#RobotDropper - Twitter Hashtag

Szabolcs Schmidt

@smica83

over 1 year ago

Two completely undetected #RobotDropper samples @abuse_ch https://t.co/Xqju4xiXjz https://t.co/hTt8BbCulC @JAMESWT_MHT

0

15

3

1

873

RussianPanda 🐼 🇺🇦

@RussianPanda9xx

over 1 year ago

What is going on with #LegionLoader / #RobotDropper? I am seeing a significant drop from over 200 samples to 15... Did they go on vacation?

RussianPanda9xx's tweet photo. What is going on with #LegionLoader / #RobotDropper? I am seeing a significant drop from over 200 samples to 15...
Did they go on vacation? https://t.co/8nlDL1RUVR

5

33

2

6

3K

Johnk3r @johnk3r

over 1 year ago

For a few weeks now I have been tracking "#Satacom/#RobotDropper/#LegionLoader" and curiously most of the submissions to VT are related to Latin American countries, mainly Brazil. Some references and IoC below... @Merlax_ @1ZRR4H

johnk3r's tweet photo. For a few weeks now I have been tracking "#Satacom/#RobotDropper/#LegionLoader" and curiously most of the submissions to VT are related to Latin American countries, mainly Brazil.

Some references and IoC below...

@Merlax_ @1ZRR4H https://t.co/jCFtT2AR2Z

1

42

15

7

4K

RussianPanda 🐼 🇺🇦

@RussianPanda9xx

over 1 year ago

Did you know #LegionLoader aka #RobotDropper injects the core payload into explorer.exe and you can hunt for it in @anyrun_app Threat Intelligence tool using the query: commandLine:"C:\\WINDOWS\\SysWOW64\\explorer.exe explorer.exe" Here is the recent configuration from the loader: https://t.co/k7wtMZN1aP Sample: https://t.co/mL2LfLu3eQ

$RussianPanda9xx's tweet photo. Did you know #LegionLoader aka #RobotDropper injects the core payload into explorer.exe and you can hunt for it in @anyrun_app Threat Intelligence tool using the query: commandLine:"C:\\WINDOWS\\SysWOW64\\explorer.exe explorer.exe" Here is the recent configuration from the loader: https://t.co/k7wtMZN1aP Sample: https://t.co/mL2LfLu3eQ$

4

110

15

42

11K

Who said what?

@g0njxa

almost 2 years ago

#robotdropper malvertising campaign can be also spotted on fake download .monster domains impersonating RapidShare /getofficialapp.monster Detonation: https://t.co/rwxp2BuPV2

g0njxa's tweet photo. #robotdropper malvertising campaign can be also spotted on fake download .monster domains impersonating RapidShare

/getofficialapp.monster

Detonation: https://t.co/rwxp2BuPV2 https://t.co/f9ctnVQpes

ANY.RUN

@anyrun_app

almost 2 years ago

💢 Low-Detection MSI Dropper Delivers #Malware – #ExploreWithANYRUN ⚠️ A recently developed #dropper is an #MSI file containing a #password-protected RAR archive 📌 Both the sample and #C2 domains have a very low detection rate on #VirusTotal 🔗 https://t.co/Vx45sGudWg 📤 The dropper sends requests to the get-license4[.]com and get-license2[.]com resources, with the example of the following content: IsICS=0&LangCode=5875&AwaitTmp=17&Kiid=81257 ⚙️ After execution, it asks the user to confirm that they are not a robot by clicking the "OK" button. It then displays the 'Sending collected data' message 📝 Now the server’s returning only the '0a' string. It may be intended to return the password for its content 🤖 We named it #RobotDropper because it requires the user to confirm that they are human 👉 https://t.co/qE3bcFFkai We've observed it dropping #Lumma and #Stealc: 👉 https://t.co/QWiariKcGG Find more samples by these #TILookup requests: 👉 https://t.co/2yxhsPQT8A 👉 https://t.co/mUYAZ3wVNa 🐼 Special thanks to @RussianPanda9xx for providing the initial sample in her tweet! Analyze and investigate the latest #malware and #phishing threats with #ANYRUN 🛡️

anyrun_app's tweet photo. 💢 Low-Detection MSI Dropper Delivers #Malware – #ExploreWithANYRUN

⚠️ A recently developed #dropper is an #MSI file containing a #password-protected RAR archive

📌 Both the sample and #C2 domains have a very low detection rate on #VirusTotal
🔗 https://t.co/Vx45sGudWg

📤 The dropper sends requests to the get-license4[.]com and get-license2[.]com resources, with the example of the following content:
IsICS=0&LangCode=5875&AwaitTmp=17&Kiid=81257

⚙️ After execution, it asks the user to confirm that they are not a robot by clicking the "OK" button. It then displays the 'Sending collected data' message

📝 Now the server’s returning only the '0a' string. It may be intended to return the password for its content

🤖 We named it #RobotDropper because it requires the user to confirm that they are human
👉 https://t.co/qE3bcFFkai

We've observed it dropping #Lumma and #Stealc:
👉 https://t.co/QWiariKcGG

Find more samples by these #TILookup requests:
👉 https://t.co/2yxhsPQT8A
👉 https://t.co/mUYAZ3wVNa

🐼 Special thanks to @RussianPanda9xx for providing the initial sample in her tweet!

Analyze and investigate the latest #malware and #phishing threats with #ANYRUN 🛡️

3

55

17

15

14K

2

15

1

4

13K

Who said what?

@g0njxa

almost 2 years ago

2nd scenario shows traditional Privateloader download and redirection to #robotdropper (by anyrun) .msi files hosted in MEGA, first spotted by @RussianPanda9xx Privateloader .7z (traditional 1234 password) https://t.co/0UbQx9RTya Robotdropper https://t.co/BWZexUz1mk

g0njxa's tweet photo. 2nd scenario shows traditional Privateloader download and redirection to #robotdropper (by anyrun) .msi files hosted in MEGA, first spotted by @RussianPanda9xx

Privateloader .7z (traditional 1234 password)
https://t.co/0UbQx9RTya
Robotdropper
https://t.co/BWZexUz1mk https://t.co/GeZjUPClRd

1

3

1

0

526

NDA0E @NDA0E

almost 2 years ago

Distribution domain queries for #RobotDropper on @ValidinLLC and @censysio Validin: RapidShare - Fast & Secure File Transfer for Free Censys: services.http.response.html_title="RapidShare - Fast & Secure File Transfer for Free" IOCs shared on ThreatFox: https://t.co/9MMfTt9KcI

NDA0E's tweet photo. Distribution domain queries for #RobotDropper on @ValidinLLC and @censysio

Validin: RapidShare - Fast & Secure File Transfer for Free

Censys: services.http.response.html_title="RapidShare - Fast & Secure File Transfer for Free"

IOCs shared on ThreatFox: https://t.co/9MMfTt9KcI https://t.co/FZfDnGiWma

ANY.RUN

@anyrun_app

almost 2 years ago

💢 Low-Detection MSI Dropper Delivers #Malware – #ExploreWithANYRUN ⚠️ A recently developed #dropper is an #MSI file containing a #password-protected RAR archive 📌 Both the sample and #C2 domains have a very low detection rate on #VirusTotal 🔗 https://t.co/Vx45sGudWg 📤 The dropper sends requests to the get-license4[.]com and get-license2[.]com resources, with the example of the following content: IsICS=0&LangCode=5875&AwaitTmp=17&Kiid=81257 ⚙️ After execution, it asks the user to confirm that they are not a robot by clicking the "OK" button. It then displays the 'Sending collected data' message 📝 Now the server’s returning only the '0a' string. It may be intended to return the password for its content 🤖 We named it #RobotDropper because it requires the user to confirm that they are human 👉 https://t.co/qE3bcFFkai We've observed it dropping #Lumma and #Stealc: 👉 https://t.co/QWiariKcGG Find more samples by these #TILookup requests: 👉 https://t.co/2yxhsPQT8A 👉 https://t.co/mUYAZ3wVNa 🐼 Special thanks to @RussianPanda9xx for providing the initial sample in her tweet! Analyze and investigate the latest #malware and #phishing threats with #ANYRUN 🛡️

3

55

17

15

14K

0

19

4

8

2K

ANY.RUN

@anyrun_app

almost 2 years ago

🚨We've just rolled out a new #Suricata rule for #RobotDropper, and we're excited to share it with you! Give it a try and share your feedback with us! Your insights help us improve 👉 https://t.co/UGbjyJ9k3O

anyrun_app's tweet photo. 🚨We've just rolled out a new #Suricata rule for #RobotDropper, and we're excited to share it with you!

Give it a try and share your feedback with us! Your insights help us improve
👉 https://t.co/UGbjyJ9k3O https://t.co/FgysFYQYDy

0

3

2

0

992

JAMESWT @JAMESWT_WT

almost 2 years ago

Some Related Samples #RobotDropper *https://get-license4].com/licenseUser.php ❇️https://t.co/z8rMqsZ7np

ANY.RUN

@anyrun_app

almost 2 years ago

💢 Low-Detection MSI Dropper Delivers #Malware – #ExploreWithANYRUN ⚠️ A recently developed #dropper is an #MSI file containing a #password-protected RAR archive 📌 Both the sample and #C2 domains have a very low detection rate on #VirusTotal 🔗 https://t.co/Vx45sGudWg 📤 The dropper sends requests to the get-license4[.]com and get-license2[.]com resources, with the example of the following content: IsICS=0&LangCode=5875&AwaitTmp=17&Kiid=81257 ⚙️ After execution, it asks the user to confirm that they are not a robot by clicking the "OK" button. It then displays the 'Sending collected data' message 📝 Now the server’s returning only the '0a' string. It may be intended to return the password for its content 🤖 We named it #RobotDropper because it requires the user to confirm that they are human 👉 https://t.co/qE3bcFFkai We've observed it dropping #Lumma and #Stealc: 👉 https://t.co/QWiariKcGG Find more samples by these #TILookup requests: 👉 https://t.co/2yxhsPQT8A 👉 https://t.co/mUYAZ3wVNa 🐼 Special thanks to @RussianPanda9xx for providing the initial sample in her tweet! Analyze and investigate the latest #malware and #phishing threats with #ANYRUN 🛡️

3

55

17

15

14K

1

25

10

2

4K

Top Tweets for #RobotDropper

Last Seen Hashtags on Sotwe

Trends for you

Most Popular Users