malwarelabnet

- A simple project to submit malware to MalwareBazaar

[malwarelabnet @malwarelabnet]

A simple project to submit malware to MalwareBazaar https://t.co/6HKWaWJN1l

[malwarelabnet @malwarelabnet]

@AvastThreatLabs That looks like FakeUpdateRU (https://t.co/HVDP8lX4v8) not ClearFake (https://t.co/hyj1AmvUNY)?

[malwarelabnet @malwarelabnet]

@BiteFre4k @pmmkowalczyk @CERT_OPL @500mk500 @arturaugustyni2 @kilijanek @abuse_ch @pr0xylife @reecdeep @JAMESWT_MHT A similar campaign with the same infra last week was email>pdf>url>url>js>url>dll

[malwarelabnet @malwarelabnet]

@k3dg3 Got a good run here: https://t.co/bDGnSF7oYM

[malwarelabnet @malwarelabnet]

@jpvigneault @executemalware This should be similar: https://t.co/QBUB1squZI

[malwarelabnet @malwarelabnet]

@pr0xylife @executemalware @ffforward @Cryptolaemus1 @ankit_anubhav @Max_Mal_ @JAMESWT_MHT @1ZRR4H @fr0s7_ @Myrtus0x0 You're fast ;) , here's another https://t.co/eDzYOQ3BXX

[malwarelabnet @malwarelabnet]

#IcedID *.document.09.09.22.xlsm > DLL 94c90a08262f15574b39eada9d0b041c > C2 > audifastinggip[.]com
Sample: https://t.co/ey6rHPC8NC

[malwarelabnet @malwarelabnet]

#IcedID Invoice-Sep-09-document-*-scan.zip > ISO > DLL cebd895e436afbb98221762821847142 > C2 > trakonicwe[.com
Sample: https://t.co/1gCqNrdDXv

[malwarelabnet @malwarelabnet]

Incoming zip>iso>bat/lnk/dll #IcedID
https://t.co/TmW3iTdDHp

[malwarelabnet @malwarelabnet]

@58_158_177_102 #ursnif payload from fierstar[.]com https://t.co/hbUVAajy4J

[malwarelabnet @malwarelabnet]

Reached the milestone of 2500 samples submitted to @abuse_ch :)

[malwarelabnet @malwarelabnet]

#IcedID password-protected zip > iso > lnk > dll
c2: bransfortrionaf[.]com
https://t.co/Xhrvd8PJJL

[malwarelabnet @malwarelabnet]

@ankit_anubhav @1ZRR4H @Max_Mal_ Didn't have time to dig, but these are probably some additional recent ones: https://t.co/4O4Us8epb3
https://t.co/zGoeISTVba

[Cryptolaemus @Cryptolaemus1]

@log4jay @pr0xylife @1ZRR4H @executemalware @ffforward @ankit_anubhav @Max_Mal_ @malwarelabnet @malware_traffic @JAMESWT_MHT @fr0s7_ Using an ISO is for bypassing defenses. It will in some cases not even be scanned by AV. In other cases this vector usage will prevent metadata being applied to the file called the Mark of the Web or MOTW. This prevents Windows from tagging it as from the web and not safe.

[malwarelabnet @malwarelabnet]

@bigmacjpg @GootLoaderSites Here's an example of the first stage: https://t.co/1LrsjLos0J

[malwarelabnet @malwarelabnet]

@InQuest payload is vidar https://t.co/B1iRBcVMmD

[malwarelabnet @malwarelabnet]

@pr0xylife @hatching_io @James_inthe_box @JRoosen @0xtornado @osipov_ar @sugimu_sec qakbot payload, obama182 https://t.co/kDEKkppFQ2

[malwarelabnet @malwarelabnet]

@1ZRR4H @fr0s7_ @pr0xylife @Max_Mal_ @Ledtech3 CAPE got a partial extract: https://t.co/AVNrMzWSJa

[malwarelabnet @malwarelabnet]

@Max_Mal_ @fr0s7_ @1ZRR4H @pr0xylife This is the DLL from inside the downloaded CAB: https://t.co/KMiGRenX2I

[malwarelabnet @malwarelabnet]

@58_158_177_102 payload is from: investoriant[.]com > ursnif/3000 https://t.co/MieVldWvSp

[malwarelabnet @malwarelabnet]

@pr0xylife @executemalware @ffforward @Cryptolaemus1 @ankit_anubhav @Max_Mal_ @fr0s7_ @1ZRR4H @JAMESWT_MHT @Myrtus0x0 xlsb sig = SETA GROUP LIMITED