CDI Research

@cdi_research

We are crawling the abyss of cybersecurity...

Joined December 2022

1 Following

68 Followers

6 Posts

CDI Research @cdi_research

over 3 years ago

We hunted this sample(3ad1a9770a533c2bb8be9d4e7150a2a167d0709c4b0339a5fd6a511008cea7ef). It is so fresh! https://t.co/GYyEVGlRtW

0

3

0

0

521

CDI Research @cdi_research

over 3 years ago

Hello Kety! Do you want fresh HUI Loader? Let’s hunt with funny string c:\users\hellokety.ini ! DLL is now 64bit and it uses RC4-like encryption for payload. HelloKety was also used by APT10’s PlugX(02b95ef7a33a87cc2b3b6fd47db03e711045974e1ecf631d3ba9e076e1e374e9). #APT

$cdi_research's tweet photo. Hello Kety! Do you want fresh HUI Loader? Let’s hunt with funny string c:\users\hellokety.ini ! DLL is now 64bit and it uses RC4-like encryption for payload. HelloKety was also used by APT10’s PlugX(02b95ef7a33a87cc2b3b6fd47db03e711045974e1ecf631d3ba9e076e1e374e9). #APT https://t.co/wRMNn7honQ$

$cdi_research's tweet photo. Hello Kety! Do you want fresh HUI Loader? Let’s hunt with funny string c:\users\hellokety.ini ! DLL is now 64bit and it uses RC4-like encryption for payload. HelloKety was also used by APT10’s PlugX(02b95ef7a33a87cc2b3b6fd47db03e711045974e1ecf631d3ba9e076e1e374e9). #APT https://t.co/wRMNn7honQ$

$cdi_research's tweet photo. Hello Kety! Do you want fresh HUI Loader? Let’s hunt with funny string c:\users\hellokety.ini ! DLL is now 64bit and it uses RC4-like encryption for payload. HelloKety was also used by APT10’s PlugX(02b95ef7a33a87cc2b3b6fd47db03e711045974e1ecf631d3ba9e076e1e374e9). #APT https://t.co/wRMNn7honQ$

$cdi_research's tweet photo. Hello Kety! Do you want fresh HUI Loader? Let’s hunt with funny string c:\users\hellokety.ini ! DLL is now 64bit and it uses RC4-like encryption for payload. HelloKety was also used by APT10’s PlugX(02b95ef7a33a87cc2b3b6fd47db03e711045974e1ecf631d3ba9e076e1e374e9). #APT https://t.co/wRMNn7honQ$

1

25

5

8

7K

CDI Research @cdi_research

over 3 years ago

🪲#PlugX https://t.co/zLtzRO4EKx

0

0

0

0

360

CDI Research @cdi_research

over 3 years ago

#MustangPanda #TA416 abused iso file and malicious LNK file and malware. Malware delivers shellcode which has #PlugX. 1/2

cdi_research's tweet photo. #MustangPanda #TA416 abused iso file and malicious LNK file and malware. Malware delivers shellcode which has #PlugX. 1/2 https://t.co/KQlPK1OUC7

cdi_research's tweet photo. #MustangPanda #TA416 abused iso file and malicious LNK file and malware. Malware delivers shellcode which has #PlugX. 1/2 https://t.co/KQlPK1OUC7

cdi_research's tweet photo. #MustangPanda #TA416 abused iso file and malicious LNK file and malware. Malware delivers shellcode which has #PlugX. 1/2 https://t.co/KQlPK1OUC7

cdi_research's tweet photo. #MustangPanda #TA416 abused iso file and malicious LNK file and malware. Malware delivers shellcode which has #PlugX. 1/2 https://t.co/KQlPK1OUC7

Samir @SBousseaden

over 3 years ago

02d605b7e07b9026104d8160602b0142 draft letter to European Commission RUSSIAN OIL PRICE CAP sg de.iso (deliver #PlugX) :

SBousseaden's tweet photo. 02d605b7e07b9026104d8160602b0142
draft letter to European Commission RUSSIAN OIL PRICE CAP sg de.iso (deliver #PlugX) : https://t.co/ykqMn1GJIm

1

34

10

8

20K

1

7

1

3

5K

Who to follow

パロアルトネットワークス(@PaloAltoNtwksJP) のスレットインテリジェンス & セキュリティコンサルティングチーム Unit 42 から最新のリサーチレポートとニュースをお伝えします。

サイバーディフェンス研究所｜脆弱性診断・ペネトレーションテスト・フォレンジック・脅威インテリジェンス

Verified account

@cyberdefense_jp

サイバーディフェンス研究所の公式アカウントです。脆弱性診断、ペネトレーションテスト、デジタルフォレンジック、脅威インテリジェンスに関する情報を発信しています。 Blog : https://t.co/DIgDSxFAth｜PV : https://t.co/wjRrkcYV77

Verified account

日本🇯🇵のサイバー脅威を分析してインテリジェンスを垂れ流している存在です。ときどきマルウェアも解析します。 ▶ CISSP/OSCP/OSEP/GREM/GCTI/Z2A ▶ Pub.: 今日から始めるサイバー脅威インテリジェンス』Software Design (2022) ▶ Conf.: JSAC2023

CDI Research @cdi_research

over 3 years ago

#PlugX has encrypted config. It has mutex and campaignID(test2022) and C2 address( 217.12.206[.]116 ) 2/2

cdi_research's tweet photo. #PlugX has encrypted config. It has mutex and campaignID(test2022) and C2 address( 217.12.206[.]116 ) 2/2 https://t.co/a3AEOofXhU

cdi_research's tweet photo. #PlugX has encrypted config. It has mutex and campaignID(test2022) and C2 address( 217.12.206[.]116 ) 2/2 https://t.co/a3AEOofXhU

cdi_research's tweet photo. #PlugX has encrypted config. It has mutex and campaignID(test2022) and C2 address( 217.12.206[.]116 ) 2/2 https://t.co/a3AEOofXhU

cdi_research's tweet photo. #PlugX has encrypted config. It has mutex and campaignID(test2022) and C2 address( 217.12.206[.]116 ) 2/2 https://t.co/a3AEOofXhU

1

0

0

0

2K

CDI Research @cdi_research

over 3 years ago

#TONESHELL (which was used by #MustangPanda ) uses public anti-debug technique. It is also used in leaked and forked #DarkRAT https://t.co/EbHA7qJx0C

cdi_research's tweet photo. #TONESHELL (which was used by #MustangPanda ) uses public anti-debug technique. It is also used in leaked and forked #DarkRAT

https://t.co/EbHA7qJx0C https://t.co/ZPhyPGiUcg

cdi_research's tweet photo. #TONESHELL (which was used by #MustangPanda ) uses public anti-debug technique. It is also used in leaked and forked #DarkRAT

https://t.co/EbHA7qJx0C https://t.co/ZPhyPGiUcg

cdi_research's tweet photo. #TONESHELL (which was used by #MustangPanda ) uses public anti-debug technique. It is also used in leaked and forked #DarkRAT

https://t.co/EbHA7qJx0C https://t.co/ZPhyPGiUcg

0

9

3

2

4K

Last Seen Users on Sotwe

Trends for you

Most Popular Users