Greg Leah

Hunting #malware and #C2 frameworks.

[Greg Leah @powershellcode]

Call for Beta Testers

We’re looking for beta testers for our new CTI Maltego Transforms.

If you have a Maltego Professional license and want early access in exchange for feedback, reply here or DM us.

#Maltego #CTI #ThreatIntelligence #DFIR

[PrecisionSec @precisionsec]

We’re opening beta access to our new CTI @MaltegoHQ Transforms.

Built to help analysts pivot through high-confidence threat intelligence directly inside Maltego.

If you have a Maltego Professional license and are interested,reply here or DM us.

#ThreatIntelligence #CTI #DFIR

[Greg Leah @powershellcode]

@threatintel Also using "DocuSign Shared File"

[Greg Leah @powershellcode]

Join me at @BSidesVancouver on May 26 for my workshop "Precision #ThreatHunting: Unveiling Adversary Infrastructure using Free and Open Source Tools," designed to teach participants techniques for discovering and analyzing adversary infrastructure. Only 6 seats left! #OSINT

[Greg Leah @powershellcode]

@sjhilt Yea man I was saying I literally haven’t seen that in years

[Greg Leah @powershellcode]

@NoLogsNoCrime 💯 what a game

[Greg Leah @powershellcode]

@VanCitySec ✋

[Greg Leah @powershellcode]

@BCFerries Update that this is running again would have been appreciated

[Gigs @ Shmoo @Gigs_Security]

Today is 123123

[Greg Leah @powershellcode]

Captured a screenshot of a live #panel of the #Ermac 3.0 #Android #bot builder. Some interesting functionality here:

✅ #C2 connection URL
✅ Backend encryption key
✅ Crypt the #apk
✅ Emulator blocking
✅ Custom icon
✅ Build with a clean app

#malware

[Greg Leah @powershellcode]

Interesting interview with the author of #Amadey loader, which is consistently one of the top malware families observed in the wild recently

[Who said what? @g0njxa]

A few days ago, #Amadey owner and I did a brief interview.

We talk about past, present and future of the infamous #Amadey Loader, one of the biggest products in the MaaS environment. Something worth a read.

Please find it at:
https://t.co/D3Md7vgUim

[Greg Leah @powershellcode]

Excited to present "ChatGPT for Security Analysts" at #BSidesCalgary tomorrow! I will be exploring using AI to streamline #securityanalyst workflows - from #malwareanalysis to #threatintelligence and #threathunting. See you there! #ChatGPT #AI

[Greg Leah @powershellcode]

@VanCitySec 👋

[BSides Vancouver Island @BSidesVI]

Don't miss the chance to speak at BSides Vancouver Island! The CFP is closing this week, we want to hear from you. Apply now at https://t.co/E0eZ3LhPKN and get ready to rock the stage!

[Greg Leah @powershellcode]

@ViriBack @g0njxa @JAMESWT_MHT @fastfire @ChrisUeland @0xrb Very low detection on VT with quite a few related samples dating back to 2023-06-10:

https://t.co/KOCNfQ8jMD
https://t.co/srY8g40hwV
https://t.co/VOgQT2WANI

[Greg Leah @powershellcode]

A few active #RisePro #stealer #c2 panels:

hxxp://194.169.175[.]128:8081/login
hxxp://38.47.220[.]202:8081/login
hxxp://79.110.49[.]141:8081/login

@ViriBack @g0njxa @JAMESWT_MHT @fastfire @ChrisUeland @0xrb

#threathunting #malware

[Greg Leah @powershellcode]

Some additional #IcedID #malware IPs from a related .pdf campaign:

80.77.23[.]154
80.77.23[.]155
80.77.23[.]170
80.77.23[.]176
80.77.23[.]64
91.240.202[.]190
91.240.202[.]195

pdf name: Document_[mm_dd]_[number].pdf

[Mangusta @Tac_Mangusta]

#IcedID spotted also in #italy 🇮🇹 - campaign ID 2704445589

mail(old conv) > .pdf > url > .zip> .exe

🔥skofilldrom.]com

[Greg Leah @powershellcode]

@NoLogsNoCrime @VanCitySec 🤚 see you tonight!

[Greg Leah @powershellcode]

@bambenek 💯

[Greg Leah @powershellcode]

Did some hunting based on this excellent share by @0xperator and was able to find another active #Rhadamanthys #Stealer #c2 panel:

hxxp://185.228.234[.]189:443/admin/console/index.html

cc @ViriBack @0xrb

[Greg Leah @powershellcode]

@TLP_R3D @josh_penny 45.154.98.244 was also a #Redline Stealer C2 recently:

https://t.co/wcaI8qGXl5

https://t.co/AugobZasi9