3r1c

1nc1d3n7 r35p0n53

[3r1c @p5yb34m]

Testing a PoC.
<img src=x onerror=alert('XSS_FROM_FEED')>

[3r1c @p5yb34m]

Found a live compromised WordPress site with ClearFake (FakeCaptcha) delivery:
https://comexblog[.]com[.]br

[3r1c @p5yb34m]

Anyone familiar with the infection chain for:
FakeCaptcha
=>
https://check.dasoc[.]icu/gkcxv.google?u=${usr_id}

I would very much appreciate a sample, IOCs, or other knowledge from this specific #FakeUpdate batch.

@threatcat_ch

[abuse.ch @abuse_ch]

Have you set up a hunting alert on URLhaus yet? With this new feature, you can get real-time notifications of key events, including:

✅ URL pattern (exact or wildcard match)
✅ Tag match (exact)
✅ Payload of a URL changes (URL ID)
✅ Signature for payload matches (exact)

URLhaus hunting alerts automatically pull your email from your https://t.co/x0TWKNn9PP profile, making setup easy! Setup your first hunting alert here 👉  https://t.co/WcVmScZ6KR

🎥 Watch it in action here (skip to 5:48 in this demo!)
👉 https://t.co/m1acqRrF7n

[3r1c @p5yb34m]

@SacramentoKings
https://t.co/BJqe3NZKFy == online

[3r1c @p5yb34m]

@SacramentoKings
https://t.co/BJqe3NZKFy == online

[3r1c @p5yb34m]

** Corrected link to the .dll sample **:
https://t.co/ep2LSJ4yKI

[3r1c @p5yb34m]

#Gozi #IFSB (4455 botnet):

.dll DNS IOCs:
mills2008-delivery[.]com
rojasgown[.]com

C2s:
coolorenuloke[.]xyz
foolorenuloke[.]xyz

.doc Sample:
https://t.co/RP4Krz8wXn

.dll Sample:
https://t.co/4fA57ToNOT

Malware Config:
https://t.co/RUatkgUIzq

https://t.co/fpH0FP0AT8

[3r1c @p5yb34m]

#Trickbot (rob86 botnet):

.dll:
://shatteredglass.io/uo/date.php

.dll Sample:
https://t.co/X8qaNmyxVW

.xlsm Sample:
https://t.co/0A3xBAsZyT

C2 Traffic:
https://t.co/C2us17Xosu

Malware Config:
https://t.co/T2aflnvuXa

https://t.co/7T9UEub83A

[Artilllerie ☣ @Artilllerie]

#IcedID (from ThreatFox @abuse_ch)

☢️Low detection (2/69)
https://t.co/wnisc2XPlO

➡️C&C
/24savetonnofmaoney[.xyz
/shaxtugel[.fun
/kripotopliv[.website
/geasgeolander[.fun
/anewknowwhere[.website
/kdbploxokrocks[.uno
/kosmolitopor[.space
/teacupshotter[.space

@malwrhunterteam

[3r1c @p5yb34m]

#Gozi #IFSB (1100 botnet) #opendir (with #Trickbot):
s://wajirmaternityandnursinghome.co[.]ke/vendor/phpunit/phpunit-mock-objects/tests/MockObject/

C2s:
api10[.]laptok[.]at/api1
golang[.]feel500[.]at/api1
go.in100k[.]at/api1

Malware Config:
https://t.co/6fApaE45dM

@JAMESWT_MHT

[3r1c @p5yb34m]

#Trickbot #opendir (mon### botnet payloads):
://wajirmaternityandnursinghome.co.ke/vendor/phpunit/phpunit-mock-objects/tests/MockObject/

Malware Config (C2s for mon156 botnet):
https://t.co/6kXrOG6t3s

@JAMESWT_MHT

[3r1c @p5yb34m]

@James_inthe_box @lazyactivist192 @GossiTheDog Thanks! @CapeSandbox was right.

[3r1c @p5yb34m]

Unconfirmed #Trickbot:

PE32 .dll:
itelsys[.]ma/prod/education.php

PE32 .dll Sample:
https://t.co/3oENyKdORA

.xls Sample:
https://t.co/VGtHIoU52q

Looks to be the same actors with new tricks.

Share your findings.

https://t.co/oQWZP0tY6T

[3r1c @p5yb34m]

#Trickbot (mon147 botnet):

.dll:
s://ozpinarco.com/wp-content/themes/archi-child/images/prettyPhoto/147.dll

.dll Sample:
https://t.co/orxfDln1Z1

C2 Traffic:
https://t.co/VYLwrfO9aG

Malware Config:
https://t.co/YJB4UyQybn

@JAMESWT_MHT

[3r1c @p5yb34m]

#Trickbot (mon156 botnet):

PE32 .dll Source:
s://ozpinarco.com/wp-content/themes/archi-child/images/prettyPhoto/156.dll

PE32 .dll Sample:
https://t.co/NrbdQW1e34

C2 Traffic:
https://t.co/WtW1gBn5uR

Malware Config:
https://t.co/tNDjMOUQ4U

@JAMESWT_MHT

[3r1c @p5yb34m]

@JawsIntel @JAMESWT_MHT I've been tracking the botnets for a while; some other indicators I go off of are:

> XLM 4.0 macros
> Excel naming
> Excel template
> Malspam templates
> Payload naming
> .php Delivery

When I have time I'll try to get you a better answer.

Reference:
https://t.co/HQyudmCDvo

[3r1c @p5yb34m]

#Trickbot (rob78 botnet) #TA505:

.dll:
://www.linkinc.es/scss/water.php

.dll Sample:
https://t.co/Vh9OoyPqrl

.xlsm Sample:
https://t.co/QFA0irEfHL

C2 Traffic:
https://t.co/m0yUHzSRRv

Malware Config:
https://t.co/y0t6lEYMpx

@JAMESWT_MHT

[3r1c @p5yb34m]

#Gozi #IFSB (5513 botnet):

.doc dropper Sample:
https://t.co/2hmVn4MUGN

C2:
greenwoodgrace[.]website

Malware Config:
https://t.co/vvVUj4WITx

@JAMESWT_MHT

[3r1c @p5yb34m]

Note:

For each GET .php request a .exe is served. When this happens, the respective .exe is deleted from the web server.

That is why there are no more live payloads at this time...

Take-down example:
for n in `seq XXX`; do wget XXX.php; done

@Cryptolaemus1 @lazyactivist192

[3r1c @p5yb34m]

#Trickbot (yas48 botnet):

PE32 .exe:
s://g1ba4tt4ngq5nl7w.xyz/index.php

.exe Sample:
https://t.co/t2YiEktPgB

C2s:
https://t.co/9cee4MtFJM

Malware Config:
https://t.co/M1aunq5qrN

@JAMESWT_MHT