Pyvonix

@Pyv0nix

Security Research • If all persons who can do something are in the bad side, the game could not be balanced.

World Golf Village, FL

انضم في يوليو 2012

99المنشورات 185المتابعون 279المتابَعون

قد يعجبك

@JaromirHorejsi

@SettiDavide89

@ViriBack

@MalHunters

@James_inthe_box

@WifiRumHam

@mal_share

@SwitchToThread

@HerbieZimmerman

@avman1995

@JRoosen

@Paladin3161

@SaurabhSha15

Pyvonix

@Pyv0nix

١١ يوليو ٢٠١٨ م

#opendir: http://hokoog[.]com/yo/ I think I like these little guys that make your life easier by letting access to to their webshell. @JAMESWT_MHT @James_inthe_box @ViriBack

Pyv0nix's tweet image. #opendir: http://hokoog[.]com/yo/

I think I like these little guys that make your life easier by letting access to to their webshell.

@JAMESWT_MHT @James_inthe_box @ViriBack

Pyvonix

@Pyv0nix

١٩ يونيو ٢٠١٨ م

#opendir: aitelong[.]top/amadi/ contents: .exe and .hta malware: #lokibot #pony For this episode of "chose your malware", I offer a wide range of files. @James_inthe_box

Pyv0nix's tweet image. #opendir: aitelong[.]top/amadi/
contents: .exe and .hta
malware: #lokibot #pony

For this episode of "chose your malware", I offer a wide range of files.
@James_inthe_box

Besides developing malware, they make poetry... Oh wait. It's lyrics of Nerd Ambition by YTCracker. Malware: #tinynuke Payload: coriolis[.]site/facture/ Panel: 4s65xlo930ubyjz8dlcm[.]com/admin/login.php

Pyv0nix's tweet image. Besides developing malware, they make poetry...
Oh wait. It's lyrics of Nerd Ambition by YTCracker.

Malware: #tinynuke
Payload: coriolis[.]site/facture/
Panel: 4s65xlo930ubyjz8dlcm[.]com/admin/login.php

Pyvonix

@Pyv0nix

١٢ يونيو ٢٠١٨ م

Second stage dropper hosted on: pomf.pyonpyon[.]moe/befqki.doc Find different payload on #opendir: irishlebanese[.]com/wp-admin/images/eight/ It's seen like files aren't on Virus Total, yet. @malwrhunterteam @ViriBack

Pyv0nix's tweet image. Second stage dropper hosted on: pomf.pyonpyon[.]moe/befqki.doc

Find different payload on #opendir: irishlebanese[.]com/wp-admin/images/eight/

It's seen like files aren't on Virus Total, yet.
@malwrhunterteam @ViriBack

Pyvonix أعاد

Gigamon | Security

@gigamonsecurity

٧ يونيو ٢٠١٨ م

Our Security Research Team has identified a zero-day #vulnerability in Adobe Flash that enables an attacker to execute code on a victims computer. #0day #networksecurity ow.ly/6plP50hBDMp

gigamonsecurity's tweet image. Our Security Research Team has identified a zero-day #vulnerability in Adobe Flash that enables an attacker to execute code on a victims computer. #0day #networksecurity ow.ly/6plP50hBDMp

Pyvonix

@Pyv0nix

١ يونيو ٢٠١٨ م

Current wave of #dropper but i'm not sur about the payload... Do you have more info? @malwrhunterteam @James_inthe_box @ViriBack All info: pastebin.com/iQXsPvXR

Pyv0nix's tweet image. Current wave of #dropper but i'm not sur about the payload... Do you have more info? @malwrhunterteam @James_inthe_box @ViriBack

All info: pastebin.com/iQXsPvXR

Pyvonix

@Pyv0nix

١٧ مايو ٢٠١٨ م

Today the presentation of my POC: a solution who collect and identify threats ✓ scalable solution ✓ automatically collect links ✓ identify the threat ✓ design a "user friendly" interface Thank to @benkow_ and @ViriBack for them great job who help me for identification

Pyv0nix's tweet image. Today the presentation of my POC: a solution who collect and identify threats

✓ scalable solution
✓ automatically collect links
✓ identify the threat
✓ design a "user friendly" interface

Thank to @benkow_ and @ViriBack for them great job who help me for identification

Pyvonix

@Pyv0nix

٣ مايو ٢٠١٨ م

Amazing PO_.doc: RTF HASH: d6122adcf1bc34f293fed334d928f25dda5a76e53226c89a7bdb4c869c734ec8 It's NOT a dropper but an "all inclusive package" with all what he needs Behavior: #Ransomware + #Persistance Request: test1[.]ru/newbuild/t.php (may be a test ?) @malwrhunterteam

Pyv0nix's tweet image. Amazing PO_.doc: RTF
HASH: d6122adcf1bc34f293fed334d928f25dda5a76e53226c89a7bdb4c869c734ec8

It's NOT a dropper but an "all inclusive package" with all what he needs

Behavior: #Ransomware + #Persistance
Request: test1[.]ru/newbuild/t.php (may be a test ?)

@malwrhunterteam

Pyvonix

@Pyv0nix

٣٠ أبريل ٢٠١٨ م

Website compromised: mcts-qatar[.]com Url used for delivering payload: mcts-qatar[.]com/wp-content/plugins/de6.exe Well, it's not your first time: urlhaus.abuse.ch/host/mcts-qata… … May be it's time to upgrade your Wordpress extensions or you deliberately host malware?

Pyvonix

@Pyv0nix

٣٠ أبريل ٢٠١٨ م

Wave of office document. mimetype: RTF Dropper use CVE-2017-11882 with eqnedt32.exe Domain with payload: b.reich[.]io (/jsdrjs.exe or /kdhqfz.png) Paypload: Password Stealer #lokibot Panel: detini.nut[.]cc cc @ViriBack @malwrhunterteam

Pyvonix

@Pyv0nix

٢٥ أبريل ٢٠١٨ م

Malware from: sendspace[.]com/file/6fjyyf He embed and use the @ImminentMethods solution (Cf. official website : imminentmethods.net ). Sample behavior: Keylogging C&C: DUJANADEC.djaoke[.]ga (no reponse) C&C infos :urlquery.net/report/924a8f3…

Pyv0nix's tweet image. Malware from: sendspace[.]com/file/6fjyyf
He embed and use the @ImminentMethods solution (Cf. official website : imminentmethods.net ).
Sample behavior: Keylogging

C&amp;C: DUJANADEC.djaoke[.]ga (no reponse)
C&amp;C infos :urlquery.net/report/924a8f3…

Pyvonix

@Pyv0nix

٢٥ أبريل ٢٠١٨ م

Dropper dowload payload from @github : github[.]com/yeahtheboys19892/beets/raw/master/beets/bin.exe Payload: AutoIT Keylogger Hash: 49475fa8074b25cd6aeb06551fa1f8544cdbc90e8d479858802a6510bb205d67 Behavior: drop 'nthwytulqctogyqrypoegivdc1696780.png'