#underminerek - Twitter Hashtag

almost 4 years ago

Long time no see, Underminer Exploit Kit👋 ℹ️ Targets both IE and Chrome browsers, payload is Amadey Stealer ➡️ #UnderminerEK IP: 216.250.255[.]122 ➡️ Amadey: b3e4ddc5b9947b700ee667ee1d9cadbcfca74cd00210b0bb256981221f9fe62c en[.]eredirected[.]xyz/xC0m3/

Threat_Down's tweet photo. Long time no see, Underminer Exploit Kit👋

ℹ️ Targets both IE and Chrome browsers, payload is Amadey Stealer

➡️ #UnderminerEK IP:
216.250.255[.]122

➡️ Amadey:
b3e4ddc5b9947b700ee667ee1d9cadbcfca74cd00210b0bb256981221f9fe62c
en[.]eredirected[.]xyz/xC0m3/ https://t.co/eJUIMX0hTO

0

51

21

5

0

Gen Threat Labs

@GenThreatLabs

over 4 years ago

In our latest #research, we are taking a closer look at two browser exploit kits that are experimenting with exploit chains targeting unpatched users of #Google #Chrome and other Chromium-based browsers. Read, enjoy and share. #MagnitudeEK #UnderminerEK https://t.co/RcLXfcSmAe

0

17

12

0

EKFiddle @EKFiddle

almost 5 years ago

#UnderminerEK rules updated for #FiddlerClassic and #FiddlerEverywhere https://t.co/U67qZosp1e

0

17

6

4

0

ThreatDown @Threat_Down

almost 5 years ago

🚨 #UnderminerEK exploiting Google Chrome (CVE-2021-21224) and dropping #Amadey. cc @nao_sec ℹ️ As previously reported by @AvastThreatLabs, there are now 2 active exploit kits targeting Chrome.

Threat_Down's tweet photo. 🚨 #UnderminerEK exploiting Google Chrome (CVE-2021-21224) and dropping #Amadey. cc @nao_sec

ℹ️ As previously reported by @AvastThreatLabs, there are now 2 active exploit kits targeting Chrome. https://t.co/xdurM7BvhQ

1

120

44

21

0

Gen Threat Labs

@GenThreatLabs

almost 5 years ago

Et tu, Underminer? Following #MagnitudeEK's lead, #UnderminerEK has added a Chromium exploit chain to its arsenal. A malvertising campaign is currently ongoing, targeting unpatched browsers to deliver the exploit kit's usual payload, #HiddenBee. 1/4

GenThreatLabs's tweet photo. Et tu, Underminer? Following #MagnitudeEK's lead, #UnderminerEK has added a Chromium exploit chain to its arsenal. A malvertising campaign is currently ongoing, targeting unpatched browsers to deliver the exploit kit's usual payload, #HiddenBee. 1/4 https://t.co/4wjfeez4hu

2

31

18

6

0

EKFiddle @EKFiddle

almost 5 years ago

Rules updated for #UnderminerEK for both Fiddler Classic and Fiddler Everywhere. https://t.co/U67qZosp1e

0

17

4

2

0

ThreatDown @Threat_Down

almost 5 years ago

ℹ️ #UnderminerEK dropping #Amadey v.2.71 169.197.142[.]162/os.zip 7a7a128a51a5e153c55481518bdffe67093e94d99845531918ff50875a13e5fe C2: web.jsonpost[.]xyz 169.197.142[.]162

Threat_Down's tweet photo. ℹ️ #UnderminerEK dropping #Amadey v.2.71

169.197.142[.]162/os.zip
7a7a128a51a5e153c55481518bdffe67093e94d99845531918ff50875a13e5fe

C2:
web.jsonpost[.]xyz
169.197.142[.]162 https://t.co/Mc1qWim1SJ

1

22

16

3

0

Gen Threat Labs

@GenThreatLabs

about 5 years ago

We’ve found #UnderminerEK has the following modules and can exploit a whopping 11 different vulnerabilities including #PrintNightmare.

GenThreatLabs's tweet photo. We’ve found #UnderminerEK has the following modules and can exploit a whopping 11 different vulnerabilities including #PrintNightmare. https://t.co/q2pH06i0px

nao_sec @nao_sec

about 5 years ago

#UnderminerEK is back! Now dropping #Amadey (CC: @malware_traffic, @jeromesegura) https://t.co/DeCQ3ZXOEp

1

49

17

2

0

1

37

17

3

0

nao_sec @nao_sec

about 5 years ago

#UnderminerEK is back! Now dropping #Amadey (CC: @malware_traffic, @jeromesegura) https://t.co/DeCQ3ZXOEp

1

49

17

2

0

nao_sec @nao_sec

over 5 years ago

#UnderminerEK is back!?!? (CC: @malware_traffic, @jeromesegura) https://t.co/rWE1IOl417

1

28

11

0

David Jursa

@david_jursa

almost 6 years ago

"Checking your browser before accessing" #UnderminerEK #Malvertising node: antiadblocksystems[.]com #TDS: 148.163.12[.]101 Landing page: 213.159.203[.]207 https://t.co/FMIvQjSuAd cc @nao_sec @EKFiddle @FaLconIntel

david_jursa's tweet photo. "Checking your browser before accessing" #UnderminerEK

#Malvertising node: antiadblocksystems[.]com
#TDS: 148.163.12[.]101
Landing page: 213.159.203[.]207

https://t.co/FMIvQjSuAd

cc @nao_sec @EKFiddle @FaLconIntel https://t.co/djMUctiUAJ

1

21

11

2

0

nao_sec @nao_sec

about 6 years ago

#UnderminerEK https://t.co/yYXpzQRkTB

0

11

6

0

ThreatDown @Threat_Down

about 6 years ago

Malvertising into #UnderminerEK. 🚨 IOCs 🚨 commercialpromotion[.]live 148.163.12[.]110

0

11

3

1

0

nao_sec @nao_sec

over 6 years ago

Hello again! #UnderminerEK

1

24

6

2

0

FaLcon Intelligence @FaLconIntel

over 6 years ago

2020-04-11 #Malvertising -> #UnderminerEK -> #HiddenBee(#HiddenMelliferaBee) Chinese #Miner Example https://t.co/9PKbgmOgJh Reference https://t.co/iqVzzR44PX https://t.co/rqGg7Kzsd7

FaLconIntel's tweet photo. 2020-04-11
#Malvertising -> #UnderminerEK -> #HiddenBee(#HiddenMelliferaBee) Chinese #Miner

Example
https://t.co/9PKbgmOgJh

Reference
https://t.co/iqVzzR44PX
https://t.co/rqGg7Kzsd7 https://t.co/Klz5z5wU58

1

6

4

0

FaLcon Intelligence @FaLconIntel

over 6 years ago

2020-02-16 #Malvertising -> #UnderminerEK -> #HiddenMelliferaBee Example: https://t.co/ZslkO6j3qu

0

4

2

0

David Jursa

@david_jursa

over 6 years ago

#UnderminerEK via #Malwaretising , analysis https://t.co/lB8vkwq09v

0

9

5

0

David Jursa

@david_jursa

almost 7 years ago

#UnderminerEK via #Malvertising active in Japan

0

9

4

0

ThreatDown @Threat_Down

almost 7 years ago

Fall 2019 Exploit Kit activity review by @jeromesegura. Featuring: ➡️#SpelevoEK ➡️#FalloutEK ➡️#MagnitudeEK ➡️#RIGEK ➡️#GrandSoftEK ➡️#UnderminerEK ➡️#KaiXinEK ➡️#PurplefoxEK ➡️#CapesandEK https://t.co/5ngisC4yqN

0

39

33

5

0