Ben

building @synthient

[Ben @deobfuscately]

Latest IPIDEA SDK // BHSdk v1.3.8

Seed: seed-info[.]oss-ap-southeast-1[.]aliyuncs[.]com/favorite.ico
Dispatch: {appKey}[.]api-seed[.]phacoketics[.]com/dp/getServer // dporder[.]packetsdk[.]net
Tunnel: 170[.]106[.]142[.]223:800 // :799
SDK: 43[.]135[.]136[.]244:7788 // UDP 43[.]153[.]0[.]0/16:8080
appKey: ntyExwqAVvwrMZqa
#packetsdk #ipidea #botnet #ioc #hunting

[Ben @deobfuscately]

Tier 2 Relays
US / DE / default - 84[.]17[.]41[.]68:11080
GB - 89[.]187[.]175[.]119:18658
FR / IN - 23[.]111[.]152[.]174:14378
BR - 79[.]127[.]137[.]165:13890
JP - 95[.]173[.]204[.]33:16653

[Ben @deobfuscately]

Malicious FlixVison streaming apps pushing Hopmonsdk Proxy SDK.

[Ben @deobfuscately]

File iOCs:
FLIX VISION v3.6.2.apk - bcbe670fa63f8decee32f3cf6cea9fd549f3e113ccbc17fa9735a9a0a01aed63
FLIX VISION v3.6.3 (PREMIUM).apk - bd2c864958cbd1649898e39cc702cf31c094ebec5c7fec7296feed442349dfda
FlixVision_v3.6.3.apk - 3e7124ac6e0b987403da0f962692c23655d3c04b17f3e16f3db9e2fc8a1ad942

Network Observables:
apis[.]cyberprotector[.]online - SDK
linktr[.]ee/flixvision - Distribution Page
liteapks[.]com/download/flix-vision-760923/1 - Distribution Page
flixvision[.]net/flix-vision-app/ - Distribution Page
flix[.]vison - Distribution Page

Twitter Accounts Involved:
@FlixVisionApp

[Ben @deobfuscately]

@AdityaShips Kindve scummy to charge $49 for something you just forked. Doesn’t have a ton of notable changes from the open source project.

[Ben @deobfuscately]

This is a 1:1 rip of the open source project openscreen. The code is almost fully copied, with references to the openscreen codebase.

[Ben @deobfuscately]

@denzil_correa https://t.co/OL7MwXvYhm

[Ben @deobfuscately]

This is a 1:1 rip of the open source project openscreen. The code is almost fully copied, with references to the openscreen codebase.

[Ben @deobfuscately]

@AndrewSchrbr @AikidoSecurity Is this a real save or just a proactive block?

[Ben @deobfuscately]

@UK_Daniel_Card Looks to be no longer online. Also to seem to be misold by the upstream provider - looks to be datacenter.
https://t.co/tTNRv2497o

[Ben @deobfuscately]

@iocapon @interfere_ Congrats🎉

[Ben @deobfuscately]

Earnify // Maskify Botnet

Loader: empty-violet-63e1[.]maskify[.]workers[.]dev // 84[.]21[.]189[.]244:6969
SDK: 84[.]21[.]189[.]244:4433

#maskify #botnet #ioc #hunting

[Olivia Gallucci ✨ @OliviaGalluccii]

It's amazing to see the impact that one *student* can have on the world.

Super excited to see where Ben and Synthient go. The work this kid is publishing is so impressive.

[Ben @deobfuscately]

@iocapon 🔥

[Ben @deobfuscately]

@Gi7w0rm @synthient Such a crazy journey

[The Wall Street Journal @WSJ]

A flurry of powerful attacks had internet experts baffled. A college student armed with a cat meme helped solve the mystery. https://t.co/18P2kTwrQG

[DrakeN 魔人 @draken1721]

@WSJ college kid with a meme > billion dollar security apparatus

[Ben @deobfuscately]

@vxdb

[Philip Snyder @PhilipSnyder]

A routine all you can eat sushi lock in session and @deobfuscately casually mentions he got featured in an article…

>Its a full feature expo in WSJ
>used cat memes to socially engineer
>reverse engineered their backdooor
>pivoted that into mapping ~2M infected res proxy devices
>caught it midterms week
>notified relevant authorities
>U.S DoJ brings charges and shouts him out
>kimwolf gets kneecapped
>back to spicy tuna like nothing happened