sysopfb

Threat Intel as a reverse-engineer in Crimeware domain. Dubbed "Malware Mangler" by TheRegister. [email protected]

[sysopfb @sysopfb]

Maksim Yakubets was indicted but treasury department also went after Evil Corp, what is really interesting is all the alluding to them being linked to FSB and as it turns out Yakubets is married to the daughter of Eduard Bendersky. w/ Joshua Platt @ WSJPro in Charlotte, NC
1/3

[sysopfb @sysopfb]

Dumped a bunch of notes surrounding a macos based stealer from etherhiding clickfix https://t.co/7OSGD8l9tM someone also released a blog surrounding pieces of it last night: https://t.co/Z2Gv7uJLoF

[Ctrl-Alt-Intel @ctrlaltintel]

Cool find from @sysopfb here is a couple of Images from the Panel, This specific panel was delivering a MacOS stealer notnullOSX

http.html:"notnullOSX " - Shodan Search
http://111.90.]143.163:8080/install

[sysopfb @sysopfb]

Nice writeup https://t.co/1P5sUB0UlH Of note is a panel: hxxp://65.38.120.]80:8080 they left some tidbits behind in the login page: <<label>Пул доменов (по одному на строку)</label>"oeannon.]com
heethcote.]com
windlrr.]com"

[sysopfb @sysopfb]

https://t.co/D79qFw0WRC

[sysopfb @sysopfb]

https://t.co/JNXpRozK8i

[sysopfb @sysopfb]

https://t.co/DfWSPeQEZW

[sysopfb @sysopfb]

https://t.co/g50arBh3qk

[sysopfb @sysopfb]

https://t.co/H48GQgHevx Kudos to GitHub they were taking stuff down very fast

[sysopfb @sysopfb]

https://t.co/JRVsEuHZyX

[sysopfb @sysopfb]

DFIRReport pastebin link also lines up with one of the pastebins I saw in my blog - "cLika3dt"; https://t.co/tStFUVd3VH

[sysopfb @sysopfb]

Auto decoding IOCs from Arechclient and the onboard browser extension they drop https://t.co/PCIjGz8nE4

[sysopfb @sysopfb]

Auto decoding IOCs from Arechclient and the onboard browser extension they drop https://t.co/PCIjGz8nE4

[sysopfb @sysopfb]

https://t.co/PQQO0fTMgQ go through a little of the panel they are using for the fake invites also

[sysopfb @sysopfb]

https://t.co/pDm0sFnuI2

[sysopfb @sysopfb]

https://t.co/CZJvZnb2I2

[sysopfb @sysopfb]

@diego_gg95 Oh well take what I said as a best guess, also don’t feel too bad all the detections from av on vt were less than 5 out of 60+ or however many vt uses nowadays and most were very generic detections

[sysopfb @sysopfb]

Samples look like stealers. Some of the recent ones being Lumma placekeawe(.my

[Diego @diego_gg95]

I got drained, fully drained.

Hi everyone, I'm just coming to share with you all the worst day of my life, and how it happened so that you guys don't ever have to pass through it.

Thread below.

[sysopfb @sysopfb]

@diego_gg95 The recent ones I’ve seen are LummaC with a c2 of the domain I posted. If you still have yours you can upload it to virustotal and shoot out the link to the file and we can verify if you want.

[sysopfb @sysopfb]

Maksim Yakubets was indicted but treasury department also went after Evil Corp, what is really interesting is all the alluding to them being linked to FSB and as it turns out Yakubets is married to the daughter of Eduard Bendersky. w/ Joshua Platt @ WSJPro in Charlotte, NC
1/3

[sysopfb @sysopfb]

Eduard Benderskiy sanctioned: https://t.co/ymQo19iAd9