jamesinthebox.bsky.social @jamesinthebox.bsky.social · 06/05/2026You were saying? www.malwarebytes.com/blog/news/20...malwarebytes.comGoogle Chrome's silent 4GB AI download problemGoogle Chrome writes a 4GB AI model to users’ devices without asking, and reinstalls it if you delete it. 000
jamesinthebox.bsky.social @jamesinthebox.bsky.social · 06/03/2025Malicious @github repo at: github/.com/charlie... seen dropped via #xworm on a hijacked @operagxofficial installer app.any.run/tasks/4be36a...app.any.runAnalysis OperaGXSetup.exe (MD5: 331950DC665052789DC9FCB607CC10AF) Malicious activity - Interactive analysis ANY.RUNInteractive malware hunting service. Live testing of most type of threats in any environments. No installation and no waiting necessary. 000
jamesinthebox.bsky.social @jamesinthebox.bsky.social · 05/03/2025If you'be been dealing with these janky downloaders ("pdfs" if MiTM the TLS), these have been #darkcloud #stealer so far: app.any.run/tasks/925ce6... Look for: vbs file showip\.net LoginData WebData keyDBPath.db in the run and StrFtpServer DCS V in the dmp file 000
jamesinthebox.bsky.social @jamesinthebox.bsky.social · 05/03/2025Some fresh (and I can't believe I'm typing this) #lokibot: app.any.run/tasks/054d7a... c2: http:// touxzw\.ir/fix/five/fre.phpapp.any.runAnalysis Payment receipt PO 1437 1_ Payment receipt PO #1437 2.exe (MD5: 5A4FC3780CFC0527D12D8BB5134A81F5) Malicious activity - Interactive analysis ANY.RUNInteractive malware hunting service. Live testing of most type of threats in any environments. No installation and no waiting necessary. 000
jamesinthebox.bsky.social @jamesinthebox.bsky.social · 03/03/2025A csv formatted list of #malspam campaigns that crossed my path in February to include #malware name, c2, hash, subject, and email exfil addresses: gist.github.com/silence-is-b... #retrohunt 000
jamesinthebox.bsky.social @jamesinthebox.bsky.social · 26/02/2025Hrmm....thinking a whitehat has taken control ;) 000
jamesinthebox.bsky.social @jamesinthebox.bsky.social · 26/02/2025Huh...first time I've seen threat actor's using @ThinkstCanary : https:// assistance-newton-adam-indiana.trycloudflare\.com 100
jamesinthebox.bsky.social @jamesinthebox.bsky.social · 26/02/2025Badness at: 144.91.79.54/10022025/ app.any.run/tasks/70b515... Ultimately #darkcloud (the txt file); c2 juguly\.shop 000
jamesinthebox.bsky.social @jamesinthebox.bsky.social · 20/02/2025Ultimately #asyncrat and #hvnc: mathewhvnc.twilightparadox\.com kjhvnc.duckdns\.org rtasyn.duckdns\.org asyncyam.twilightparadox\.com 010
jamesinthebox.bsky.social @jamesinthebox.bsky.social · 20/02/2025If you're not blocking trycloudflare\.com at the perimeter, now's the time: #opendir 's: https:// em-ash-announcements-alpha.trycloudflare\.com/1DSAHJKSA/ -> https:// did-efficiency-than-lenses.trycloudflare\.com -> https:// reached-theoretical-regular-impact\.trycloudflare.com 121
jamesinthebox.bsky.social @jamesinthebox.bsky.social · 17/02/2025#phishing #opendir: dmc.otarvesq/.com/POST/ 010
jamesinthebox.bsky.social @jamesinthebox.bsky.social · 12/02/2025http:// account\.empireaccelerate.com:9200/empire_account/account/account.do 🤨 000
jamesinthebox.bsky.social @jamesinthebox.bsky.social · 07/02/2025When the threat actor REALLY wants it to run... #venomrat c2: 176.65.142.172:4449 110
jamesinthebox.bsky.social @jamesinthebox.bsky.social · 03/02/2025A csv formatted list of #malspam campaigns that crossed my path in January to include subjects, hashes, c2's, #malware type, and email exfil addresses: gist.github.com/silence-is-b... #retrohunt 000
jamesinthebox.bsky.social @jamesinthebox.bsky.social · 02/02/2025When #windows decides it's had enough of you blocking it's update/telemetry processes (going to wd-prod-cp-us-west-2-fe\.westus.cloudapp.azure.com) and just yeats out the lookup over #netbios 🤷 000
jamesinthebox.bsky.social @jamesinthebox.bsky.social · 24/01/2025A fairly sizable distributed port scan (all source port 19000) about 30 minutes ago; raw logs and sources here: gist.github.com/silence-is-b... 011
jamesinthebox.bsky.social @jamesinthebox.bsky.social · 23/01/2025If you're....you know...bored... app.any.run/tasks/365f89... 020
jamesinthebox.bsky.social @jamesinthebox.bsky.social · 22/01/2025#webshell #opendir #netsupport #rat at: https:// appointedtimeagriculture\.com/wp-includes/blocks/post-content/ GatewayAddress=95.179.158.213:443 RADIUSSecret=dgAAAPpMkI7ke494fKEQRUoablcA 000
jamesinthebox.bsky.social @jamesinthebox.bsky.social · 16/01/2025As much as I was excited about #telegram cooperating with LE...I haven't noticed much of a change: app.any.run/tasks/694cb9... 100
jamesinthebox.bsky.social @jamesinthebox.bsky.social · 09/01/2025Big zips appear to be a #python #stealer 000
jamesinthebox.bsky.social @jamesinthebox.bsky.social · 09/01/2025#opendir at: https:// superior-somalia-bs-leisure.trycloudflare\.com -> http:// jsnybsafva\.biz:8030 141
jamesinthebox.bsky.social @jamesinthebox.bsky.social · 06/01/2025A late (due to holiday vacation) and sparse csv formatted list of #malspam campaigns that crossed my path in December to include subjects, #malware, hashes, c2's, and email exfil addresses: gist.github.com/silence-is-b... #retrohunt 031
jamesinthebox.bsky.social @jamesinthebox.bsky.social · 10/12/2024An #expiro (believe it or not) dropping #xloader app.any.run/tasks/43f807... fake c2 and campaign: http ://www.sunnyz.store/px6japp.any.runAnalysis MA-DS-2024-03 URGENT.exe (MD5: B5C0BC1CA5223C4B18328235497A2EF6) Malicious activity - Interactive analysis ANY.RUNInteractive malware hunting service. Live testing of most type of threats in any environments. No installation and no waiting necessary. 110
jamesinthebox.bsky.social @jamesinthebox.bsky.social · 05/12/2024But it's not though. Not really. 000
jamesinthebox.bsky.social @jamesinthebox.bsky.social · 05/12/2024Interesting use of @Formstack as an interactive landing page for a #ms365 #phish: https:// bilykfilms .com/m/ is the site. 041
jamesinthebox.bsky.social @jamesinthebox.bsky.social · 02/12/2024An unsurprisingly light csv formatted list of #malspam campaigns that crossed my path in November to included subjects, #malware type, hashes, c2's and email exfil addresses: gist.github.com/silence-is-b... #retrohunt #infosec #cybersecurity 091
jamesinthebox.bsky.social @jamesinthebox.bsky.social · 27/11/2024A curious js file... app.any.run/tasks/112848... 171
