Broad Analysis

[Broad Analysis @BroadAnalysis]

Is Sentinel one still working. Asking for a friend.🤓

[Broad Analysis @BroadAnalysis]

A good follow - @JohndCyber

[Broad Analysis @BroadAnalysis]

#FakeBrowserUpdate Making me work for it. DYI infection.
Payload - rtattack.baqebei1[.]online
Payload - cdnforfiles[.]xyz

[ExecuteMalware @executemalware]

It looks like this is another guest at the #fakesocgholish party. Similarities to #rogueraticate but the initial download is a .rar file containing a Java-based .exe and a Java runtime environment.
https://t.co/GGknd9lp7H

[First Watch Cyber Security @FirstWatchCyber]

NOT #SocGholish but #FakeSG as reported by Malwarebytes and other great Security Researchers. #pcap Avail. #IoC #TTP #MitreAttack
https://t.co/4UKXMHpQ9S
pcap - https://t.co/lXsChVNNIG

[First Watch Cyber Security @FirstWatchCyber]

#SocGholish #pcap #IoC
sandwiches.tropipackfood[.]com
eyc.rfc.zitoprohealth[.]com
asfgze[.]fun
nbjhllilknbjldk[.]top

https://t.co/lXsChVNNIG

[Broad Analysis @BroadAnalysis]

Check-out APPENDIX. Good TTP's - #BianLian #Ransomware https://t.co/2Mq17iCYIW

[Broad Analysis @BroadAnalysis]

94.158.244[.]69 - POST /c2sock #LummaStealer #C2

[Broad Analysis @BroadAnalysis]

#RigEK #LummaStealer #Exploit #C2
cryptotdsinc[.]xyz - Redirect
popmag[.]xyz - Redirect
popwertcrypt[.]xyz -Redirect
78.111.88[.]94 - RigEK C2
82.117.255[.]127 - Lumma Stealer C2

https://t.co/L3z32ZcfHi

[Broad Analysis @BroadAnalysis]

#socgholish #fakeupdate - trackrecord.wheresbecky[.]com and some redirects to domain

[Broad Analysis @BroadAnalysis]

@HerbieZimmerman @HuntressLabs Congratulations!!

[Broad Analysis @BroadAnalysis]

@Gi7w0rm @AnFam17 @DanInglis_ popwertcrypt[.]xyz/hd63hd

[Broad Analysis @BroadAnalysis]

#RigEK #Exploit is still a thing. Exploit's IE 11. Dropped something or other.
188.227.58[.]76
https://t.co/OilnPFj3TB

[Broad Analysis @BroadAnalysis]

@ebbe37 @malwrhunterteam Do the best you can.

[Broad Analysis @BroadAnalysis]

#socgholish #NetSupportRat
SocGholish Stage1 - taxes.rpacx[.]com
SocGholish Stage2 - hjgk67kg[.]xyz
SocGholish Stage3 - *.asset.tradingvein[.]xyz
NetSupportRat C2 - 52226asdiobioboioie[.]com (IP 94.158.244.38)

[Broad Analysis @BroadAnalysis]

#socgholish #fakebrowserupate Original loader hosted at navyseal.digijump[.]online - reaches out to *.shrubs.emptyisland[.]pics

[Broad Analysis @BroadAnalysis]

@HerbieZimmerman @Ledtech3 Very sad news. Praying for him and family.

[Broad Analysis @BroadAnalysis]

@thebairam Right is just osquery monitoring processes

[Broad Analysis @BroadAnalysis]

#bumblebee #loader 51.83.250[.]102 downloads #CobaltStrike #C2 naporiz[.]com. Injects C:\Program Files\Windows Photo Viewer\ImagingDevices.exe.

[Broad Analysis @BroadAnalysis]

#bumblebee loader #C2 - 103.144.139[.]135