tisf

[tisf @tisfe]

https://t.co/tYHbD67UMJ

[tisf @tisfe]

New ransomware samples are out! One uses Paint, one self-encrypts, one wants SoundCloud subs. Meet 'OopsieDaisy,' 'ForgotMyKey,' 'PleaseJustVenmoMe.' Grab 'em at theZoo!
#Ransomware #theZoo #malware_analysis #APT

[tisf @tisfe]

Wiper.BEEP.E
a691e976d2dbe3387cb95c1f2bfab5ab

#APT #Ransomware #wiper #malware

[tisf @tisfe]

Wiper.SAPP.IC
f42d28a0fc75207d9d1e700a51f55138

#APT #Ransomware #wiper #malware

[tisf @tisfe]

Wiper.WIPE32.P
95f14acc2cee0ecbb81528586335aab3
b9e1737abe5684ea3c7359ce0f52e420
aa93c1f66c707a495ddbf3a37345f40c
6093afce53d56355dbabb43f2bbd2085

#APT #Ransomware #wiper #malware

[tisf @tisfe]

@NuKEVX @vxunderground @0xludar @mikko Whoa, thanks for the shoutout, @NuKEVX! We're all just digital archaeologists unearthing the fascinating artifacts of VX history. Glad to be part of this wild ride with fellow enthusiasts like @vxunderground, @0xludar & @mikko. Always remember to wash our hands after analysis😉!

[tisf @tisfe]

#TURLA #LightNeuron seems to be always awake.
c438010f56efc135fe6919d83a333148

#APT #VENOMOUSBEAR

[tisf @tisfe]

Have you ever thought how cool of a name #SHADOWPAD is?
Get your samples while they’re hot!

f57ccea4d05a5ae3713ea27e30924b36
aa780c38044baa55053c05dbd1f1cd07
f438834ffd1678ddf5557b2887dcf603
17d6c44ad58a3ec3ca270fa8d52a4212
7476ed4a8a374031b6455d19f5a250d5

#MOSHENDRAGON #WINNTI

[tisf @tisfe]

#APT #PrimitiveBear
297c9e8f7de64a1303614149a7cca07776eec5da
58c79bd3d739420ca3bd5860d4b33806469518ac
9a385e59a359d368b79dad463ee674d2751cef42
d1275fb06df0d830696fa17ab62489bda6c414cd

[tisf @tisfe]

Some #Gamaredon samples found ITW.
Watch out for these guys.

8590bae36e4a5a5725ff192e0db13366
7a91febc06be0dad3c90f0245456383e
5215732b1a988bc3e2d60ea7be1f09bc
fcc539e8595967233ab23f613a8a7787

[tisf @tisfe]

@coriplusplus Thanks. It's nice to see theZoo is actually useful for some people. Always looking for pointers on new malware people are after. And good satirical comments. But to be honest, it's way easier to find the occasional rare sample...

[tisf @tisfe]

@TuftLuckLynx @coriplusplus I promise you, each word in and of itself makes absolute sense. The threading of these together however... a bit sketchy at best.

[tisf @tisfe]

@coriplusplus As the author of #theZoo, this is not even remotely the "best" question I've received. But i have strongly recommended some people to just "hex edit the binary to match the YARA regex of the btc block to fix packing issue with some blockchain". Some have replied....

[tisf @tisfe]

#PyExfil is now on version 1.3.2. It now fully supports both Python2 and Python3 and has a IMAP_Drafts module for data exfiltration. This joins the 13 data modules, 12 covert communications modules, 3 physical and 6 steganography modules!
Get it at: https://t.co/JFgilIOYjQ

[tisf @tisfe]

Due to increased interest in Supply Chain Attacks, theZoo’s new samples include: PhantomNet, SnowBalls, #HyperBro, #KorPlug, #ShadowPad, Tmanger from the campaigns #SIGNSIGHT, #STEALTHYTRIDENT, #SUNBURST and #HIDDENCOBRA as well as new #Pay2Key samples.
https://t.co/gce5uk8uEb

[tisf @tisfe]

#theZoo’s new DB release is focused on Source Code: #OilRig PoisionFrog C2, Zeus.B, Android.CEREBRUS, some Win9x.LegacyASM malware and the Entire #Mirai Family!

https://t.co/uxyajdQcyF

[tisf @tisfe]

@C0ryInTheHous3 Yes. This seems so.

[tisf @tisfe]

Fresh hot #MuddyWater #WebShell samples. Get them while they’re hot. https://t.co/ska048COvT #theZoo #APT

[tisf @tisfe]

Another fresh Muddy sample. https://t.co/LkUv6Wdg3u

[tisf @tisfe]

Download them at https://t.co/VGQzWndolN