OpcodeIntel

Independent Threat & Malware Researcher

[OpcodeIntel @OpcodeIntel]

#Russian-speaking threat actor targets #Bahrain via a fake "Alert - Bahrain" Civil Defence app to distribute a malicious Android dropper.
9694294addbe58be93ddbb6cabc499ce
58330aaf1f533e9fe03b6355c60347b4
@skocherhan @malwrhunterteam @smica83
#ThreatIntel #Android #Malware

[OpcodeIntel @OpcodeIntel]

@smica83 @skocherhan @malwrhunterteam Dropper:

[OpcodeIntel @OpcodeIntel]

Discovered a GitHub repo hosting 20+ mParivahan-themed Android apps, including droppers using .enc payloads to build and deploy the final APK.

Github - weddingcard1910

@smica83 @skocherhan @malwrhunterteam

#Malware #ThreatIntel

[OpcodeIntel @OpcodeIntel]

@malwrhunterteam @skocherhan C2: https://ptnrmat[.]xyz/police/mydata.php

#Android #malware scans documents, images, WhatsApp media, contacts & device info, then uploads them to a remote C2

[OpcodeIntel @OpcodeIntel]

Fake Google Play lure impersonating Pakistan’s Police Khidmat Markaz, distributing Android malware targeting #Pakistan 😂
police-khidmat-markaz-online-verification-registration[.pages[.dev
6bbff1c69b203a8b4fec033f83d2f4b7

#Malware #ThreatIntel

[Urlyze @urlyzeio]

#ClickFix

1⃣ 📷 Caught a live #ClickFix lure: hxxps://vimcolors[.]com/ Looks like a routine Cloudflare "human check." It isn't. On load it copies a hidden PowerShell one-liner to your clipboard and social-engineers you into running it yourself. 📷 🧵

2⃣ The "verification steps" = Win+X → Terminal (I) → Ctrl+V → Enter. Clipboard payload

🔗Urlyze Report: https://t.co/OkZgse5pUt

[OpcodeIntel @OpcodeIntel]

@skocherhan @malwrhunterteam @smica83 Also: https://github[.]com/Make-Mkv-Software

[OpcodeIntel @OpcodeIntel]

#Russian-speaking threat actors are leveraging GitHub to distribute stealers disguised as legitimate tools like HxD.

github[.]com/hxd-tool

@skocherhan @malwrhunterteam @smica83

#ThreatIntel #Malware

[OpcodeIntel @OpcodeIntel]

5.181.3.108:8080
synastraai[.com
f3bec769784f0185750b526e6a4eeafdff027601be747c296f56c2033da7730c

@skocherhan @malwrhunterteam @smica83 @Huntio
#Malware #opendir

[OpcodeIntel @OpcodeIntel]

@skocherhan @malwrhunterteam @smica83 Continuation

[OpcodeIntel @OpcodeIntel]

@skocherhan @IndianCERT @Malwarehunterr @patialavii @GoDaddy @GoDaddyHelp Whois:

SM Tech Support
Tamil Nadu
IN

[Bitshadow @fbgwls245]

New Ethics #Ransomware Leak Site

4 Victims

/ethics67vxjomvlcugjovv4fc3g6ru5tpwotg533d4j3uf2btmnndead[.]onion

[OpcodeIntel @OpcodeIntel]

FLocker (.FLOCK) Ransomware

055fff8f18cd134f35ba49aada815e704a75ca8b3f3cbf30a3d26d2bb5fe62fc

@skocherhan @malwrhunterteam @smica83

#Ransomware #Malware

[OpcodeIntel @OpcodeIntel]

@JoenOwek @malwrhunterteam @smica83 @skocherhan Thanks for clarifying. I analyzed llst.ps1 and identified it as malicious.

e344f19dd0bd71e8c016d6848563122f96fc5dba426e176b3ba0a7a39aa1a321

[OpcodeIntel @OpcodeIntel]

104.236.230.184:8888
@malwrhunterteam @smica83 @skocherhan

#opendir #Malware

[OpcodeIntel @OpcodeIntel]

65.20.106.101:8080/cloud/

@skocherhan @malwrhunterteam @smica83

#opendir #malware

[OpcodeIntel @OpcodeIntel]

@etugenio https://t.co/eTJKfMSvbO

[OpcodeIntel @OpcodeIntel]

43[.]156[.]228[.]149:8888
141079d8a6328c9764c1c74934fb6c9d5c9db12cb558e2da827dc45da7dd45f5
#opendir #ThreatIntel #Malware
@smica83 @malwrhunterteam @skocherhan @Huntio

[etugen.io @etugenio]

Lnk Malware AFC_Security_Report_2026.pdf.lnk
xyzblue[.]dpdns[.]org
43[.]156.228.149

Platform: https://t.co/DDS4VYKyT5
#malware #clickfix #lnk

[Hido Cohen @0xhido]

@OpcodeIntel @Nec_Money @malwrhunterteam @skocherhan @smica83 Fake Nec Money APK

getUserDetails[.]php → full user DB/plaintext passwords
upload_card[.]php → PAN/CVV/billing data
verifyAccount[.]php → ID docs
firebase[.]php → OTP relay
getintensive[.]php → kill switch/APK update

C2: clientproject[.]fun/taptap212/TAkaPay/

[Hido Cohen @0xhido]

@OpcodeIntel @smica83 @malwrhunterteam @skocherhan @Huntio .lnk → .ps (AMSI bypass) → shellcode → Meterpreter reverse_https “long” URI -> 43[.]156[.]228[.]149:443

/KYqg4a7pUHNdcVxzNwXy_Q5N-NvQrvg3EYhVhmdLDSBTkeYfHfKVuBNWLw9hmdx067nQLz6-ejJWYilZ1nlIJzYbuRlsMtVSajYwMAIaV50nGBC

Payload UID: 298aa0e1aee95073
Built: 2026-08-06T16:00:12Z

[Anurag @Malwarehunterr]

Same PowerShell is hosted on below IP:

hxxp://89.125.255[.]236/ and its downloading https://t.co/QlmSbYEsEy from
hxxp://drvupdates[.]com/meetsdrv.zip

#Malware #ThreatIntel #ThreatHunting
@malwrhunterteam
@500mk500
@skocherhan
@JAMESWT_WT
@OpcodeIntel
@James_inthe_box