English
English Indonesia Türkçe Deutsch Español Português Pусский Français Italiano Nederlands Polski العربية ไทย Tiếng Việt 繁體中文 简体中文 日本語 한국어
filescan_itsec's profile picture. http://Filescan.io is a next-gen sandbox and malware analysis service. Operating at 10x speed vs traditional, it is the best choice for in-depth malware assessment

Filescan.io

@filescan_itsec

http://Filescan.io is a next-gen sandbox and malware analysis service. Operating at 10x speed vs traditional, it is the best choice for in-depth malware assessment

257Posts 2KFollowers 34Following
You might like
filescan_itsec's profile picture.
Filescan.io
 @filescan_itsec
Dec 10

Fully undetected loader script 🚨 Flagged by Filescan.io!🦉 Linked to the latest #MuddyWater APT campaign targeting critical infrastructure in Israel & Egypt. The sample remains undetected by most AV vendors. Check out our report: filescan.io/uploads/69394d… // #sandbox

filescan_itsec's tweet image. Fully undetected loader script 🚨 Flagged by Filescan.io!🦉 Linked to the latest #MuddyWater APT campaign targeting critical infrastructure in Israel & Egypt. The sample remains undetected by most AV vendors. Check out our report: filescan.io/uploads/69394d… // #sandbox
filescan_itsec's tweet image. Fully undetected loader script 🚨 Flagged by Filescan.io!🦉 Linked to the latest #MuddyWater APT campaign targeting critical infrastructure in Israel & Egypt. The sample remains undetected by most AV vendors. Check out our report: filescan.io/uploads/69394d… // #sandbox
0
0
3
1
102
filescan_itsec's profile picture.
Filescan.io
 @filescan_itsec
Nov 21

Vietnam gov #phishing campaign Attack chain: 📩eml->js->bat-> PowerShell☠️ 4 days ago, a malicious file disguised as a tax notice from Vietnam's Government was uploaded and detected as a threat by Filescan’s emulation. Check out how we flagged this! 🦉 filescan.io/uploads/691ad8…

filescan_itsec's tweet image. Vietnam gov #phishing campaign Attack chain: 📩eml->js->bat-> PowerShell☠️ 4 days ago, a malicious file disguised as a tax notice from Vietnam's Government was uploaded and detected as a threat by Filescan’s emulation. Check out how we flagged this! 🦉 filescan.io/uploads/691ad8…
filescan_itsec's tweet image. Vietnam gov #phishing campaign Attack chain: 📩eml->js->bat-> PowerShell☠️ 4 days ago, a malicious file disguised as a tax notice from Vietnam's Government was uploaded and detected as a threat by Filescan’s emulation. Check out how we flagged this! 🦉 filescan.io/uploads/691ad8…
0
0
2
0
156
filescan_itsec's profile picture.
Filescan.io
 @filescan_itsec
Nov 10

Still malware in MP3s? 🎧 @TrendMicro uncovered Fake CAPTCHA campaigns abusing MP3s with obfuscated JS — and the audio still plays. Want to rip open the track, emulate hidden code, and expose this threat's insights — all in a single run? 🔍 filescan.io/uploads/6900d7… #sandbox #DFIR

filescan_itsec's tweet image. Still malware in MP3s? 🎧 @TrendMicro uncovered Fake CAPTCHA campaigns abusing MP3s with obfuscated JS — and the audio still plays. Want to rip open the track, emulate hidden code, and expose this threat's insights — all in a single run? 🔍 filescan.io/uploads/6900d7… #sandbox #DFIR
filescan_itsec's tweet image. Still malware in MP3s? 🎧 @TrendMicro uncovered Fake CAPTCHA campaigns abusing MP3s with obfuscated JS — and the audio still plays. Want to rip open the track, emulate hidden code, and expose this threat's insights — all in a single run? 🔍 filescan.io/uploads/6900d7… #sandbox #DFIR
filescan_itsec's tweet image. Still malware in MP3s? 🎧 @TrendMicro uncovered Fake CAPTCHA campaigns abusing MP3s with obfuscated JS — and the audio still plays. Want to rip open the track, emulate hidden code, and expose this threat's insights — all in a single run? 🔍 filescan.io/uploads/6900d7… #sandbox #DFIR
filescan_itsec's tweet image. Still malware in MP3s? 🎧 @TrendMicro uncovered Fake CAPTCHA campaigns abusing MP3s with obfuscated JS — and the audio still plays. Want to rip open the track, emulate hidden code, and expose this threat's insights — all in a single run? 🔍 filescan.io/uploads/6900d7… #sandbox #DFIR
0
0
2
0
193
filescan_itsec's profile picture.
Filescan.io
 @filescan_itsec
Oct 28

Want to hunt the most used .NET loader today?🎯 #RoboSki It stealthy poses as a harmless app, decrypts a bitmap to load a protected .NET DLL, then drops the payload. Don’t want to unpack it yourself? 💥 Hunting query: filescan.io/search-result?… Report: filescan.io/uploads/686fac…

filescan_itsec's tweet image. Want to hunt the most used .NET loader today?🎯 #RoboSki It stealthy poses as a harmless app, decrypts a bitmap to load a protected .NET DLL, then drops the payload. Don’t want to unpack it yourself? 💥 Hunting query: filescan.io/search-result?… Report: filescan.io/uploads/686fac…
filescan_itsec's tweet image. Want to hunt the most used .NET loader today?🎯 #RoboSki It stealthy poses as a harmless app, decrypts a bitmap to load a protected .NET DLL, then drops the payload. Don’t want to unpack it yourself? 💥 Hunting query: filescan.io/search-result?… Report: filescan.io/uploads/686fac…
0
0
2
0
220
filescan_itsec's profile picture.
Filescan.io
 @filescan_itsec
Sep 24

🚀 Malicious #AI models aren’t theory—they’re a real supply-chain threat. Attackers use new evasion tricks to slip past scanners. See how filescan.io detects poisoned models before they reach production: opsw.at/cDGW3Zh #AI #SecOps #Infosec #Sandbox

filescan_itsec's tweet image. 🚀 Malicious #AI models aren’t theory—they’re a real supply-chain threat. Attackers use new evasion tricks to slip past scanners. See how filescan.io detects poisoned models before they reach production: opsw.at/cDGW3Zh #AI #SecOps #Infosec #Sandbox
0
0
2
0
354
filescan_itsec's profile picture.
Filescan.io
 @filescan_itsec
Sep 9

Attackers abused Alibaba #AI brand to push fake #PyPI packages with malicious #Pickle stealer 😈🥒. Though online less than 24 hours, they were downloaded ~1,600 times. This shows how fast supply chain attacks can spread Check out sandbox's Pickle scan: filescan.io/uploads/68bf95…

filescan_itsec's tweet image. Attackers abused Alibaba #AI brand to push fake #PyPI packages with malicious #Pickle stealer 😈🥒. Though online less than 24 hours, they were downloaded ~1,600 times. This shows how fast supply chain attacks can spread Check out sandbox's Pickle scan: filescan.io/uploads/68bf95…
filescan_itsec's tweet image. Attackers abused Alibaba #AI brand to push fake #PyPI packages with malicious #Pickle stealer 😈🥒. Though online less than 24 hours, they were downloaded ~1,600 times. This shows how fast supply chain attacks can spread Check out sandbox's Pickle scan: filescan.io/uploads/68bf95…
filescan_itsec's tweet image. Attackers abused Alibaba #AI brand to push fake #PyPI packages with malicious #Pickle stealer 😈🥒. Though online less than 24 hours, they were downloaded ~1,600 times. This shows how fast supply chain attacks can spread Check out sandbox's Pickle scan: filescan.io/uploads/68bf95…
0
5
10
1
576
filescan_itsec's profile picture.
Filescan.io
 @filescan_itsec
Sep 4

How cool is it when AI flags a malicious email at entry, and sandbox emulates the infection chain in seconds? email > doc > shellcode > vbs > ps > payload Check out a #phishing email we received last week in our community instance: filescan.io/uploads/68b8b0… #aidetect #sandbox

filescan_itsec's tweet image. How cool is it when AI flags a malicious email at entry, and sandbox emulates the infection chain in seconds? email > doc > shellcode > vbs > ps > payload Check out a #phishing email we received last week in our community instance: filescan.io/uploads/68b8b0… #aidetect #sandbox
filescan_itsec's tweet image. How cool is it when AI flags a malicious email at entry, and sandbox emulates the infection chain in seconds? email > doc > shellcode > vbs > ps > payload Check out a #phishing email we received last week in our community instance: filescan.io/uploads/68b8b0… #aidetect #sandbox
filescan_itsec's tweet image. How cool is it when AI flags a malicious email at entry, and sandbox emulates the infection chain in seconds? email > doc > shellcode > vbs > ps > payload Check out a #phishing email we received last week in our community instance: filescan.io/uploads/68b8b0… #aidetect #sandbox
filescan_itsec's tweet image. How cool is it when AI flags a malicious email at entry, and sandbox emulates the infection chain in seconds? email > doc > shellcode > vbs > ps > payload Check out a #phishing email we received last week in our community instance: filescan.io/uploads/68b8b0… #aidetect #sandbox
1
1
5
2
678
filescan_itsec's profile picture.
Filescan.io
 @filescan_itsec
Aug 13

Nothing beats a .NET holiday! 🎶 Wait... 🦸 Our #sandbox does! The sample hides malicious DLLs in image resources using #steganography 🖼️🐀 which will then perform the decrypting and loading of the final #stealer payload ⚙️ Our detection: filescan.io/uploads/689ca1… #malware

filescan_itsec's tweet image. Nothing beats a .NET holiday! 🎶 Wait... 🦸 Our #sandbox does! The sample hides malicious DLLs in image resources using #steganography 🖼️🐀 which will then perform the decrypting and loading of the final #stealer payload ⚙️ Our detection: filescan.io/uploads/689ca1… #malware
filescan_itsec's tweet image. Nothing beats a .NET holiday! 🎶 Wait... 🦸 Our #sandbox does! The sample hides malicious DLLs in image resources using #steganography 🖼️🐀 which will then perform the decrypting and loading of the final #stealer payload ⚙️ Our detection: filescan.io/uploads/689ca1… #malware
0
0
2
0
485
filescan_itsec's profile picture.
Filescan.io
 @filescan_itsec
Jun 20

Opendir on compromised website #Remcos hides in plain sight on a compromised website. Sandboxing helps cut noise on #opendir discovery & extract C2s fast. Go hunt on filescan.io! Curious? Check it out: filescan.io/uploads/6852d3… #ThreatIntel

filescan_itsec's tweet image. Opendir on compromised website #Remcos hides in plain sight on a compromised website. Sandboxing helps cut noise on #opendir discovery & extract C2s fast. Go hunt on filescan.io! Curious? Check it out: filescan.io/uploads/6852d3… #ThreatIntel
filescan_itsec's tweet image. Opendir on compromised website #Remcos hides in plain sight on a compromised website. Sandboxing helps cut noise on #opendir discovery & extract C2s fast. Go hunt on filescan.io! Curious? Check it out: filescan.io/uploads/6852d3… #ThreatIntel
1
3
6
1
915
filescan_itsec's profile picture.
Filescan.io
 @filescan_itsec
May 27

#KatzStealer was recently spotted for sale in underground forums. Now flooding the wild via classic chain: gzip > JS > PowerShell > image w/ hidden .NET loader. Unmask the obfuscated chain and reach the payload in secs, check its trace! filescan.io/uploads/680f74… #stealer #sandbox

filescan_itsec's tweet image. #KatzStealer was recently spotted for sale in underground forums. Now flooding the wild via classic chain: gzip > JS > PowerShell > image w/ hidden .NET loader. Unmask the obfuscated chain and reach the payload in secs, check its trace! filescan.io/uploads/680f74… #stealer #sandbox
filescan_itsec's tweet image. #KatzStealer was recently spotted for sale in underground forums. Now flooding the wild via classic chain: gzip > JS > PowerShell > image w/ hidden .NET loader. Unmask the obfuscated chain and reach the payload in secs, check its trace! filescan.io/uploads/680f74… #stealer #sandbox
0
2
9
1
802
filescan_itsec's profile picture.
Filescan.io
 @filescan_itsec
Apr 25

🚨 Stealthy PowerShell dropper evades delivers XWorm! Stealthy PowerShell dropper evades AVs! Adds Defender exclusions & drops multiple malicious EXEs. Uses irm | iex for remote execution, delivering #XWorm. Check out the report: filescan.io/uploads/680999…

filescan_itsec's tweet image. 🚨 Stealthy PowerShell dropper evades delivers XWorm! Stealthy PowerShell dropper evades AVs! Adds Defender exclusions & drops multiple malicious EXEs. Uses irm | iex for remote execution, delivering #XWorm. Check out the report: filescan.io/uploads/680999…
filescan_itsec's tweet image. 🚨 Stealthy PowerShell dropper evades delivers XWorm! Stealthy PowerShell dropper evades AVs! Adds Defender exclusions & drops multiple malicious EXEs. Uses irm | iex for remote execution, delivering #XWorm. Check out the report: filescan.io/uploads/680999…
filescan_itsec's tweet image. 🚨 Stealthy PowerShell dropper evades delivers XWorm! Stealthy PowerShell dropper evades AVs! Adds Defender exclusions & drops multiple malicious EXEs. Uses irm | iex for remote execution, delivering #XWorm. Check out the report: filescan.io/uploads/680999…
0
2
7
2
939
filescan_itsec's profile picture.
Filescan.io
 @filescan_itsec
Apr 3

WSF challenges traditional sandboxes & AVs! This one evades detection but unravels fast with emulation, exposing modus operandi & infrastructure in seconds: WSF > Base64+XOR > Remote BAT > Persistence & Payload Fetch > PyArmor Scripts filescan.io/uploads/67ed06… #adaptive #sandbox

filescan_itsec's tweet image. WSF challenges traditional sandboxes & AVs! This one evades detection but unravels fast with emulation, exposing modus operandi & infrastructure in seconds: WSF > Base64+XOR > Remote BAT > Persistence & Payload Fetch > PyArmor Scripts filescan.io/uploads/67ed06… #adaptive #sandbox
filescan_itsec's tweet image. WSF challenges traditional sandboxes & AVs! This one evades detection but unravels fast with emulation, exposing modus operandi & infrastructure in seconds: WSF > Base64+XOR > Remote BAT > Persistence & Payload Fetch > PyArmor Scripts filescan.io/uploads/67ed06… #adaptive #sandbox
filescan_itsec's tweet image. WSF challenges traditional sandboxes & AVs! This one evades detection but unravels fast with emulation, exposing modus operandi & infrastructure in seconds: WSF > Base64+XOR > Remote BAT > Persistence & Payload Fetch > PyArmor Scripts filescan.io/uploads/67ed06… #adaptive #sandbox
1
1
6
3
808
filescan_itsec's profile picture.
Filescan.io
 @filescan_itsec
Mar 7

🚨⚠️Some attackers discovered that cropping the bottom pixels of a QRcode would get many automatic scanners to miss the actual QR💀 Guess what... we discovered it too!🦉MONTHS AGO!😎 Though we realized that many vendors are still missing this. Our report: filescan.io/uploads/67c84d…

filescan_itsec's tweet image. 🚨⚠️Some attackers discovered that cropping the bottom pixels of a QRcode would get many automatic scanners to miss the actual QR💀 Guess what... we discovered it too!🦉MONTHS AGO!😎 Though we realized that many vendors are still missing this. Our report: filescan.io/uploads/67c84d…
filescan_itsec's tweet image. 🚨⚠️Some attackers discovered that cropping the bottom pixels of a QRcode would get many automatic scanners to miss the actual QR💀 Guess what... we discovered it too!🦉MONTHS AGO!😎 Though we realized that many vendors are still missing this. Our report: filescan.io/uploads/67c84d…
0
3
9
3
752
filescan_itsec's profile picture.
Filescan.io
 @filescan_itsec
Feb 11

A 6-month-old .NET PE injector remains undetected on archive.org! This file was flagged as clean... and still available for its usage 🚨 VBScript → PowerShell → base64 .PE + reflective loading → .NET PE injector → #PureLogs Stealer filescan.io/uploads/678f55…

filescan_itsec's tweet image. A 6-month-old .NET PE injector remains undetected on archive.org! This file was flagged as clean... and still available for its usage 🚨 VBScript → PowerShell → base64 .PE + reflective loading → .NET PE injector → #PureLogs Stealer filescan.io/uploads/678f55…
filescan_itsec's tweet image. A 6-month-old .NET PE injector remains undetected on archive.org! This file was flagged as clean... and still available for its usage 🚨 VBScript → PowerShell → base64 .PE + reflective loading → .NET PE injector → #PureLogs Stealer filescan.io/uploads/678f55…
filescan_itsec's tweet image. A 6-month-old .NET PE injector remains undetected on archive.org! This file was flagged as clean... and still available for its usage 🚨 VBScript → PowerShell → base64 .PE + reflective loading → .NET PE injector → #PureLogs Stealer filescan.io/uploads/678f55…
filescan_itsec's tweet image. A 6-month-old .NET PE injector remains undetected on archive.org! This file was flagged as clean... and still available for its usage 🚨 VBScript → PowerShell → base64 .PE + reflective loading → .NET PE injector → #PureLogs Stealer filescan.io/uploads/678f55…
0
1
5
1
651
filescan_itsec's profile picture.
Filescan.io
 @filescan_itsec
Feb 4

Stealthy execution via WebDAV is on the rise! 📈 #StrelaStealer used this technique to target Europe: email → obfuscated JS → PowerShell → WebDAV-hosted malware Check out this report: filescan.io/uploads/6793a5… Hunt more samples: filescan.io/search-result?… #sandbox #triage

filescan_itsec's tweet image. Stealthy execution via WebDAV is on the rise! 📈 #StrelaStealer used this technique to target Europe: email → obfuscated JS → PowerShell → WebDAV-hosted malware Check out this report: filescan.io/uploads/6793a5… Hunt more samples: filescan.io/search-result?… #sandbox #triage
filescan_itsec's tweet image. Stealthy execution via WebDAV is on the rise! 📈 #StrelaStealer used this technique to target Europe: email → obfuscated JS → PowerShell → WebDAV-hosted malware Check out this report: filescan.io/uploads/6793a5… Hunt more samples: filescan.io/search-result?… #sandbox #triage
1
2
4
4
2K
filescan_itsec's profile picture.
Filescan.io
 @filescan_itsec
Jan 30

🛠️ Today, we’re sharing the untold story behind the sandbox technology that empowers our community. Detonator dives into Jan Miller’s journey—bootstrapping, persistence, and a drive to build something better: 🔗 youtube.com/watch?v=C1pa2c… #sandbox #startup #cybersecurity #infosec

filescan_itsec's tweet image. 🛠️ Today, we’re sharing the untold story behind the sandbox technology that empowers our community. Detonator dives into Jan Miller’s journey—bootstrapping, persistence, and a drive to build something better: 🔗 youtube.com/watch?v=C1pa2c… #sandbox #startup #cybersecurity #infosec
0
1
7
1
1K
filescan_itsec's profile picture.
Filescan.io
 @filescan_itsec
Jan 29

⚠️ OLE objects embedded within RTF files are suspicious. ⚠️ 🤔 🚨 But if the context is an email containing an attached RTF with an OLE object, it may be trying to exploit CVE-2025-21298! 🚨☠️ filescan.io/uploads/679a76… #exploit #RCE #maldoc #CVE

filescan_itsec's tweet image. ⚠️ OLE objects embedded within RTF files are suspicious. ⚠️ 🤔 🚨 But if the context is an email containing an attached RTF with an OLE object, it may be trying to exploit CVE-2025-21298! 🚨☠️ filescan.io/uploads/679a76… #exploit #RCE #maldoc #CVE
0
3
6
2
1K

United States Trends

You might like

Something went wrong.


Something went wrong.