NDA0E

200 posts

NDA0E banner
NDA0E

NDA0E

@NDA0E

Katılım Nisan 2024
102 Takip Edilen460 Takipçiler
NDA0E
NDA0E@NDA0E·
@banthisguy9349 CyberChef recipe: #recipe=Find_/_Replace(%7B'option':'Simple%20string','string':'%25'%7D,'4',true,false,true,false)Find_/_Replace(%7B'option':'Simple%20string','string':'~'%7D,'000',true,false,true,false)From_Hex('None')&oeol=FF" target="_blank" rel="nofollow noopener">gchq.github.io/CyberChef/#rec… MD5: bc1705db6ccc60784390e7ae66887148
Français
0
0
3
131
Fox_threatintel
Fox_threatintel@banthisguy9349·
#decoding challange! Decode the following from this url: hxxps://paste.ee/r/sOYJc/0 Below the encoded string: This encoded string was observed for the first time 2024-05-15
Fox_threatintel tweet mediaFox_threatintel tweet media
English
3
2
15
2.9K
NDA0E retweetledi
abuse.ch
abuse.ch@abuse_ch·
On the 1st of December, the notorious Socks5Systemz payload server hosted at AS57678 (Cat Technologies 🇭🇰) that is already active for several months started to serve a new version of Socks5Systemz ⤵️ 🌐 urlhaus.abuse.ch/url/3189430/ This is the first major change since 2023 in Socks5Systemz and includes: 🔑 New RC4 key used during C2 communication: hi_few5i6ab&7#d3 👋 Direct IP communication through HTTP(s) for botnet command and control instead of the usage of a DGA and a custom DNS server 🔙 Backconnect TCP port changed from 2023 to 2024 Current botnet C2 servers: 188.119.66.185:443 CHANGWAY 🇭🇰 45.155.249.212:443 RACKPLACE 🇩🇪 91.211.249.30:443 PODAON 🇱🇻 Malware sample:📄 bazaar.abuse.ch/sample/528334e… Socks5Systemz IOCs: 🦊 threatfox.abuse.ch/browse/malware…
abuse.ch tweet mediaabuse.ch tweet media
English
1
13
34
7K
Germán Fernández
Germán Fernández@1ZRR4H·
Interesting campaign in Brazil installs an Atera agent for remote control of victims. Other distribution domains: + gdhbbdv.sellsyourhome[.]org + nmfhnjf.knowsitall[.]info + aweewe.barrel-of-knowledge[.]info Download from: https://sdfgfv.stuff-4-sale[.]org/clientela/Atualizador_Fiscal_NFe.msi
Germán Fernández tweet media
Johnk3r@johnk3r

Campaign remains active with 100+ delivery URLs (thanks @ValidinLLC). -New email for registration; -Victims who click are registered before RMM delivery; location/FQDN controls manage payload; -Financial, Tech, Hospital and Government firms found in the console. @AteraCloud

English
2
7
11
2.9K
Shanholo
Shanholo@ShanHolo·
🚨#Malware #ecrime🚨 hxxps://217.195.153.196/assets/paleochorologyma.exe ⚠️#koiloader #TMBackdoor ☣️paleochorologyma.exe➡️9e70e823876c7e83bf254d1f8fcbb3e5 📡hxxp://217.195.153.196/academy.php
HT
3
2
3
702
NDA0E
NDA0E@NDA0E·
@onecert_ir @Namecheap Similar phishing: hXXps://45[.]147[.]230[.]41/ hXXp://sana-ir.wicaso6530[.]workers[.]dev/ Malware payloads: https://45[.]147[.]230[.]41/app.apk hXXps://github[.]com/iosyu01/okdash/raw/main/assets/eblagh.apk Samples: bazaar.abuse.ch/browse/tag/San…
Filipino
2
0
1
131
OneCert Cyber Security
OneCert Cyber Security@onecert_ir·
#phishing and #malware attack against Saham Edalat Domain: specbest[.]com hXXps://specbest[.]com/Source/dashbord/ User agent: Android Proxy: Iran Payload URLs: hXXps://specbest[.]com/Source/dashbord/app.apk @Namecheap
OneCert Cyber Security tweet media
English
4
0
1
628
abuse.ch
abuse.ch@abuse_ch·
@JAMESWT_MHT @cocaman Hey James. The issue is a weird tag ("Τράπεζα Πειραιώς") submitted by @NDA0E . I've removed the tag and the issue seems to be gone. For further bug reports, I suggest to send me an email as I am not following X.
2
0
2
561
NDA0E
NDA0E@NDA0E·
@500mk500 threat type should be "payload_delivery"
English
1
0
1
61

Keşfet

@BlinkzSec @500mk500 @banthisguy9349 @DaveLikesMalwre @RacWatchin8872 @illegalFawn @eranet_com @malwrhunterteam