For a good time, just strings that malicious msi you found (https:// oanapolis .com.br/Receipt_9334.msi)..if it's #screenconnect c2 info is at the end...you don't even need to extract or run the thing.
James_inthe_box
- 589 Followers
- 179 Following
- 1,052 Posts
@iagox86 @campuscodi They work a treat downloading malware from geofenced hosts though ;)
@campuscodi Sadly the VPN bit of firefox requires an email. No reason to keep it on the drive then.
@NetscapeNavigator Exactly like all the "AI" companies....build dependency so people feel they can't do their jobs/live without it.
@malware_traffic Confirming #snake keylogger...
Bot telegram token and email exfil host:
8099843793:AAGeYKMLti1IpyT9o6bz7OtgdXF9md25uXA
hosting2\.ro\.hostsailor\.com
@5ecurityChemist Going to take a leap of faith and say you...congrats :)
@netresec That's the expiro at work :) ftp.aventour\.com\.mx is the originlogger exfil.
First time seeing #expiro drop #originlogger:
https://app.any.run/tasks/3d2d1d8b-b635-40b3-8a45-5edcaf3872b0/
https://ssa-sharing\.cloud
https://app.any.run/tasks/dd8cfd7b-63ef-49b3-8fcc-3f8efb1bd51a
