LightNews LightNews
jamesinthebox.bsky.social
@jamesinthebox.bsky.social
150 followers 30 following 30 posts
malware
Posts Replies Media Videos
jamesinthebox.bsky.social
Malicious @github repo at:

github/.com/charlie...

seen dropped via #xworm on a hijacked @operagxofficial installer

app.any.run/tasks/4be36a...
Analysis OperaGXSetup.exe (MD5: 331950DC665052789DC9FCB607CC10AF) Malicious activity - Interactive analysis ANY.RUN
Interactive malware hunting service. Live testing of most type of threats in any environments. No installation and no waiting necessary.
app.any.run
March 6, 2025 at 5:37 PM
jamesinthebox.bsky.social
If you'be been dealing with these janky downloaders ("pdfs" if MiTM the TLS), these have been #darkcloud #stealer so far:

app.any.run/tasks/925ce6...

Look for:
vbs file
showip\.net
LoginData
WebData
keyDBPath.db
in the run and

StrFtpServer
DCS V

in the dmp file
March 5, 2025 at 10:34 PM
jamesinthebox.bsky.social
Some fresh (and I can't believe I'm typing this) #lokibot:

app.any.run/tasks/054d7a...

c2: http:// touxzw\.ir/fix/five/fre.php
Analysis Payment receipt PO 1437 1_ Payment receipt PO #1437 2.exe (MD5: 5A4FC3780CFC0527D12D8BB5134A81F5) Malicious activity - Interactive analysis ANY.RUN
Interactive malware hunting service. Live testing of most type of threats in any environments. No installation and no waiting necessary.
app.any.run
March 5, 2025 at 2:20 PM
jamesinthebox.bsky.social
A csv formatted list of #malspam campaigns that crossed my path in February to include #malware name, c2, hash, subject, and email exfil addresses:

gist.github.com/silence-is-b...

#retrohunt
March 3, 2025 at 8:31 PM
jamesinthebox.bsky.social
Huh...first time I've seen threat actor's using @ThinkstCanary :

https:// assistance-newton-adam-indiana.trycloudflare\.com
February 26, 2025 at 3:17 PM
jamesinthebox.bsky.social
Badness at:

144.91.79.54/10022025/

app.any.run/tasks/70b515...

Ultimately #darkcloud (the txt file); c2 juguly\.shop
February 26, 2025 at 3:03 PM
jamesinthebox.bsky.social
If you're not blocking trycloudflare\.com at the perimeter, now's the time: #opendir 's:

https:// em-ash-announcements-alpha.trycloudflare\.com/1DSAHJKSA/ ->
https:// did-efficiency-than-lenses.trycloudflare\.com ->
https:// reached-theoretical-regular-impact\.trycloudflare.com
February 20, 2025 at 2:34 PM
jamesinthebox.bsky.social
#phishing #opendir:

dmc.otarvesq/.com/POST/
February 17, 2025 at 5:51 PM
jamesinthebox.bsky.social
http:// account\.empireaccelerate.com:9200/empire_account/account/account.do 🤨
February 12, 2025 at 10:10 PM
jamesinthebox.bsky.social
When the threat actor REALLY wants it to run... #venomrat c2:

176.65.142.172:4449
February 7, 2025 at 2:23 PM
jamesinthebox.bsky.social
A csv formatted list of #malspam campaigns that crossed my path in January to include subjects, hashes, c2's, #malware type, and email exfil addresses:

gist.github.com/silence-is-b...

#retrohunt
February 3, 2025 at 4:36 PM
jamesinthebox.bsky.social
When #windows decides it's had enough of you blocking it's update/telemetry processes (going to wd-prod-cp-us-west-2-fe\.westus.cloudapp.azure.com) and just yeats out the lookup over #netbios 🤷
February 2, 2025 at 12:50 PM
jamesinthebox.bsky.social
A fairly sizable distributed port scan (all source port 19000) about 30 minutes ago; raw logs and sources here:

gist.github.com/silence-is-b...
January 24, 2025 at 5:16 PM
jamesinthebox.bsky.social
If you're....you know...bored...

app.any.run/tasks/365f89...
January 23, 2025 at 8:30 PM
jamesinthebox.bsky.social
#webshell #opendir #netsupport #rat at:

https:// appointedtimeagriculture\.com/wp-includes/blocks/post-content/

GatewayAddress=95.179.158.213:443
RADIUSSecret=dgAAAPpMkI7ke494fKEQRUoablcA
January 22, 2025 at 10:20 PM
jamesinthebox.bsky.social
As much as I was excited about #telegram cooperating with LE...I haven't noticed much of a change:

app.any.run/tasks/694cb9...
January 16, 2025 at 2:34 PM
jamesinthebox.bsky.social
#opendir at:

https:// superior-somalia-bs-leisure.trycloudflare\.com ->
http:// jsnybsafva\.biz:8030
January 9, 2025 at 2:52 PM
jamesinthebox.bsky.social
A late (due to holiday vacation) and sparse csv formatted list of #malspam campaigns that crossed my path in December to include subjects, #malware, hashes, c2's, and email exfil addresses:

gist.github.com/silence-is-b...

#retrohunt
January 6, 2025 at 5:25 PM
jamesinthebox.bsky.social
An #expiro (believe it or not) dropping #xloader

app.any.run/tasks/43f807...

fake c2 and campaign:
http ://www.sunnyz.store/px6j
Analysis MA-DS-2024-03 URGENT.exe (MD5: B5C0BC1CA5223C4B18328235497A2EF6) Malicious activity - Interactive analysis ANY.RUN
Interactive malware hunting service. Live testing of most type of threats in any environments. No installation and no waiting necessary.
app.any.run
December 10, 2024 at 5:08 PM
jamesinthebox.bsky.social
Interesting use of @Formstack as an interactive landing page for a #ms365 #phish:

https:// bilykfilms .com/m/

is the site.
December 5, 2024 at 6:03 PM
jamesinthebox.bsky.social
An unsurprisingly light csv formatted list of #malspam campaigns that crossed my path in November to included subjects, #malware type, hashes, c2's and email exfil addresses:

gist.github.com/silence-is-b...

#retrohunt #infosec #cybersecurity
December 2, 2024 at 4:23 PM
jamesinthebox.bsky.social
A curious js file...
app.any.run/tasks/112848...
November 27, 2024 at 10:48 PM
jamesinthebox.bsky.social
...nice place you got here...
November 14, 2024 at 8:48 PM