Top Tweets for #OSTAP
Check out our new arrivals from OSTAP ๐๐ก๏ธโ๏ธ๐ฅ
https://t.co/YEFXUuOAW6
#ostap #bead #spaceship #polishcustomknives #customknives #customknife #custom #blade #polishknifemakersย #knives #madeinpoland #custommade #knifeporn
#Ostap_Susval is 84. He lives in a small village in #Volyn region on the #Polish border. The village name is also #Susval and it was renamed after his son #Petro, a Hero of the #Russian_Ukrainian war who was killed in August 2014. #Ostap hates the new village name.
"He wanted to be a hero" - #Andrei_Onistrat about his dead son
In civilian life, #Andrei_Onistrat was a famous banker, & after the invasion, together with his son, #Ostap, went to the front They fought side by side, & in early June, the young Defender died in the #Donetsk region
#Ostap, the son of the famous #Ukrainian banker #Andrii_Onistrat, died in the war.
#Ostap_Onistrat, who was about to turn 22 years old, was the operator of the #UAV strike department. Died near #Ugledar, #Donetsk region.
๐ฅOctober 8!๐ฅ
#lowreensliveblues #chicagoblues #livemusic #chicagoblueswomen
#logansquare #chicagonightlife #chicagolivemusic #ostap #divebar #beergarden #gonnapitchawangdangdoodle #junemallory
https://t.co/29mX7lf1BT
#ostap from malspam "E-FAX <NNNNN> <XXX>"
https://t.co/OtQuTSdy96
https://t.co/iMw0lHaBVH
C2: 188.116.36.154
thx @James_inthe_box for id
Malspam with weaponized XLS file distributing #Ostap ๐ฃ
Payload on MalwareBazaar:
๐ https://t.co/mw8V7IiU6Q
Payload URL:
๐ https://t.co/MR5jBkgFXr
Ostap C2:
๐ฅ https://185.183.96 .173/90/90.php
#Ostap
Exe
https://t.co/nh6mosujbJ
Jse
https://t.co/uWXfshIEaI
cc @malwrhunterteam @VK_Intel @sugimu_sec @Arkbird_SOLG @FBussoletti @Jan0fficial @James_inthe_box @guelfoweb
@bigmacjpg Related?
https://t.co/mMHhp747MQ
Using a different C2:
https://188.116.36[.]89/zt2p4Q/jaY066.php
Hosted at @HostSailor (Dubai, UAE ๐ฆ๐ช)
/cc @TheUAETRA @DubaiPoliceHQ
![abuse_ch's tweet photo. @bigmacjpg Related?
https://t.co/mMHhp747MQ
Using a different C2:
https://188.116.36[.]89/zt2p4Q/jaY066.php
Hosted at @HostSailor (Dubai, UAE ๐ฆ๐ช)
/cc @TheUAETRA @DubaiPoliceHQ https://t.co/0aZZdG4qJ3](https://pbs.twimg.com/media/EjquWjIWoAMjlR8.jpg)
26 sep - 02 oct 2020: Weekly report of italian campaign malspam with ioc: #Emotet, #AgentTesla, #MassLogger, #XpertRAT, #OSTAP, #Ursnif, #FormBook & #Remcos.
@58_158_177_102 @Cryptolaemus1 @csirt_it @AgidCert @JAMESWT_MHT @fr0s7_ @Bl4ng3l @a_de_pasquale
https://t.co/h7KqbNFoI3
#cybercrime, #Ostap colpisce #Italia con falsi bonifici-fatture.Infezione parte da allegati con macro. Se chiusi,JS esegue downloader che contatta C2 e scarica altri #Malware per recuperare payload finale #CyberSecurity #infosec @JAMESWT_MHT @VirITeXplorer https://t.co/5jl1jMQ1bI
#Ostap #Italy
Attachment Sample
https://t.co/PSdWmquDMp
cc @malwrhunterteam @FBussoletti @guelfoweb @AgidCert
Email example
โฌ๏ธโฌ๏ธโฌ๏ธ
Docs #OSTAP
https://t.co/LBx9POAh5K
Vbe
https://t.co/KgsbmBgqXy
Exe
https://t.co/nbn2CCcyiC
Js
https://t.co/5VrjBtRyGU
Run
https://t.co/2Z0mbW2gIg
Relation
https://t.co/ig7hEs8wQZ
TK to C2 from @VirITeXplorer
cc @malwrhunterteam @FBussoletti @AgidCert @Arkbird_SOLG @sugimu_sec
Docs #OSTAP
https://t.co/LBx9POAh5K
Vbe
https://t.co/KgsbmBgqXy
Exe
https://t.co/nbn2CCcyiC
Js
https://t.co/5VrjBtRyGU
Run
https://t.co/2Z0mbW2gIg
Relation
https://t.co/ig7hEs8wQZ
TK to C2 from @VirITeXplorer
cc @malwrhunterteam @FBussoletti @AgidCert @Arkbird_SOLG @sugimu_sec
#OSTAP #ITA ๐ฎ๐น 2020-09-28
Campagna: "Fattura n. "
DOC: 45DFEB37B180D81BA5FBB5518DD94727
JSE: 9E4A5826A1A1CF37B3027322A8E74486
C2: https://188.116.36.]143
@58_158_177_102 @csirt_it @AgidCert @guelfoweb @fr0s7_ @Bl4ng3l @a_de_pasquale
![VirITeXplorer's tweet photo. #OSTAP #ITA ๐ฎ๐น 2020-09-28
Campagna: "Fattura n. "
DOC: 45DFEB37B180D81BA5FBB5518DD94727
JSE: 9E4A5826A1A1CF37B3027322A8E74486
C2: https://188.116.36.]143
@58_158_177_102 @csirt_it @AgidCert @guelfoweb @fr0s7_ @Bl4ng3l @a_de_pasquale https://t.co/o0R9ljI1d8](https://pbs.twimg.com/media/EjA1z_uWoAIZUiA.jpg)
![VirITeXplorer's tweet photo. #OSTAP #ITA ๐ฎ๐น 2020-09-28
Campagna: "Fattura n. "
DOC: 45DFEB37B180D81BA5FBB5518DD94727
JSE: 9E4A5826A1A1CF37B3027322A8E74486
C2: https://188.116.36.]143
@58_158_177_102 @csirt_it @AgidCert @guelfoweb @fr0s7_ @Bl4ng3l @a_de_pasquale https://t.co/o0R9ljI1d8](https://pbs.twimg.com/media/EjA1zNDWkAAHyjN.jpg)
#OSTAP #ITA ๐ฎ๐น 2020-09-28
Campagna: "Fattura n. "
DOC: 45DFEB37B180D81BA5FBB5518DD94727
JSE: 9E4A5826A1A1CF37B3027322A8E74486
C2: https://188.116.36.]143
@58_158_177_102 @csirt_it @AgidCert @guelfoweb @fr0s7_ @Bl4ng3l @a_de_pasquale
@JAMESWT_MHT @matte_lodi @AgidCert @abuse_ch @reecdeep @malwrhunterteam @Certego_IRT I thought the same thing...turns out was #ostap
https://t.co/51i6mpnoSD
I never got the final payload from this OSTAP but someone may find this interesting and want to check it out :)
H/T to
@James_inthe_box
and
@lazyactivist192
for the help in diagnosing what the hell this was.
IOC:
s://aware.pw/wp-index.php
C2 - 185.117.75.142:443
4 of 4
The was an odd find and turned out to be #OSTAP that was delivered via an EXE from a php in an Excel 4.0 macro enabled and password protected spreadsheet. Very low detection on the Excel spreadsheet 2/58: https://t.co/t3mucguLPj. Password for this sample is F0409! 1 of 4
Last Seen Hashtags on Sotwe
jonita
Seen from Italy
RSNA2026
Seen from United States
hinata
Seen from United States
abstragedy
Seen from Italy
momson()*+filter:native_video
Seen from United States
NightDrive
Seen from Algeria
ModiGovernment12Years
Seen from United States
Fucking
Seen from Turkey
nsfw #yaoi animation
Seen from Israel
_A_kise
Seen from United States
Most Popular Users
Elon Musk 
@elonmusk
240.9M followers
Barack Obama
@barackobama
119.2M followers
Donald J. Trump
@realdonaldtrump
111.8M followers
Cristiano Ronaldo
@cristiano
111.6M followers
Narendra Modi
@narendramodi
107M followers
Rihanna
@rihanna
97.9M followers
NASA
@nasa
92.2M followers
Justin Bieber
@justinbieber
91.1M followers
KATY PERRY
@katyperry
88.2M followers
Taylor Swift
@taylorswift13
82.1M followers
Lady Gaga
@ladygaga
73.6M followers
Virat Kohli
@imvkohli
70.8M followers
Kim Kardashian
@kimkardashian
70M followers
YouTube
@youtube
68.7M followers
Bill Gates
@billgates
64.2M followers
Neymar Jr
@neymarjr
63.6M followers
The Ellen Show
@theellenshow
62.4M followers
CNN
@cnn
61.8M followers
Selena Gomez
@selenagomez
61.3M followers
X
@x
60.8M followers