyda

[Roland Dela Paz @_ddoxer]

#Geodo / #Emotet doc dropper locations 20/06/18: https://t.co/m2fXbgnqBp
@JRoosen @_odisseus @JAMESWT_MHT @James_inthe_box @pollo290987 @Mesiagh @NelsonSecurity @DynamicAnalysis @neonprimetime @noottrak @Techhelplistcom

[\_(ʘ_ʘ)_/ @pollo290987]

Sorry for join me late... Resume of #Emotet 06/01/2018

394 URL's
15 DOC
4 Payload
48 C2

1 Sample unknown

IOC's
https://t.co/DApCVH50HU

Thnks for the lists:
@_ddoxer @JRoosen @executemalware @DecayPotato @jamesin

[Joe Roosen @JRoosen]

Here is today's notes for #emotet. I go into more in depth analysis of the dual variant/epoch hypothesis in the notes section at the bottom. IOCs are at the top like normal. Will keep updating as I can. https://t.co/v4wRyFheB6

[Roland Dela Paz @_ddoxer]

#Geodo / #Emotet doc dropper locations 01/06/18: https://t.co/moosp1tEck
@JRoosen @_odisseus @JAMESWT_MHT @James_inthe_box @pollo290987 @Mesiagh @NelsonSecurity @DynamicAnalysis @neonprimetime @noottrak @Techhelplistcom