3xp0rt

@3xp0rtblog

Programmer / Malware Analyst

Ukraine  
3xp0rt.com
Joined March 2020
212 Photos and videos Photos and videos

Tweets

You blocked @3xp0rtblog

Are you sure you want to view these Tweets? Viewing Tweets won't unblock @3xp0rtblog

  1. Pinned Tweet
    Feb 1

    My first blog post about is out:

    16 replies . 57 retweets 153 likes
    Show this thread
    Show this thread
    Undo
  2. Retweeted
    Apr 10

    Packed with UPX update.exe: Additional information is in the comments 👇

    2 replies . 28 retweets 83 likes
    Show this thread
    Show this thread
    Undo
  3. Apr 14

    3 likes
    Show this thread
    Show this thread
    Undo
  4. Apr 14

    Posted on: lolz[.]guru/threads/3707473/ Telegram: whisperproject_bot (5200576854) whisperstealer (-1001160109012) xthreenine (1843530387) saintsellerbot (2067635141)

    1 retweet 4 likes
    Show this thread
    Show this thread
    Undo
  5. Apr 14

    The same that but with sending logs to C2 that redirects them to the telegram bot. saintgang.exe:

    4 replies . 25 retweets 43 likes
    Show this thread
    Show this thread
    Undo
  6. Retweeted
    Apr 12

    CryptBot is an information stealer distributed by fake cracked software, it is an advanced and mature operation providing many of the underground shops with its stolen credentials. Read the analysis here: Thx2 for the edits

    2 replies . 31 retweets 70 likes
    Show this thread
    Show this thread
    Undo
  7. Apr 10

    1 reply . 5 likes
    Show this thread
    Show this thread
    Undo
  8. Apr 10

    Discord: InvokeNULL#5568 Telegram: invokenull

    1 like
    Show this thread
    Show this thread
    Undo
  9. Apr 10

    Posted on: xss[.]is/threads/63627/ cracked[.]io/Thread-Sellix-SAPPHIRE-MULTI-COIN-MINER-v1-1-100-NATIVE-SELECT-COIN-DEPENDING-ON-GPU hackforums[.]net/showthread.php?tid=6191352 nulled[.]to/topic/1382288-sapphire-multi-coin-miner-v11-100-native-select-coin-depending-on-gpu/

    1 reply . 1 retweet 4 likes
    Show this thread
    Show this thread
    Undo
  10. Apr 10

    Packed with UPX update.exe: Additional information is in the comments 👇

    2 replies . 28 retweets 83 likes
    Show this thread
    Show this thread
    Undo
  11. Retweeted
    Apr 8

    Android banking frequently mentioned on dark-web forums is in fact () enhanced with On-Device Fraud capabilities and spread via Google Play Store. Read more details in our latest blog:

    25 retweets 32 likes
    Undo
  12. Retweeted
    Apr 7

    We also shared , rules and a C2 extractor in our Github repository

    5 retweets 13 likes
    Show this thread
    Show this thread
    Undo
  13. Retweeted
    Apr 7

    has recently gain in popularity among information stealers, we try to demystify its different versions and explain our tracking process in our article

    3 replies . 29 retweets 59 likes
    Show this thread
    Show this thread
    Undo
  14. Retweeted
    Apr 6

    I share some additional samples and a Yara rule of ransomware. This is active since mid-March 2022. H/T Samples : Yara: Hunting:

    Last article in March , probably fake encryptor. Uses UA and LV mail accounts, but asks for a ransom on Qiwi wallet. Thank
    Show this thread
    1 reply . 15 retweets 32 likes
    Show this thread
    Show this thread
    Undo
  15. Retweeted
    Apr 6

    Our large actors are back...still rolling with the creative c2 names.... bitratnew9200[.]duckdns[.]org

    8 retweets 27 likes
    Undo
  16. Retweeted
    Apr 5

    c2: hxxp://194.87.218(.)39/RyC66VfSGP.php hash: 4bcff4386ce8fadce358ef0dbe90f8d5aa7b4c7aec93fca2e605ca2cbc52218b cc:

    5 replies . 14 retweets 24 likes
    Show this thread
    Show this thread
    Undo
  17. Retweeted
    Apr 5

    ISC Diary: reviews new malware first seen on 2022-03-30

    1 reply . 61 retweets 186 likes
    Undo
  18. Retweeted
    Apr 5

    FLARE dropping tool bombs on github that I haven't seen mentioned around the place. Been waiting for this to go public so I could share some scripts I have to dump .Net functions generating yara rules

    1 reply . 80 retweets 241 likes
    Show this thread
    Show this thread
    Undo
  19. Retweeted
    Apr 5

    and the reported on a new cyber-attack aimed at gaining access to Telegram accounts. This activity is tracked by UAC-0094:

    38 retweets 45 likes
    Undo
  20. Retweeted
    Apr 4

    I'm taking advantage while I share the samples of the X86 version of V5 for sharing also the Yara rule at the same time. Samples: Yara : cc

    16 retweets 31 likes
    Undo
  21. Retweeted
    Apr 1

    Stealer and panel are written in Go Loader.exe (build): 185.112.83.228 (C2): 000Stealer[.]zip (panel resources):

    2 replies . 25 retweets 60 likes
    Show this thread
    Show this thread
    Undo

@3xp0rtblog hasn't Tweeted yet.

Loading seems to be taking a while.

Twitter may be over capacity or experiencing a momentary hiccup. Try again or visit Twitter Status for more information.

    You may also like

    ·