#wproilbask - Twitter Hashtag

over 4 years ago

#wproilbask distro has been activated again, old and new compromised sites now delivering #BazaLoader xll instead of #IcedID. C2 s/91.201.202.219/story/novel s/188.127.251.106/story/novel xll: https://t.co/OcOle3OIzE dll: https://t.co/C1egExKCeY

Tommy M (TheAnalyst) @ffforward

over 4 years ago

This #wproilbask #IcedID campaign went active again yesterday, 12 new compromised sites used as distro. I'm guessing that it's a reverse proxy because file rotation (not true hash busting) and that files were updated on the old distros too. Current downloader C2 /ovedfromasi.top

ffforward's tweet photo. This #wproilbask #IcedID campaign went active again yesterday, 12 new compromised sites used as distro. I'm guessing that it's a reverse proxy because file rotation (not true hash busting) and that files were updated on the old distros too. Current downloader C2 /ovedfromasi.top https://t.co/8yzBYMLkvD

2

29

15

4

0

1

37

15

2

0

Tommy M (TheAnalyst) @ffforward

over 4 years ago

#IcedID Downloader C2s /teredaroundcarb.top /ovedfromasi.top /reverdoome.top /olerantand.top /heyintrodu.top 159.89.171.14 @digitalocean. Related to 172.105.27.36 @linode with additional domains. Overlaps with #wproilbask xll campaign cc @executemalware @malware_traffic

JAMESWT @JAMESWT_WT

over 4 years ago

#Signed "Venezia Design SRL" #IcedID samples ✳️https://t.co/XSrTqyn3MW H/T @malwrhunterteam

2

22

11

1

0

23

13

2

0

Tommy M (TheAnalyst) @ffforward

over 4 years ago

This #wproilbask #IcedID campaign went active again yesterday, 12 new compromised sites used as distro. I'm guessing that it's a reverse proxy because file rotation (not true hash busting) and that files were updated on the old distros too. Current downloader C2 /ovedfromasi.top

Tommy M (TheAnalyst) @ffforward

over 4 years ago

Very interesting #IcedID distro. A fake @WordPress plugin "wp-roilbask" that is spoofing the "WP Rollback" plugin. They even took the time to edit the readme (where they call it roilback instead). So far I have found 18 compromised sites with this! https://t.co/FFChpiu3oe

ffforward's tweet photo. Very interesting #IcedID distro. A fake @WordPress plugin "wp-roilbask" that is spoofing the "WP Rollback" plugin. They even took the time to edit the readme (where they call it roilback instead). So far I have found 18 compromised sites with this!
https://t.co/FFChpiu3oe https://t.co/6B1V7fje1P

4

52

23

3

0

2

29

15

4

0

Top Tweets for #wproilbask

Last Seen Hashtags on Sotwe

Trends for you

Most Popular Users