Vladimir Martyanov

Security researcher

[Vladimir Martyanov @ffb7d579]

@levelsio @Reddit @nickvanderwildt Are you still owning hoodmaps? Could you please proper attribute Openstreetmap as a source of a map data, please?

[Vladimir Martyanov @ffb7d579]

@JAMESWT_MHT Do you have a hash/sample of the final Ursnif file?

[Vladimir Martyanov @ffb7d579]

@coursera your support doesn't work well: can't contact with them. Seems you don't want my money :-)

[Vladimir Martyanov @ffb7d579]

@_brettfitz Do you have a sample hash with these IPs (194.58.97[.42 etc)?

[Gen Threat Labs @GenThreatLabs]

A new configuration of #Raccoon #Stealer is being distributed with instructions to also steal data from the @signalapp Desktop clients.

The C&C server: 83.217.11[.]6

[Vladimir Martyanov @ffb7d579]

@viuleeenz @JAMESWT_MHT skype and other legitimate domains are fake C&Cs. Ursnif is usually have them in C&C list ;-)

[Vladimir Martyanov @ffb7d579]

@luc4m Have you ever seem non-Russian IPs of their C&Cs? I don't remember, for example...

[Vladimir Martyanov @ffb7d579]

New build of #RaccoonStealer was released on February 3rd, 2023

[Vladimir Martyanov @ffb7d579]

Hashes of IcedID samples are here https://t.co/0XAx05ADSY

[Gen Threat Labs @GenThreatLabs]

In the last two days (1-2 Feb) we noticed that #Ursnif is spreading the #IcedID #banker using its downloader function.
Decrypted samples (SHA256): 769ea924e2a1414ae02b466b3b2f6c52025bab40803ee011f3573efd25283077
b456dde5b0f8bad6686bec6bca49dd5f8de40058f655b1407492c261e16e9ddd

[Vladimir Martyanov @ffb7d579]

Wow! In the last few days #Ursnif is spreading #IcedID

[Vladimir Martyanov @ffb7d579]

@Artilllerie @malwrhunterteam @Blender @1ZRR4H @wdormann Yes, it's Ursnif C&Cs

[Vladimir Martyanov @ffb7d579]

@SASSnRaaS Why do you call Ursnif a ransomware?

[Vladimir Martyanov @ffb7d579]

@AgidCert Why didn't you publish IoCs in Twitter too? We may spend precious minutes to find them on the TG, really...

[Vladimir Martyanov @ffb7d579]

@ffforward @JAMESWT_MHT @k3dg3 @hatching_io @guelfoweb @malwrhunterteam @pr0xylife @0xToxin @StopMalvertisin @fr0s7_ @1ZRR4H @sugimu_sec @_operations6_ Exactly, LDR4 (x64 version)

[Vladimir Martyanov @ffb7d579]

@TheDFIRReport Twis XLS is known since the mid May 2022, so nothing actually new...

[Vladimir Martyanov @ffb7d579]

@reecdeep What is the DLL hash?

[Vladimir Martyanov @ffb7d579]

@lsass_dump Oh, I thought you found a panel on their C&C...

[Vladimir Martyanov @ffb7d579]

https://t.co/7JQUUNLzmD

[Gen Threat Labs @GenThreatLabs]

We discovered a new #RaccoonStealer V2 build, timestamp Aug 9, 2022. The authors finally started to encrypt their strings, but the C&C encryption is now weaker.
Sample hash: f126e199fc9f86af136520b60e27c62d2d00609210c02fec625073cae3d25abe

[Vladimir Martyanov @ffb7d579]

We published Q2 threat report where I wrote about Raccoon and Zloader. And today I found a new #RaccoonStealer build with crap instead of C&C encryption ;-)

[Gen Threat Labs @GenThreatLabs]

The Q2/2022 #AvastThreatReport is out now! #Ransomware is on the rise, #exploits were discovered, #RaccoonStealer made a comeback, and farewell to #Conti and #Zloader. Read, enjoy, share: https://t.co/Jbo0ZqSpdQ.

[Vladimir Martyanov @ffb7d579]

@lsass_dump What's the login page relative URL? ;-)