Naoki Takayama

A malware analyst, digital forensic investigator, and threat researcher. Conference speaker at BSides Tokyo, JSAC, and VB.

[Naoki Takayama @mopisec]

Related sample uploaded from China:
b892981af3ca699d13f07ddcf75c2df62c1543b071278b4cc1ac0993d8b9dc01 (Same C2)

[Naoki Takayama @mopisec]

WindowsTelemetry[.]zip uploaded from Japan.
SHA256: 0fb45474ca58bd67220f79b0e3b07f940270c371ba56e27d3e2b99bf4dbb5174

Sideloaded DLL "VERSION.dll" executes payload that deploys PoisonX RAT and vulnerable driver (EneIo64.sys).

C2: 101.32.190[.]202:8080
#malware #iocs

[Virus Bulletin @virusbtn]

IIJ's Naoki Takayama analyses SLOTAGENT, a newly identified multifunctional RAT found in a ZIP uploaded from Japan to a public malware repository. The malware can execute BOF-format payloads, and implements anti-forensic features including time stomping. https://t.co/ZZ8qpefZqF

[IIJ-SECT @IIJSECT]

BOFの実行などに対応した新たなマルウェアSLOTAGENT | IIJ Security Diary https://t.co/pPV7EiSl8C @IIJSECT

[JPCERT/CC @jpcert_en]

Recorded videos from #JSAC2026 are now available on Youtube. ^YU
https://t.co/gMlZquEugH

[Analysis Center @jpcert_ac]

#JSAC2026 の講演動画を公開いたしました。
当日ご参加いただけなかった方や、内容を改めて確認されたい方はぜひご視聴ください。^AS
https://t.co/qr9UoJQA5S

[Naoki Takayama @mopisec]

Correction: The payload will be executed only if the USERDNSDOMAIN variable **starts with** "maz", "minaz", "tib", or "geel.maz".

[Naoki Takayama @mopisec]

Found multi-stage Cobalt Strike Beacon Loader. The payload will be executed only if the USERDNSDOMAIN variable is "maz", "minaz", "tib", or "geel.maz".

SHA256: 4078905b6f1810a913a7204c320a31bce644376a72ebe1f54cf324db9afa3ecd
C2: cloudmanagernetapp[.]nl:443

#malware #iocs

[Naoki Takayama @mopisec]

👀

[Naoki Takayama @mopisec]

C2: www[.]neurosurgeryx[.]com:443
#PlugX

[Szabolcs Schmidt @smica83]

'ЕС-аас Хөндөж болзошгүй асуудал.zip' seen from Mongolia @abuse_ch
Looks like #PlugX
https://t.co/SIOmjEdOoQ
Source from:
hxxps://loadmn.z13.web(.)core(.)windows(.)net/ЕС-аас Хөндөж болзошгүй асуудал.zip

[Naoki Takayama @mopisec]

@kienbigmummy I haven't developed formal configuration extractor yet, but I shared analysis result of config's structure & C2 address's decryption routine in my company's blog post (unfortunately not available in English, so please machine translate it).
https://t.co/qO26v1yUnL

[Naoki Takayama @mopisec]

Eraser.dat #PlugX
SHA256: c5267fefaac1764eba5f42681eb216f146b7d18fcbf546275d33e70cb36fdfba
C2: coastallasercompany[.]com:443

Reference: https://t.co/qO26v1yUnL

[m4n0w4r @kienbigmummy]

#APT
#MustangPanda
#PlugX

[Naoki Takayama @mopisec]

@58_158_177_102 すみません、公開作業時のミスでアクセスできない状態になっていました。
修正したので、開けるようになったと思います。

[IIJ-SECT @IIJSECT]

Dropbox APIを使用するKimsukyのマルウェア | IIJ Security Diary https://t.co/N2MsgJ0SmX @IIJSECT

[Naoki Takayama @mopisec]

@byrne_emmy12099 Great finding. Another (possible) related sample:
a762d65c0d6f6345541485aeef35a3b331b1f69bace8452cf55026b301e963bd

[Michael R @nahamike01]

UNC6384, Mustang Panda, and RedDelta have a lot in common: overlaps in tooling, targeting, and C2 procurement.

This research identifies an active PlugX C2 cluster staged on a single ASN for a short window before being obscured by a proxy.

Full analysis https://t.co/DM8ehqkgwo

[LAB52 @LAB52io]

Check out our new post!!! PlugX Meeting Invitation via MSBuild and GDATA https://t.co/mqbdjlIegu

[IIJ-SECT @IIJSECT]

STATICPLUGINによって実行される最新のPlugX亜種 | IIJ Security Diary https://t.co/pKBVNVUTxr @IIJSECT

[JPCERTコーディネーションセンター @jpcert]

ブログ JPCERT/CC Eyes「JSAC2026 開催レポート～DAY 1～」を公開。1月21日～23日に開催したJSAC2026の様子を3回に分けて紹介します。第1回は、DAY 1 Main Trackの講演についてです。^KI
https://t.co/0ta2uzJBBS

[Naoki Takayama @mopisec]

It seems the config is not only RC4 encrypted but also partially encoded now. Very interesting.

SHA256 (AVKTray.dat - Payload File): 4ee6bd5a5701853402a08640f531e1be937d0c1f497e3fc255c9ea3e943ecf42
C2: 108.165.255[.]97:443

#PlugX

[Szabolcs Schmidt @smica83]

Confirmed #PlugX sample seen from Hungary again @abuse_ch
'Avk.dll'
https://t.co/rEg0Qhm35Q