devmihaylov

Full-stack developer specializing in reverse engineering, game hacking, and offensive/defensive cybersecurity.

[devmihaylov @devmihaylov]

@sashikantsingh_ I have experienced this with my LG TV, all you have to do it root it yourself and then it will do the rest, if you ask Claude to root it, this will trigger safeguards due to "exploiting", try it yourself with SlopBro for example, good luck.

[devmihaylov @devmihaylov]

@malwrhunterteam @SquiblydooBlog Well, there's only we can do so much though, also thanks for the sharing the sample with @SquiblydooBlog who tagged me for analysis on it!

[Squiblydoo @SquiblydooBlog]

Amazing: it somehow went from 1 detection on VirusTotal to 0

CertGraveyard volunteers report certificates for revocation, but in this case, the certificate was revoked before @malwrhunterteam shared it with us. We add it to our database and use these opportunities to investigate the malware anyway.

In his blogpost, @devmihaylov does an amazing job digging in and turning the malware inside out.

(Note: We can always use more volunteers to analyze malware, pivot on known bad indicators, tracking infrastructure and more. If you're interested, join the Discord and reach out: https://t.co/ZcWIqa6rKB.)

[devmihaylov @devmihaylov]

@V0iD_0daY @SquiblydooBlog @malwrhunterteam Yeah, same SocketIO channel, new domain, it waits for Microsoft's NCSI check, polls g[.]obrn[.]cc/heartbeat for "pong", if that fails it hashes the ncsi.txt Date header (md5 of hex("16 Oct 2026"), first 10 chars) and tries g.<hash> on .cc/.io/.com/.net/.xyz, new set daily.

[devmihaylov @devmihaylov]

Malware Analysis on a fake “Active Call” Python RAT

msvci[.]com/files/.ini - stage 2 download
45[.]61[.]139[.]149 - download server
g[.]obrn[.]cc - C2 (behind Cloudflare)
64[.]7[.]199[.]7 - operator server

https://t.co/Wo9ojRKY3c

@SquiblydooBlog @malwrhunterteam

[ANY.RUN @anyrun_app]

🚨 #WKLP, a new Python stealer/RAT targeting government organizations in the US and France, steals credentials and browser data, abuses Microsoft Defender exclusions, and connects to relay[.]wklp-searcher[.]xyz for remote operator commands.

It adds files, paths, and Python processes to Defender exclusions, creates firewall rules disguised as Windows Update Service, and terminates security processes and services.

👨‍💻 Explore the full chain and collect #IOCs: https://t.co/gmAxD9KiMn

WKLP downloads files from an attacker-controlled GitHub repository and an embedded Python archive, then disguises Python 3.13 as MoUsoCoreWorker.exe before launching the final client[.]py payload: wklpcs2.exe ➡️ PowerShell ➡️ renamed Python runtime ➡️ client[.]py

#ExploreWithANYRUN 1/3 🧵

[devmihaylov @devmihaylov]

@SquiblydooBlog @malwrhunterteam @abuse_ch Sometimes they manually have to verify the file before it shows up, other times it could be the automation being slow on making the file appear to the database but it's normal, happens to me all the time when I upload multiple files!

[devmihaylov @devmihaylov]

@RNR_0 @Google @gmail AFAIK this is not exactly a phishing, more like an attempt of a social engineering attack getting advantage of the original Google domain sender, as long as you don't interact with it, you are fine, you can also report the email in question trying to pull off the SE attack, GL!

[devmihaylov @devmihaylov]

Full credits to @malwrhunterteam for the initial post which lead to the analysis! https://t.co/KkxY7xNCFC

[MalwareHunterTeam @malwrhunterteam]

Possible interesting "T.No20260921.dll" sample found inside "Pack_20260921_173723.iso" that was seen from India (also seen from Singapore as "file.iso").
Signed using Certum given cert with name "Xidao E-commerce Studio, Yishui County".
Also no AV detected it on VT...
🤷‍♂️

[devmihaylov @devmihaylov]

A signed loader that installs a real IT agent answering to the attacker.

134[.]122[.]200[.]153:8151 - C2
hxxps://gfgxcx[.]com/LocalOffice1[.]zip - second stage
178[.]128[.]118[.]22 - download host

https://t.co/btylxSPE8I

[devmihaylov @devmihaylov]

Same ManageEngine kit in all three zips, only the enrollment server changes, and the filename encodes its last octet:

https://t.co/OcwIxqqyJh - 134[.]122[.]200[.]153:8151
https://t.co/1ZOjv5X8aj - 143[.]92[.]38[.]221:8151
https://t.co/qxAj60NRTc - 134[.]122[.]204[.]114:8151

[devmihaylov @devmihaylov]

hxxps://gfgxcx[.]com/
hxxps[://]gfgxcx[.]com/c[.]f[.]g[.]hf[.]t[.]221[.]zip
hxxps[://]gfgxcx[.]com/d[.]f[.]r[.]qe[.]114[.]zip

[devmihaylov @devmihaylov]

@malwrhunterteam Thank you for the report, analyzed - it's a nasty malware.

https://t.co/REW10Umdxd

[devmihaylov @devmihaylov]

A signed loader that installs a real IT agent answering to the attacker.

134[.]122[.]200[.]153:8151 - C2
hxxps://gfgxcx[.]com/LocalOffice1[.]zip - second stage
178[.]128[.]118[.]22 - download host

https://t.co/btylxSPE8I

[devmihaylov @devmihaylov]

@JustWantToQ1 I bet it's admin/admin

[devmihaylov @devmihaylov]

A Certum EV-signed stager that pulls shellcode from a customer-service CDN

cik07-cos[.]7moor-fs2[.]com/im/4d2c3f00-7d4c-11e5-af15-41bf63ae4ea0/ - stage 2
37E0CA1FFE95DDF08D4979EFEB4AF05668B89BEF - Certum EV cert (live, revocation requested)

https://t.co/asyf80euqP

[devmihaylov @devmihaylov]

@WumpusCentral I'm good thanks, Brave does just an awesome job.. oh and.. it's free..

[devmihaylov @devmihaylov]

@cyber_rekk Shodan / https://t.co/LWnKR9gkED or from reverse engineering if it's directly embedded inside the source code (such as C2 server data/info as an example).

[devmihaylov @devmihaylov]

@JustWantToQ1 Vibe coded C2 server, enough said, good find though!

[devmihaylov @devmihaylov]

@Techjunkie_Aman @Homo_sapien21 Just because it's on Playstore doesn't mean it's safe, don't make such bold claims especially when such an app ships as GTA game under a completely different looking game on it's landing page.