SoulRage

Malware Researcher | Threat hunter | One more #malware hunter. #cybersecurity #NBA #malware 🐲🦖

[SoulRage @SoulRage6]

@ReneRobichaud @PB3st3r @0bfusCat

[SoulRage @SoulRage6]

@CryptoInsane @PB3st3r @0bfusCat

[SoulRage @SoulRage6]

@CryptoInsane @PB3st3r @0bfusCat

[SoulRage @SoulRage6]

@CryptoInsane @0bfusCat

[SoulRage @SoulRage6]

@fr3dhk @PB3st3r @0bfusCat @bg_qak

[SoulRage @SoulRage6]

@JAMESWT_MHT @malware_traffic @malwrhunterteam @James_inthe_box @VK_Intel @sugimu_sec @guelfoweb @Ethereal_x0r @Arkbird_SOLG @PB3st3r @0bfusCat

[SoulRage @SoulRage6]

@JAMESWT_MHT @malwrhunterteam @_operations6_ @Seifreed @anyrun_app @virustotal @PB3st3r @0bfusCat

[SoulRage @SoulRage6]

@fr3dhk @PB3st3r @0bfusCat

[SoulRage @SoulRage6]

@securityaffairs @0bfusCat

[SoulRage @SoulRage6]

@0bfusCat @PB3st3r

[\_(ʘ_ʘ)_/ @pollo290987]

#Banking #Brazilian #malware maybe related with #Lampion.

By pdb: #KLBanker

Loader for W7 & W10
Antidebug
Banks: Santander, BBVA, BancoEstado

2 more samples related:
EncryptAndDecrypt: Used to enc/dec strings 3DES+CBC.
Clientes: Login for "Keylogger Banker"

[SoulRage @SoulRage6]

@underthebreach @0bfusCat

[SoulRage @SoulRage6]

@PB3st3r @0bfusCat

[Germán Fernández @1ZRR4H]

Más del Troyano Bancario #Cerberus, descarga desde:
corona-virusapps[.]com/s1/CoronaVirus-apps.apk
corona-virusapps[.]com/s2/CoronaVirus-apps.apk
corona-virusapps[.]com/s3/CoronaVirus-apps.apk

Relacionado a: https://t.co/BufGzP50nu

#malcovid19 #CiberCOVID19 #covid19

[SoulRage @SoulRage6]

@1ZRR4H @0bfusCat

[SoulRage @SoulRage6]

@CryptoInsane @PB3st3r

[SoulRage @SoulRage6]

@1ZRR4H @PB3st3r

[SoulRage @SoulRage6]

@1ZRR4H @0bfusCat @PB3st3r
see also tweet in comment.

[SoulRage @SoulRage6]

@kafeine Salut

[SoulRage @SoulRage6]

@ElMrhassel @PB3st3r @0bfusCat @bg_qak

[SoulRage @SoulRage6]

#opendir IP contain 2 differnet malware C2
191.232.233.]32
/man/ is C2 of #MetaMorfo/#MeKotio
https://t.co/dz87YVmRkD
/Android/ folder is C2 of #BasBanke/#CoyBot Android malware(as the folder name suggests..)
https://t.co/im50gz8a3I
Both targeting Brazilian banks.🇧🇷

[SoulRage @SoulRage6]

@JasonMilletary @koodous_project Thx! ye i've got that in mind also but the fact that its mamba in the domain and my emotions played a role lead me to the kobe directions.

[SoulRage @SoulRage6]

I found a bunch of APKs uploaded yesterday to VT and @koodous_project which are #Anubis/#BankBot Android malware with C2 named mambanumber5.]top and also the key "mamb".
At first, I thought its tribute to Kobe Brayent and his 5 championship rings... 1/2