Top Tweets for #TinyNuke

Daniel Stepanic @DanielStepanic

about 2 years ago

Aujourd’hui avait lieu le procès d’Augustin Inzirillo dans le cadre du dossier #Tinynuke. Il n’était pas présent et a été jugé par défaut. Son avocat a demandé un renvoi en vain (son précédent conseil avait déjà fait de même et obtenu gain de cause. 3 ans de prison dont 18m ferme

1

5

1

3K

over 3 years ago

If we look at the source code from #TinyNuke, we can see it assigned and it being passed to create a new process https://t.co/5GO5tKmxwX https://t.co/SkLjfVliW0

DanielStepanic's tweet photo. If we look at the source code from #TinyNuke, we can see it assigned and it being passed to create a new process

https://t.co/5GO5tKmxwX

https://t.co/SkLjfVliW0 https://t.co/dwbEc1blH8

1

3

0

1K

over 4 years ago

Seems a #loader for 2nd payload that is detected as #Tinynuke. 6c56b8972850ea913a0833c679bce4ba Same pattern delivering #vertex #malware on second request: 193.233.193.]67/ItsJustACigarette.exe -> 193.233.193.]68/panel/gate.php?type=settings see: https://t.co/ufgFPwJvIS

ViriBack's tweet photo. Seems a #loader for 2nd payload that is detected as #Tinynuke.

6c56b8972850ea913a0833c679bce4ba

Same pattern delivering #vertex #malware on second request:

193.233.193.]67/ItsJustACigarette.exe
->
193.233.193.]68/panel/gate.php?type=settings

see: https://t.co/ufgFPwJvIS https://t.co/SaG2TCLikW

over 4 years ago

#mikubot C2 panel #malware #tinynuke ? ref: https://t.co/SkoLaaYglD Panel: 136.144.41.]244/panel/admin/login.php ref: https://t.co/APEX0wBnmD cc: @ET_Labs @fumik0_ @malwrhunterteam @James_inthe_box

ViriBack's tweet photo. #mikubot C2 panel
#malware
#tinynuke ?

ref: https://t.co/SkoLaaYglD

Panel: 136.144.41.]244/panel/admin/login.php

ref: https://t.co/APEX0wBnmD

cc: @ET_Labs @fumik0_ @malwrhunterteam @James_inthe_box https://t.co/13iIdijF44

5

64

24

8

0

2

10

5

3

0

Gi7w0rm

@Gi7w0rm

over 4 years ago

Panel of #tinynuke variant called #mikubot found by @ViriBack. Thread includes screenshots of inside the #panel as well.

over 4 years ago

#mikubot C2 panel #malware #tinynuke ? ref: https://t.co/SkoLaaYglD Panel: 136.144.41.]244/panel/admin/login.php ref: https://t.co/APEX0wBnmD cc: @ET_Labs @fumik0_ @malwrhunterteam @James_inthe_box

5

64

24

8

0

2

0

James @James_inthe_box

over 4 years ago

@ViriBack @ET_Labs @fumik0_ @malwrhunterteam And yes, flagged as #tinynuke

0

3

0

Limor Kessem, CISM, C|ISO @iCyberFighter

over 4 years ago

#mikubot C2 panel #malware #tinynuke ? ref: https://t.co/SkoLaaYglD Panel: 136.144.41.]244/panel/admin/login.php ref: https://t.co/APEX0wBnmD cc: @ET_Labs @fumik0_ @malwrhunterteam @James_inthe_box

5

64

24

8

0

James @James_inthe_box

over 4 years ago

A fresh #tinynuke ...looks like testing: https://t.co/jX3UfvGXJh

2

21

4

2

0

Tata Communications

@tata_comm

almost 5 years ago

Encountered first in 2017, #TinyNuke, is an information-stealing #malware whose targeting has now expanded to sectors such as #manufacturing, tech, and construction. To avoid falling prey to such threats, read our weekly #ThreatAdvisoryTuesday report: https://t.co/PthIOhIMxP

tata_comm's tweet photo. Encountered first in 2017, #TinyNuke, is an information-stealing #malware whose targeting has now expanded to sectors such as #manufacturing, tech, and construction. To avoid falling prey to such threats, read our weekly #ThreatAdvisoryTuesday report: https://t.co/PthIOhIMxP https://t.co/wo6JQC6vVU

0

5

2

0

almost 5 years ago

The info-stealing #malware #TinyNuke has re-emerged in a new campaign targeting French users with invoice-themed lures in emails: https://t.co/w2Fe726eOP | #infosec #cybercrime

0

2

0

Developpez.com @Developpez

almost 5 years ago

Le #malware bancaire TinyNuke est de retour et s'implante exclusivement en #France, #TinyNuke est utilisé pour dérober des #identifiants et d'autres types d'informations #privées https://t.co/OBQeeAo1tn

0

2

4

0

Threat Intelligence @threatintel

almost 5 years ago

#ThreatProtection #TinyNuke #malware spread in recent campaigns targeting French organizations, read more: https://t.co/AKnJnDtYpZ

threatintel's tweet photo. #ThreatProtection #TinyNuke #malware spread in recent campaigns targeting French organizations, read more: https://t.co/AKnJnDtYpZ https://t.co/8h67zmWcbx

0

1

4

0

Secure Blink

@secure_blink

almost 5 years ago

TinyNuke credential-stealing #malware re-emerged to target #French entities. Details: https://t.co/XOB74TM7G0 #TinyNuke #payloads #banking #infosec #Finance #Threatfeeds #SecureBlink

secure_blink's tweet photo. TinyNuke credential-stealing #malware re-emerged to target #French entities.
Details: https://t.co/XOB74TM7G0

#TinyNuke #payloads #banking #infosec #Finance #Threatfeeds #SecureBlink https://t.co/N7rWcjWmF7

0

2

0

Qintegra Consulting @QintegraC

almost 5 years ago

🟠Identifican a un nuevo #malware llamado #TinyNuke dirigido a entidades bancarias francesas 🇫🇷. ¿Cómo funciona? 🔍 #QintegraNews #ciberseguridad @proofpoint Más detalles: 👀 https://t.co/tIdLgfCuRz

0

6

1

0

Proofpoint

@proofpoint

almost 5 years ago

Proofpoint researchers identified ongoing activity from the banking #malware #TinyNuke. The activity nearly exclusively targets French entities and organizations with operations in #France. https://t.co/ymvg86vYAu

0

2

0

Rahul Neel Mani

@rneelmani

almost 5 years ago

#TinyNuke info-stealing #malware is again attacking #French users. The campaign is to steal credentials and other private information and install additional payloads onto a compromised system. ��@dynamicCISO⁩ #girlswhocode #100daysofcode #infosec https://t.co/k1jwlfmleF

0

2

10

0

almost 5 years ago

Following that tweet https://t.co/i5IULLfaEJ I've just published my deobfuscation script to identify the packed DLL and unxor key despite the added noise. It's not perfect but good enough to make the unpacking easier. #Tinynuke https://t.co/jlNTrt7w1v

almost 5 years ago

\o/ with an ugly Ghidra script useless instruction used as noise can be removed and the unpacking and injection routine is readable again. In the red square: the unxor mechanism which remains the same

$H_Miser's tweet photo. \o/ with an ugly Ghidra script useless instruction used as noise can be removed and the unpacking and injection routine is readable again. In the red square: the unxor mechanism which remains the same https://t.co/YtfY4vWkCk$

0

3

1

0

2

8

7

3

0