-
2020-02-03:


#Shellcode Loader
#hVNC 'HiddenDesktop'#Malware
"FudV"|
Recompiled from #TinyNuke Leak|
AVE_MARIA
C2:
94.103.81. 79
PDB:
C:\Users\Administrator\Documents\c++ project\hVNC\Client\Release\FudV.pdb
h/t @malwrhunterteam MD5: 6d8d825d00a4a1d8e3f406bad69fa4a7pic.twitter.com/bsvz8nCkeE
-
#RigEK ->#SmokeLoader ->#danabot +#SystemBC +#KPOT +#Predator +#Quasar RAT +#HVNC +#SmokeLoader + Unknown malwares... https://app.any.run/tasks/03749e15-832f-49ea-a741-e50d9ea7b76e …pic.twitter.com/O77yVjW1Gx
-
-
-
-
#Smokeloader ->#hvnc Example Payload https://app.any.run/tasks/1e0a521d-8b23-463c-aa31-f863c02c568d …Prikaži ovu nit -
Nice
#opendir found by my friend@FewAtoms at: beastmas[.]club/dl/#azorult (VtpYRswHC.exe) and#hvnc#snort /#suricata sig to match the traffic: https://pastebin.com/ki23VdgK c2 on the#hnvc: 23.83.133.215 these inject into WerFault.exe instead of svchost.exe, cc@VK_Intel pic.twitter.com/JEvNiXPJhT
Prikaži ovu nit -
Yes. To be frank, it is very rare we see new modules lately outside of you flagging here. Here is the older tweet re:
#vnc32Dll x86 (or vnc64Dll x64) aka#Carberp-like#hVNC replica -> https://twitter.com/vk_intel/status/1042511970392571905 …
-
A very interesting
#opendir at: apertona[.]com found by@FewAtoms c2's: 32.41.89.121 https://sertacio12[.]com/~yb284fvbhsd/error_faust.php possible modded#hvnc so cc@VK_Intel hash cb0b5f73d5804b86a0bd90e2bf6cad8a on@mal_share pic.twitter.com/VPIijXArU1
-
-
Hidden remote desktop tool DarkVNC C&C : hxxp://23.82.19.60:8070
#malware#darkvnc#hvnc pic.twitter.com/apfdRD8biZ
-
-
the
#hvnc guys are more active there days with a few versions pic.twitter.com/09qiE7wx3R
-
-
#hvnc(?)#rat hosted at: 31.210.172.47 c2 is 74.118.139.159 orig and extracted hashes on@HybridAnalysis "4debd59e6e01c49e995658000f9c6b702ae65fafd30a0ddeef4c706cf7a8ac81" "38075690fdaa2371c8fc7e1b1db0902006e736f4032119cbb94c9e5bb98d1e33" pic.twitter.com/lCL9ydPKTl
Prikaži ovu nit -
Let's Learn: Deeper Dive into
#Ramnit (demetra)#Banker#Malware Hidden ”VNC#IFSB" Remote Control Module Allows Concurrent Victim PC Usage for ATO Hidden Desktop Creation | Code Reuse of#Carberp#hVNC | Copy/Paste of ISFB AcDLL Inject |#Yara mem Source: http://www.vkremez.com/2018/02/deeper-dive-into-ramnit-banker-vnc-ifsb.html …pic.twitter.com/yrHNsr6je0
-
#DeepSec 2017 Talk: Who Hid My Desktop – Deep Dive Into#hVNC - Or Safran & Pavel Asinovsky#Malwarehttp://blog.deepsec.net/deepsec-2017-talk-hid-desktop-deep-dive-hvnc-safran-pavel-asinovsky/ … -
Via
@IBMSecurity Anatomy of an hVNC attack: http://ibm.co/2kZDur6#hVNC pic.twitter.com/XtzhcM5GLW
-
Finding and Decrypting the
#Gozi’s Trojan's#hVNC Module: https://securityintelligence.com/anatomy-of-an-hvnc-attack/ … |#cybercrime#malware#fraud
Čini se da učitavanje traje već neko vrijeme.
Twitter je možda preopterećen ili ima kratkotrajnih poteškoća u radu. Pokušajte ponovno ili potražite dodatne informacije u odjeljku Status Twittera.
(