Sotwe logo Sotwe logo

Top Tweets for #Privateloader

RakeshKrish12's profile image
RAKESH KRISHNAN @RakeshKrish12
🚨7 fresh samples of #PrivateLoader! 34.95.33[.]208πŸ‡¨πŸ‡¦ πŸ’‘IP hosted on #GoogleCloud πŸ’‘All 7 files are created at different time intervals since June 2025! Here: https://t.co/e1k4lWLtRv #ThreatIntel #ransomware #malware #security #infosec #stealer #hack #DarkWeb #DeepWeb #OSINT
RakeshKrish12's tweet photo. 🚨7 fresh samples of #PrivateLoader! 34.95.33[.]208πŸ‡¨πŸ‡¦ πŸ’‘IP hosted on #GoogleCloud πŸ’‘All 7 files are created at different time intervals since June 2025! Here: https://t.co/e1k4lWLtRv #ThreatIntel #ransomware #malware #security #infosec #stealer #hack #DarkWeb #DeepWeb #OSINT https://t.co/Ii6cPgg8Z5
0
10
3
3
3K
JAMESWT_WT's profile image
JAMESWT @JAMESWT_WT
#CopyrightViolation πŸ‘‡ #rhadamanthys #Asyncrat #PrivateLoader #Loader #Lycaon #Amadey #RemcosRAT βœ…~157 Samples Collection UpdatedπŸ‘‡ https://t.co/gcvhrmtKuz https://t.co/tR4A667Lzz https://t.co/8npQFfx7sI https://t.co/GoydtmRK6h https://t.co/tPNiWD0LxW https://t.co/ytc7XoE0yi
JAMESWT_WT's tweet photo. #CopyrightViolation πŸ‘‡ #rhadamanthys #Asyncrat #PrivateLoader #Loader #Lycaon #Amadey #RemcosRAT βœ…~157 Samples Collection UpdatedπŸ‘‡ https://t.co/gcvhrmtKuz https://t.co/tR4A667Lzz https://t.co/8npQFfx7sI https://t.co/GoydtmRK6h https://t.co/tPNiWD0LxW https://t.co/ytc7XoE0yi https://t.co/tTjxBWxEzV
JAMESWT_WT's profile image
JAMESWT @JAMESWT_WT
"Richiesta Rimozione Contenuto Diritti d'Autore Caltagirone Editore" #rhadamanthys #AsyncRAT #CopyrightViolation πŸ‘‡ t.]ly/CaltagironeEditore2101 πŸ‘‡ urlhaus.abuse.]ch/url/3408772/ C2 66.181.33.]65 192.30.241[.106 Samples https://t.co/8npQFfx7sI AnyRun https://t.co/D86DSUdHvm
JAMESWT_WT's tweet photo. "Richiesta Rimozione Contenuto Diritti d'Autore Caltagirone Editore" #rhadamanthys #AsyncRAT #CopyrightViolation πŸ‘‡ t.]ly/CaltagironeEditore2101 πŸ‘‡ urlhaus.abuse.]ch/url/3408772/ C2 66.181.33.]65 192.30.241[.106 Samples https://t.co/8npQFfx7sI AnyRun https://t.co/D86DSUdHvm https://t.co/p9huRE5vcB
1
19
8
1
12K
0
17
7
1
6K
anyrun_app's profile image
ANY.RUN Verified account @anyrun_app
πŸ€ #zgRAT is a #malware active since 2021 often delivered by #PrivateLoader It can steal browser credentials, exfiltrate data to Telegram, and spread via USB Learn more and collect #IOCs & samples πŸ”— https://t.co/rmdcTCQzBP
anyrun_app's tweet photo. πŸ€ #zgRAT is a #malware active since 2021 often delivered by #PrivateLoader It can steal browser credentials, exfiltrate data to Telegram, and spread via USB Learn more and collect #IOCs & samples πŸ”— https://t.co/rmdcTCQzBP https://t.co/fM5TGfYJXa
0
17
3
3
2K
struppigel's profile image
Karsten Hahn @struppigel
πŸ¦” πŸ“Ή Video: Learn how to write code based signatures ➑️ using privateloader as example ➑️ what to detect ➑️ where to set wildcards ➑️ how to test your rule on unpac me https://t.co/ZmRjTdcTS1 #MalwareAnalysisForHedgehogs #privateloader
1
149
43
100
17K
g0njxa's profile image
Who said what? Verified account @g0njxa
In the past days , i've been observing a totally different behavior of the loader builds on #Installskey PPI service New behaviour: https://t.co/JU9Iji1dvi Last tipically privateloader detonation available on me: https://t.co/1q9Fhv6RRI Is this the new #Privateloader? πŸ‘‡πŸ‘‡πŸ‘‡
2
12
3
6
2K
naumovax's profile image
Kseniia \n @naumovax
#PrivateLoader - C2: 64.95.13[.]143:1120πŸ‘Ύ See the detailed structure of network communication in the pic. below ⏬ https://t.co/4q4QbWjkst https://t.co/1I3TQbT5nu
naumovax's tweet photo. #PrivateLoader - C2: 64.95.13[.]143:1120πŸ‘Ύ See the detailed structure of network communication in the pic. below ⏬ https://t.co/4q4QbWjkst https://t.co/1I3TQbT5nu https://t.co/bwKKcB2XQq
banthisguy9349's profile image
Fox_threatintel @banthisguy9349
https://t.co/8LBgQYQdKf 64.95.13.143
banthisguy9349's tweet photo. https://t.co/8LBgQYQdKf 64.95.13.143 https://t.co/lfeR7slxwK
0
2
0
1
10K
2
63
16
30
9K
Neiki__'s profile image
Neiki Verified account @Neiki__
#privateloader #opendir https://t.co/6jGgvbFsCI
0
5
0
0
255
g0njxa's profile image
Who said what? Verified account @g0njxa
Some changes observed in the #Privateloader (InstallsKey PPI loader) web communication: Endpoints name change (Not A Wordpress): /api/wp-ping.php (old /api/crazyfish.php) /api/wp-admin.php (old /api/twofish.php) Run: https://t.co/sQzD9fXB83
g0njxa's tweet photo. Some changes observed in the #Privateloader (InstallsKey PPI loader) web communication: Endpoints name change (Not A Wordpress): /api/wp-ping.php (old /api/crazyfish.php) /api/wp-admin.php (old /api/twofish.php) Run: https://t.co/sQzD9fXB83 https://t.co/Y6PnuDud0z
0
16
7
3
2K
banthisguy9349's profile image
Fox_threatintel @banthisguy9349
#fresh malware! https://t.co/J0GdaiwL0J #cryptbot #privateloader
banthisguy9349's tweet photo. #fresh malware! https://t.co/J0GdaiwL0J #cryptbot #privateloader https://t.co/kPQ9NBVqF4
1
31
12
6
4K
kddx0178318's profile image
kddx00 @kddx0178318
Some more #PrivateLoader form #Installskey #PPI sevice #IOCs https[:]//crackedpcsoft88.com/ http://45.91.200.135/api/ file-link-iota.vercel[.]app kaysons-group[.]com http://176.113.115.33/ http://62.204.41.151/ http://46.8.231.109/ 78.47.207.136:443 62.204.41.151 cc @g0njxa
kddx0178318's profile image
kddx00 @kddx0178318
The #stealer could be find in the #active site https://t.co/aQahYp9Ziq the file is grand_theft_auto_iv_pc_game_free_download.7z Each time you click will redirect you to different domains hosting it. Once launched will reach sites as the one below to install even more malware.
kddx0178318's tweet photo. The #stealer could be find in the #active site https://t.co/aQahYp9Ziq the file is grand_theft_auto_iv_pc_game_free_download.7z Each time you click will redirect you to different domains hosting it. Once launched will reach sites as the one below to install even more malware. https://t.co/5Bmj8Fufll
5
11
5
1
3K
0
5
3
1
480
g0njxa's profile image
Who said what? Verified account @g0njxa
In the past days I observed some interesting behavior on the #Installskey PPI malvertising networks dropping #Privateloader: I will be showing 2 scenarios were victims gets a malware download, and also these websites redirecting already known visitors to other downloads. πŸ‘‡
1
6
1
3
1K
g0njxa's profile image
Who said what? Verified account @g0njxa
Some variants of #privateloader malvertising frontpages in english and spanish another recent beautiful detonation: https://t.co/DFUDgUepi0
g0njxa's tweet photo. Some variants of #privateloader malvertising frontpages in english and spanish another recent beautiful detonation: https://t.co/DFUDgUepi0 https://t.co/o5AGD4efZF
g0njxa's profile image
Who said what? Verified account @g0njxa
#privateloader #crackedcantil, from Dozkey's Installskey PPI service is still kicking on the wild! A recent (and beautiful) detonation: https://t.co/899O9Nve0y
g0njxa's tweet photo. #privateloader #crackedcantil, from Dozkey's Installskey PPI service is still kicking on the wild! A recent (and beautiful) detonation: https://t.co/899O9Nve0y https://t.co/SAVuWA3pwb
0
14
1
3
5K
0
21
7
5
3K
g0njxa's profile image
Who said what? Verified account @g0njxa
#privateloader #crackedcantil, from Dozkey's Installskey PPI service is still kicking on the wild! A recent (and beautiful) detonation: https://t.co/899O9Nve0y
g0njxa's tweet photo. #privateloader #crackedcantil, from Dozkey's Installskey PPI service is still kicking on the wild! A recent (and beautiful) detonation: https://t.co/899O9Nve0y https://t.co/SAVuWA3pwb
0
14
1
3
5K
g0njxa's profile image
Who said what? Verified account @g0njxa
#PrivateLoader now serves its builds from an FTP server. 1 - download a .zip from a compromised host (/institutodeseguros.com.pe) 2 - Zip contains a .lnk that retrieves the privateloader build .zip from FTP server 147.45.47.80 Stage 3 - Autoit loader https://t.co/CKlxRlhm7F
g0njxa's tweet photo. #PrivateLoader now serves its builds from an FTP server. 1 - download a .zip from a compromised host (/institutodeseguros.com.pe) 2 - Zip contains a .lnk that retrieves the privateloader build .zip from FTP server 147.45.47.80 Stage 3 - Autoit loader https://t.co/CKlxRlhm7F https://t.co/rg3D17bqAc
11
39
10
7
4K
g0njxa's profile image
Who said what? Verified account @g0njxa
The #Installskey PPI service is still delivering the hell out of malware through #PrivateLoader #crackedcantil c2: /77.105.133.27/api /5.42.99.177/api A recent succesful detonation: https://t.co/fvVRvJ9Tbk
g0njxa's tweet photo. The #Installskey PPI service is still delivering the hell out of malware through #PrivateLoader #crackedcantil c2: /77.105.133.27/api /5.42.99.177/api A recent succesful detonation: https://t.co/fvVRvJ9Tbk https://t.co/3r4w92lBwW
1
21
9
4
3K
banthisguy9349's profile image
Fox_threatintel @banthisguy9349
4 ips that are using #gcleaner #lummastealer #redlinestealer #smokeloader #glupteba #privateloader unique identifier of the threatactor = batushka directory + the file named ''checkk.txt" https://t.co/9VHY2LmK5R in picture 2 from the looks of it SQL-Injection statements.
banthisguy9349's tweet photo. 4 ips that are using #gcleaner #lummastealer #redlinestealer #smokeloader #glupteba #privateloader unique identifier of the threatactor = batushka directory + the file named ''checkk.txt" https://t.co/9VHY2LmK5R in picture 2 from the looks of it SQL-Injection statements. https://t.co/0oz1u3LHY3
3
33
6
13
9K
banthisguy9349's profile image
Fox_threatintel @banthisguy9349
Hey! i found my old friend again! #opendir with #privateloader #gcleaner on http://185.172.128.69/ https://t.co/FQbBIB10Fq hash: 89cfbdb9bb8613b4d86426bc61d463ae29759690b567bc276cd0dc21a501a629 d55e86610dcad29c3d2857d9dae91aa51228b1fa001ea2d7bda88b9a2b5570a9 cc: @500mk500
banthisguy9349's tweet photo. Hey! i found my old friend again! #opendir with #privateloader #gcleaner on http://185.172.128.69/ https://t.co/FQbBIB10Fq hash: 89cfbdb9bb8613b4d86426bc61d463ae29759690b567bc276cd0dc21a501a629 d55e86610dcad29c3d2857d9dae91aa51228b1fa001ea2d7bda88b9a2b5570a9 cc: @500mk500 https://t.co/RoRsFbOq5Y
banthisguy9349's profile image
Fox_threatintel @banthisguy9349
πŸ‘€
banthisguy9349's tweet photo. πŸ‘€ https://t.co/UZ4o1UKtw9
0
0
1
0
4K
0
27
10
5
4K
threatintel's profile image
Threat Intelligence @threatintel
#ThreatProtection #Remcos #RAT expands functionality with #PrivateLoader module. Read more: https://t.co/itqEpbBRvQ #CyberSecurity
0
3
3
0
2K
Neiki__'s profile image
Neiki Verified account @Neiki__
Low detected #malware #privateloader Threat Score: 100/100 Virustotal Detections: 3/72 SHA256: 0bce62b057e8d60bcbaa16c3d8571943f7ea7e42f5bcfab85f1968a266e5386d https://t.co/JDqIVM5Rx9
0
0
0
0
27
g0njxa's profile image
Who said what? Verified account @g0njxa
new domains sharing #crackedcantil #privateloader via Discord CDN whois updated as April 12th /sik586.com (old template) /slk594.com (new template) /skh731.com (new template) @Cloudflare
g0njxa's tweet photo. new domains sharing #crackedcantil #privateloader via Discord CDN whois updated as April 12th /sik586.com (old template) /slk594.com (new template) /skh731.com (new template) @Cloudflare https://t.co/iAsk6HEb36
g0njxa's profile image
Who said what? Verified account @g0njxa
You can actually see real download statistics from the "downloads" number showed in some of the executables loaded. As for example, /bitbucket.org/ixef571134343/ef571134343/downloads/ with 11003 since 2024-03-23. Not everything from the PPI service but still big numbers πŸ« πŸ™„
g0njxa's tweet photo. You can actually see real download statistics from the "downloads" number showed in some of the executables loaded. As for example, /bitbucket.org/ixef571134343/ef571134343/downloads/ with 11003 since 2024-03-23. Not everything from the PPI service but still big numbers πŸ« πŸ™„ https://t.co/vxBToqzXFu
0
4
2
0
3K
0
13
4
0
2K

Last Seen Hashtags on Sotwe

minichat filter:videos min_faves:34
Seen from Chile
tana beurette
Seen from Switzerland
ヒデフェス
Seen from Japan
MGAI
Seen from United States
mom
Seen from United States
Ψ²Ω…ΩŠΩ„Ω‡Ψ§
Seen from Jordan
ΰΈ„ΰΈ§ΰΈ’ΰΈ—ΰΈ«ΰΈ²ΰΈ£
Seen from Thailand
aporteanΓ³nimo
Seen from Mexico
mgai
Seen from Korea
brosis
Seen from United States

Trends for you

1
Luka
Under 10K tweets
2
Halloween
Under 10K tweets
3
Poland
Under 10K tweets
4
Reaves
Under 10K tweets
5
Podz
Under 10K tweets
6
#SmackDown
Under 10K tweets
7
Kyrie
Under 10K tweets
8
Tusk
Under 10K tweets
9
#OPLive
Under 10K tweets
10
Dillon Brooks
Under 10K tweets

Most Popular Users

elonmusk's profile image
1
Elon Musk Verified account
@elonmusk
241.5M followers
barackobama's profile image
2
Barack Obama Verified account
@barackobama
118.8M followers
cristiano's profile image
3
Cristiano Ronaldo Verified account
@cristiano
114.5M followers
realdonaldtrump's profile image
4
Donald J. Trump Verified account
@realdonaldtrump
111.9M followers
narendramodi's profile image
5
Narendra Modi Verified account
@narendramodi
107.1M followers
rihanna's profile image
6
Rihanna Verified account
@rihanna
98.7M followers
nasa's profile image
7
NASA Verified account
@nasa
92.3M followers
justinbieber's profile image
8
Justin Bieber Verified account
@justinbieber
91.8M followers
katyperry's profile image
9
KATY PERRY Verified account
@katyperry
90M followers
taylorswift13's profile image
10
Taylor Swift Verified account
@taylorswift13
84M followers
ladygaga's profile image
11
Lady Gaga Verified account
@ladygaga
75.5M followers
imvkohli's profile image
12
Virat Kohli Verified account
@imvkohli
73.4M followers
kimkardashian's profile image
13
Kim Kardashian Verified account
@kimkardashian
70.8M followers
youtube's profile image
14
YouTube Verified account
@youtube
68.8M followers
neymarjr's profile image
15
Neymar Jr Verified account
@neymarjr
66.4M followers
billgates's profile image
16
Bill Gates Verified account
@billgates
65.2M followers
selenagomez's profile image
17
Selena Gomez Verified account
@selenagomez
63.1M followers
theellenshow's profile image
18
The Ellen Show
@theellenshow
62.2M followers
cnn's profile image
19
CNN Verified account
@cnn
61.7M followers
x's profile image
20
X Verified account
@x
60.7M followers