OpcodeIntel

Independent Threat & Malware Researcher

[OpcodeIntel @OpcodeIntel]

#Russian-speaking threat actor targets #Bahrain via a fake "Alert - Bahrain" Civil Defence app to distribute a malicious Android dropper.
9694294addbe58be93ddbb6cabc499ce
58330aaf1f533e9fe03b6355c60347b4
@skocherhan @malwrhunterteam @smica83
#ThreatIntel #Android #Malware

[Bitshadow @fbgwls245]

New Ethics #Ransomware Leak Site

4 Victims

/ethics67vxjomvlcugjovv4fc3g6ru5tpwotg533d4j3uf2btmnndead[.]onion

[OpcodeIntel @OpcodeIntel]

FLocker (.FLOCK) Ransomware

055fff8f18cd134f35ba49aada815e704a75ca8b3f3cbf30a3d26d2bb5fe62fc

@skocherhan @malwrhunterteam @smica83

#Ransomware #Malware

[OpcodeIntel @OpcodeIntel]

@JoenOwek @malwrhunterteam @smica83 @skocherhan Thanks for clarifying. I analyzed llst.ps1 and identified it as malicious.

e344f19dd0bd71e8c016d6848563122f96fc5dba426e176b3ba0a7a39aa1a321

[OpcodeIntel @OpcodeIntel]

104.236.230.184:8888
@malwrhunterteam @smica83 @skocherhan

#opendir #Malware

[OpcodeIntel @OpcodeIntel]

65.20.106.101:8080/cloud/

@skocherhan @malwrhunterteam @smica83

#opendir #malware

[OpcodeIntel @OpcodeIntel]

@etugenio https://t.co/eTJKfMSvbO

[OpcodeIntel @OpcodeIntel]

43[.]156[.]228[.]149:8888
141079d8a6328c9764c1c74934fb6c9d5c9db12cb558e2da827dc45da7dd45f5
#opendir #ThreatIntel #Malware
@smica83 @malwrhunterteam @skocherhan @Huntio

[etugen.io @etugenio]

Lnk Malware AFC_Security_Report_2026.pdf.lnk
xyzblue[.]dpdns[.]org
43[.]156.228.149

Platform: https://t.co/DDS4VYKyT5
#malware #clickfix #lnk

[Hido Cohen @0xhido]

@OpcodeIntel @Nec_Money @malwrhunterteam @skocherhan @smica83 Fake Nec Money APK

getUserDetails[.]php → full user DB/plaintext passwords
upload_card[.]php → PAN/CVV/billing data
verifyAccount[.]php → ID docs
firebase[.]php → OTP relay
getintensive[.]php → kill switch/APK update

C2: clientproject[.]fun/taptap212/TAkaPay/

[Hido Cohen @0xhido]

@OpcodeIntel @smica83 @malwrhunterteam @skocherhan @Huntio .lnk → .ps (AMSI bypass) → shellcode → Meterpreter reverse_https “long” URI -> 43[.]156[.]228[.]149:443

/KYqg4a7pUHNdcVxzNwXy_Q5N-NvQrvg3EYhVhmdLDSBTkeYfHfKVuBNWLw9hmdx067nQLz6-ejJWYilZ1nlIJzYbuRlsMtVSajYwMAIaV50nGBC

Payload UID: 298aa0e1aee95073
Built: 2026-08-06T16:00:12Z

[Anurag @Malwarehunterr]

Same PowerShell is hosted on below IP:

hxxp://89.125.255[.]236/ and its downloading https://t.co/QlmSbYEsEy from
hxxp://drvupdates[.]com/meetsdrv.zip

#Malware #ThreatIntel #ThreatHunting
@malwrhunterteam
@500mk500
@skocherhan
@JAMESWT_WT
@OpcodeIntel
@James_inthe_box

[D3Lab @D3LabIT]

🚨 Campagna #RemcosRAT in #Italia

Rilevata una campagna #malspam con oggetto "Richiesta di preventivo".

IoC
- cinnamonthai[.]com/cgi-bins/05.08_8080_64[.]exe
- C2: comeforreealz[.]duckdns[.]org
- C2: careerlongprofit[.]duckdns[.]org
- MD5: c5572f461bcc603de50104ec6c245098

[Anurag @Malwarehunterr]

🚨 #ClickFix

Investigating 31.76.87[.]37 revealed a multi-stage malware delivery chain

- Port 80 hosts a fake Cloudflare verification page instructing users to execute a PowerShell command.

- Port 8443 hosts the second-stage PowerShell loader.'

- The loader downloads LogBri12.msi from a Cloudflare R2 bucket and falls back to 31.76.87[.]37 if the primary download fails.

- The downloaded MSI contains multiple embedded files, including a renamed executable whose original filename is SmartAIP.exe.

IOCs

SHA-256:
Filename: LogBri12.msi
447adde94a1f14ba36c831b1009bd35992e66404aa3a4114b4bca921edab3969

Filename: SmartAIP.exe
ceb70e58e63eac81b8193e7b0dabd42168feb7929a0005c883967b99e1759732

Infrastructure:
31.76.87[.]37
31.76.87[.]37:8443
pub-32e2f642271c45008a1601bacbdfd3f1[.]r2[.]dev

#ThreatIntel #ClickFix #Malware #PowerShell

@malwrhunterteam @500mk500 @skocherhan @OpcodeIntel @JAMESWT_WT @smica83 @_ChezDaniela

[OpcodeIntel @OpcodeIntel]

Fake @Nec_Money lure delivering Android malware. Associated GitHub profile hosts 60+ phishing and malware repositories.
Github- officialappss
4af8266ffe2ef42db33c2c6f3f5744c3
#ThreatIntel #Malware
@malwrhunterteam @skocherhan @smica83

[OpcodeIntel @OpcodeIntel]

43[.]156[.]228[.]149:8888
141079d8a6328c9764c1c74934fb6c9d5c9db12cb558e2da827dc45da7dd45f5
#opendir #ThreatIntel #Malware
@smica83 @malwrhunterteam @skocherhan @Huntio

[Anurag @Malwarehunterr]

🚨 Analyzed a suspicious GoogleMeets-agent-x86.msi sample delivered via PowerShell.

The observed PowerShell connects to:
hxxps://drvupdates[.]com/
and downloads: hxxp://drvupdates[.]com/meetsdrv.zip,
which contains GoogleMeets-agent-x86.msi.

The MSI is not a Google installer. Internally it identifies as "Great" (Manufacturer: Diene Douche) and drops a legitimate signed K7 executable (Station-Logic.exe / K7AVQrnt.exe) together with a modified K7UI.dll, broker.lib, and signalspec.lib.

Dynamic Flow:

- Observed PowerShell connects to hxxps://drvupdates[.]com/

- Downloads hxxp://drvupdates[.]com/meetsdrv.zip

- Drops files into C:\ProgramData\com_int_tool\

- Executes the signed Station-Logic.exe (K7AVQrnt.exe)

- Loads the modified K7UI.dll

- Creates Chime.exe

- Drops C:\ProgramData\SpectraEmu.exe

- SpectraEmu.exe appears to be a likely second-stage payload. It attempts a TCP connection to 31.57.38[.]141:3333 during execution.

It's also possible that the observed PowerShell is itself a later stage, generated or retrieved by an earlier infection stage. Further analysis is required to determine the complete initial infection chain.

IOCs:

Network:

hxxps://drvupdates[.]com/
hxxp://drvupdates[.]com/meetsdrv.zip
31.57.38[.]141:3333

SHA-256:

GoogleMeets-agent-x86.msi
0614cca495539cfe5c281a638060f1d9c990b6be0eda7c3bdbb363bd4f18206c

Station-Logic.exe
e7e5e7086870d785c55cde559c34d61552fe7ba2cffea32a436b66c21b1f79d2

K7UI.dll (Modified)
cb5f23db25beb1488652c6284e233c3bed51b14c645fcf4dbc5451294cb36251

K7TSHelp.dll
c8f7d8d9eef2476399e70a0859daecb0f2dde82a2dd06b89feedcd006e0cc4cd

broker.lib
f44dc45f71ac594117fd2729fc3b9f52e9bbd56ffbac17fb628701899a0a4668

signalspec.lib
de13761793b3e153e778c11f55aa2ed5090e5d0a972cdcfa2253b1425d67518d

Chime.exe
adb8347dfa1b1df1ca2211fe4d7e82f27ced939f1bf3d52548e52bc9e23fc52c

SpectraEmu.exe
f8e409319baa062bbba8bb4114889d7e3dfc5774780aefc57a46f19ff407c18b

File Dropped Paths:

C:\ProgramData\com_int_tool\
C:\ProgramData\SpectraEmu.exe

#Malware #ThreatIntel #ThreatHunting @malwrhunterteam @500mk500 @skocherhan @JAMESWT_WT @OpcodeIntel @James_inthe_box

[ܛܔܔܔܛܔܛܔܛ @skocherhan]

'Coinbase Dashboard'
97ee4[.]catex[.]at/cnbcard/web_sms_activate[.]php
#phishing #Coinbase @webamon_search

[OpcodeIntel @OpcodeIntel]

http://87[.]58[.]199[.]8/

@skocherhan @malwrhunterteam @smica83

#opendir

[Hido Cohen @0xhido]

@OpcodeIntel @skocherhan @malwrhunterteam @smica83 Delivers BTMOB RAT v4.2

C2s:
148[.]224[.]63[.]123
195[.]160[.]221[.]203:8080

https://t.co/VQjyiCISBP

[Mikhail Kasimov @500mk500]

@ReBensk @malwrhunterteam @cryptax @LukasStefanko @Cyber_O51NT @bl4ckh0l3z @JAMESWT_MHT @ni_fi_70 @Protectstar @MariusSheppard Related: https://t.co/pZ3ON8zU4u

[OpcodeIntel @OpcodeIntel]

seguro-play[.store -> Fake Play Store Themed - Jadlog
3f72767b211c84a7e35cdf397b228b22f2156984ea1c8cc4380b73a516c49ab8 -> Dropper

targeting #Brazilian #Portuguese speaking

@skocherhan @malwrhunterteam @smica83
#ThreatIntel #Malware