Threat Intel as a reverse-engineer in Crimeware domain. Dubbed "Malware Mangler" by TheRegister. [email protected]
Joined August 2016
- Tweets959
- Following760
- Followers4.3K
- Likes732
Pinned Tweet
Maksim Yakubets was indicted but treasury department also went after Evil Corp, what is really interesting is all the alluding to them being linked to FSB and as it turns out Yakubets is married to the daughter of Eduard Bendersky. w/ Joshua Platt @ WSJPro in Charlotte, NC
1/3
sysopfb retweeted
Shodan Membership sale is live until 2026-08-09 00:00 UTC (~48 hours from now): account.shodan.io/billing/me…
sysopfb retweeted
So, let's talk about MetaStealer and make sure I'm not delusional.
The actual MetaStealer is a .NET stealer I blogged about a while back: russianpanda.com/MetaStealer…. Its seller, "META", stopped updating it around 2022 and pretty much disappeared.
The malware AVs have been flagging as "MetaStealer" is NOT that MetaStealer: virustotal.com/gui/file/0583…
What we're actually seeing is ongoing updates (since 2023) to the loader I named Potemkin: huntress.com/blog/potemkin-l…
Turns out it was documented earlier under the MetaStealer name, kudos to @banthisguy9349 for surfacing these:
medium.com/walmartglobaltech…
blog.defentive.com/the-phant…
DeviceManager python backdoor/rat operates over DNS or HTTP, current C2 is setup for DNS over TXT records; gist.github.com/sysopfb/3a90…
SpectrePaste - a case of a TA leveraging AI as a primary orchestrater and developer of the entire system. medium.com/walmartglobaltech…
"tracker" piece of malware related to RMMSystem RAT(which uses metastealer URIs), uses a separate DGA but also wordlist based blog: medium.com/walmartglobaltech… and DGA code: gist.github.com/sysopfb/2e6f…
Dumped a bunch of notes surrounding a macos based stealer from etherhiding clickfix github.com/sysopfb/open_mal_… someone also released a blog surrounding pieces of it last night: medium.com/@ashishbogati098/…
sysopfb retweeted
Cool find from @sysopfb here is a couple of Images from the Panel, This specific panel was delivering a MacOS stealer notnullOSX
http.html:"notnullOSX " - Shodan Search
http://111.90.]143.163:8080/install
Nice writeup rmceoin.github.io/malware-an… Of note is a panel: hxxp://65.38.120.]80:8080 they left some tidbits behind in the login page: <<label>Пул доменов (по одному на строку)</label>"oeannon.]com heethcote.]com windlrr.]com"
Nice writeup rmceoin.github.io/malware-an… Of note is a panel: hxxp://65.38.120.]80:8080 they left some tidbits behind in the login page: <<label>Пул доменов (по одному на строку)</label>"oeannon.]com heethcote.]com windlrr.]com"
medium.com/walmartglobaltech… Kudos to GitHub they were taking stuff down very fast
DFIRReport pastebin link also lines up with one of the pastebins I saw in my blog - "cLika3dt"; thedfirreport.com/2025/03/31…
Auto decoding IOCs from Arechclient and the onboard browser extension they drop medium.com/walmartglobaltech…
Auto decoding IOCs from Arechclient and the onboard browser extension they drop medium.com/walmartglobaltech…
medium.com/walmartglobaltech… go through a little of the panel they are using for the fake invites also
