Top Tweets for #sovietZloader
Daily #zloader #sovietZloader via s/puredoc2020.top/get.php. Domains in the config doesn't resolve
XLS: https://t.co/PHyMdVBbpO
DLL: https://t.co/3XqiCB26gC
#Signed DPPBWSYCVRETPQECOD
cc @malwrhunterteam @executemalware @James_inthe_box @JAMESWT_MHT @lazyactivist192 @Arkbird_SOLG
Daily #zloader #sovietZloader download domain will most likely be /secureinfo.top. Not fully deployed yet.
cc @malwrhunterteam @JAMESWT_MHT @James_inthe_box @lazyactivist192 @executemalware @JRoosen
Friday night run of #zloader #sovietZloader /download24.top and /getfiles2020.top weaponized on new IP 8.208.80.144.
XLS: https://t.co/HPai0hikvA
DLL: https://t.co/gG7UbMuHm3
#Signed TKEDKFNSRPUKQOTGWF
C2 /uookqihwdid.ru
@Office365 now quarantines these 👏@Pawp81 @GossiTheDog
There is also another #zloader #sovietzloader domain for today: /getfiles2020.top. Not weaponized now, don't know if it has or will be later today or tomorrow.
@500mk500 @malwrhunterteam @James_inthe_box @JAMESWT_MHT @Arkbird_SOLG @lazyactivist192 @executemalware Yeah I have covered most of those under the #sovietZloader tag.
Daily domain for #zloader #sovietZloader will be /purefile24.top. Responding but usual URL not weaponized (yet).
cc @malwrhunterteam @James_inthe_box @JAMESWT_MHT @Arkbird_SOLG @lazyactivist192 @executemalware
Samples detected as #CobaltStrike and/or #CozyDuke on VT communicating with 8.209.124.215 @alibaba_cloud, same IP used for #zloader #sovietZloader downloads. https://t.co/KJW5shwWgu
sovietZloader collection: https://t.co/qKioZOrlkk
cc @James_inthe_box @JAMESWT_MHT @VK_Intel
Daily #zloader #sovietZloader, s/download24.top/download.php as seen yesterday.
Subject: Your boss is going to be pissed off
XLS: https://t.co/Z39og6sw14
DLL: https://t.co/Wuz1m2Tpdg
#Signed AHYKURGXLQFNQZUZJZ
C2 /kochamkkkras.ru
@Office365 w. @MSThreatProtect delivers to inbox.
Daily #zloader #sovietZloader downloads from /download24.top/download.php, lure unknown.
XLS: https://t.co/xLuw7ybLF1
DLL: https://t.co/O6wwa7Tttu
New C2: https://t.co/GlPKRM19Ew
#signed AHYKURGXLQFNQZUZJZ
@Pawp81 @malwrhunterteam @James_inthe_box @JAMESWT_MHT @lazyactivist192 @malware_traffic @executemalware @VK_Intel @GossiTheDog Yes, as per above yesterdays #sovietZloader was sent to inbox and admin submissions said clean. #BazaLoader today just seems to be considered as spam, and just sending those to junk isn't good enough considering that they eventually leads to Ryuk ransomware.
#zloader #sovietZloader from last night via google docs > /donwloadfiles.top
XLS: https://t.co/tak9IMnzQe
DLL: https://t.co/h95biKJo6g
#Signed LRHOEUSYOEOXISTPKZ
C2 still /fqnceas.su but lot's of other domains in the config.
Mails not blocked by @MSThreatProtect @MsftSecIntel
Daily #zloader via google docs, today #IRS themed
⏬https://t.co/36GAuMUoK7
XLS https://t.co/iBvOQJ8kA9
DLL https://t.co/VeQqK7C9fU
#signed IHUSKLPESWNLWBJTXN
C2 /privatefiles24.top /fqnceas.su
I'm dubbing these #sovietZloader due to the constant use of .su
Last Seen Hashtags on Sotwe
Most Popular Users
Elon Musk 
@elonmusk
241.1M followers
Barack Obama
@barackobama
119.1M followers
Cristiano Ronaldo
@cristiano
112.6M followers
Donald J. Trump
@realdonaldtrump
111.8M followers
Narendra Modi
@narendramodi
107.1M followers
Rihanna
@rihanna
98.2M followers
NASA
@nasa
92.2M followers
Justin Bieber
@justinbieber
91.4M followers
KATY PERRY
@katyperry
88.8M followers
Taylor Swift
@taylorswift13
82.7M followers
Lady Gaga
@ladygaga
74.2M followers
Virat Kohli
@imvkohli
71.7M followers
Kim Kardashian
@kimkardashian
70.3M followers
YouTube
@youtube
68.7M followers
Neymar Jr
@neymarjr
64.6M followers
Bill Gates
@billgates
64.5M followers
The Ellen Show
@theellenshow
62.4M followers
Selena Gomez
@selenagomez
61.9M followers
CNN
@cnn
61.8M followers
X
@x
60.8M followers