iiinova — where your digital self keeps evolving

jamesinthebox.bsky.social @jamesinthebox.bsky.social · 05/03/2025

If you'be been dealing with these janky downloaders ("pdfs" if MiTM the TLS), these have been #darkcloud #stealer so far: app.any.run/tasks/925ce6... Look for: vbs file showip\.net LoginData WebData keyDBPath.db in the run and StrFtpServer DCS V in the dmp file

000

jamesinthebox.bsky.social @jamesinthebox.bsky.social · 03/03/2025

A csv formatted list of #malspam campaigns that crossed my path in February to include #malware name, c2, hash, subject, and email exfil addresses: gist.github.com/silence-is-b... #retrohunt

000

jamesinthebox.bsky.social @jamesinthebox.bsky.social · 26/02/2025

Huh...first time I've seen threat actor's using @ThinkstCanary : https:// assistance-newton-adam-indiana.trycloudflare\.com

100

jamesinthebox.bsky.social @jamesinthebox.bsky.social · 26/02/2025

Badness at: 144.91.79.54/10022025/ app.any.run/tasks/70b515... Ultimately #darkcloud (the txt file); c2 juguly\.shop

000

jamesinthebox.bsky.social @jamesinthebox.bsky.social · 20/02/2025

If you're not blocking trycloudflare\.com at the perimeter, now's the time: #opendir 's: https:// em-ash-announcements-alpha.trycloudflare\.com/1DSAHJKSA/ -> https:// did-efficiency-than-lenses.trycloudflare\.com -> https:// reached-theoretical-regular-impact\.trycloudflare.com

121

jamesinthebox.bsky.social @jamesinthebox.bsky.social · 12/02/2025

http:// account\.empireaccelerate.com:9200/empire_account/account/account.do 🤨

000

jamesinthebox.bsky.social @jamesinthebox.bsky.social · 07/02/2025

When the threat actor REALLY wants it to run... #venomrat c2: 176.65.142.172:4449

110

jamesinthebox.bsky.social @jamesinthebox.bsky.social · 03/02/2025

A csv formatted list of #malspam campaigns that crossed my path in January to include subjects, hashes, c2's, #malware type, and email exfil addresses: gist.github.com/silence-is-b... #retrohunt

000

jamesinthebox.bsky.social @jamesinthebox.bsky.social · 02/02/2025

When #windows decides it's had enough of you blocking it's update/telemetry processes (going to wd-prod-cp-us-west-2-fe\.westus.cloudapp.azure.com) and just yeats out the lookup over #netbios 🤷

000

jamesinthebox.bsky.social @jamesinthebox.bsky.social · 24/01/2025

A fairly sizable distributed port scan (all source port 19000) about 30 minutes ago; raw logs and sources here: gist.github.com/silence-is-b...

011

jamesinthebox.bsky.social @jamesinthebox.bsky.social · 23/01/2025

If you're....you know...bored... app.any.run/tasks/365f89...

020

jamesinthebox.bsky.social @jamesinthebox.bsky.social · 22/01/2025

#webshell #opendir #netsupport #rat at: https:// appointedtimeagriculture\.com/wp-includes/blocks/post-content/ GatewayAddress=95.179.158.213:443 RADIUSSecret=dgAAAPpMkI7ke494fKEQRUoablcA

000

jamesinthebox.bsky.social @jamesinthebox.bsky.social · 16/01/2025

As much as I was excited about #telegram cooperating with LE...I haven't noticed much of a change: app.any.run/tasks/694cb9...

100

jamesinthebox.bsky.social @jamesinthebox.bsky.social · 09/01/2025

#opendir at: https:// superior-somalia-bs-leisure.trycloudflare\.com -> http:// jsnybsafva\.biz:8030

141

jamesinthebox.bsky.social @jamesinthebox.bsky.social · 06/01/2025

A late (due to holiday vacation) and sparse csv formatted list of #malspam campaigns that crossed my path in December to include subjects, #malware, hashes, c2's, and email exfil addresses: gist.github.com/silence-is-b... #retrohunt

031

jamesinthebox.bsky.social @jamesinthebox.bsky.social · 05/12/2024

Interesting use of @Formstack as an interactive landing page for a #ms365 #phish: https:// bilykfilms .com/m/ is the site.

041

jamesinthebox.bsky.social @jamesinthebox.bsky.social · 02/12/2024

An unsurprisingly light csv formatted list of #malspam campaigns that crossed my path in November to included subjects, #malware type, hashes, c2's and email exfil addresses: gist.github.com/silence-is-b... #retrohunt #infosec #cybersecurity

091

jamesinthebox.bsky.social @jamesinthebox.bsky.social · 27/11/2024

A curious js file... app.any.run/tasks/112848...

171