Ali Aqeel

Added extraction update for latest #vidar campaigns v1.1-1.4 are same old config encryption that been seen in v18.x the latest 1.5 is entirely new config encryption sample: tria.ge/260513-xe8pzah… more sample: tria.ge/s/family:vidar For defensive purposes

Added extraction support for #Remus_stealer in #triage sandbox sample: tria.ge/260513-ve58qsc… The c2s extracted statically not on runtime dynamic generated. more sample: tria.ge/s/family:remus… For defensive purposes

@malwrhunterteam @1ZRR4H found this tria.ge/260506-zf8gpse…

"L0G1N - D4R7H V4D3R": http://65.109.55[.]181:8181/login "4CC3SS D3N13D - 1D3NT1FY Y0URS3LF" "0P3R4D0R" "S3NH4" With such texts, it must be the panel of some sophisticated, complex, APT's malware, right? 😂 🤷‍♂️ @1ZRR4H

#netherhound sample tria.ge/260508-r5njtsa… exfiltrator using discord

#govti v4 added extractor sample: tria.ge/260508-r267rsd… more samples tria.ge/s/family:govti

#eimeria RAT sample: tria.ge/260508-n6jeqag… added extractor

#spankrat added extractor sample: tria.ge/260501-j1hh1sc… more: tria.ge/s/family:spank…

#RatonRat Added extractor sample: tria.ge/260430-xn996ag… more: tria.ge/s/family:raton…

#enmity stealer Added extractor tria.ge/260501-j1htsah… more samples: tria.ge/s/family:enmity

#stubworm samples: tria.ge/260424-jckngac… tria.ge/s/family:stubw…

Added extractor support for #STXRAT sample: tria.ge/260416-trgkgae… more samples: tria.ge/s/family:stxrat

#crysome rat tria.ge/260416-tpx5fah… more samples: tria.ge/s/family:cryso…

We've added configuration extraction support for #santastealer latest samples tria.ge/260417-ph86xag… more samples: tria.ge/s/family:santa…

@James_inthe_box tria.ge/251120-w9sfssa…

c2: https://api\.telegram\.org/bot6926474815:AAFx9tLAnf5OAVQZp2teS3G2_6T1wCP67xM

#stealerium hosted at: http://31.57.147.77:6464/gethta http://31.57.147.77:6464/getdll hash 88feadbb2f9548d3c0cb9c6519bcea476acf9ac2a3eeccde5655457cbba29db4 on the dll

@Xanderuxsf5 @virustotal tria.ge/250912-f9bv2sh… probably they've another hash.

🛡️Lazarus Stealer IP : 193.151.108.39 AS 207957( Serv .host Group Ltd ) Low detection on @virustotal more Lazarus servers detected by #C2Watcher on github.com/Xanderux/C2wat…

@Fact_Finder03 @500mk500 @ViriBack more tria.ge/250630-y4lgeav… tria.ge/250630-yjvvcas… tria.ge/250701-3yj4lsz… tria.ge/250711-bxc55az… tria.ge/250714-2k5mqay… tria.ge/250716-mp45ess… tria.ge/250717-t3fsba1… tria.ge/250726-ywk6nsc…

@Fact_Finder03 @500mk500 @ViriBack Exract c2 panel from #cyberstealer samples samples has synproxy[.]live/webpanel/ tria.ge/250731-fdqdka1… tria.ge/250731-a5hj5sy… tria.ge/250727-wxp5xad… others c2s tria.ge/250731-fpe2za1… tria.ge/250731-rvetyax… tria.ge/250624-mk6sfs1… tria.ge/250630-wtx2cat…

Cyber Stealer Panel - synproxy[.live @500mk500 @ViriBack #CTI #Panel #stealer

@solostalking @500mk500 tria.ge/241114-chhbzas…

Hexon Stealer 72[.]145.3.21 @500mk500