r3dbU7z's profile picture. Биомусор | Bio-garbage

̇

@r3dbU7z

Биомусор | Bio-garbage

Pinned

Important Message to All my Followers & Readers. Please keep in mind that: I am absolutely not connected with cybersecurity or IT, it is not my profession because I do not have a profession. And I do not have education. Do not trust what I do. Thank you for reading.


̇ reposted

Beware the Unpatchable: Corona Mirai Botnet Spreads via Zero-Day | Akamai akamai.com/blog/security-…


#специальнодлятупых A Special Secret Hint, for those who are fishing in a fish store -> f2c879bedd2257d131a87cd15d194174 Ref[1]: valhalla.nextron-systems.com/info/rule/SUSP…

r3dbU7z's tweet image. #специальнодлятупых

A Special Secret Hint, for those who are fishing in a fish store ->

f2c879bedd2257d131a87cd15d194174

Ref[1]:
valhalla.nextron-systems.com/info/rule/SUSP…
r3dbU7z's tweet image. #специальнодлятупых

A Special Secret Hint, for those who are fishing in a fish store ->

f2c879bedd2257d131a87cd15d194174

Ref[1]:
valhalla.nextron-systems.com/info/rule/SUSP…

Очередного персонажа забанили в Твиттере: Когда за тебя уже все нашли, легко и удобно публиковать результаты чужой работы. Сообщество обязательно оценит твой труд в X. С другой стороны-если бы я не загрузил свой архив на VT-не было самого сообщения этого исследователя и охотника.

r3dbU7z's tweet image. Очередного персонажа забанили в Твиттере:
Когда за тебя уже все нашли, легко и удобно публиковать результаты чужой работы. Сообщество обязательно оценит твой труд в X. С другой стороны-если бы я не загрузил свой архив на VT-не было самого сообщения этого исследователя и охотника.

#письма_счастья NotificacaoAutuacao_023400E61936083-206920.pdf.[lnk] 6e4e582b51b73cd75345d6f8c585207d url: portalservicos-denatran-serpro-gov-br\.org 🇧🇷🚔 Ref[1]: virustotal.com/gui/file/a8cc6… See also -> url: computador\.run Ref[2]: virustotal.com/gui/file/de6df…

r3dbU7z's tweet image. #письма_счастья

NotificacaoAutuacao_023400E61936083-206920.pdf.[lnk]
6e4e582b51b73cd75345d6f8c585207d

url: portalservicos-denatran-serpro-gov-br\.org  🇧🇷🚔

Ref[1]:
virustotal.com/gui/file/a8cc6…

See also ->

url: computador\.run

Ref[2]:
virustotal.com/gui/file/de6df…

̇ reposted

#Cthulhu Stealer targeting #macOS spotted in the wild! 🦑 Similar to #AMOS Stealer but with key differences. Great breakdown by @CadoSecurity 👏 – stages data in /Users/Shared/NW/, compresses it for exfiltration, and uses OpenSSL for AES decryption.

MarceloRivero's tweet image. #Cthulhu Stealer targeting #macOS spotted in the wild! 🦑 Similar to #AMOS Stealer but with key differences. Great breakdown by @CadoSecurity 👏 – stages data in /Users/Shared/NW/, compresses it for exfiltration, and uses OpenSSL for AES decryption.

MY SECURE #OPENDIR FOLDER !11 url: mysecureserveronlinefolder[.]com Stager-> tax_documents.[lnk] 93ce603aedbecf6e0946bba2674043ff -> Lumma-E tax_documents f2db0977b7c9377131ee5b7e5d9260c4 -> Remcos InnoPack\.exe 8359912322add7b9bb3cfa27253c448e Ref[1]: virustotal.com/gui/file/82956…

r3dbU7z's tweet image. MY SECURE #OPENDIR FOLDER !11

url: mysecureserveronlinefolder[.]com

Stager->
tax_documents.[lnk]
93ce603aedbecf6e0946bba2674043ff
->
Lumma-E
tax_documents
f2db0977b7c9377131ee5b7e5d9260c4
->
Remcos
InnoPack\.exe 
8359912322add7b9bb3cfa27253c448e

Ref[1]:
virustotal.com/gui/file/82956…
r3dbU7z's tweet image. MY SECURE #OPENDIR FOLDER !11

url: mysecureserveronlinefolder[.]com

Stager->
tax_documents.[lnk]
93ce603aedbecf6e0946bba2674043ff
->
Lumma-E
tax_documents
f2db0977b7c9377131ee5b7e5d9260c4
->
Remcos
InnoPack\.exe 
8359912322add7b9bb3cfa27253c448e

Ref[1]:
virustotal.com/gui/file/82956…

Domain Impersonation url: loginsmoobu[.]com /Downloads/ Document.pdf\.lnk Original Domain -> [ smoobu.com ] "Smoobu ᐅ The Short-Term & Vacation Rental Software" Ref[1]: virustotal.com/gui/domain/log… Ref[2]: Document.pdf\.lnk virustotal.com/gui/file/76b3d…

r3dbU7z's tweet image. Domain Impersonation

url: loginsmoobu[.]com /Downloads/ Document.pdf\.lnk

Original Domain -> [ smoobu.com ]
"Smoobu ᐅ The Short-Term & Vacation Rental Software"

Ref[1]:
virustotal.com/gui/domain/log…

Ref[2]:
Document.pdf\.lnk  
virustotal.com/gui/file/76b3d…
r3dbU7z's tweet image. Domain Impersonation

url: loginsmoobu[.]com /Downloads/ Document.pdf\.lnk

Original Domain -> [ smoobu.com ]
"Smoobu ᐅ The Short-Term & Vacation Rental Software"

Ref[1]:
virustotal.com/gui/domain/log…

Ref[2]:
Document.pdf\.lnk  
virustotal.com/gui/file/76b3d…
r3dbU7z's tweet image. Domain Impersonation

url: loginsmoobu[.]com /Downloads/ Document.pdf\.lnk

Original Domain -> [ smoobu.com ]
"Smoobu ᐅ The Short-Term & Vacation Rental Software"

Ref[1]:
virustotal.com/gui/domain/log…

Ref[2]:
Document.pdf\.lnk  
virustotal.com/gui/file/76b3d…

#nocomments Ref[1]: 62.133.61.56_Downloads.zip virustotal.com/gui/file/f809d…

r3dbU7z's tweet image. #nocomments

Ref[1]:
62.133.61.56_Downloads.zip
virustotal.com/gui/file/f809d…


#nocomments Ref[1]: 62.133.61.56_Downloads.zip virustotal.com/gui/file/f809d…

r3dbU7z's tweet image. #nocomments

Ref[1]:
62.133.61.56_Downloads.zip
virustotal.com/gui/file/f809d…

#opendir `undetectable` #metasploit url: keylifeofenzyme\.com Ref[1]: virustotal.com/gui/domain/key…

r3dbU7z's tweet image. #opendir `undetectable` #metasploit

url: keylifeofenzyme\.com

Ref[1]:
virustotal.com/gui/domain/key…
r3dbU7z's tweet image. #opendir `undetectable` #metasploit

url: keylifeofenzyme\.com

Ref[1]:
virustotal.com/gui/domain/key…

̇ reposted

Found 3 domains masquerading as #fake #telegram websites delivering #RAT with surprisingly low detections on VT for the .msi installers that they drop 1. hxxps://47.236.48.41 resolves to www.telegram-in.]com 2. www.telegramkd.]com 3. www.telegram-apk.]com file link below

raghav127001's tweet image. Found 3 domains masquerading as #fake #telegram websites delivering #RAT with surprisingly low detections on VT for the .msi installers that they drop

1. hxxps://47.236.48.41 resolves to www.telegram-in.]com
2. www.telegramkd.]com
3. www.telegram-apk.]com

file link below
raghav127001's tweet image. Found 3 domains masquerading as #fake #telegram websites delivering #RAT with surprisingly low detections on VT for the .msi installers that they drop

1. hxxps://47.236.48.41 resolves to www.telegram-in.]com
2. www.telegramkd.]com
3. www.telegram-apk.]com

file link below
raghav127001's tweet image. Found 3 domains masquerading as #fake #telegram websites delivering #RAT with surprisingly low detections on VT for the .msi installers that they drop

1. hxxps://47.236.48.41 resolves to www.telegram-in.]com
2. www.telegramkd.]com
3. www.telegram-apk.]com

file link below

#суровыйибеспощадныйэстонскийбюджет🇪🇪 Lumma Stealer(?) url: ✅gregoryshuman\.com /Downloads/ Estonia_Consolidated_annual_report_of_the_state2024\.lnk 95c380b57b24829d79ca4087018f500b -> Ref[1]: Estonia3 virustotal.com/gui/file/2812b…

r3dbU7z's tweet image. #суровыйибеспощадныйэстонскийбюджет🇪🇪
Lumma Stealer(?)

url: ✅gregoryshuman\.com /Downloads/
Estonia_Consolidated_annual_report_of_the_state2024\.lnk
95c380b57b24829d79ca4087018f500b ->

Ref[1]:
Estonia3
virustotal.com/gui/file/2812b…
r3dbU7z's tweet image. #суровыйибеспощадныйэстонскийбюджет🇪🇪
Lumma Stealer(?)

url: ✅gregoryshuman\.com /Downloads/
Estonia_Consolidated_annual_report_of_the_state2024\.lnk
95c380b57b24829d79ca4087018f500b ->

Ref[1]:
Estonia3
virustotal.com/gui/file/2812b…

#понедельникденьтяжелый atlaissian BUT moday DOT com url: atlaissian\.com 🕶️ url: roobsadlov[.cloud /j7xl6v -> Monday-release-\.exe App-release-.exe [Inno Setup installer] 87ae797946f26db53e7f0847877e5cb9 Ref[1]: virustotal.com/gui/file/212e0…

r3dbU7z's tweet image. #понедельникденьтяжелый

atlaissian BUT moday DOT com

url: atlaissian\.com 🕶️

url: roobsadlov[.cloud /j7xl6v -> 
Monday-release-\.exe
App-release-.exe
[Inno Setup installer]
87ae797946f26db53e7f0847877e5cb9

Ref[1]:
virustotal.com/gui/file/212e0…
r3dbU7z's tweet image. #понедельникденьтяжелый

atlaissian BUT moday DOT com

url: atlaissian\.com 🕶️

url: roobsadlov[.cloud /j7xl6v -> 
Monday-release-\.exe
App-release-.exe
[Inno Setup installer]
87ae797946f26db53e7f0847877e5cb9

Ref[1]:
virustotal.com/gui/file/212e0…

JS stealer url: mireiaskqans\.com Ref[1]: EditPro_Installer-release-\.exe virustotal.com/gui/file/269f1… URLs: doweoanst\.pro foojerwa\.ink amorefysuop\.pro fostoopas\.site fostoopas\.cloud afternburner\.org hoopsature\.click Ref[2]: virustotal.com/gui/file/12876…

r3dbU7z's tweet image. JS stealer

url: mireiaskqans\.com

Ref[1]:
EditPro_Installer-release-\.exe
virustotal.com/gui/file/269f1…

URLs:
doweoanst\.pro
foojerwa\.ink
amorefysuop\.pro
fostoopas\.site
fostoopas\.cloud                   
afternburner\.org
hoopsature\.click

Ref[2]:
virustotal.com/gui/file/12876…
r3dbU7z's tweet image. JS stealer

url: mireiaskqans\.com

Ref[1]:
EditPro_Installer-release-\.exe
virustotal.com/gui/file/269f1…

URLs:
doweoanst\.pro
foojerwa\.ink
amorefysuop\.pro
fostoopas\.site
fostoopas\.cloud                   
afternburner\.org
hoopsature\.click

Ref[2]:
virustotal.com/gui/file/12876…


Loading...

Something went wrong.


Something went wrong.