@ASIS_Intl you have a credit card skimmer on your site, found at the end of this script https://t.co/I8ivYVxBYb
Loads hxxps://0446aa5.netsolhost[.]com/123/jquery.ux.js
Might want to take care of that
Today #Lazarus#APT sample has been found on VT by our researcher
ITW:34f83ff7b0a1d05aaf8f81c9803a3a02
C2:www.ne-ba[.]org
Attacked by forging a job description from BAE SYSTEMS London's human resources department
A post about recent #ZLoader activity from IBM X-Force Security: https://t.co/iRPFvAYI6u
Info on one of the samples from this article can be found here: https://t.co/kAw7iLTpT6
Also, I submitted the sample to AnyRun: https://t.co/yZLHgWz5Lo
Keep an eye out for these newish funky droppers going to:
www[.]google[.]com[.]br
Looks to be trying to evade MITM solutions:
https://t.co/gTaKe7WsQZ
https://t.co/o0M7QHElKL
cc @siri_urz
2020-04-27: 🔥 "We are the team which created a trojan-encryptor mostly known as #Shade, #Troldesh or Encoder.858 #ransomware. In fact, we stopped its distribution in the end of 2019. Now we made a decision to put the last point in this story & to publish all the decryption keys"
According to our crawlers, credit card skimming code was injected into wine store belonging to top French supermarket chain E. Leclerc.
This may be why the site is now in maintenance mode.
IOCs:
clipbutton[.]com[.]br/catalog/discount.php
tivents[.]de/media/wysiwyg/paypal4.gif
#ZLoader invoiced themed #malspam with new downloader URLs for today:
hxxp://rksinha.com/wp-content/themes/calliope/wp-front.php
hxxp://salamdrug.com/wp-content/themes/calliope/wp-front.php
Both redirect to DLL at:
hxxp://95.181.172.99/l/a.dll
#malware#apt#crimson
b5515042f59a90e13e49542a3b6de1f8 (India and Afghanistan on Parliamentary Affairs[.]zip)
48a00c1a8c9b39c96152e8ca80b7a972 (India and Afghanistan on Parliamentary Affairs.exe)
C2: 64.188.25[.]205
https://t.co/b6y8nviGp0
If you want to search for EK tasks in @anyrun_app use SID instead of tag. For example, 2024049 and 2024381 are useful for #RigEK, and 4001761 is for #SpelevoEK. There are many other great signatures you can use in search, such as 4001554 and 10004044.