Top Tweets for #D3fackLoader

over 1 year ago

An interesting loader that is similar to #D3FackLoader in terms of leveraging Inno Setup's Pascal scripting capabilities to retrieve next stage payloads using an authentication token. You can hunt for impersonated malicious domains using HOST-BANNER_0_HASH (e36885cbaaf494301ff191f5862f2cb6) provided by awesome folks at @ValidinLLC

PandaRE__'s tweet photo. An interesting loader that is similar to #D3FackLoader in terms of leveraging Inno Setup's Pascal scripting capabilities to retrieve next stage payloads using an authentication token.
You can hunt for impersonated malicious domains using HOST-BANNER_0_HASH (e36885cbaaf494301ff191f5862f2cb6) provided by awesome folks at @ValidinLLC

Unit 42 @Unit42_Intel

over 1 year ago

Malicious webpages impersonating legitimate software sites distribute a previously unknown loader. The loader has anti-VM functionality & retrieves payloads through tinyurl[.]com using authentication token and compromised WordPress websites. More info at https://t.co/uSAeH3QDDL

Unit42_Intel's tweet photo. Malicious webpages impersonating legitimate software sites distribute a previously unknown loader. The loader has anti-VM functionality & retrieves payloads through tinyurl[.]com using authentication token and compromised WordPress websites. More info at https://t.co/uSAeH3QDDL https://t.co/s3nu2xUxtd

115

17K

PandaRE 🐼 🇺🇦

@PandaRE__

about 2 years ago

My little piece of work on a MaaS loader, #D3FackLoader 💙 I hope you will enjoy the read. Link: https://t.co/2cmNdE78P3

PandaRE 🐼 🇺🇦

@PandaRE__

about 2 years ago

It doesn't matter if your payload is FUD or how hard you try to blur out the payload you uploaded to VT. I will still find you and detect you, #D3FackLoader ['https://steamcommunity[.]com/profiles/76561199689894251', '\\21[.]txt', '\\21[.]cmd', '\\85[.]zip', '\\855[.]zip', '\\4554[.]cmd', '/manual/225/225[.]zip', 'https://t[.]me/+UfHrjVyCLZ03ODYy', '/manual/225/225']

$PandaRE__'s tweet photo. It doesn't matter if your payload is FUD or how hard you try to blur out the payload you uploaded to VT. I will still find you and detect you, #D3FackLoader ['https://steamcommunity[.]com/profiles/76561199689894251', '\\21[.]txt', '\\21[.]cmd', '\\85[.]zip', '\\855[.]zip', '\\4554[.]cmd', '/manual/225/225[.]zip', 'https://t[.]me/+UfHrjVyCLZ03ODYy', '/manual/225/225']$

13K

PandaRE 🐼 🇺🇦

@PandaRE__

over 2 years ago

Another certificate used by #D3FackLoader, but this one put a big smile on panda's face 🐼

Karsten Hahn @struppigel

over 2 years ago

🦔 📹 New Video: D3fack loader analysis ➡️ Inno Setup pascal script analysis ➡️ string deobfuscation with binary refinery ➡️ JPHP decompilation Sample was first described by @RussianPanda9xx https://t.co/J4kB3Lbef2 #MalwareAnalysisForHedgehogs #D3fackLoader

Karsten Hahn @struppigel

over 2 years ago

This new loader named d3f@ck has a stage which is JPHP. Here is how to analyse JPHP #d3fackloader #d3fack

PandaRE 🐼 🇺🇦

@PandaRE__

over 2 years ago

My little write-up on #D3fackLoader, the lovely MaaS loader from our boy Sergei. Preparing another blog on it, stay tuned 👀 Article: https://t.co/0rfBc5GmgE @esthreat

PandaRE__'s tweet photo. My little write-up on #D3fackLoader, the lovely MaaS loader from our boy Sergei. Preparing another blog on it, stay tuned 👀

Article: https://t.co/0rfBc5GmgE

@esthreat https://t.co/Lx9B9dA6jK

10K

Top Tweets for #D3fackLoader

Last Seen Hashtags on Sotwe

Trends for you

Most Popular Users