filescan_itsec's profile picture. http://Filescan.io is a next-gen sandbox and malware analysis service. Operating at 10x speed vs traditional, it is the best choice for in-depth malware assessment

Filescan.io

@filescan_itsec

http://Filescan.io is a next-gen sandbox and malware analysis service. Operating at 10x speed vs traditional, it is the best choice for in-depth malware assessment

Pinned

🛠️ Today, we’re sharing the untold story behind the sandbox technology that empowers our community. Detonator dives into Jan Miller’s journey—bootstrapping, persistence, and a drive to build something better: 🔗 youtube.com/watch?v=C1pa2c… #sandbox #startup #cybersecurity #infosec

filescan_itsec's tweet image. 🛠️ Today, we’re sharing the untold story behind the sandbox technology that empowers our community.

Detonator dives into Jan Miller’s journey—bootstrapping, persistence, and a drive to build something better:
🔗 youtube.com/watch?v=C1pa2c…

#sandbox #startup #cybersecurity #infosec

🚀 Malicious #AI models aren’t theory—they’re a real supply-chain threat. Attackers use new evasion tricks to slip past scanners. See how filescan.io detects poisoned models before they reach production: opsw.at/cDGW3Zh #AI #SecOps #Infosec #Sandbox

filescan_itsec's tweet image. 🚀 Malicious #AI models aren’t theory—they’re a real supply-chain threat.  Attackers use new evasion tricks to slip past scanners.

See how filescan.io detects poisoned models before they reach production: opsw.at/cDGW3Zh

#AI #SecOps #Infosec #Sandbox

Attackers abused Alibaba #AI brand to push fake #PyPI packages with malicious #Pickle stealer 😈🥒. Though online less than 24 hours, they were downloaded ~1,600 times. This shows how fast supply chain attacks can spread Check out sandbox's Pickle scan: filescan.io/uploads/68bf95…

filescan_itsec's tweet image. Attackers abused Alibaba #AI brand to push fake #PyPI packages with 
malicious #Pickle stealer 😈🥒. Though online less than 24 hours, they 
were downloaded ~1,600 times. This shows how fast supply chain attacks 
can spread
Check out sandbox's Pickle scan: filescan.io/uploads/68bf95…
filescan_itsec's tweet image. Attackers abused Alibaba #AI brand to push fake #PyPI packages with 
malicious #Pickle stealer 😈🥒. Though online less than 24 hours, they 
were downloaded ~1,600 times. This shows how fast supply chain attacks 
can spread
Check out sandbox's Pickle scan: filescan.io/uploads/68bf95…
filescan_itsec's tweet image. Attackers abused Alibaba #AI brand to push fake #PyPI packages with 
malicious #Pickle stealer 😈🥒. Though online less than 24 hours, they 
were downloaded ~1,600 times. This shows how fast supply chain attacks 
can spread
Check out sandbox's Pickle scan: filescan.io/uploads/68bf95…

How cool is it when AI flags a malicious email at entry, and sandbox emulates the infection chain in seconds? email > doc > shellcode > vbs > ps > payload Check out a #phishing email we received last week in our community instance: filescan.io/uploads/68b8b0… #aidetect #sandbox

filescan_itsec's tweet image. How cool is it when AI flags a malicious email at entry, and sandbox emulates the infection chain in seconds?
email > doc > shellcode > vbs > ps > payload
Check out a #phishing email we received last week in our community instance: filescan.io/uploads/68b8b0…
#aidetect #sandbox
filescan_itsec's tweet image. How cool is it when AI flags a malicious email at entry, and sandbox emulates the infection chain in seconds?
email > doc > shellcode > vbs > ps > payload
Check out a #phishing email we received last week in our community instance: filescan.io/uploads/68b8b0…
#aidetect #sandbox
filescan_itsec's tweet image. How cool is it when AI flags a malicious email at entry, and sandbox emulates the infection chain in seconds?
email > doc > shellcode > vbs > ps > payload
Check out a #phishing email we received last week in our community instance: filescan.io/uploads/68b8b0…
#aidetect #sandbox
filescan_itsec's tweet image. How cool is it when AI flags a malicious email at entry, and sandbox emulates the infection chain in seconds?
email > doc > shellcode > vbs > ps > payload
Check out a #phishing email we received last week in our community instance: filescan.io/uploads/68b8b0…
#aidetect #sandbox

Nothing beats a .NET holiday! 🎶 Wait... 🦸 Our #sandbox does! The sample hides malicious DLLs in image resources using #steganography 🖼️🐀 which will then perform the decrypting and loading of the final #stealer payload ⚙️ Our detection: filescan.io/uploads/689ca1… #malware

filescan_itsec's tweet image. Nothing beats a .NET holiday!  🎶   Wait... 🦸 Our #sandbox does!

The sample hides malicious DLLs in image resources using #steganography 🖼️🐀 which will then perform the decrypting and loading of the final #stealer payload 

⚙️  Our detection:
filescan.io/uploads/689ca1…

#malware
filescan_itsec's tweet image. Nothing beats a .NET holiday!  🎶   Wait... 🦸 Our #sandbox does!

The sample hides malicious DLLs in image resources using #steganography 🖼️🐀 which will then perform the decrypting and loading of the final #stealer payload 

⚙️  Our detection:
filescan.io/uploads/689ca1…

#malware

Opendir on compromised website #Remcos hides in plain sight on a compromised website. Sandboxing helps cut noise on #opendir discovery & extract C2s fast. Go hunt on filescan.io! Curious? Check it out: filescan.io/uploads/6852d3… #ThreatIntel

filescan_itsec's tweet image. Opendir on compromised website

#Remcos hides in plain sight on a compromised website. Sandboxing helps cut noise on #opendir discovery & extract C2s fast. Go hunt on filescan.io!

Curious? Check it out:
filescan.io/uploads/6852d3…

#ThreatIntel
filescan_itsec's tweet image. Opendir on compromised website

#Remcos hides in plain sight on a compromised website. Sandboxing helps cut noise on #opendir discovery & extract C2s fast. Go hunt on filescan.io!

Curious? Check it out:
filescan.io/uploads/6852d3…

#ThreatIntel

#KatzStealer was recently spotted for sale in underground forums. Now flooding the wild via classic chain: gzip > JS > PowerShell > image w/ hidden .NET loader. Unmask the obfuscated chain and reach the payload in secs, check its trace! filescan.io/uploads/680f74… #stealer #sandbox

filescan_itsec's tweet image. #KatzStealer was recently spotted for sale in underground forums. Now flooding the wild via classic chain: gzip > JS > PowerShell > image w/ hidden .NET loader.
Unmask the obfuscated chain and reach the payload in secs, check its trace! filescan.io/uploads/680f74…

#stealer #sandbox
filescan_itsec's tweet image. #KatzStealer was recently spotted for sale in underground forums. Now flooding the wild via classic chain: gzip > JS > PowerShell > image w/ hidden .NET loader.
Unmask the obfuscated chain and reach the payload in secs, check its trace! filescan.io/uploads/680f74…

#stealer #sandbox

🚨 Stealthy PowerShell dropper evades delivers XWorm! Stealthy PowerShell dropper evades AVs! Adds Defender exclusions & drops multiple malicious EXEs. Uses irm | iex for remote execution, delivering #XWorm. Check out the report: filescan.io/uploads/680999…

filescan_itsec's tweet image. 🚨 Stealthy PowerShell dropper evades delivers XWorm!

Stealthy PowerShell dropper evades AVs! Adds Defender exclusions & drops multiple malicious EXEs. Uses irm | iex for remote execution, delivering #XWorm.

Check out the report: filescan.io/uploads/680999…
filescan_itsec's tweet image. 🚨 Stealthy PowerShell dropper evades delivers XWorm!

Stealthy PowerShell dropper evades AVs! Adds Defender exclusions & drops multiple malicious EXEs. Uses irm | iex for remote execution, delivering #XWorm.

Check out the report: filescan.io/uploads/680999…
filescan_itsec's tweet image. 🚨 Stealthy PowerShell dropper evades delivers XWorm!

Stealthy PowerShell dropper evades AVs! Adds Defender exclusions & drops multiple malicious EXEs. Uses irm | iex for remote execution, delivering #XWorm.

Check out the report: filescan.io/uploads/680999…

WSF challenges traditional sandboxes & AVs! This one evades detection but unravels fast with emulation, exposing modus operandi & infrastructure in seconds: WSF > Base64+XOR > Remote BAT > Persistence & Payload Fetch > PyArmor Scripts filescan.io/uploads/67ed06… #adaptive #sandbox

filescan_itsec's tweet image. WSF challenges traditional sandboxes & AVs! This one evades detection but unravels fast with emulation, exposing modus operandi & infrastructure in seconds:
WSF > Base64+XOR > Remote BAT > Persistence & Payload Fetch > PyArmor Scripts

filescan.io/uploads/67ed06…

#adaptive #sandbox
filescan_itsec's tweet image. WSF challenges traditional sandboxes & AVs! This one evades detection but unravels fast with emulation, exposing modus operandi & infrastructure in seconds:
WSF > Base64+XOR > Remote BAT > Persistence & Payload Fetch > PyArmor Scripts

filescan.io/uploads/67ed06…

#adaptive #sandbox
filescan_itsec's tweet image. WSF challenges traditional sandboxes & AVs! This one evades detection but unravels fast with emulation, exposing modus operandi & infrastructure in seconds:
WSF > Base64+XOR > Remote BAT > Persistence & Payload Fetch > PyArmor Scripts

filescan.io/uploads/67ed06…

#adaptive #sandbox

🚨⚠️Some attackers discovered that cropping the bottom pixels of a QRcode would get many automatic scanners to miss the actual QR💀 Guess what... we discovered it too!🦉MONTHS AGO!😎 Though we realized that many vendors are still missing this. Our report: filescan.io/uploads/67c84d…

filescan_itsec's tweet image. 🚨⚠️Some attackers discovered that cropping the bottom pixels of a QRcode would get many automatic scanners to miss the actual QR💀
Guess what... we discovered it too!🦉MONTHS AGO!😎 Though we realized that many vendors are still missing this.
Our report:
filescan.io/uploads/67c84d…
filescan_itsec's tweet image. 🚨⚠️Some attackers discovered that cropping the bottom pixels of a QRcode would get many automatic scanners to miss the actual QR💀
Guess what... we discovered it too!🦉MONTHS AGO!😎 Though we realized that many vendors are still missing this.
Our report:
filescan.io/uploads/67c84d…

A 6-month-old .NET PE injector remains undetected on archive.org! This file was flagged as clean... and still available for its usage 🚨 VBScript → PowerShell → base64 .PE + reflective loading → .NET PE injector → #PureLogs Stealer filescan.io/uploads/678f55…

filescan_itsec's tweet image. A 6-month-old .NET PE injector remains undetected on archive.org! This file was flagged as clean... and still available for its usage 🚨
VBScript → PowerShell → base64 .PE + reflective loading → .NET PE injector → #PureLogs Stealer filescan.io/uploads/678f55…
filescan_itsec's tweet image. A 6-month-old .NET PE injector remains undetected on archive.org! This file was flagged as clean... and still available for its usage 🚨
VBScript → PowerShell → base64 .PE + reflective loading → .NET PE injector → #PureLogs Stealer filescan.io/uploads/678f55…
filescan_itsec's tweet image. A 6-month-old .NET PE injector remains undetected on archive.org! This file was flagged as clean... and still available for its usage 🚨
VBScript → PowerShell → base64 .PE + reflective loading → .NET PE injector → #PureLogs Stealer filescan.io/uploads/678f55…
filescan_itsec's tweet image. A 6-month-old .NET PE injector remains undetected on archive.org! This file was flagged as clean... and still available for its usage 🚨
VBScript → PowerShell → base64 .PE + reflective loading → .NET PE injector → #PureLogs Stealer filescan.io/uploads/678f55…

Stealthy execution via WebDAV is on the rise! 📈 #StrelaStealer used this technique to target Europe: email → obfuscated JS → PowerShell → WebDAV-hosted malware Check out this report: filescan.io/uploads/6793a5… Hunt more samples: filescan.io/search-result?… #sandbox #triage

filescan_itsec's tweet image. Stealthy execution via WebDAV is on the rise! 📈 #StrelaStealer used this technique to target Europe: email → obfuscated JS → PowerShell → WebDAV-hosted malware

Check out this report: filescan.io/uploads/6793a5…

Hunt more samples: filescan.io/search-result?…

#sandbox #triage
filescan_itsec's tweet image. Stealthy execution via WebDAV is on the rise! 📈 #StrelaStealer used this technique to target Europe: email → obfuscated JS → PowerShell → WebDAV-hosted malware

Check out this report: filescan.io/uploads/6793a5…

Hunt more samples: filescan.io/search-result?…

#sandbox #triage

⚠️ OLE objects embedded within RTF files are suspicious. ⚠️ 🤔 🚨 But if the context is an email containing an attached RTF with an OLE object, it may be trying to exploit CVE-2025-21298! 🚨☠️ filescan.io/uploads/679a76… #exploit #RCE #maldoc #CVE

filescan_itsec's tweet image. ⚠️ OLE objects embedded within RTF files are suspicious. ⚠️ 🤔

🚨 But if the context is an email containing an attached RTF with an OLE object, it may be trying to exploit CVE-2025-21298! 🚨☠️

filescan.io/uploads/679a76…

#exploit #RCE #maldoc #CVE

Emulation & YARA? 🔥 Perfect duo to identify malware even through thick layers of obfuscation! Email attachment -> obfuscated & multilayer JavaScript -> vjw0rm #phishing #adaptive #sandbox // Check it out: filescan.io/uploads/67575f…

filescan_itsec's tweet image. Emulation & YARA? 🔥 Perfect duo to identify malware even through thick layers of obfuscation! Email attachment -> obfuscated & multilayer JavaScript -> vjw0rm
#phishing #adaptive #sandbox // Check it out: filescan.io/uploads/67575f…
filescan_itsec's tweet image. Emulation & YARA? 🔥 Perfect duo to identify malware even through thick layers of obfuscation! Email attachment -> obfuscated & multilayer JavaScript -> vjw0rm
#phishing #adaptive #sandbox // Check it out: filescan.io/uploads/67575f…
filescan_itsec's tweet image. Emulation & YARA? 🔥 Perfect duo to identify malware even through thick layers of obfuscation! Email attachment -> obfuscated & multilayer JavaScript -> vjw0rm
#phishing #adaptive #sandbox // Check it out: filescan.io/uploads/67575f…
filescan_itsec's tweet image. Emulation & YARA? 🔥 Perfect duo to identify malware even through thick layers of obfuscation! Email attachment -> obfuscated & multilayer JavaScript -> vjw0rm
#phishing #adaptive #sandbox // Check it out: filescan.io/uploads/67575f…

Loading...

Something went wrong.


Something went wrong.