#reverseloader #remcos #opendir at:

http://107.172.235\.213/95/ also img dir

c2: 173.231.188\.244:14641

#reverseloader #xworm #opendir at:

http://172.245.209\.253/203/

c2: 172.245.106\.54:3333

From #clickfix to #stealc

https://app.any.run/tasks/9cd9a0f0-bf6f-4a23-9bf0-4d804f816b07

c2: https:// pas. canamrent .com/

A csv formatted list of #malspam campaigns that crossed my path in May to include #malware, subjects, hashes, c2's, and email exfil addresses:

https://gist.github.com/silence-is-best/9b7365532f5ceb3b963bbc2dc3d8e876

#retrohunt

A new one on me.. #overlord rat at:

https:// localgolf\.globalmerx\.es/ssa/Windows/utility.php

https://app.any.run/tasks/f0336476-584b-4970-9ab7-fb4e6882f896

Fresh #gostealer :

https://app.any.run/tasks/ffd0507e-40e2-4ec4-8b87-ac90ef081889

Couple #reverseloader -> #xloader #opendir at:

http://107.175.246 .42/25/
http://89.40.31 .143/img/

An on time (yay) csv formatted list of #malspam campaigns that crossed my path in April to include #malware type, c2, hash, subject, and email exfil addresses:

https://gist.github.com/silence-is-best/bc95a949f272f8c5487d057bbd74d14f

#retrohunt

#nanocore......#ransomware ..?

https://app.any.run/tasks/0f06cf0b-8417-4e7d-83db-0fd384472772

No files actually encrypted though 🤔