#URLZONE - Twitter Hashtag

Steve YARA Synapse Miller @stvemillertime

about 7 years ago

Let's talk Global Prevalence (GP) of malware families that contain PDB paths with Users\User. Quite a few. In a cursory look, I see the following fams: #AURORA (ransomware), #DILLJUICE, #SEEDOOR, #ICEDID, #SOGU (aka #PlugX), #TRICKBOT, #URLZONE, #UPDATESEE, #XTUNNEL, and more.

1

9

1

0

Cybereason_JP_SOC @CybereasonJPSOC

about 7 years ago

@CybereasonJPSOC detects the latest #malspam campaign targeting #Japan, spreading #Bebloh / #URLZONE & #Ursnif / #Gozi , which utilizes wmic for execution. Unknown hash. SHA1:6c41d5953cae2f8c613e3da0a5372a75611db44b

CybereasonJPSOC's tweet photo. @CybereasonJPSOC detects the latest #malspam campaign targeting #Japan, spreading #Bebloh / #URLZONE & #Ursnif / #Gozi , which utilizes wmic for execution. Unknown hash.
SHA1:6c41d5953cae2f8c613e3da0a5372a75611db44b https://t.co/JupfsxjIOy

0

11

2

0

The Boardtown Blast @boardtownblast

about 7 years ago

https://t.co/qPmMccLSAf #SecurityWeek #URLZone #Ursnif #malware #stego #steganography $MSFT #PowerShell #Japan #phishing #socialengineering #threatintel #Security #INFOSEC #NETSEC #APPSEC

0

2

0

Dark Reading

@DarkReading

about 7 years ago

Persistent Threat: URLZone Turns> 10 https://t.co/63itJMp8oR @cylanceinc #whitepaper explains how and why basic #malware infection strategies, like #URLZone, remain highly effective

0

4

1

0

Cybereason_JP_SOC @CybereasonJPSOC

over 7 years ago

@CybereasonJPSOC detects the latest #malspam campaign targeting #Japan, spreading #Bebloh / #URLZONE & #Ursnif / #Gozi , which utilizes #steganography. Unknown hash. SHA1:7316be0c8696272cd26e33a2360d491ade454935 @cybereasonjp

2

7

4

0

moto_sato

@58_158_177_102

over 7 years ago

very nice malware analysis report of #URLZone / #bebloh, targeted Japan

0

9

3

0

Cybereason_JP_SOC @CybereasonJPSOC

over 7 years ago

@InQuest @DissectMalware @JosiahSecurity @InQuest - Great post and analysis! See our analysis of this campaign, where #URLZone (Bebloh) drops its final payload, which is a new undocumented #Ursnif variant, currently spotted only in Japan. https://t.co/X6Z3MoFbCX

1

2

0

RedDrip Team @RedDrip7

over 7 years ago

New approaches in #URLZone attacks specifically targeting #Japanese high-tech industry employees by using constants like currency format and LCID in decryption, steganography, etc. https://t.co/coWqmHKdmv Chinese version: https://t.co/151AWMZ7nV

RedDrip7's tweet photo. New approaches in #URLZone attacks specifically targeting #Japanese high-tech industry employees by using constants like currency format and LCID in decryption, steganography, etc.

https://t.co/coWqmHKdmv

Chinese version: https://t.co/151AWMZ7nV https://t.co/3AIhD5HUkW

1

32

19

2

0

vallejocc @vallejocc

over 7 years ago

CryptoApi in Malware - https://t.co/OjhtsLmldT - Five different malware families are analyzed to understand how malware uses Microsoft Cryptographic Library and how to implement equivalent code in Python language #MALWARE #PANDABANKER #AGENTTESLA #URLZONE #WANNACRY

0

77

44

3

0

Vitali Kremez @VK_Intel

over 7 years ago

2018-11-18: Let's Learn: #URLZone aka #Bebloh Banking #Malware Hooking Engine | Trampoline function with 32-bit relative jmp opcode = { 0xe9 } 😉 MD5: e29533e8b43ac9eccc9bc2d8b7fdbcc3 Background & solid research on this malware targeting users in 🇯🇵 Src: https://t.co/T5zq6oASjy

$VK_Intel's tweet photo. 2018-11-18: Let's Learn: #URLZone aka #Bebloh Banking #Malware Hooking Engine | Trampoline function with 32-bit relative jmp opcode = { 0xe9 } 😉 MD5: e29533e8b43ac9eccc9bc2d8b7fdbcc3 Background & solid research on this malware targeting users in 🇯🇵 Src: https://t.co/T5zq6oASjy https://t.co/Bb3oTOf5Bl$

0

31

18

0

☩MalwareMustDie

@malwaremustdie

over 7 years ago

@tmmalanalyst #URLzone (#bebloh) の検知率、現状（画像）

0

4

0

☩MalwareMustDie

@malwaremustdie

over 7 years ago

@tmmalanalyst @tmmalanalystさん、本件は #urlzone (beblohも呼ばれます)です、ここでレポートを書いたので↓ https://t.co/ojyzXUgCpK (一応古いVTウェブUIで↑レポートが綺麗に見れます)

1

8

0

TMMalAnalyst @tmmalanalyst

over 7 years ago

Nov-06,2018(JST). Japanese MalSpam attached XLS -> macro enabled -> Exe -> Infects #URLZone? #Bebloh? #Malware. Leads XLS file VT: https://t.co/t0JNfsl0VJ Download Malware file VT: https://t.co/VSU9LtJnuY

tmmalanalyst's tweet photo. Nov-06,2018(JST). Japanese MalSpam attached XLS -> macro enabled -> Exe -> Infects #URLZone? #Bebloh? #Malware.
Leads XLS file VT: https://t.co/t0JNfsl0VJ
Download Malware file VT: https://t.co/VSU9LtJnuY https://t.co/X2MAxtDCmJ

1

20

11

1

0

ᵖRͥoͤmͭaͬnͦo @tribal_sec

almost 8 years ago

#Cutwail #Spam Campaign Uses #Steganography to Distribute #URLZone https://t.co/SKrGTBzA5m #ATP #NARWHALSPIDER #Bebloh #malware #C2 #GoziISFB - #InfoSec #CyberSec #ThreatIntel #Crowdstrike report (@CrowdStrike)

0

8

5

0

TMMalAnalyst @tmmalanalyst

almost 8 years ago

OCT-24,2018(JST). Japanese MalSpam attached XLS -> macro enabled -> Exe -> Infects #URLZone? #Bebloh? #Malware. Macro enabled price down. Leads XLS file VT: https://t.co/JWgGUzDKMP Download Malware file VT: https://t.co/S0nns06PBt

tmmalanalyst's tweet photo. OCT-24,2018(JST). Japanese MalSpam attached XLS -> macro enabled -> Exe -> Infects #URLZone? #Bebloh? #Malware. Macro enabled price down.
Leads XLS file VT: https://t.co/JWgGUzDKMP
Download Malware file VT: https://t.co/S0nns06PBt https://t.co/Tu0DcyxIAy

0

15

16

0

Hacking Essentials @hacking_future

about 8 years ago

💡 Last week's most engaging news in #security 👉 Threat Spotlight: URLZone Malware Campaigns Targeting Japan https://t.co/ZECisK6edR #hacking #cybersecurity #encryption #URLZone via @cylanceinc

0

1

0

Hacking Essentials @hacking_future

about 8 years ago

💡 Last week's most engaging news in #security 👉 Threat Spotlight: URLZone Malware Campaigns Targeting Japan https://t.co/QzN12dd4A2 #hacking #cybersecurity #encryption #URLZone via @cylanceinc

0

2

0

Hacking Essentials @hacking_future

about 8 years ago

💡 Last week's most engaging news in #security 👉 Threat Spotlight: URLZone Malware Campaigns Targeting Japan https://t.co/QzN12dd4A2 #hacking #cybersecurity #encryption #URLZone via @cylanceinc

0

2

0