ge0lev

Threat Hunting | Malware Analysis

[WatchingRac @RacWatchin8872]

#Lumma #Malware
👾8 New Lumma Domains with Low Hits👾

🚨https://t.co/dHxvJ9mg1L🚨

CC:
@banthisguy9349
@NDA0E
@BlinkzSec
@kddx0178318
@raghav127001
@DaveLikesMalwre
@g0njxa
@ViriBack
@500mk500
@ge0lev
@marsomx_
@JAMESWT_MHT
@DonPasci

[WatchingRac @RacWatchin8872]

#Lumma #Malware
👾12 New Lumma Domains with Low Hits👾

🚨https://t.co/ad6uS0Rmqk🚨

CC:
@banthisguy9349
@NDA0E
@BlinkzSec
@kddx0178318
@raghav127001
@DaveLikesMalwre
@g0njxa
@ViriBack
@500mk500
@ge0lev
@marsomx_
@JAMESWT_MHT
@DonPasci

[WatchingRac @RacWatchin8872]

#Stealc #Malware

🚨58 IP's with Low Hits on VT related to Stealc🚨
https://t.co/6RLEQDqKdz

CC:
@banthisguy9349
@NDA0E
@BlinkzSec
@kddx0178318
@raghav127001
@DaveLikesMalwre
@g0njxa
@ViriBack
@500mk500
@ge0lev
@marsomx_
@JAMESWT_MHT
@DonPasci

[ge0lev @ge0lev]

@vxunderground @nikhil_mitt @struppigel Malware analysis for hedgehogs plox

[WatchingRac @RacWatchin8872]

#Stealc #Malware

🚨40 IP's with Low Hits on VT related to Stealc🚨

https://t.co/gmo3y0mREY

CC:
@banthisguy9349
@NDA0E
@BlinkzSec
@kddx0178318
@raghav127001
@DaveLikesMalwre
@g0njxa
@ViriBack
@500mk500
@ge0lev
@marsomx_
@JAMESWT_MHT
@DonPasci

[ge0lev @ge0lev]

@vxunderground @mrd0x @MalDevAcademy

[WatchingRac @RacWatchin8872]

#Tycoon2FA #Phishing
- Using new TLD ([.]co[.]za)
- New Anti-Bot System (never saw something like that)

CC:
@banthisguy9349
@NDA0E
@BlinkzSec
@kddx0178318
@raghav127001
@DaveLikesMalwre
@g0njxa
@ViriBack
@500mk500
@ge0lev
@marsomx_
@JAMESWT_MHT
@DonPasci

[Raaz @solostalking]

#Clickfix more I'll add later

[WatchingRac @RacWatchin8872]

#Lumma #Malware
👾 37 domains related to Lumma:
https://t.co/cDG5qPyipJ

CC:
@banthisguy9349
@NDA0E
@BlinkzSec
@kddx0178318
@raghav127001
@DaveLikesMalwre
@g0njxa
@ViriBack
@500mk500
@ge0lev
@marsomx_
@JAMESWT_MHT
@DonPasci

[WatchingRac @RacWatchin8872]

#Lumma #Malware
👾 32 domains related to Lumma: https://t.co/kA0zf1oDQn

CC:
@banthisguy9349
@NDA0E
@BlinkzSec
@kddx0178318
@raghav127001
@DaveLikesMalwre
@g0njxa
@ViriBack
@500mk500
@ge0lev
@marsomx_
@JAMESWT_MHT
@DonPasci

[WatchingRac @RacWatchin8872]

🚨After a long time, I finally created a GitHub repo containing the domains discovered by the bot:

https://t.co/yRYLe8o4rK

CC:
@banthisguy9349
@NDA0E
@BlinkzSec
@kddx0178318
@raghav127001
@DaveLikesMalwre
@g0njxa
@ViriBack
@500mk500
@ge0lev
@marsomx_
@JAMESWT_MHT
@DonPasci

[WatchingRac @RacWatchin8872]

#Phishing
My first bot will focus on phishing domains!

CC:
@banthisguy9349
@NDA0E
@BlinkzSec
@kddx0178318
@raghav127001
@DaveLikesMalwre
@g0njxa
@ViriBack
@500mk500
@ge0lev
@marsomx_
@JAMESWT_MHT
@DonPasci

[WatchingRac @RacWatchin8872]

#Tycoon
Updates:
-> New Captcha (IconCaptcha)
-> Currently Using .es, .ru, .com, .info, .org TLD's
New Domains: https://t.co/8E7MaEPUoh

CC:
@banthisguy9349
@NDA0E
@BlinkzSec
@kddx0178318
@raghav127001
@DaveLikesMalwre
@g0njxa
@ViriBack
@500mk500
@ge0lev
@marsomx_
@JAMESWT_MHT

[WatchingRac @RacWatchin8872]

#FakeCaptcha

87 Domains hosting FakeCaptcha: https://t.co/QUB4YOFLvr

AnyRun:
https://t.co/j5TGydM1kj
https://t.co/BDoBLogWqx

CC:
@banthisguy9349
@NDA0E
@BlinkzSec
@kddx0178318
@raghav127001
@DaveLikesMalwre
@g0njxa
@ViriBack
@500mk500
@ge0lev
@marsomx_
@JAMESWT_MHT
@DonPasci

[WatchingRac @RacWatchin8872]

#Github #Malware #Lumma
💣Campaign Using SolaraExecutor-V3 to infect victims with Lumma Stealer:

Github -> Exe with Powershell Code -> Pastebin -> Github -> Lumma Stealer

https://t.co/16BRAI60rs

[WatchingRac @RacWatchin8872]

#Tycoon2FA #Phishing
24 new domains and urls related to Tycoon with low hits on VT:
https://t.co/UqN9pSSTGC
CC:
@banthisguy9349
@NDA0E
@BlinkzSec
@kddx0178318
@raghav127001
@DaveLikesMalwre
@g0njxa
@ViriBack
@500mk500
@ge0lev
@marsomx_
@JAMESWT_MHT
@DonPasci

[Fox_threatintel @banthisguy9349]

8af777d0f92cef2d9040a634527c3753669235589c23129f09855ad0ebe10c6f

GoogleUpdateSetup.exe

Guys. 'googleupdatesetup.exe' has been spread by a actor that uses Snakekeylogger. I suspect this certificate to be abused.

Tag Cert Abuse Specialist into this post please.

[WatchingRac @RacWatchin8872]

#Tycoon2FA #Phishing
126 new domains and urls related to Tycoon:
https://t.co/8UsogaEdej

CC:
@banthisguy9349
@NDA0E
@BlinkzSec
@kddx0178318
@raghav127001
@DaveLikesMalwre
@g0njxa
@ViriBack
@500mk500
@ge0lev
@marsomx_
@JAMESWT_MHT
@DonPasci

[WatchingRac @RacWatchin8872]

#Tycoon #Phishing
Got more domains with the help of @g0njxa 571 domains linked to Tycoon.
Here’s a list of domains+subdomains+full path, hosting Outlook/Gmail phishing pages:
https://t.co/kX73ISVgPc
A few of them are waiting for API renew (TA's didn't pay the bill 😂)

[WatchingRac @RacWatchin8872]

#Tycoon2FA
31 new domains related to the infrastructure
https://t.co/BGtDfzXiM1
CC:
@banthisguy9349
@NDA0E
@BlinkzSec
@kddx0178318
@raghav127001
@DaveLikesMalwre
@g0njxa
@500mk500
@ge0lev
@marsomx_
@JAMESWT_MHT
@DonPasci