Felipe Duarte retweetet
I built an open-source library of 700+ cybersecurity skills for AI coding agents -- covers DFIR, threat hunting, cloud security, and more github.com/mukul975/Anthr…
English
Felipe Duarte
1.7K posts
Felipe Duarte
@dark0pcodes
Malware researcher, CEH, GREM, electronics geek, IoT enthusiast, programmer, drone lover and machine learning fan. Just hunting malware for fun... and profit!
Bogotá, D.C., Colombia Beigetreten Ağustos 2017
745 Folgt2.8K Follower
Felipe Duarte retweetet
Agentic-SOC-Simulation: AI-powered SOC simulation platform github.com/SafelineMan/Ag…
English
Felipe Duarte retweetet
@colCERT Campaña activa de Phishing.
Redirect: hxxps://pgsmit[.]fi/multas
Phishing: simit-pago[.]cc
Ataque inicia con un mensaje de texto que contiene el nombre de la victima.
Español
Things that you only see in malware analysis 🤯
I just unpacked Lumma Stealer, and the first sign to know I nailed it: a warning pop up!
A debug message to remind rookie attackers not to self-infect 😂
#MalwareAnalysis #Cybersecurity
English
@threatactress Thanks for reporting. Let me check what happened.
English
Check out! Our latest research were we exposed several tools found during an incident response involving APT41.
securityjoes.com/post/the-silen…
English
@JParticle0 Thanks for reporting. Let me check what happened.
English
@dark0pcodes not sure what's going on with the page but same article organized a little differently cybersrcc.com/2024/10/22/chi…
English
@Myrtus0x0 Qbot, I analyzed it so hard one time that it would be nice to validate all my conclusions with the source code.
English
Italiano
Español
¡Atención! 🚩 Están circulando campañas de distribución del malware Lumma Stealer, usando una técnica tan simple (y estúpida) como peligrosa. Esta campaña afecta especialmente en sitios de streaming llenos de anuncios.
Español
Felipe Duarte retweetet
Felipe Duarte retweetet
You can also leverage @virustotal Enterprise to search for potential C2s related to #LummaC2 based on the redirect page.
WatchingRac@RacWatchin8872
#Lumma Possible Lumma C2: -assaultxnh[.site -febnceokwi[.site -jealouskfnn[.site -mountainywj[.site -sunhsinkujh[.site -throaatyinpak[.site -witnesjwuka[.site All nginx default page, all have /api and all Namecheap + Cloudflare Thanks @g0njxa for helping me in this crazy idea
English
Felipe Duarte retweetet
Quick changes on this reCAPTCHA malware campaign now abusing @digitalocean S3 buckets and CDN to still deliver #Lumma Stealer.
Similar behavior,
Detonation: app.any.run/tasks/02afc68d…
Who said what?@g0njxa
reCAPTCHA malware campaign is now abusing @Vultr S3 buckets and CDN to deliver #Lumma Stealer Detonation: app.any.run/tasks/ccf381f1… Also loading another unidentified binary from /onefreex.com/api/download that only downloads with a custom User Agent: app.any.run/tasks/d9d21810…
English
Felipe Duarte retweetet
#Lummac2
With this simple query is possible to find more Lumma C2:
#hash%3A51280dabfbc880cdc5f92cc2f4f22c8032de5aba401c3268250a11eeb2df1f73%20AND%20page.url%3A%22%2Fapi%22" target="_blank" rel="nofollow noopener">urlscan.io/search/#hash%3…
CC:
@banthisguy9349 @NDA0E @BlinkzSec @kddx0178318 @raghav127001 @DaveLikesMalwre @g0njxa @ViriBack @500mk500 @ge0lev
Fox_threatintel@banthisguy9349
@RussianPanda9xx I have seen a change! They are not using only .shop domain extensions!
English