Finch

Studying Malware Analysis.

[Finch @finch_mw]

@vxunderground https://t.co/bDgIMwGcmv

[Finch @finch_mw]

@thor_scanner aigroup[.]ly - hxxps://aigroup[.]ly/fd5opdna.ajc/zmdgrml2.jpg

[Finch @finch_mw]

AsyncRAT with 0 detections since 2025-02-18 (except @thor_scanner) and 2024-12-18

2c27fad3bdeab8dab52b21562df4dbd8217a84fb2553c1f99de03d1c686137e7 ("Internal Security Report - Mossad - Libya")

[Finch @finch_mw]

@thor_scanner 7348760bbb74159d0be1ebabe54c22f1e158780d9a76d0a73c5ed391491d563f ("List of Leaders Tripoli - Mossad")

pdflove[.]ddnsfree[.]com

[Finch @finch_mw]

@solostalking 0683a9750c9c44988c4a8d2b269ad648329caccfc3933efdd972233a70862cd9 Looks like fake cheats downloading the miner (8b43ad177856a521f39ae49614409b0ec84a80c86cb7acff1127f77f103ccfa9)

[Finch @finch_mw]

@solostalking Query: metadata:"aarbe"

Cathredal Loader [Licenses: https://t.co/By7XbbyJyi - zerobyteprotector[.]com/license.txt]
06ee29e7835d4039e1a7e76e627cc043955efbcb14b4b20b8c08d284c8b6c790
3f7b3747b514f9ed5efee36c93f160cdba071150de67e71bc40c117e1e5ebfe0

[Finch @finch_mw]

@solostalking https://t.co/ONWJprBHRn "Users\aarbe"

[Finch @finch_mw]

@solostalking c44b2151320715a7a2ed1d77f3cf2712c67e52c3d777efb35f528e4e8bd21978 [BlazorCrypter]
FleetCrypter [https://t.co/H2eBJNk8Jb]
03e7269a7aff4223d5d5fed09c3e05aa6d833a0742ee959446cd3e00ef4be37a
0d10817d5e7851c6fdb2fe99016121edcca9279038458aa6e3eafbf0fd9728f9

[Finch @finch_mw]

@solostalking 6c5494451c9061a52f34e0e7891f1adc1a90c3146089e2a8d579b7de514d62c0
8b43ad177856a521f39ae49614409b0ec84a80c86cb7acff1127f77f103ccfa9 [Miner]
9d2843acf69a54a45a45f6dd9edab72f56b9b8d9b7155a380d3fd454d6c1b49f

[Finch @finch_mw]

@solostalking Cathredal Loader
54da4e02972c080a4ed11fdce043a5d221a5fdc4afde209d8453a8db3e4ae727
zerobyteprotector[.]com
738a12e5f8df3af003b9b882dd345154f30361313736c546910cf98a39f8d546
293c71267958bb7fa94247891b1b371723941e5aa45e2dbf3cd09e15d0e97e9a

[lc4m @luc4m]

🧾new report - > "How to target European SMEs with #Ransomware? Through #Zyxel!"

To complete the recent @Truesec and @sekoia_io reports, we link early Sept activities to the #Helldown wave opening many interrogations.

https://t.co/1REmrql0fa

[Finch @finch_mw]

Bluesky: https://t.co/WzfCP4BzCC
Bluesky RSS Feed:
https://t.co/cfOPEWVxuP

[Finch @finch_mw]

@Tac_Mangusta @AgidCert @guelfoweb @malwrhunterteam @executemalware @reecdeep @anyrun_app @Jane_0sint @JAMESWT_MHT @James_inthe_box https://t.co/Uwfj6dsUti

[Finch @finch_mw]

Hunt more Samples by searching: "MaxXor 2020"

[Finch @finch_mw]

#Malware #QuasarRAT

12cf577a266608862f59fd88331e3622813de09acf0e9ed89f4c19f392c9480d

DLL-Sideloading->Injection to RegAsm.exe->Unzip Calc to C:\Users\Public\Pictures->secur32.dll sideloading by calc.exe->Injection to RegAsm.exe->QuasarRAT

3.94.91.]208
endoftext.]run.]place

[Finch @finch_mw]

#Malware #Stealer

casperstealer.]xyz
zbot.casperstealer.]xyz

Packed: https://t.co/h2JHeiU5zS
Unpacked: https://t.co/kiX1zFuC6k

[Finch @finch_mw]

e6e901bf7dff6d9fcc0c3cacfc8a2f89eed1e8bdfec1b1d2d59f44fea0521865

hxxps://discord.]com/api/webhooks/1154049148157435914/dC01jzMhvF33PioDIwrrEDzGFBFeq6sRs95VdfZsuMZpXwHgz26edrKIrEFbcfAAcjiR

[Finch @finch_mw]

Interesting Sample, copies directories and files to %appdata%+Username+'-AntiHeil', zips and uses curl to send the stolen files to a discord webhook. Only 1/2 detections on VT.

[Finch @finch_mw]

2977dac60160d7485ab8e94aec6177863ae4f5fe899f2f48bcba1a1368c3b436
4fc89f5e0e91bc897fc88e547c2fa34075a7ab6fd13877c60f935eb8c4e37f57
f6912da137c6a61b15d88002d7eaf7c395671ea2f5762ab427f748947bc7af8a
77a6f971e907f20a306cd4cd3eabdaccdaca578457d9270a3b43653018789188

[Finch @finch_mw]

#SerpentStealer (Usual copypasted .NET Stealer but only 3 detections)

cd118e082d2c035da179358c8a3c54b879b6e1b71eec2a965b78aa929b83eb11
06dffe7635f3e84c29de5d6b1f117c2c17ea2e1ca4b0bcb8851adebe70b697ce