Top Tweets for #solarmarker
#SolarMarker infection leading to #StellarInjector and #SolarPhantom π How you liking those fancy names π€£
https://t.co/jYNDI4Xjsy
@SquiblydooBlog #SolarMarker Added 2 samples
MD5
a3702ee26db2a712bf1cc35e2361ce93
98b925951c204782c9ddfeca3570a11d
https://t.co/1bsNFYf5xP
#SolarMarker RAT
#Signed "Plus 5 XP Corporation"
#ImpostorCertificate
Decoy: Show('The code execution cannot proceed because MSVCR120.dll was not found. Reinstalling the program may fix this problem.'
C2: 68.233.238.123
More links in comment
VT: https://t.co/PCLcymqE8I
The full PDF is a great long-term overview of #SolarMarker as it has been reported and a look at its current infrastructure.
π π¨- New @RecordedFuture report! This report, from my colleague @JulianVoeg, leverages Recorded Future Network Intelligence to examine the layered infrastructure and evasion techniques employed by SolarMarker. And yes, there are IOCs! https://t.co/C4n8ugw9bm
Our latest post dives into SolarMarker, a sophisticated information-stealing malware. Hunt is currently tracking 20 tier 1 servers and has uncovered interesting connections, including shared SSH keys and domains impersonating large financial organizations. https://t.co/GvSAXUOgPn
Image is from #malcat's Kesakode service.
SolarMarker's DLL's obfuscation doesn't seem to help it much here. 1800+ hits oof
#SolarMarker #trojan
#signed #ImpostorCert
C2: 68.233.238.123
VT: https://t.co/0UTqScPWEH
MB: https://t.co/Sm9Kv77OHg
Backdoor: https://t.co/OirToRpRAB
Finally seeing some post-compromise from #SolarMarker, it's been awhile π
Kudos to @bohansec for retrieving the sample and logs.
π Initial check-in: 146.70.80.]83
π€ Backdoor C2: 2.58.15.]118
π Observed signature: Ameri Mode Inc. (revoked)
π» C2 for the stealer and hVNC: 139.60.161.]78
π Samples in the wild:
9fcdb329122b918110be82e8040386798f1a0c28ad1d103bf06e5df6ec820aca
873f57835567b14b99f1ebeda537fdbd2437593455239c97476485d0a3fd8716
@esthreat
![PandaRE__'s tweet photo. Finally seeing some post-compromise from #SolarMarker, it's been awhile π
Kudos to @bohansec for retrieving the sample and logs.
π Initial check-in: 146.70.80.]83
π€ Backdoor C2: 2.58.15.]118
π Observed signature: Ameri Mode Inc. (revoked)
π» C2 for the stealer and hVNC: 139.60.161.]78
π Samples in the wild:
9fcdb329122b918110be82e8040386798f1a0c28ad1d103bf06e5df6ec820aca
873f57835567b14b99f1ebeda537fdbd2437593455239c97476485d0a3fd8716
@esthreat](https://pbs.twimg.com/media/GOPHbXxW0AAi4p5.jpg)
Today we are releasing new research exploring #SolarMarkerβs tactics and multi-tiered #infrastructure using various methods, including Network Intelligence. (0/6)
https://t.co/dAiijoIJqt
It is common for malware to be signed with code signing certificates.
How is this possible? Impostors receive the cert directly and sign malware.
In this blog-post, we look at 100 certs used by #Solarmarker malware to learn more.
https://t.co/TzxQyzOUEG
#SolarMarker Infostealer
#Signed: "Table Ronde 1155 Inc."
This marks 100 Authenticode Certificates for SolarMarker. Watch for our blog-post looking back over these 100 certs. Image is a sneak peak.
MB: https://t.co/0uHGZUeQjM
Backdoor: https://t.co/bNUdTUybHT
@JAMESWT_MHT
#solarmarker
Loader: https://t.co/KJTDMcu6x9
DLL: https://t.co/zE2lAv2IYF
#solarmarker
Loader: https://t.co/KJTDMcu6x9
DLL: https://t.co/zE2lAv2IYF
For my extraction tool, I added an option for gzip decompression. This latest version of #solarmarker has an additional layer using gzip compression to get to the DLL. https://t.co/6AFk2miG2g
Low detection #SolarMarker
#Signed #EV "TRACK PROJECT SP Z O O"
Decoy error message:
Show('The code execution cannot proceed because MSVCR120.dll was not found. Reinstalling the program may fix this problem.', 'System Error', 0, 16);
MB: https://t.co/fJvSO5riAh
@JAMESWT_MHT
#solarmarker
Loader: https://t.co/h2u8rOVbut
DLL: https://t.co/zgAaaPYABn
#solarmarker
Loader: https://t.co/h2u8rOVbut
DLL: https://t.co/zgAaaPYABn
#ThreatProtection #SolarMarker #malware campaign adapts with PyInstaller for obfuscation, read more about Symantec's protection: https://t.co/BQTyBiAcBz
2/70 - Low Detection #SolarMarker
#Signed #EV "Heart Craft Brewery s. r. o."
Ah yeah, my favorite craft breweries make the best binaries too.
MSI manual as decoy.
VT: https://t.co/Y8bChtqQe4
MB: https://t.co/wHz5yXBy5f
Backdoor: https://t.co/QdjvDTdZRj
@JAMESWT_MHT
Updated my debloat (https://t.co/yv0LBdVRdO) tool to handle the inflation technique used in this sample.
Thanks, #SolarMarker, for pointing out that I missed this use case. It is now solved.
#SolarMarker malware
Signed: #EV "HOLDING MEDICAL GROUP KATOWICE SP Z O O"
New PyInstaller version
Dishwasher manual as a decoy, installs backdoor
VT: https://t.co/VSSo1mkNV0
MB: https://t.co/iptdlSYTQu
Backdoor: https://t.co/Bwr96eIZQL
@JAMESWT_MHT
#SolarMarker malware
Signed: #EV "HOLDING MEDICAL GROUP KATOWICE SP Z O O"
New PyInstaller version
Dishwasher manual as a decoy, installs backdoor
VT: https://t.co/VSSo1mkNV0
MB: https://t.co/iptdlSYTQu
Backdoor: https://t.co/Bwr96eIZQL
@JAMESWT_MHT
Last Seen Hashtags on Sotwe
blacktaboo
anxiouspanda((((*))))* filter:videos
Seen from Turkey
publicsex
Seen from Germany
incestaboo
tantesange
Seen from Indonesia
εε
Seen from Italy
minichatt(*)*******filter:videos
Seen from United Arab Emirates
anxiouspandaa
Seen from Germany
raddoren
Seen from United States
sleep incest
Seen from France
Most Popular Users
Elon Musk 
@elonmusk
241.5M followers
Barack Obama
@barackobama
118.8M followers
Cristiano Ronaldo
@cristiano
114.5M followers
Donald J. Trump
@realdonaldtrump
111.8M followers
Narendra Modi
@narendramodi
107.1M followers
Rihanna
@rihanna
98.7M followers
NASA
@nasa
92.3M followers
Justin Bieber
@justinbieber
91.8M followers
KATY PERRY
@katyperry
90M followers
Taylor Swift
@taylorswift13
84M followers
Lady Gaga
@ladygaga
75.5M followers
Virat Kohli
@imvkohli
73.5M followers
Kim Kardashian
@kimkardashian
70.9M followers
YouTube
@youtube
68.8M followers
Neymar Jr
@neymarjr
66.5M followers
Bill Gates
@billgates
65.3M followers
Selena Gomez
@selenagomez
63.1M followers
The Ellen Show
@theellenshow
62.2M followers
CNN
@cnn
61.7M followers
X
@x
60.7M followers