Top Tweets for #ADWIND
![JAMESWT_WT's tweet photo. #AdWind #Italy
Samples +extra
https://t.co/DF4mc75cPm
⛔️C2
1po56mdxc.localto[.]net
Zip
⛔️fdsxzxcgghadahdhgadsfdsfhghgcxvyjdsjjthrgbewagddxhg.]ngrok.]dev/InvoiceXpress.zip
AnyRun
https://t.co/SqvaxCS1Th
Extra 1
https://t.co/WRgAFOBmdJ
Related Extra 2
https://t.co/wxf7In3j6G https://t.co/zD62M7JWFV](https://pbs.twimg.com/media/GrEcyWjXgAA_4ww.jpg)
![JAMESWT_WT's tweet photo. #AdWind #Italy
Samples +extra
https://t.co/DF4mc75cPm
⛔️C2
1po56mdxc.localto[.]net
Zip
⛔️fdsxzxcgghadahdhgadsfdsfhghgcxvyjdsjjthrgbewagddxhg.]ngrok.]dev/InvoiceXpress.zip
AnyRun
https://t.co/SqvaxCS1Th
Extra 1
https://t.co/WRgAFOBmdJ
Related Extra 2
https://t.co/wxf7In3j6G https://t.co/zD62M7JWFV](https://pbs.twimg.com/media/GrEcxnJXQAAYM32.jpg)
![JAMESWT_WT's tweet photo. #AdWind #Italy
Samples +extra
https://t.co/DF4mc75cPm
⛔️C2
1po56mdxc.localto[.]net
Zip
⛔️fdsxzxcgghadahdhgadsfdsfhghgcxvyjdsjjthrgbewagddxhg.]ngrok.]dev/InvoiceXpress.zip
AnyRun
https://t.co/SqvaxCS1Th
Extra 1
https://t.co/WRgAFOBmdJ
Related Extra 2
https://t.co/wxf7In3j6G https://t.co/zD62M7JWFV](https://pbs.twimg.com/media/GrEbk8sWoAAQpcA.jpg)
@JAMESWT_MHT @1ZRR4H @0xToxin @pr0xylife @malwrhunterteam @reecdeep @VirITeXplorer @marsomx_ It is similar to the #AdWind malware. You can use this #CyberChef recipe to decode the checksum file: https://t.co/l0mDnpVWl2
Campagne #Malware #Italy Week 34
🔥☠️💣👻
#VIPKeylogger: Fattura
#RemcosRAT: Delivery
#Formbook: Preventivo
#Irata: #APK Bank
#Adwind: Fattura
#SnakeKeylogger: Pagamento
#AgentTesla: Bank
#QuasarRAT: Udienza Centrale Polizia
#Vidar: Pagamento via PEC
#Unknown: Telecom
#mwitaly
#ThreatProtection #Adwind (aka #jRAT) distributed in recent campaigns targeting users in Italy, read more about Symantec's protection: https://t.co/e9A5vsD12P #malware
#Adwind
We need to be more frank between you and me🫦
Don't hide anything in traffic from me🫣
Neither do you use my webcam, keylogger, password recovery☺️
Now we are together, you and me😅
https://t.co/XSiDUazrQM
🎯 Hunt unique #AdWind samples #100DaysofYARA
💫 Would you like to develop threat hunting #YARA rules?
📌 Here is an example of how you can do it for the unknown samples of AdWind (#AlienSpy), a Java-based #MaaS with remote access capabilities.
✍️ Just follow these steps:
1⃣ Find out the three characteristics of obfuscation for writing a hunting rule:
- YARA rule targeting a #Java class’s nested names
- Those names include two symbols (i&l)
- META-INF/MANIFEST.MF isn’t obfuscated
2⃣ Upload the rule into #ANYRUN YARA Search ↘️ https://t.co/lhAHWDSssb
3⃣ Find unique samples (still no hashes on VT) ↘️
https://t.co/SxDOnqrs9R
https://t.co/CcbtZfOZw4
https://t.co/PhlNGJe2n0
💡Check out hunting YARA rule on #GitHub ↘️
https://t.co/GrnqAGuMNs
Use https://t.co/5F3kh2e7mb to hunt and analyze new threats 🔎
#AdWind , a java-based RAT, has been spotted on YT.
It seems to have the ability to load some "SerializedPlugins" to grab files, steal webcam screenshoots, and drop a keylogger.
C2 ⚙️
23.26.248.208:2222 - rat19.duckdns[.]org
👇👇
https://t.co/T88sWgMx02
#cybercrime, 29 campagne contro l’#Italia la settimana scorsa. Gli esperti di #CyberSecurity di @AgidCert rilevano 6 #Malware: #Ursnif, #Emotet, #AdWind, #Quakbot, #Mekotio e #AgentTesla. Ancora #phishing via @INPS_it. #infosec #malspam https://t.co/kRFYxPZuUn
Adwind RAT (Remote Access Trojan) is a cross-platform, multi-functional remote access program that is distributed through a single malware-as-a-service platform.
https://t.co/w0qf5M5NjY
#LMNTRIX #XDR #MDR #malwareanalysis #Adwind
Related C&Cs servers which have 0-detection on VT belonging to a reborned #Adwind campaign targeting #Turkey.
findingisaure[.]ml:1505
54121[.]ml:1505
discovery[.]tk:1505
bafaholding[.]online:1505
runtimecollectors[.]tk:1505
Some of them are still active. 1/2
![cluster25_io's tweet photo. Related C&Cs servers which have 0-detection on VT belonging to a reborned #Adwind campaign targeting #Turkey.
findingisaure[.]ml:1505
54121[.]ml:1505
discovery[.]tk:1505
bafaholding[.]online:1505
runtimecollectors[.]tk:1505
Some of them are still active. 1/2 https://t.co/Xogk5QahF6](https://pbs.twimg.com/media/Fd5WyslXoAA0EWU.png)
"siparis_listesi.xls": 663d185dcdb65dd8204ca9fa4dfe218a1027fe4026b357d3ab42a0e6d5fea9a6
Next stage / payload: https://ogumeta.github[.]io/vwui/kyhla.png
@StopMalvertisin
![malwrhunterteam's tweet photo. "siparis_listesi.xls": 663d185dcdb65dd8204ca9fa4dfe218a1027fe4026b357d3ab42a0e6d5fea9a6
Next stage / payload: https://ogumeta.github[.]io/vwui/kyhla.png
@StopMalvertisin https://t.co/rRqWzliKgX](https://pbs.twimg.com/media/FdakusNWAAATD9j.jpg)
@abuse_ch @adrian__luca TR malspam + https://t.co/OxEIQMVxsU known documented check, getting #Adwind vibes cc @ffforward
https://t.co/Z7UX2y9Uh1
This is for @Valkyrivy being an absolute angel!!!
Noir on the other hand isn't. But we love him anyway
#ADWIND
If you missed it and you look for a reading, please take a look here. https://t.co/8peRz0CMjH #adwind #apt #cybercrime #cybersecurity
Last Seen Hashtags on Sotwe
Most Popular Users
Elon Musk 
@elonmusk
240.8M followers
Barack Obama
@barackobama
119.2M followers
Donald J. Trump
@realdonaldtrump
111.7M followers
Cristiano Ronaldo
@cristiano
111.3M followers
Narendra Modi
@narendramodi
107M followers
Rihanna
@rihanna
97.8M followers
NASA
@nasa
92.2M followers
Justin Bieber
@justinbieber
91.1M followers
KATY PERRY
@katyperry
88M followers
Taylor Swift
@taylorswift13
81.9M followers
Lady Gaga
@ladygaga
73.4M followers
Virat Kohli
@imvkohli
70.5M followers
Kim Kardashian
@kimkardashian
70M followers
YouTube
@youtube
68.7M followers
Bill Gates
@billgates
64.1M followers
Neymar Jr
@neymarjr
63.3M followers
The Ellen Show
@theellenshow
62.4M followers
CNN
@cnn
61.9M followers
Selena Gomez
@selenagomez
61.1M followers
X
@x
60.8M followers