#opendir 搜尋結果

New domain, same #OpenDir + new #malware directory. libertytrading-biz[.]com/pure/APPDATA[.]exe "APPDATA.exe" - app.any.run/tasks/99bcb3f6… #stealer #purehvnc #netreactor #zgrat @anyrun_app

🧵 www[.]packinqsolutionsindia[.]com - An interesting collection of #RMM dropper and #Phishing pages in an #OpenDir #SimpleHelp #ConnectWise #LogMeInResolve etc. Impersonates @SocialSecurity @CanRevAgency @Intuit @QuickBooks @onedrive @TencentGlobal etc. Operation has been…

FUD 'Docusign_Document.pdf.url' seen from Singapore @abuse_ch bazaar.abuse.ch/sample/9ae7e1c… URL's #opendir: hxxp://tammhdka(.)shop:5970/1BT/yerk.bat hxxps://polyphonic-lights-shipped-minneapolis.trycloudflare(.)com/1ym.zip…

So, someone is running a social engineering campaign (#ClickFix) impersonating Rapid7 and using an old/abandoned domain that belonged to the same company? 🤔 🔸 https://rapid7labs[.]com/printer.html (#opendir) "Printer Vulnerability Remediation Steps" (possibly related to this…

🧵2 Another #Opendir …reproduce-amenities.trycloudflare.com

Whoever left an #OpenDir with #Malwar clearly wanted to be discovered 🕵️🤦‍♂️ Thanks for the samples, Freddy Krueger of web servers. 🎁🔍🤣 hxxps://frontier-shops-timothy-cal.trycloudflare.com/ rec.wsh📸➡️e22f1c9ea85b355de40e22601d0f680a Drops ⬇️🧵2

🚩 #ClickFix ("Rapid7 IT Advisory") → macOS users → Apfell (red teaming framework). URL: https://security-usa[.]com:8443/printer.html (#opendir). "CRITICAL ADVISORY: Xerox Client Update Immediate action required for all Moose" + "If you're looking at this, this is part of a…

This ones has a #WsgiDAV #opendir full mirror at hxxp://91.219.239(.)49:7940/ ServerAstra Kft #Hungary emojohbokloc-dedicated.serverastra(.)com AS56322 Still active mirror to these #trycloudflare pages: ethical-points-competitive-fluid.trycloudflare(.)com…

💀 #Malware Analysis Resource — 123 EXE Files 💀 #Opendir contains 123 .EXE files. Handle with extreme caution — good source for #Malware analysts. Access: static[.]centbrowser[.]com/SysinternalsSuite/

XWORM #opendir #rust #loader Rust Loader is been used to download XWORM. @JAMESWT_WT @abuse_ch

#malware #opendir #xloader (small one works, big one not so much) at: https://royfils\.com/encrypt/ 2cd9b8fb88e7cbbc5c049441fb61e0aea7be23dc7aa2c109c13abefe7a2ac943 4733feaca04e871d4e0bb052f2437a2f46f10852602ea4f8b2f0170f4838dd87

That awkward moment when an #Malware #Opendir is more organized than your inbox except this one wants to #RCE you #ThreatIntel 😂 1⃣hxxp://172.245.27.131/ 2⃣hxxps://scratch-orbit-method-unlikely.trycloudflare.com 3⃣hxxps://significant-adopted-bearing-own.trycloudflare.com/pyank/

Another #WsgiDAV #opendir hxxps://scratch-orbit-method-unlikely.trycloudflare(.)com/ "RUP" "W1PP" "WYA" folders contains LNK bazaar.abuse.ch/sample/8f40b6c… bazaar.abuse.ch/sample/bf82d23… bazaar.abuse.ch/sample/9b32646… @skocherhan

#malware #opendir at: http://179.43.176].109:8081/Downloads/1/

'DATEV-Rechnung Nr. 21412122025.pdf.lnk' @abuse_ch bazaar.abuse.ch/sample/b13fe27… #WsgiDAV #opendir with LNK that was seen from Germany: hxxps://msg-presented-threshold-figure.trycloudflare(.)com/DE/DATEV-Rechnung%20Nr.%2021412122025.pdf.lnk

@Huntio shows the IP 89.110.95.186 to be part of a broader infra cluster reusing SSH keys across multiple VPS providers, likely automated or C2-related activity. Several linked hosts (🇩🇪 🇳🇱 🇺🇸 🇵🇱) seen active Oct–Nov 2025. An #opendir is also observed at 5.253.86.21.

Our friend is still active on this IP, related to Systembc and some ransomware samples urlhaus.abuse.ch/host/94.198.53… #opendir

#Opendir sample: netscan.exe hxxps[:]//www[.]onpointlc[.]com/programs/ netscan.exe Used by #INCRansom #Ransomware for internal reconnaissance. Handle with caution. Good source for #Malware analysts.

#Opendir sample files: ipscan221.exe, netscan.exe hxxps[:]//kandev[.]com/files/apps/ Handle with caution. Good source for #Malware analysts. Do not download or run samples outside an isolated lab. Report to vendor/CERT.

#Opendir sample: netscan.exe hxxps[:]//fen[.]home[.]pl/pub/webFTP/sterowniki/Welland/ #Poland Handle with caution. Good source for #Malware analysts. Do not download or run samples outside an isolated lab.

Our friend is still active on this IP, related to Systembc and some ransomware samples urlhaus.abuse.ch/host/94.198.53… #opendir

#malware #opendir at: http://179.43.176].109:8081/Downloads/1/

#DarkVisionRAT #opendir https://5.89.185[.]156/

🤔 #opendir hxxp://34.101.154[.]50

#opendir #malware #sliver hxxp://136.0.44.4:8000/

#Opendir #Panel 🇧🇷 Sites: hxxp://74.207.237.97/ hxxp://24.152.39.178/contador/ hxxp://24.152.37.226/contador/

🚨#OpenDir hxxp://sremc.duckdns.org

Large #opendir at: http://57.180.253.244 medium confidence msbuild.exe is #ghostrat

🚩 #ClickFix ("Rapid7 IT Advisory") → macOS users → Apfell (red teaming framework). URL: https://security-usa[.]com:8443/printer.html (#opendir). "CRITICAL ADVISORY: Xerox Client Update Immediate action required for all Moose" + "If you're looking at this, this is part of a…

#Malware 🇧🇷 Sitio falso de MercadoEnvios descarga: - zip -> msi - AnyDesk Sites: hxxps://52.159.123.0/ hxxp://20.206.241.68/ #opendir C2 52.159.123.]0:6400 20.206.241.]68:6400

When threat actors forget to lock the door… and leave their malware stash wide open 🚪💀 🔥Found two lovely #Opendir today full of #Malware: 1⃣hxxps://encryptedfiletransfer-end-to-enduploads.info/ 2⃣htxxp://45.128.223.118:8000/ Don't be shy and analyze them 😉

#mirai #opendir at http://31.220.3.140

🚨#Opendir #Malware🚨 hxxps://45.81.113.220/ ⚠️#QuasarRAT ☣️📸Client.exe➡️efffe2afbc5d8a0ad85b16155f0e1ed6 📡📸tcp://45.81.113.220:1605

#opendir #cobalstrike and more cc: @500mk500 @JAMESWT_WT

#opendir #obfuscated bat files

#malware #opendir at: http://invoicetrycloudflare\.com:9983/

#Malware KL Remota "Zeus" 🇧🇷 Payloads #Opendir hxxp://92.205.129.120/ Contador hxxps://3illeceara1e2.likescandy.com/ C2 92.205.231.]161:80

#phishing #opendir: https://dmc.otarvesq\.com/POST/

#opendir 106.14.176.]208 Is hosting several suspicious ELF files communicating w/ the above IP on port 7744 and frp, likely to proxy traffic. RingQ, an open-source Windows shellcode generator, is also present. A week ago, Vshell was also detected on this IP on port 8082.

#Malware posible APT-C-36 🇨🇴 Remcos & njrat #Opendir hxxp://167.0.201.5/ hxxps://186.169.63.46/ hxxp://190.9.223.135/ hxxp://186.169.83.212/ C2 sost2024ene.]duckdns.]org:1213 remcosoct.]duckdns.]org:4576 02oct.]duckdns.]org:9001