Ricky LaFleur

#GINP Android banking trojan drop point: hxxp://remembergreet.site/index2.php?ref=adsterra111 --> hxxps://behaverear.site/get SHA-256: 8147dd00df915b66d7a3b6e81f1a07624a7cf07941d19c20c3f582bb0abe7c16 C2: hxxp://purefoe.cc/api201/ hxxp://fatgoose.top/api201/

#Cerberus drop point: hxxp://azimutmarket.com/Hx5 SHA-256: 4e6226b84275d1185a4d9c5b63e38dd4c399791233146ef22bd77b56f6093cd7 C&C: hxxp://serverscreen.host/gate.php

#Android #Lokibot drop point: hxxps://whats-app.gq/ SHA-256: a6547415ef61bc66531978ef28913938f74dacb887bbd4ec5fc3a4ee978c4376 C2: hxxp://185.185.71.90/

Gracias a @JoelSernaMoreno sorteamos dos cables Evil Crow que podréis ver en el Arsenal de #hc0n2020. Si vas a ir a la Con de @hackplayers y quieres participar en el sorteo haz RT y estate atento a @h_c0n. Daremos a conocer los ganadores el próximo 20/01: github.com/joelsernamoren…

#Anubis drop point targeting turkish people: hxxp://bedava-kazan.com/ SHA-256:4c736a4e1c029da46d0047d02d30b591ceedec192352ee99be2ef0896efa8a97

#Phishing targeting french tax agency hxxp://u521272mba.ha003.t.justns.ru/impots.gouv/espace-clients/

#Ginp drop point: hxxp://cewavato.tk SHA256: c6559133aad4284821f98da04a06d84596e2f5c663fcc5a057872ec30201862e apklab.io/apk.html?hash=… C&Cs: hxxps://designpriorityozone.info hxxps://animalaround.info stats:

#azorult hxxp://18.216.84.23/download_file.php c2: hxxp://18.216.84.23/lastdll/index.php app.any.run/tasks/3c6a1c1b…

#Cerberus drop point: hxxp://zydalafobyxo.tk SHA-256: 52746ddb32ca8023246862acdd1e2f828d5ba7760d4be7909b934b6ca28f117c

#Anubis drop point: hxxps://tikitok-app.ru SHA-256: fc45cd699eb461fd58abb259e4d754a754a5cb75209d83293b6370d7f0265504

#Anubis drop point targeting turkish people: hxxp://hediyeinternet.ga/hediyegb.html SHA-256: 0b79c55a8a3158ef11a79c98a13827f7af22bb1ebc86c7c27e35472f6fe05165

Other drop point: hxxp://turkcell10gbgnc.com/ SHA-256: c3cd110ae3c76a132211d05dd5faa9f4898ab685d123cf207734162d0a035f5d

Another Drop point: hxxp://turkcellhediyeservisleri.com/

#Anubis Drop point targeting @Turkcell costumers: hxxp://turkcell-10gb.com/ SHA-256: 8569b19b87a786f9ffbfbc3467ea07621adaa54d3f4c8771b59746793720f890

Oh.. Another #anubis dropper with 10.000+ installs play.google.com/store/apps/det… Same c2 as previous one. koodous.com/apks/c43f9a6bd… big thanks to @RickyLafleur1 <3

#Banker #Anubis found/flagged by @RickyLafleur1 koodous.com/apks/0b3c212ba… with nearly 0 detection VT, OK the Banker itselfe has a better score

#Phishing targeting @ZipRecruiter customers: hxxps://ziprecruiter.hk/login

#Anubis Drop point: hxxps://tomupdate.host/ MD5: a21217c355618275e4aa6a1d2aa7aedd

Gracias a todos los que han hecho posible la #hc0n2019 y @hackplayers . En cuanto pueda os actualizo el readme del github github.com/Hackplayers/Sa…