Top Tweets for #AHKLoader

over 4 years ago

Currently mapping a #AHKloader campaign in @MaltegoHQ . See tweet below to find all associated domains and IP addresses I am currently tracking.

Gi7w0rm

@Gi7w0rm

over 4 years ago

@ankit_anubhav @Bitly @1ZRR4H @ffforward @Max_Mal_ @pr0xylife Yep, this one looks rather familiar ^^

Ankit Anubhav

@ankit_anubhav

over 4 years ago

Disappointing stuff by @Bitly / AWS / Onedrive as #AHKLoader is repeatedly attacking Thaipass victims using custom URLs. /bit.ly/Thailand-passport -> onedrive -> HTML -> .ISO -> .VBS > AWS > /microsoft.soundcast.me Attacker is hosting the whole attack chain on cloud services.

ankit_anubhav's tweet photo. Disappointing stuff by @Bitly / AWS / Onedrive as #AHKLoader is repeatedly attacking Thaipass victims using custom URLs.

/bit.ly/Thailand-passport -> onedrive -> HTML -> .ISO -> .VBS > AWS > /microsoft.soundcast.me

Attacker is hosting the whole attack chain on cloud services. https://t.co/N1sBTBKaLt

Ankit Anubhav

@ankit_anubhav

over 4 years ago

@notkoutsie @1ZRR4H Petition to rename #AHKLoader as #AhmadLoader (The ones who are attacking posing as ThaiPass) If you are a malware researcher, go to /94.130.207.164/ and wget everything before it goes down. A lot of interesting files to analyze, specially the AVA folder.

ankit_anubhav's tweet photo. @notkoutsie @1ZRR4H Petition to rename #AHKLoader as #AhmadLoader
(The ones who are attacking posing as ThaiPass)

If you are a malware researcher, go to /94.130.207.164/ and wget everything before it goes down.
A lot of interesting files to analyze, specially the AVA folder. https://t.co/362DOiR7pv

Ankit Anubhav

@ankit_anubhav

over 4 years ago

/ec2-34-229-64-131.compute-1.amazonaws.com/ Amazon EC2 again used to host malware infrastructure of #AHKLoader. . Files added today 10.03.2022

Ankit Anubhav

@ankit_anubhav

over 4 years ago

If (AVG exists) { run malware specific for AVG } else if (Malwarebytes exists ) { run malware specific for malwarebytes } #AHKLoader campaign (AsyncRAT and others) Live #opendirectory /34.105.85.231/

$ankit_anubhav's tweet photo. If (AVG exists) { run malware specific for AVG } else if (Malwarebytes exists ) { run malware specific for malwarebytes } #AHKLoader campaign (AsyncRAT and others) Live #opendirectory /34.105.85.231/ https://t.co/wlKckw2YqG$

143

Ankit Anubhav

@ankit_anubhav

over 4 years ago

/ec2-3-235-29-66.compute-1.amazonaws.com/ #vjworm ( related to #AHKLoader campaign seen by @morphisec in past ) is hosting several stuff of its attack cycle on EC2 AWS. Of course AWS URL has 0/93 link detection and people keep AWS in whitelists. https://t.co/Kl9ib5jTjs

ankit_anubhav's tweet photo. /ec2-3-235-29-66.compute-1.amazonaws.com/

#vjworm ( related to #AHKLoader campaign seen by @morphisec in past ) is hosting several stuff of its attack cycle on EC2 AWS.

Of course AWS URL has 0/93 link detection and people keep AWS in whitelists.

https://t.co/Kl9ib5jTjs https://t.co/XRQxiXpgCt

Threat Intelligence @threatintel

about 5 years ago

#ThreatProtection Multiple RATs get cozy with #AHKLoader, read more about Symantec's protection: https://t.co/j72fYoxAum

Top Tweets for #AHKLoader

Last Seen Hashtags on Sotwe

Trends for you

Most Popular Users