Top Tweets for #WormsWeeklyIOC
So I want to lose some words on the lack of #WormsWeeklyIoC content over the last weeks.
As you might have noticed I have been relatively absent from sharing Indicators, which is mainly caused by ongoing work on refining the backend processes.
1/18
#WormsWeeklyIoC has been released (I guess?)
During the last week I uploaded over 12000 new #IoC to #Threatfox. I also added even more to my Github Repo.
A huge shoutout goes to @500mk500 who helped me check every single list for #FPs.
1/3
#IoC
I am currently improving my #WormsWeeklyIoC scripts.
Now, I will clean up known fps as well as possible.
Any further suggestions welcome :)
To improve false-positive detection in my #WormsWeeklyIoC and also because there is a lot going on behind the scenes, this/last week's IoC collections will be skipped.
I will try to tackle false positives by setting up a private #MISP instance.
Also, one more exam on Wednesday
#WormsWeeklyIoC have been released!
This week with some new guests:
#AsyncRAT
#BitRat
#QuasarRAT
#RemcosRAT
#XWorm
and the usual
#Rhadamanthys
#Raccoonv2/#RecordBreaker
#DBatLoader / #ModiLoader
#Amadey
6530 new indicators (ca 2020-2023) added to #ThreatFox
Links below:
1/2
#WormsWeeklyIoC have been shared.
New indicators for:
#SystemBC
#Racconv2,#RecordBreaker
#Amadey
#Rhadamanthys
#RedLine
#DBatLoader / #ModiLoader
#Prometei
have been shared via #Threatfox, #OTXAlienvault
and #Github. All links below!
#botnet #ioc #stealer #sharingiscaring
A personal note: #WormsWeeklyIoC will continue around 31.08.2023 as I will take 3 weeks of well-deserved holidays. However, the IoC for these weeks will be shared afterward.
Thanks to @ValidinLLC for providing me with free infrastructure for my hunts.
5/5
#WormsWeeklyIoC have been shared.
This week more than 7000 #IoC have been collected and shared via #Github, #Threatfox, and #OTXAlienvault. Included are #SystemBC, #RedLine, #Amadey #botnet, #raccoonv2/#RecordBreaker and #Prometei.
Check them out:
https://t.co/ZhIxozCSQC
1/5
#WormsWeeklyIoC have been released.
This week with #IoC for #raccoon_v2 / #RecordBreaker, #Amadey #botnet, and a collection of payload URLs for #ModiLoader / #DBatLoader.
You can find them as always in my Github:
hxxps://github.com/Gi7w0rm/MalwareConfigLists/tree/main
1/4
#WormsWeeklyIoC have been released. This week features #RecordBreaker/#racconv2, #Amadey #Botnet, and a rework of my #Rhadamanthys #Stealer #IoC gathering.
Find all indicators here:
https://t.co/C3iIY6Q9fr
1/2
#WormsWeeklyIoC have returned after a week of absence due to my exams.
This week with new indicators for #Amadey #Botnet, #raccoonv2 / #RecordBreaker and #SmokeLoader.
Find them in this repo:
https://t.co/ZhIxozCl14
1/3
I will postpone #WormsWeeklyIoC this week. After recovering from one week of fever and throat pain, I am now faced with 10 days of extensive learning to struggle through some upcoming exams and deadlines in university.
#WormsWeeklyIoC have been shared.
This week with #IoC for #Amadey, #AgentTesla, and #raccoon_v2/#RecordBreaker.
I encourage everyone to check the additional_payloads section of raccoon (49 not prior known to #Urlhaus) and the new #AgentTesla section!
https://t.co/C3iIY6Q9fr
#WormsWeeklyIoC have been released.
A day late because behind the scenes I am currently involved in a soon-to-be LEA investigation.
You can find all released indicators on my Github as always:
https://t.co/ZhIxozCl14
1/2
#WormsWeeklyIOC have been shared.
Uploaded new indicators for #Amadey, #Rhadamanthys, #Raccoonv2/#RecordBreaker, and additional payloads loaded via #RecordBreaker to my Github!
https://t.co/C3iIY6Q9fr
1/4
#WormsWeeklyIOC have been shared.
Uploaded new indicators for #Amadey, #Rhadamanthys, #DynamicRAT, #Raccoonv2/#RecordBreaker, and additional payloads loaded via #RecordBreaker to my Github!
https://t.co/ZhIxozCl14
1/4
#WormsWeeklyIOC have been shared.
Uploaded new indicators for #Amadey, #Rhadamanthys, #SmokeLoader, #Raccoonv2/#RecordBreaker, and additional payloads loaded via #RecordBreaker to my Github!
https://t.co/3bApbVLK4T
#OTX sadly was not willing to take my #IoC today.
SmokeLoader #IoC are back as to the changes announced last week :) This is also why I am releasing the IoC late today, I just had to see what Smoke had to offer so I was waiting for the tools to finish ^^
70 previously unknown IoC released on #ThreatFox during the last 2 days (#Daam Android Sample hashes included), and several new download URLs on #URLhaus :)
A special shoutout goes to @ValidinLLC for their constant help collecting #RacoonStealer #IoC.
Several new #Raccoon Ranges were added this week.
Stay safe out there
Cheers <3
#WormsWeeklyIOC have been shared. Sadly this is a sad week in terms of numbers. This is caused by the following reasons:
- Aurora is defunct. This week's scan shows 1 remaining C2. The scanner is now discontinued.
- Raccoonv2 has made changes to its infrastructure. I do believe this has to do with the increased attention to Raccoon by a member of the community which probably caused them to get wet pants. Proxy numbers are continuously falling in my telemetry over the last weeks too as they are blocking more and more IPs.
- SmokeLoader has started to ban my VPN ranges. I have not received any got logs during the last week. This will be fixed soon.
- Last but not least I have been super involved in university the last 2 weeks which has led to very reduced activity on my part. Here's hoping that this will be improving again once I have submitted my term paper on Sunday.
Indicators can be found here:
https://t.co/3bApbVLK4Tโฆ
Additionally, new submits have been made to my #OTX #Alienvault profile: https://t.co/v4Hntjy5hfโฆ
A special shoutout as always to
@ValidinLLC for their constant help with collecting #RacoonStealer #IoC.
Cheers, you all <3
P.s. If you want to support me with getting new IP addresses for scanning, please send some money to my https://t.co/5WgDqr0K8p
Last Seen Hashtags on Sotwe
brosis()() +filter:native_video
Seen from United States
ankaratravestileri
Seen from Turkey
LoveDollToyFactory
omegleleak
Seen from Netherlands
FemaleInfertility
Seen from United States
officefuck
Seen from Pakistan
ๆฟๆฒปๅฎถใๅใใฆ
Seen from Ecuador
brosis()***** +filter:native_video
Seen from Singapore
่ใฒใ
Seen from United States
็ๅฅณ
Seen from Germany
Most Popular Users
Elon Musk 
@elonmusk
241.6M followers
Barack Obama
@barackobama
119M followers
Cristiano Ronaldo
@cristiano
114.2M followers
Donald J. Trump
@realdonaldtrump
111.8M followers
Narendra Modi
@narendramodi
107.2M followers
Rihanna
@rihanna
98.7M followers
NASA
@nasa
92.4M followers
Justin Bieber
@justinbieber
91.8M followers
KATY PERRY
@katyperry
89.9M followers
Taylor Swift
@taylorswift13
83.8M followers
Lady Gaga
@ladygaga
75.3M followers
Virat Kohli
@imvkohli
73.1M followers
Kim Kardashian
@kimkardashian
70.8M followers
YouTube
@youtube
68.8M followers
Neymar Jr
@neymarjr
66.1M followers
Bill Gates
@billgates
65M followers
Selena Gomez
@selenagomez
62.9M followers
The Ellen Show
@theellenshow
62.3M followers
CNN
@cnn
61.8M followers
X
@x
60.7M followers