ImPureMotion (@ImPureMotion) header
ImPureMotion (@ImPureMotion) profile picture

ImPureMotion

@ImPureMotion

The Cyberz

Joined February 2015
  • Tweets110
  • Following621
  • Followers195
29Media
Photo by ImPureMotion (@ImPureMotion)Photo by ImPureMotion (@ImPureMotion)Photo by ImPureMotion (@ImPureMotion)Photo by ImPureMotion (@ImPureMotion)Photo by ImPureMotion (@ImPureMotion)Photo by ImPureMotion (@ImPureMotion)Photo by ImPureMotion (@ImPureMotion)Photo by ImPureMotion (@ImPureMotion)Photo by ImPureMotion (@ImPureMotion)Photo by ImPureMotion (@ImPureMotion)
HTML Smuggling Leads to Domain Wide Ransomware ➡️Initial Access: Thread-Hijacked Email > HTML Attachment ➡️Credentials: LSASS Access, SessionGopher ➡️Lateral Movement: RDP, PsExec ➡️C2: IcedID, Cobalt Strike ➡️Impact: Nokoyawa Ransomware thedfirreport.com/2023/08/28… 1/X
HTML Smuggling Leads to Domain Wide Ransomware - The DFIR Report

HTML Smuggling Leads to Domain Wide Ransomware - The DFIR Report

We’ve previously reported on a Nokoyawa ransomware case in which the initial access was via an Excel macro and IcedID malware. This case, which also ended in Nokoyawa Ransomware, involved the threat...

thedfirreport.com
5
161
5
369
97,022
Operation JOKAA(RR) #molerats #gazacybergang #apt #malware #infosec mymalwareparty.blogspot.com/…
Image from MalwareParty (@MalwareParty)
2
13
2
23
Iranian #Oilrig campaign decoy: "User list must change password.xls", target in Saudi Arabia. C2: coldflys[.]com Further analysis: docs.google.com/document/d/1… Leads and analysis with @ImPureMotion and @blu3_team
Image from ClearSky Cyber Security (@ClearskySec)
Image from ClearSky Cyber Security (@ClearskySec)
Image from ClearSky Cyber Security (@ClearskySec)
Image from ClearSky Cyber Security (@ClearskySec)
9
13
#AridViper uses pastes on pastebin.com/u/virtualnote for second stage scripts delivery Recent sample: محضر اجتماع اليوم - (Minutes of today 's meeting) Details and Indicators in Raw Threat Intelligence: docs.google.com/document/d/1… Credit @ImPureMotion
Image from ClearSky Cyber Security (@ClearskySec)
Image from ClearSky Cyber Security (@ClearskySec)
Image from ClearSky Cyber Security (@ClearskySec)
Image from ClearSky Cyber Security (@ClearskySec)
10
16
Packed - C:\Users\User\AppData\Local\Temp\cnjslysb.exe (md5,1535ACBCAE591B0D03EF7518CB56883E) Unpacked - C:\Users\User\AppData\Local\Temp\cnjslysb.exe (md5,8DFF9A738986462398226B08171C5688)
5
Syria - New Russia provocations.doc (e4ef63f74d55930157bc425bf3bd856f) Large POST with url encoded system info
Image from ImPureMotion (@ImPureMotion)
1
8
22
PLA-Deployment-Revealed.doc 3d429324354aa0f1a49168c6790d5a62 176.107.177[.]10 imminent rat
1
2
China-Pakistan-Internet-Security-LAW_2017.doc cf63638a2cfce962e228a06413dba33f 45.32.232[.]70 revenge rat
Image from ImPureMotion (@ImPureMotion)
Image from ImPureMotion (@ImPureMotion)
2
1
4
Bitcoin Theme: 08e128a70d1c96ae403fde40e2471389 d2118c0d8277a0fe951e8d2c5d34d68a ec7ba18cc775a58647943e16d51d01ac
Image from ImPureMotion (@ImPureMotion)
Image from ImPureMotion (@ImPureMotion)
2
7c1a92453792914888e34a6b4093492d 채용모집정보(상세)_32.docm Recruitment information (details) _32.docm cant get next stage :(
Image from ImPureMotion (@ImPureMotion)
Image from ImPureMotion (@ImPureMotion)
1
1
C:\Users\User\AppData\Local\Temp\csc.exe C:\Users\User\AppData\Local\Temp\Job Description.doc csc.exe (cc23f830fe33371e4c59502e87e28745)
1
Blockbuster Saga Continues: 9b7efc5b1fce6bbe6e4538b9e38e4aa5
Image from ImPureMotion (@ImPureMotion)
1
2
First blog post... taking a stab at it, had some fun with the logo mymalwareparty.blogspot.com/… #malware #molerats #infosec #cybersecurity
Image from MalwareParty (@MalwareParty)
4
1
4
C2 Stuff/Host
Image from ImPureMotion (@ImPureMotion)
2
a856f56fec6abdc3a93c3715be1567e5 The quarrel between Trump and Abbas Same campaign
2
1
4
91d0770261df8a1b3eba61483fdb255c Who stands around the attempt to assassinate al – Jubeir
2
1
3
@xdxdxdxdoa returning to the APTs per your suggestion :)
1
1
3dd80078da80fb7105c4f2703f3235b3 Looks targeted Повышение зарплаты воен - Military salary increase
1
1
1
2
myguy.exe - a1d5895f85751dfe67d19cccb51b051a
First hash is CVE-2017-0199
1
1
Load more