Top Tweets for #malicioius

21 days ago

👿 #malicioius #opendir at fa.windows32[.]men AttackCapture URL: https://t.co/PFbtZWLHv9 Found by @malwrhunterteam https://t.co/3gFjS0eYcU What we found: - Hosted at AS13335 (Cloudflare), 104.21.33[.]159 fa.txt / tk.txt: paired one-liner stagers. reg add on HKCU...\Run pointing to smss.lnk, then msiexec /qn pulling fa.y / tk.y from Tencent COS (ap-guangzhou), chained to a conditional wscript.exe //E:JScript call on success. - Wscript invocation is preceded by a long whitespace run, pushing it off-screen in narrow terminal views. - Two identical CASSc*.html files: document.write() injecting a script tag for kiss.thwc[.]cn/index-5988.js with a Date[.]now() cache-buster, plus a stock cloudflareinsights[.]com beacon. - Captured 1.txt is a bare JScript engine directive pointing to a path under the Administrator profile; it doesn't match the C:\log\back\smss\1.txt path the stagers reference.

$Huntio's tweet photo. 👿 #malicioius #opendir at fa.windows32[.]men AttackCapture URL: https://t.co/PFbtZWLHv9 Found by @malwrhunterteam https://t.co/3gFjS0eYcU What we found: - Hosted at AS13335 (Cloudflare), 104.21.33[.]159 fa.txt / tk.txt: paired one-liner stagers. reg add on HKCU...\Run pointing to smss.lnk, then msiexec /qn pulling fa.y / tk.y from Tencent COS (ap-guangzhou), chained to a conditional wscript.exe //E:JScript call on success. - Wscript invocation is preceded by a long whitespace run, pushing it off-screen in narrow terminal views. - Two identical CASSc*.html files: document.write() injecting a script tag for kiss.thwc[.]cn/index-5988.js with a Date[.]now() cache-buster, plus a stock cloudflareinsights[.]com beacon. - Captured 1.txt is a bare JScript engine directive pointing to a path under the Administrator profile; it doesn't match the C:\log\back\smss\1.txt path the stagers reference.$

MalwareHunterTeam

@malwrhunterteam

29 days ago

Opendir: https://fa.windows32[.]men/webdav/ 😂 🤷‍♂️

11K

Anti Dolt @AntiDolt

almost 8 years ago

Several years ago I read some #phishing research by @Google explaining how they break phishing into 40 or more categories but I can not find that paper. Can anyone help? Or does anyone have an exhaustive list? #dfir #malicioius #spam #email #CyberSecurity

Top Tweets for #malicioius

Last Seen Hashtags on Sotwe

Trends for you

Most Popular Users